vendor: Update vendor logic

2026-04-07 22:25:03 +00:00 · 2020-04-08 14:34:43 -04:00 · 2020-04-08 14:34:43 -04:00 · 4ca64b85f0
commit 4ca64b85f0
parent c6ac5cbc87
1540 changed files with 265304 additions and 91616 deletions
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/create.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/create.go
@ -27,7 +27,7 @@ import (
 	"unicode/utf8"

 	"k8s.io/apimachinery/pkg/api/errors"
-	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/runtime"
@ -46,7 +46,7 @@ import (
 func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Interface, includeName bool) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		// For performance tracking purposes.
-		trace := utiltrace.New("Create " + req.URL.Path)
+		trace := utiltrace.New("Create", utiltrace.Field{Key: "url", Value: req.URL.Path}, utiltrace.Field{Key: "user-agent", Value: &lazyTruncatedUserAgent{req}}, utiltrace.Field{Key: "client", Value: &lazyClientIP{req}})
 		defer trace.LogIfLong(500 * time.Millisecond)

 		if isDryRun(req.URL) && !utilfeature.DefaultFeatureGate.Enabled(features.DryRun) {
@ -57,21 +57,24 @@ func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Int
 		// TODO: we either want to remove timeout or document it (if we document, move timeout out of this function and declare it in api_installer)
 		timeout := parseTimeout(req.URL.Query().Get("timeout"))

-		var (
-			namespace, name string
-			err             error
-		)
-		if includeName {
-			namespace, name, err = scope.Namer.Name(req)
-		} else {
-			namespace, err = scope.Namer.Namespace(req)
-		}
+		namespace, name, err := scope.Namer.Name(req)
 		if err != nil {
-			scope.err(err, w, req)
-			return
+			if includeName {
+				// name was required, return
+				scope.err(err, w, req)
+				return
+			}
+
+			// otherwise attempt to look up the namespace
+			namespace, err = scope.Namer.Namespace(req)
+			if err != nil {
+				scope.err(err, w, req)
+				return
+			}
 		}

-		ctx := req.Context()
+		ctx, cancel := context.WithTimeout(req.Context(), timeout)
+		defer cancel()
 		ctx = request.WithNamespace(ctx, namespace)
 		outputMediaType, _, err := negotiation.NegotiateOutputMediaType(req, scope.Serializer, scope)
 		if err != nil {
@ -96,7 +99,7 @@ func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Int

 		options := &metav1.CreateOptions{}
 		values := req.URL.Query()
-		if err := metainternalversion.ParameterCodec.DecodeParameters(values, scope.MetaGroupVersion, options); err != nil {
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(values, scope.MetaGroupVersion, options); err != nil {
 			err = errors.NewBadRequest(err.Error())
 			scope.err(err, w, req)
 			return
@ -129,9 +132,14 @@ func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Int
 		audit.LogRequestObject(ae, obj, scope.Resource, scope.Subresource, scope.Serializer)

 		userInfo, _ := request.UserFrom(ctx)
+
+		// On create, get name from new object if unset
+		if len(name) == 0 {
+			_, name, _ = scope.Namer.ObjectName(obj)
+		}
 		admissionAttributes := admission.NewAttributesRecord(obj, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Create, options, dryrun.IsDryRun(options.DryRun), userInfo)
 		if mutatingAdmission, ok := admit.(admission.MutationInterface); ok && mutatingAdmission.Handles(admission.Create) {
-			err = mutatingAdmission.Admit(admissionAttributes, scope)
+			err = mutatingAdmission.Admit(ctx, admissionAttributes, scope)
 			if err != nil {
 				scope.err(err, w, req)
 				return
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/delete.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/delete.go
@ -17,12 +17,14 @@ limitations under the License.
 package handlers

 import (
+	"context"
 	"fmt"
 	"net/http"
 	"time"

 	"k8s.io/apimachinery/pkg/api/errors"
 	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/runtime"
@ -43,7 +45,7 @@ import (
 func DeleteResource(r rest.GracefulDeleter, allowsOptions bool, scope *RequestScope, admit admission.Interface) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		// For performance tracking purposes.
-		trace := utiltrace.New("Delete " + req.URL.Path)
+		trace := utiltrace.New("Delete", utiltrace.Field{Key: "url", Value: req.URL.Path}, utiltrace.Field{Key: "user-agent", Value: &lazyTruncatedUserAgent{req}}, utiltrace.Field{Key: "client", Value: &lazyClientIP{req}})
 		defer trace.LogIfLong(500 * time.Millisecond)

 		if isDryRun(req.URL) && !utilfeature.DefaultFeatureGate.Enabled(features.DryRun) {
@ -59,7 +61,8 @@ func DeleteResource(r rest.GracefulDeleter, allowsOptions bool, scope *RequestSc
 			scope.err(err, w, req)
 			return
 		}
-		ctx := req.Context()
+		ctx, cancel := context.WithTimeout(req.Context(), timeout)
+		defer cancel()
 		ctx = request.WithNamespace(ctx, namespace)
 		ae := request.AuditEventFrom(ctx)
 		admit = admission.WithAudit(admit, ae)
@ -78,7 +81,7 @@ func DeleteResource(r rest.GracefulDeleter, allowsOptions bool, scope *RequestSc
 				return
 			}
 			if len(body) > 0 {
-				s, err := negotiation.NegotiateInputSerializer(req, false, metainternalversion.Codecs)
+				s, err := negotiation.NegotiateInputSerializer(req, false, metainternalversionscheme.Codecs)
 				if err != nil {
 					scope.err(err, w, req)
 					return
@ -86,7 +89,7 @@ func DeleteResource(r rest.GracefulDeleter, allowsOptions bool, scope *RequestSc
 				// For backwards compatibility, we need to allow existing clients to submit per group DeleteOptions
 				// It is also allowed to pass a body with meta.k8s.io/v1.DeleteOptions
 				defaultGVK := scope.MetaGroupVersion.WithKind("DeleteOptions")
-				obj, _, err := metainternalversion.Codecs.DecoderToVersion(s.Serializer, defaultGVK.GroupVersion()).Decode(body, &defaultGVK, options)
+				obj, _, err := metainternalversionscheme.Codecs.DecoderToVersion(s.Serializer, defaultGVK.GroupVersion()).Decode(body, &defaultGVK, options)
 				if err != nil {
 					scope.err(err, w, req)
 					return
@ -101,7 +104,7 @@ func DeleteResource(r rest.GracefulDeleter, allowsOptions bool, scope *RequestSc
 				audit.LogRequestObject(ae, obj, scope.Resource, scope.Subresource, scope.Serializer)
 				trace.Step("Recorded the audit event")
 			} else {
-				if err := metainternalversion.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
+				if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
 					err = errors.NewBadRequest(err.Error())
 					scope.err(err, w, req)
 					return
@ -160,7 +163,7 @@ func DeleteResource(r rest.GracefulDeleter, allowsOptions bool, scope *RequestSc
 // DeleteCollection returns a function that will handle a collection deletion
 func DeleteCollection(r rest.CollectionDeleter, checkBody bool, scope *RequestScope, admit admission.Interface) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
-		trace := utiltrace.New("Delete " + req.URL.Path)
+		trace := utiltrace.New("Delete", utiltrace.Field{"url", req.URL.Path})
 		defer trace.LogIfLong(500 * time.Millisecond)

 		if isDryRun(req.URL) && !utilfeature.DefaultFeatureGate.Enabled(features.DryRun) {
@ -177,7 +180,8 @@ func DeleteCollection(r rest.CollectionDeleter, checkBody bool, scope *RequestSc
 			return
 		}

-		ctx := req.Context()
+		ctx, cancel := context.WithTimeout(req.Context(), timeout)
+		defer cancel()
 		ctx = request.WithNamespace(ctx, namespace)
 		ae := request.AuditEventFrom(ctx)

@ -188,7 +192,7 @@ func DeleteCollection(r rest.CollectionDeleter, checkBody bool, scope *RequestSc
 		}

 		listOptions := metainternalversion.ListOptions{}
-		if err := metainternalversion.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, &listOptions); err != nil {
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, &listOptions); err != nil {
 			err = errors.NewBadRequest(err.Error())
 			scope.err(err, w, req)
 			return
@ -237,7 +241,7 @@ func DeleteCollection(r rest.CollectionDeleter, checkBody bool, scope *RequestSc
 				ae := request.AuditEventFrom(ctx)
 				audit.LogRequestObject(ae, obj, scope.Resource, scope.Subresource, scope.Serializer)
 			} else {
-				if err := metainternalversion.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
+				if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
 					err = errors.NewBadRequest(err.Error())
 					scope.err(err, w, req)
 					return
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/buildmanagerinfo.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/buildmanagerinfo.go
@ -0,0 +1,72 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldmanager
+
+import (
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal"
+)
+
+type buildManagerInfoManager struct {
+	fieldManager Manager
+	groupVersion schema.GroupVersion
+}
+
+var _ Manager = &buildManagerInfoManager{}
+
+// NewBuildManagerInfoManager creates a new Manager that converts the manager name into a unique identifier
+// combining operation and version for update requests, and just operation for apply requests.
+func NewBuildManagerInfoManager(f Manager, gv schema.GroupVersion) Manager {
+	return &buildManagerInfoManager{
+		fieldManager: f,
+		groupVersion: gv,
+	}
+}
+
+// Update implements Manager.
+func (f *buildManagerInfoManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	manager, err := f.buildManagerInfo(manager, metav1.ManagedFieldsOperationUpdate)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to build manager identifier: %v", err)
+	}
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *buildManagerInfoManager) Apply(liveObj runtime.Object, patch []byte, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	manager, err := f.buildManagerInfo(manager, metav1.ManagedFieldsOperationApply)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to build manager identifier: %v", err)
+	}
+	return f.fieldManager.Apply(liveObj, patch, managed, manager, force)
+}
+
+func (f *buildManagerInfoManager) buildManagerInfo(prefix string, operation metav1.ManagedFieldsOperationType) (string, error) {
+	managerInfo := metav1.ManagedFieldsEntry{
+		Manager:    prefix,
+		Operation:  operation,
+		APIVersion: f.groupVersion.String(),
+	}
+	if managerInfo.Manager == "" {
+		managerInfo.Manager = "unknown"
+	}
+	return internal.BuildManagerIdentifier(&managerInfo)
+}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/capmanagers.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/capmanagers.go
@ -0,0 +1,135 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldmanager
+
+import (
+	"fmt"
+	"sort"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal"
+	"sigs.k8s.io/structured-merge-diff/fieldpath"
+)
+
+type capManagersManager struct {
+	fieldManager          Manager
+	maxUpdateManagers     int
+	oldUpdatesManagerName string
+}
+
+var _ Manager = &capManagersManager{}
+
+// NewCapManagersManager creates a new wrapped FieldManager which ensures that the number of managers from updates
+// does not exceed maxUpdateManagers, by merging some of the oldest entries on each update.
+func NewCapManagersManager(fieldManager Manager, maxUpdateManagers int) Manager {
+	return &capManagersManager{
+		fieldManager:          fieldManager,
+		maxUpdateManagers:     maxUpdateManagers,
+		oldUpdatesManagerName: "ancient-changes",
+	}
+}
+
+// Update implements Manager.
+func (f *capManagersManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	object, managed, err := f.fieldManager.Update(liveObj, newObj, managed, manager)
+	if err != nil {
+		return object, managed, err
+	}
+	if managed, err = f.capUpdateManagers(managed); err != nil {
+		return nil, nil, fmt.Errorf("failed to cap update managers: %v", err)
+	}
+	return object, managed, nil
+}
+
+// Apply implements Manager.
+func (f *capManagersManager) Apply(liveObj runtime.Object, patch []byte, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	return f.fieldManager.Apply(liveObj, patch, managed, fieldManager, force)
+}
+
+// capUpdateManagers merges a number of the oldest update entries into versioned buckets,
+// such that the number of entries from updates does not exceed f.maxUpdateManagers.
+func (f *capManagersManager) capUpdateManagers(managed Managed) (newManaged Managed, err error) {
+	// Gather all entries from updates
+	updaters := []string{}
+	for manager, fields := range managed.Fields() {
+		if fields.Applied() == false {
+			updaters = append(updaters, manager)
+		}
+	}
+	if len(updaters) <= f.maxUpdateManagers {
+		return managed, nil
+	}
+
+	// If we have more than the maximum, sort the update entries by time, oldest first.
+	sort.Slice(updaters, func(i, j int) bool {
+		iTime, jTime, nTime := managed.Times()[updaters[i]], managed.Times()[updaters[j]], &metav1.Time{Time: time.Time{}}
+		if iTime == nil {
+			iTime = nTime
+		}
+		if jTime == nil {
+			jTime = nTime
+		}
+		if !iTime.Equal(jTime) {
+			return iTime.Before(jTime)
+		}
+		return updaters[i] < updaters[j]
+	})
+
+	// Merge the oldest updaters with versioned bucket managers until the number of updaters is under the cap
+	versionToFirstManager := map[string]string{}
+	for i, length := 0, len(updaters); i < len(updaters) && length > f.maxUpdateManagers; i++ {
+		manager := updaters[i]
+		vs := managed.Fields()[manager]
+		time := managed.Times()[manager]
+		version := string(vs.APIVersion())
+
+		// Create a new manager identifier for the versioned bucket entry.
+		// The version for this manager comes from the version of the update being merged into the bucket.
+		bucket, err := internal.BuildManagerIdentifier(&metav1.ManagedFieldsEntry{
+			Manager:    f.oldUpdatesManagerName,
+			Operation:  metav1.ManagedFieldsOperationUpdate,
+			APIVersion: version,
+		})
+		if err != nil {
+			return managed, fmt.Errorf("failed to create bucket manager for version %v: %v", version, err)
+		}
+
+		// Merge the fieldets if this is not the first time the version was seen.
+		// Otherwise just record the manager name in versionToFirstManager
+		if first, ok := versionToFirstManager[version]; ok {
+			// If the bucket doesn't exists yet, create one.
+			if _, ok := managed.Fields()[bucket]; !ok {
+				s := managed.Fields()[first]
+				delete(managed.Fields(), first)
+				managed.Fields()[bucket] = s
+			}
+
+			managed.Fields()[bucket] = fieldpath.NewVersionedSet(vs.Set().Union(managed.Fields()[bucket].Set()), vs.APIVersion(), vs.Applied())
+			delete(managed.Fields(), manager)
+			length--
+
+			// Use the time from the update being merged into the bucket, since it is more recent.
+			managed.Times()[bucket] = time
+		} else {
+			versionToFirstManager[version] = manager
+		}
+	}
+
+	return managed, nil
+}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/endpoints.yaml
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/endpoints.yaml
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/fieldmanager.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/fieldmanager.go
@ -18,258 +18,144 @@ package fieldmanager

 import (
 	"fmt"
-	"time"

-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal"
-	"k8s.io/klog"
 	openapiproto "k8s.io/kube-openapi/pkg/util/proto"
 	"sigs.k8s.io/structured-merge-diff/fieldpath"
-	"sigs.k8s.io/structured-merge-diff/merge"
-	"sigs.k8s.io/yaml"
 )

+// DefaultMaxUpdateManagers defines the default maximum retained number of managedFields entries from updates
+// if the number of update managers exceeds this, the oldest entries will be merged until the number is below the maximum.
+// TODO(jennybuckley): Determine if this is really the best value. Ideally we wouldn't unnecessarily merge too many entries.
+const DefaultMaxUpdateManagers int = 10
+
+// Managed groups a fieldpath.ManagedFields together with the timestamps associated with each operation.
+type Managed interface {
+	// Fields gets the fieldpath.ManagedFields.
+	Fields() fieldpath.ManagedFields
+
+	// Times gets the timestamps associated with each operation.
+	Times() map[string]*metav1.Time
+}
+
+// Manager updates the managed fields and merges applied configurations.
+type Manager interface {
+	// Update is used when the object has already been merged (non-apply
+	// use-case), and simply updates the managed fields in the output
+	// object.
+	Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error)
+
+	// Apply is used when server-side apply is called, as it merges the
+	// object and updates the managed fields.
+	Apply(liveObj runtime.Object, patch []byte, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error)
+}
+
 // FieldManager updates the managed fields and merge applied
 // configurations.
 type FieldManager struct {
-	typeConverter   internal.TypeConverter
-	objectConverter runtime.ObjectConvertor
-	objectDefaulter runtime.ObjectDefaulter
-	groupVersion    schema.GroupVersion
-	hubVersion      schema.GroupVersion
-	updater         merge.Updater
+	fieldManager Manager
 }

-// NewFieldManager creates a new FieldManager that merges apply requests
+// NewFieldManager creates a new FieldManager that decodes, manages, then re-encodes managedFields
+// on update and apply requests.
+func NewFieldManager(f Manager) *FieldManager {
+	return &FieldManager{f}
+}
+
+// NewDefaultFieldManager creates a new FieldManager that merges apply requests
 // and update managed fields for other types of requests.
-func NewFieldManager(models openapiproto.Models, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion) (*FieldManager, error) {
-	typeConverter, err := internal.NewTypeConverter(models)
+func NewDefaultFieldManager(models openapiproto.Models, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, hub schema.GroupVersion) (*FieldManager, error) {
+	f, err := NewStructuredMergeManager(models, objectConverter, objectDefaulter, kind.GroupVersion(), hub)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create field manager: %v", err)
 	}
-
-	return &FieldManager{
-		typeConverter:   typeConverter,
-		objectConverter: objectConverter,
-		objectDefaulter: objectDefaulter,
-		groupVersion:    gv,
-		hubVersion:      hub,
-		updater: merge.Updater{
-			Converter: internal.NewVersionConverter(typeConverter, objectConverter, hub),
-		},
-	}, nil
+	return newDefaultFieldManager(f, objectCreater, kind), nil
 }

-// NewCRDFieldManager creates a new FieldManager specifically for
-// CRDs. This doesn't use openapi models (and it doesn't support the
-// validation field right now).
-func NewCRDFieldManager(objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion) *FieldManager {
-	return &FieldManager{
-		typeConverter:   internal.DeducedTypeConverter{},
-		objectConverter: objectConverter,
-		objectDefaulter: objectDefaulter,
-		groupVersion:    gv,
-		hubVersion:      hub,
-		updater: merge.Updater{
-			Converter: internal.NewCRDVersionConverter(internal.DeducedTypeConverter{}, objectConverter, hub),
-		},
+// NewDefaultCRDFieldManager creates a new FieldManager specifically for
+// CRDs. This allows for the possibility of fields which are not defined
+// in models, as well as having no models defined at all.
+func NewDefaultCRDFieldManager(models openapiproto.Models, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, hub schema.GroupVersion, preserveUnknownFields bool) (_ *FieldManager, err error) {
+	f, err := NewCRDStructuredMergeManager(models, objectConverter, objectDefaulter, kind.GroupVersion(), hub, preserveUnknownFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create field manager: %v", err)
 	}
+	return newDefaultFieldManager(f, objectCreater, kind), nil
+}
+
+// newDefaultFieldManager is a helper function which wraps a Manager with certain default logic.
+func newDefaultFieldManager(f Manager, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind) *FieldManager {
+	f = NewStripMetaManager(f)
+	f = NewBuildManagerInfoManager(f, kind.GroupVersion())
+	f = NewCapManagersManager(f, DefaultMaxUpdateManagers)
+	f = NewSkipNonAppliedManager(f, objectCreater, kind)
+	return NewFieldManager(f)
 }

 // Update is used when the object has already been merged (non-apply
 // use-case), and simply updates the managed fields in the output
 // object.
-func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (runtime.Object, error) {
+func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (object runtime.Object, err error) {
 	// If the object doesn't have metadata, we should just return without trying to
 	// set the managedFields at all, so creates/updates/patches will work normally.
-	if _, err := meta.Accessor(newObj); err != nil {
+	if _, err = meta.Accessor(newObj); err != nil {
 		return newObj, nil
 	}

 	// First try to decode the managed fields provided in the update,
 	// This is necessary to allow directly updating managed fields.
-	managed, err := internal.DecodeObjectManagedFields(newObj)
-
-	// If the managed field is empty or we failed to decode it,
-	// let's try the live object. This is to prevent clients who
-	// don't understand managedFields from deleting it accidentally.
-	if err != nil || len(managed) == 0 {
+	var managed Managed
+	if managed, err = internal.DecodeObjectManagedFields(newObj); err != nil || len(managed.Fields()) == 0 {
+		// If the managed field is empty or we failed to decode it,
+		// let's try the live object. This is to prevent clients who
+		// don't understand managedFields from deleting it accidentally.
 		managed, err = internal.DecodeObjectManagedFields(liveObj)
 		if err != nil {
 			return nil, fmt.Errorf("failed to decode managed fields: %v", err)
 		}
 	}
-	newObjVersioned, err := f.toVersioned(newObj)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert new object to proper version: %v", err)
-	}
-	liveObjVersioned, err := f.toVersioned(liveObj)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert live object to proper version: %v", err)
-	}
-	internal.RemoveObjectManagedFields(liveObjVersioned)
-	internal.RemoveObjectManagedFields(newObjVersioned)
-	newObjTyped, err := f.typeConverter.ObjectToTyped(newObjVersioned)
-	if err != nil {
-		// Return newObj and just by-pass fields update. This really shouldn't happen.
-		klog.Errorf("[SHOULD NOT HAPPEN] failed to create typed new object: %v", err)
-		return newObj, nil
-	}
-	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned)
-	if err != nil {
-		// Return newObj and just by-pass fields update. This really shouldn't happen.
-		klog.Errorf("[SHOULD NOT HAPPEN] failed to create typed live object: %v", err)
-		return newObj, nil
-	}
-	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
-	manager, err = f.buildManagerInfo(manager, metav1.ManagedFieldsOperationUpdate)
-	if err != nil {
-		return nil, fmt.Errorf("failed to build manager identifier: %v", err)
+
+	internal.RemoveObjectManagedFields(liveObj)
+	internal.RemoveObjectManagedFields(newObj)
+
+	if object, managed, err = f.fieldManager.Update(liveObj, newObj, managed, manager); err != nil {
+		return nil, err
 	}

-	managed, err = f.updater.Update(liveObjTyped, newObjTyped, apiVersion, managed, manager)
-	if err != nil {
-		return nil, fmt.Errorf("failed to update ManagedFields: %v", err)
-	}
-	managed = f.stripFields(managed, manager)
-
-	if err := internal.EncodeObjectManagedFields(newObj, managed); err != nil {
+	if err = internal.EncodeObjectManagedFields(object, managed); err != nil {
 		return nil, fmt.Errorf("failed to encode managed fields: %v", err)
 	}

-	return newObj, nil
+	return object, nil
 }

 // Apply is used when server-side apply is called, as it merges the
-// object and update the managed fields.
-func (f *FieldManager) Apply(liveObj runtime.Object, patch []byte, fieldManager string, force bool) (runtime.Object, error) {
+// object and updates the managed fields.
+func (f *FieldManager) Apply(liveObj runtime.Object, patch []byte, manager string, force bool) (object runtime.Object, err error) {
 	// If the object doesn't have metadata, apply isn't allowed.
-	if _, err := meta.Accessor(liveObj); err != nil {
+	if _, err = meta.Accessor(liveObj); err != nil {
 		return nil, fmt.Errorf("couldn't get accessor: %v", err)
 	}

-	managed, err := internal.DecodeObjectManagedFields(liveObj)
-	if err != nil {
+	// Decode the managed fields in the live object, since it isn't allowed in the patch.
+	var managed Managed
+	if managed, err = internal.DecodeObjectManagedFields(liveObj); err != nil {
 		return nil, fmt.Errorf("failed to decode managed fields: %v", err)
 	}
-	// Check that the patch object has the same version as the live object
-	patchObj := &unstructured.Unstructured{Object: map[string]interface{}{}}

-	if err := yaml.Unmarshal(patch, &patchObj.Object); err != nil {
-		return nil, errors.NewBadRequest(fmt.Sprintf("error decoding YAML: %v", err))
-	}
-	if patchObj.GetAPIVersion() != f.groupVersion.String() {
-		return nil,
-			errors.NewBadRequest(
-				fmt.Sprintf("Incorrect version specified in apply patch. "+
-					"Specified patch version: %s, expected: %s",
-					patchObj.GetAPIVersion(), f.groupVersion.String()))
-	}
+	internal.RemoveObjectManagedFields(liveObj)

-	liveObjVersioned, err := f.toVersioned(liveObj)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert live object to proper version: %v", err)
-	}
-	internal.RemoveObjectManagedFields(liveObjVersioned)
-
-	patchObjTyped, err := f.typeConverter.YAMLToTyped(patch)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create typed patch object: %v", err)
-	}
-	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create typed live object: %v", err)
-	}
-	manager, err := f.buildManagerInfo(fieldManager, metav1.ManagedFieldsOperationApply)
-	if err != nil {
-		return nil, fmt.Errorf("failed to build manager identifier: %v", err)
-	}
-
-	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
-	newObjTyped, managed, err := f.updater.Apply(liveObjTyped, patchObjTyped, apiVersion, managed, manager, force)
-	if err != nil {
-		if conflicts, ok := err.(merge.Conflicts); ok {
-			return nil, internal.NewConflictError(conflicts)
-		}
+	if object, managed, err = f.fieldManager.Apply(liveObj, patch, managed, manager, force); err != nil {
 		return nil, err
 	}
-	managed = f.stripFields(managed, manager)

-	newObj, err := f.typeConverter.TypedToObject(newObjTyped)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert new typed object to object: %v", err)
-	}
-
-	if err := internal.EncodeObjectManagedFields(newObj, managed); err != nil {
+	if err = internal.EncodeObjectManagedFields(object, managed); err != nil {
 		return nil, fmt.Errorf("failed to encode managed fields: %v", err)
 	}

-	newObjVersioned, err := f.toVersioned(newObj)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert new object to proper version: %v", err)
-	}
-	f.objectDefaulter.Default(newObjVersioned)
-
-	newObjUnversioned, err := f.toUnversioned(newObjVersioned)
-	if err != nil {
-		return nil, fmt.Errorf("failed to convert to unversioned: %v", err)
-	}
-	return newObjUnversioned, nil
-}
-
-func (f *FieldManager) toVersioned(obj runtime.Object) (runtime.Object, error) {
-	return f.objectConverter.ConvertToVersion(obj, f.groupVersion)
-}
-
-func (f *FieldManager) toUnversioned(obj runtime.Object) (runtime.Object, error) {
-	return f.objectConverter.ConvertToVersion(obj, f.hubVersion)
-}
-
-func (f *FieldManager) buildManagerInfo(prefix string, operation metav1.ManagedFieldsOperationType) (string, error) {
-	managerInfo := metav1.ManagedFieldsEntry{
-		Manager:    prefix,
-		Operation:  operation,
-		APIVersion: f.groupVersion.String(),
-		Time:       &metav1.Time{Time: time.Now().UTC()},
-	}
-	if managerInfo.Manager == "" {
-		managerInfo.Manager = "unknown"
-	}
-	return internal.BuildManagerIdentifier(&managerInfo)
-}
-
-// stripSet is the list of fields that should never be part of a mangedFields.
-var stripSet = fieldpath.NewSet(
-	fieldpath.MakePathOrDie("apiVersion"),
-	fieldpath.MakePathOrDie("kind"),
-	fieldpath.MakePathOrDie("metadata", "name"),
-	fieldpath.MakePathOrDie("metadata", "namespace"),
-	fieldpath.MakePathOrDie("metadata", "creationTimestamp"),
-	fieldpath.MakePathOrDie("metadata", "selfLink"),
-	fieldpath.MakePathOrDie("metadata", "uid"),
-	fieldpath.MakePathOrDie("metadata", "clusterName"),
-	fieldpath.MakePathOrDie("metadata", "generation"),
-	fieldpath.MakePathOrDie("metadata", "managedFields"),
-	fieldpath.MakePathOrDie("metadata", "resourceVersion"),
-)
-
-// stripFields removes a predefined set of paths found in typed from managed and returns the updated ManagedFields
-func (f *FieldManager) stripFields(managed fieldpath.ManagedFields, manager string) fieldpath.ManagedFields {
-	vs, ok := managed[manager]
-	if ok {
-		if vs == nil {
-			panic(fmt.Sprintf("Found unexpected nil manager which should never happen: %s", manager))
-		}
-		vs.Set = vs.Set.Difference(stripSet)
-		if vs.Set.Empty() {
-			delete(managed, manager)
-		}
-	}
-
-	return managed
+	return object, nil
 }
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/conflict.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/conflict.go
@ -76,6 +76,9 @@ func printManager(manager string) string {
 		return fmt.Sprintf("%q", manager)
 	}
 	if encodedManager.Operation == metav1.ManagedFieldsOperationUpdate {
+		if encodedManager.Time == nil {
+			return fmt.Sprintf("%q using %v", encodedManager.Manager, encodedManager.APIVersion)
+		}
 		return fmt.Sprintf("%q using %v at %v", encodedManager.Manager, encodedManager.APIVersion, encodedManager.Time.UTC().Format(time.RFC3339))
 	}
 	return fmt.Sprintf("%q", encodedManager.Manager)
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/fields.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/fields.go
@ -17,79 +17,31 @@ limitations under the License.
 package internal

 import (
+	"bytes"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"sigs.k8s.io/structured-merge-diff/fieldpath"
 )

-func newFields() metav1.Fields {
-	return metav1.Fields{Map: map[string]metav1.Fields{}}
-}
-
-func fieldsSet(f metav1.Fields, path fieldpath.Path, set *fieldpath.Set) error {
-	if len(f.Map) == 0 {
-		set.Insert(path)
-	}
-	for k := range f.Map {
-		if k == "." {
-			set.Insert(path)
-			continue
-		}
-		pe, err := NewPathElement(k)
-		if err != nil {
-			return err
-		}
-		path = append(path, pe)
-		err = fieldsSet(f.Map[k], path, set)
-		if err != nil {
-			return err
-		}
-		path = path[:len(path)-1]
-	}
-	return nil
-}
-
-// FieldsToSet creates a set paths from an input trie of fields
-func FieldsToSet(f metav1.Fields) (fieldpath.Set, error) {
-	set := fieldpath.Set{}
-	return set, fieldsSet(f, fieldpath.Path{}, &set)
-}
-
-func removeUselessDots(f metav1.Fields) metav1.Fields {
-	if _, ok := f.Map["."]; ok && len(f.Map) == 1 {
-		delete(f.Map, ".")
-		return f
-	}
-	for k, tf := range f.Map {
-		f.Map[k] = removeUselessDots(tf)
+// EmptyFields represents a set with no paths
+// It looks like metav1.Fields{Raw: []byte("{}")}
+var EmptyFields metav1.FieldsV1 = func() metav1.FieldsV1 {
+	f, err := SetToFields(*fieldpath.NewSet())
+	if err != nil {
+		panic("should never happen")
 	}
 	return f
+}()
+
+// FieldsToSet creates a set paths from an input trie of fields
+func FieldsToSet(f metav1.FieldsV1) (s fieldpath.Set, err error) {
+	err = s.FromJSON(bytes.NewReader(f.Raw))
+	return s, err
 }

 // SetToFields creates a trie of fields from an input set of paths
-func SetToFields(s fieldpath.Set) (metav1.Fields, error) {
-	var err error
-	f := newFields()
-	s.Iterate(func(path fieldpath.Path) {
-		if err != nil {
-			return
-		}
-		tf := f
-		for _, pe := range path {
-			var str string
-			str, err = PathElementString(pe)
-			if err != nil {
-				break
-			}
-			if _, ok := tf.Map[str]; ok {
-				tf = tf.Map[str]
-			} else {
-				tf.Map[str] = newFields()
-				tf = tf.Map[str]
-			}
-		}
-		tf.Map["."] = newFields()
-	})
-	f = removeUselessDots(f)
+func SetToFields(s fieldpath.Set) (f metav1.FieldsV1, err error) {
+	f.Raw, err = s.ToJSON()
 	return f, err
 }
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/gvkparser.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/gvkparser.go
@ -35,16 +35,17 @@ type gvkParser struct {
 	parser typed.Parser
 }

-func (p *gvkParser) Type(gvk schema.GroupVersionKind) typed.ParseableType {
+func (p *gvkParser) Type(gvk schema.GroupVersionKind) *typed.ParseableType {
 	typeName, ok := p.gvks[gvk]
 	if !ok {
 		return nil
 	}
-	return p.parser.Type(typeName)
+	t := p.parser.Type(typeName)
+	return &t
 }

-func newGVKParser(models proto.Models) (*gvkParser, error) {
-	typeSchema, err := schemaconv.ToSchema(models)
+func newGVKParser(models proto.Models, preserveUnknownFields bool) (*gvkParser, error) {
+	typeSchema, err := schemaconv.ToSchemaWithPreserveUnknownFields(models, preserveUnknownFields)
 	if err != nil {
 		return nil, fmt.Errorf("failed to convert models to schema: %v", err)
 	}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go
@ -28,6 +28,40 @@ import (
 	"sigs.k8s.io/structured-merge-diff/fieldpath"
 )

+// ManagedInterface groups a fieldpath.ManagedFields together with the timestamps associated with each operation.
+type ManagedInterface interface {
+	// Fields gets the fieldpath.ManagedFields.
+	Fields() fieldpath.ManagedFields
+
+	// Times gets the timestamps associated with each operation.
+	Times() map[string]*metav1.Time
+}
+
+type managedStruct struct {
+	fields fieldpath.ManagedFields
+	times  map[string]*metav1.Time
+}
+
+var _ ManagedInterface = &managedStruct{}
+
+// Fields implements ManagedInterface.
+func (m *managedStruct) Fields() fieldpath.ManagedFields {
+	return m.fields
+}
+
+// Times implements ManagedInterface.
+func (m *managedStruct) Times() map[string]*metav1.Time {
+	return m.times
+}
+
+// NewManaged creates a ManagedInterface from a fieldpath.ManagedFields and the timestamps associated with each operation.
+func NewManaged(f fieldpath.ManagedFields, t map[string]*metav1.Time) ManagedInterface {
+	return &managedStruct{
+		fields: f,
+		times:  t,
+	}
+}
+
 // RemoveObjectManagedFields removes the ManagedFields from the object
 // before we merge so that it doesn't appear in the ManagedFields
 // recursively.
@ -40,9 +74,9 @@ func RemoveObjectManagedFields(obj runtime.Object) {
 }

 // DecodeObjectManagedFields extracts and converts the objects ManagedFields into a fieldpath.ManagedFields.
-func DecodeObjectManagedFields(from runtime.Object) (fieldpath.ManagedFields, error) {
+func DecodeObjectManagedFields(from runtime.Object) (ManagedInterface, error) {
 	if from == nil {
-		return make(map[string]*fieldpath.VersionedSet), nil
+		return &managedStruct{}, nil
 	}
 	accessor, err := meta.Accessor(from)
 	if err != nil {
@ -53,54 +87,61 @@ func DecodeObjectManagedFields(from runtime.Object) (fieldpath.ManagedFields, er
 	if err != nil {
 		return nil, fmt.Errorf("failed to convert managed fields from API: %v", err)
 	}
-	return managed, err
+	return &managed, nil
 }

 // EncodeObjectManagedFields converts and stores the fieldpathManagedFields into the objects ManagedFields
-func EncodeObjectManagedFields(obj runtime.Object, fields fieldpath.ManagedFields) error {
+func EncodeObjectManagedFields(obj runtime.Object, managed ManagedInterface) error {
 	accessor, err := meta.Accessor(obj)
 	if err != nil {
 		panic(fmt.Sprintf("couldn't get accessor: %v", err))
 	}

-	managed, err := encodeManagedFields(fields)
+	encodedManagedFields, err := encodeManagedFields(managed)
 	if err != nil {
 		return fmt.Errorf("failed to convert back managed fields to API: %v", err)
 	}
-	accessor.SetManagedFields(managed)
+	accessor.SetManagedFields(encodedManagedFields)

 	return nil
 }

 // decodeManagedFields converts ManagedFields from the wire format (api format)
 // to the format used by sigs.k8s.io/structured-merge-diff
-func decodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (managedFields fieldpath.ManagedFields, err error) {
-	managedFields = make(map[string]*fieldpath.VersionedSet, len(encodedManagedFields))
+func decodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (managed managedStruct, err error) {
+	managed.fields = make(fieldpath.ManagedFields, len(encodedManagedFields))
+	managed.times = make(map[string]*metav1.Time, len(encodedManagedFields))
 	for _, encodedVersionedSet := range encodedManagedFields {
 		manager, err := BuildManagerIdentifier(&encodedVersionedSet)
 		if err != nil {
-			return nil, fmt.Errorf("error decoding manager from %v: %v", encodedVersionedSet, err)
+			return managedStruct{}, fmt.Errorf("error decoding manager from %v: %v", encodedVersionedSet, err)
 		}
-		managedFields[manager], err = decodeVersionedSet(&encodedVersionedSet)
+		managed.fields[manager], err = decodeVersionedSet(&encodedVersionedSet)
 		if err != nil {
-			return nil, fmt.Errorf("error decoding versioned set from %v: %v", encodedVersionedSet, err)
+			return managedStruct{}, fmt.Errorf("error decoding versioned set from %v: %v", encodedVersionedSet, err)
 		}
+		managed.times[manager] = encodedVersionedSet.Time
 	}
-	return managedFields, nil
+	return managed, nil
 }

 // BuildManagerIdentifier creates a manager identifier string from a ManagedFieldsEntry
 func BuildManagerIdentifier(encodedManager *metav1.ManagedFieldsEntry) (manager string, err error) {
 	encodedManagerCopy := *encodedManager

-	// Never include the fields in the manager identifier
-	encodedManagerCopy.Fields = nil
+	// Never include fields type in the manager identifier
+	encodedManagerCopy.FieldsType = ""

-	// For appliers, don't include the APIVersion or Time in the manager identifier,
+	// Never include the fields in the manager identifier
+	encodedManagerCopy.FieldsV1 = nil
+
+	// Never include the time in the manager identifier
+	encodedManagerCopy.Time = nil
+
+	// For appliers, don't include the APIVersion in the manager identifier,
 	// so it will always have the same manager identifier each time it applied.
 	if encodedManager.Operation == metav1.ManagedFieldsOperationApply {
 		encodedManagerCopy.APIVersion = ""
-		encodedManagerCopy.Time = nil
 	}

 	// Use the remaining fields to build the manager identifier
@ -112,42 +153,34 @@ func BuildManagerIdentifier(encodedManager *metav1.ManagedFieldsEntry) (manager
 	return string(b), nil
 }

-func decodeVersionedSet(encodedVersionedSet *metav1.ManagedFieldsEntry) (versionedSet *fieldpath.VersionedSet, err error) {
-	versionedSet = &fieldpath.VersionedSet{}
-	versionedSet.APIVersion = fieldpath.APIVersion(encodedVersionedSet.APIVersion)
-	if encodedVersionedSet.Operation == metav1.ManagedFieldsOperationApply {
-		versionedSet.Applied = true
-	}
-
-	fields := metav1.Fields{}
-	if encodedVersionedSet.Fields != nil {
-		fields = *encodedVersionedSet.Fields
+func decodeVersionedSet(encodedVersionedSet *metav1.ManagedFieldsEntry) (versionedSet fieldpath.VersionedSet, err error) {
+	fields := EmptyFields
+	if encodedVersionedSet.FieldsV1 != nil {
+		fields = *encodedVersionedSet.FieldsV1
 	}
 	set, err := FieldsToSet(fields)
 	if err != nil {
 		return nil, fmt.Errorf("error decoding set: %v", err)
 	}
-	versionedSet.Set = &set
-	return versionedSet, nil
+	return fieldpath.NewVersionedSet(&set, fieldpath.APIVersion(encodedVersionedSet.APIVersion), encodedVersionedSet.Operation == metav1.ManagedFieldsOperationApply), nil
 }

-// encodeManagedFields converts ManagedFields from the the format used by
-// sigs.k8s.io/structured-merge-diff to the the wire format (api format)
-func encodeManagedFields(managedFields fieldpath.ManagedFields) (encodedManagedFields []metav1.ManagedFieldsEntry, err error) {
-	// Sort the keys so a predictable order will be used.
-	managers := []string{}
-	for manager := range managedFields {
-		managers = append(managers, manager)
+// encodeManagedFields converts ManagedFields from the format used by
+// sigs.k8s.io/structured-merge-diff to the wire format (api format)
+func encodeManagedFields(managed ManagedInterface) (encodedManagedFields []metav1.ManagedFieldsEntry, err error) {
+	if len(managed.Fields()) == 0 {
+		return nil, nil
 	}
-	sort.Strings(managers)
-
 	encodedManagedFields = []metav1.ManagedFieldsEntry{}
-	for _, manager := range managers {
-		versionedSet := managedFields[manager]
+	for manager := range managed.Fields() {
+		versionedSet := managed.Fields()[manager]
 		v, err := encodeManagerVersionedSet(manager, versionedSet)
 		if err != nil {
 			return nil, fmt.Errorf("error encoding versioned set for %v: %v", manager, err)
 		}
+		if t, ok := managed.Times()[manager]; ok {
+			v.Time = t
+		}
 		encodedManagedFields = append(encodedManagedFields, *v)
 	}
 	return sortEncodedManagedFields(encodedManagedFields)
@ -172,13 +205,16 @@ func sortEncodedManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry)
 			return p.Time.Before(q.Time)
 		}

-		return p.Manager < q.Manager
+		if p.Manager != q.Manager {
+			return p.Manager < q.Manager
+		}
+		return p.APIVersion < q.APIVersion
 	})

 	return encodedManagedFields, nil
 }

-func encodeManagerVersionedSet(manager string, versionedSet *fieldpath.VersionedSet) (encodedVersionedSet *metav1.ManagedFieldsEntry, err error) {
+func encodeManagerVersionedSet(manager string, versionedSet fieldpath.VersionedSet) (encodedVersionedSet *metav1.ManagedFieldsEntry, err error) {
 	encodedVersionedSet = &metav1.ManagedFieldsEntry{}

 	// Get as many fields as we can from the manager identifier
@ -188,15 +224,16 @@ func encodeManagerVersionedSet(manager string, versionedSet *fieldpath.Versioned
 	}

 	// Get the APIVersion, Operation, and Fields from the VersionedSet
-	encodedVersionedSet.APIVersion = string(versionedSet.APIVersion)
-	if versionedSet.Applied {
+	encodedVersionedSet.APIVersion = string(versionedSet.APIVersion())
+	if versionedSet.Applied() {
 		encodedVersionedSet.Operation = metav1.ManagedFieldsOperationApply
 	}
-	fields, err := SetToFields(*versionedSet.Set)
+	encodedVersionedSet.FieldsType = "FieldsV1"
+	fields, err := SetToFields(*versionedSet.Set())
 	if err != nil {
 		return nil, fmt.Errorf("error encoding set: %v", err)
 	}
-	encodedVersionedSet.Fields = &fields
+	encodedVersionedSet.FieldsV1 = &fields

 	return encodedVersionedSet, nil
 }
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/pathelement.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/pathelement.go
@ -77,7 +77,7 @@ func NewPathElement(s string) (fieldpath.PathElement, error) {
 		if err != nil {
 			return fieldpath.PathElement{}, err
 		}
-		fields := []value.Field{}
+		fields := value.FieldList{}
 		for k, v := range kv {
 			b, err := json.Marshal(v)
 			if err != nil {
@ -94,7 +94,7 @@ func NewPathElement(s string) (fieldpath.PathElement, error) {
 			})
 		}
 		return fieldpath.PathElement{
-			Key: fields,
+			Key: &fields,
 		}, nil
 	default:
 		// Ignore unknown key types
@ -107,9 +107,9 @@ func PathElementString(pe fieldpath.PathElement) (string, error) {
 	switch {
 	case pe.FieldName != nil:
 		return Field + Separator + *pe.FieldName, nil
-	case len(pe.Key) > 0:
+	case pe.Key != nil:
 		kv := map[string]json.RawMessage{}
-		for _, k := range pe.Key {
+		for _, k := range *pe.Key {
 			b, err := k.Value.ToJSON()
 			if err != nil {
 				return "", err
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/typeconverter.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/typeconverter.go
@ -25,15 +25,13 @@ import (
 	"k8s.io/kube-openapi/pkg/util/proto"
 	"sigs.k8s.io/structured-merge-diff/typed"
 	"sigs.k8s.io/structured-merge-diff/value"
-	"sigs.k8s.io/yaml"
 )

 // TypeConverter allows you to convert from runtime.Object to
 // typed.TypedValue and the other way around.
 type TypeConverter interface {
-	ObjectToTyped(runtime.Object) (typed.TypedValue, error)
-	YAMLToTyped([]byte) (typed.TypedValue, error)
-	TypedToObject(typed.TypedValue) (runtime.Object, error)
+	ObjectToTyped(runtime.Object) (*typed.TypedValue, error)
+	TypedToObject(*typed.TypedValue) (runtime.Object, error)
 }

 // DeducedTypeConverter is a TypeConverter for CRDs that don't have a
@ -50,22 +48,17 @@ type DeducedTypeConverter struct{}
 var _ TypeConverter = DeducedTypeConverter{}

 // ObjectToTyped converts an object into a TypedValue with a "deduced type".
-func (DeducedTypeConverter) ObjectToTyped(obj runtime.Object) (typed.TypedValue, error) {
+func (DeducedTypeConverter) ObjectToTyped(obj runtime.Object) (*typed.TypedValue, error) {
 	u, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
 	if err != nil {
 		return nil, err
 	}
-	return typed.DeducedParseableType{}.FromUnstructured(u)
-}
-
-// YAMLToTyped parses a yaml object into a TypedValue with a "deduced type".
-func (DeducedTypeConverter) YAMLToTyped(from []byte) (typed.TypedValue, error) {
-	return typed.DeducedParseableType{}.FromYAML(typed.YAMLObject(from))
+	return typed.DeducedParseableType.FromUnstructured(u)
 }

 // TypedToObject transforms the typed value into a runtime.Object. That
 // is not specific to deduced type.
-func (DeducedTypeConverter) TypedToObject(value typed.TypedValue) (runtime.Object, error) {
+func (DeducedTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
 	return valueToObject(value.AsValue())
 }

@ -78,15 +71,15 @@ var _ TypeConverter = &typeConverter{}
 // NewTypeConverter builds a TypeConverter from a proto.Models. This
 // will automatically find the proper version of the object, and the
 // corresponding schema information.
-func NewTypeConverter(models proto.Models) (TypeConverter, error) {
-	parser, err := newGVKParser(models)
+func NewTypeConverter(models proto.Models, preserveUnknownFields bool) (TypeConverter, error) {
+	parser, err := newGVKParser(models, preserveUnknownFields)
 	if err != nil {
 		return nil, err
 	}
 	return &typeConverter{parser: parser}, nil
 }

-func (c *typeConverter) ObjectToTyped(obj runtime.Object) (typed.TypedValue, error) {
+func (c *typeConverter) ObjectToTyped(obj runtime.Object) (*typed.TypedValue, error) {
 	u, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
 	if err != nil {
 		return nil, err
@ -99,22 +92,7 @@ func (c *typeConverter) ObjectToTyped(obj runtime.Object) (typed.TypedValue, err
 	return t.FromUnstructured(u)
 }

-func (c *typeConverter) YAMLToTyped(from []byte) (typed.TypedValue, error) {
-	unstructured := &unstructured.Unstructured{Object: map[string]interface{}{}}
-
-	if err := yaml.Unmarshal(from, &unstructured.Object); err != nil {
-		return nil, fmt.Errorf("error decoding YAML: %v", err)
-	}
-
-	gvk := unstructured.GetObjectKind().GroupVersionKind()
-	t := c.parser.Type(gvk)
-	if t == nil {
-		return nil, newNoCorrespondingTypeError(gvk)
-	}
-	return t.FromYAML(typed.YAMLObject(string(from)))
-}
-
-func (c *typeConverter) TypedToObject(value typed.TypedValue) (runtime.Object, error) {
+func (c *typeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
 	return valueToObject(value.AsValue())
 }

--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/versionconverter.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal/versionconverter.go
@ -60,7 +60,7 @@ func NewCRDVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema
 }

 // Convert implements sigs.k8s.io/structured-merge-diff/merge.Converter
-func (v *versionConverter) Convert(object typed.TypedValue, version fieldpath.APIVersion) (typed.TypedValue, error) {
+func (v *versionConverter) Convert(object *typed.TypedValue, version fieldpath.APIVersion) (*typed.TypedValue, error) {
 	// Convert the smd typed value to a kubernetes object.
 	objectToConvert, err := v.typeConverter.TypedToObject(object)
 	if err != nil {
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/node.yaml
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/node.yaml
@ -0,0 +1,259 @@
+apiVersion: v1
+kind: Node
+metadata:
+  annotations:
+    container.googleapis.com/instance_id: "123456789321654789"
+    node.alpha.kubernetes.io/ttl: "0"
+    volumes.kubernetes.io/controller-managed-attach-detach: "true"
+  creationTimestamp: "2019-07-09T16:17:29Z"
+  labels:
+    beta.kubernetes.io/arch: amd64
+    beta.kubernetes.io/fluentd-ds-ready: "true"
+    beta.kubernetes.io/instance-type: n1-standard-4
+    beta.kubernetes.io/os: linux
+    cloud.google.com/gke-nodepool: default-pool
+    cloud.google.com/gke-os-distribution: cos
+    failure-domain.beta.kubernetes.io/region: us-central1
+    failure-domain.beta.kubernetes.io/zone: us-central1-b
+    kubernetes.io/hostname: node-default-pool-something
+  name: node-default-pool-something
+  resourceVersion: "211582541"
+  selfLink: /api/v1/nodes/node-default-pool-something
+  uid: 0c24d0e1-a265-11e9-abe4-42010a80026b
+spec:
+  podCIDR: 10.0.0.1/24
+  providerID: some-provider-id-of-some-sort
+status:
+  addresses:
+  - address: 10.0.0.1
+    type: InternalIP
+  - address: 192.168.0.1
+    type: ExternalIP
+  - address: node-default-pool-something
+    type: Hostname
+  allocatable:
+    cpu: 3920m
+    ephemeral-storage: "104638878617"
+    hugepages-2Mi: "0"
+    memory: 12700100Ki
+    pods: "110"
+  capacity:
+    cpu: "4"
+    ephemeral-storage: 202086868Ki
+    hugepages-2Mi: "0"
+    memory: 15399364Ki
+    pods: "110"
+  conditions:
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:08Z"
+    message: containerd is functioning properly
+    reason: FrequentContainerdRestart
+    status: "False"
+    type: FrequentContainerdRestart
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: docker overlay2 is functioning properly
+    reason: CorruptDockerOverlay2
+    status: "False"
+    type: CorruptDockerOverlay2
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: node is functioning properly
+    reason: UnregisterNetDevice
+    status: "False"
+    type: FrequentUnregisterNetDevice
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:17:04Z"
+    message: kernel has no deadlock
+    reason: KernelHasNoDeadlock
+    status: "False"
+    type: KernelDeadlock
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:17:04Z"
+    message: Filesystem is not read-only
+    reason: FilesystemIsNotReadOnly
+    status: "False"
+    type: ReadonlyFilesystem
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:05Z"
+    message: kubelet is functioning properly
+    reason: FrequentKubeletRestart
+    status: "False"
+    type: FrequentKubeletRestart
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: docker is functioning properly
+    reason: FrequentDockerRestart
+    status: "False"
+    type: FrequentDockerRestart
+  - lastHeartbeatTime: "2019-07-09T16:17:47Z"
+    lastTransitionTime: "2019-07-09T16:17:47Z"
+    message: RouteController created a route
+    reason: RouteCreated
+    status: "False"
+    type: NetworkUnavailable
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient disk space available
+    reason: KubeletHasSufficientDisk
+    status: "False"
+    type: OutOfDisk
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient memory available
+    reason: KubeletHasSufficientMemory
+    status: "False"
+    type: MemoryPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has no disk pressure
+    reason: KubeletHasNoDiskPressure
+    status: "False"
+    type: DiskPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient PID available
+    reason: KubeletHasSufficientPID
+    status: "False"
+    type: PIDPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:49Z"
+    message: kubelet is posting ready status. AppArmor enabled
+    reason: KubeletReady
+    status: "True"
+    type: Ready
+  daemonEndpoints:
+    kubeletEndpoint:
+      Port: 10250
+  images:
+  - names:
+    - grafana/grafana@sha256:80e5e113a984d74836aa16f5b4524012099436b1a50df293f00ac6377fb512c8
+    - grafana/grafana:4.4.2
+    sizeBytes: 287008013
+  - names:
+    - k8s.gcr.io/node-problem-detector@sha256:f95cab985c26b2f46e9bd43283e0bfa88860c14e0fb0649266babe8b65e9eb2b
+    - k8s.gcr.io/node-problem-detector:v0.4.1
+    sizeBytes: 286572743
+  - names:
+    - grafana/grafana@sha256:7ff7f9b2501a5d55b55ce3f58d21771b1c5af1f2a4ab7dbf11bef7142aae7033
+    - grafana/grafana:4.2.0
+    sizeBytes: 277940263
+  - names:
+    - influxdb@sha256:7dddf03376348876ed4bdf33d6dfa3326f45a2bae0930dbd80781a374eb519bc
+    - influxdb:1.2.2
+    sizeBytes: 223948571
+  - names:
+    - gcr.io/stackdriver-agents/stackdriver-logging-agent@sha256:f8d5231b67b9c53f60068b535a11811d29d1b3efd53d2b79f2a2591ea338e4f2
+    - gcr.io/stackdriver-agents/stackdriver-logging-agent:0.6-1.6.0-1
+    sizeBytes: 223242132
+  - names:
+    - nginx@sha256:35779791c05d119df4fe476db8f47c0bee5943c83eba5656a15fc046db48178b
+    - nginx:1.10.1
+    sizeBytes: 180708613
+  - names:
+    - k8s.gcr.io/fluentd-elasticsearch@sha256:b8c94527b489fb61d3d81ce5ad7f3ddbb7be71e9620a3a36e2bede2f2e487d73
+    - k8s.gcr.io/fluentd-elasticsearch:v2.0.4
+    sizeBytes: 135716379
+  - names:
+    - nginx@sha256:00be67d6ba53d5318cd91c57771530f5251cfbe028b7be2c4b70526f988cfc9f
+    - nginx:latest
+    sizeBytes: 109357355
+  - names:
+    - k8s.gcr.io/kubernetes-dashboard-amd64@sha256:dc4026c1b595435ef5527ca598e1e9c4343076926d7d62b365c44831395adbd0
+    - k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3
+    sizeBytes: 102319441
+  - names:
+    - gcr.io/google_containers/kube-proxy:v1.11.10-gke.5
+    - k8s.gcr.io/kube-proxy:v1.11.10-gke.5
+    sizeBytes: 102279340
+  - names:
+    - k8s.gcr.io/event-exporter@sha256:7f9cd7cb04d6959b0aa960727d04fa86759008048c785397b7b0d9dff0007516
+    - k8s.gcr.io/event-exporter:v0.2.3
+    sizeBytes: 94171943
+  - names:
+    - k8s.gcr.io/prometheus-to-sd@sha256:6c0c742475363d537ff059136e5d5e4ab1f512ee0fd9b7ca42ea48bc309d1662
+    - k8s.gcr.io/prometheus-to-sd:v0.3.1
+    sizeBytes: 88077694
+  - names:
+    - k8s.gcr.io/fluentd-gcp-scaler@sha256:a5ace7506d393c4ed65eb2cbb6312c64ab357fcea16dff76b9055bc6e498e5ff
+    - k8s.gcr.io/fluentd-gcp-scaler:0.5.1
+    sizeBytes: 86637208
+  - names:
+    - k8s.gcr.io/heapster-amd64@sha256:9fae0af136ce0cf4f88393b3670f7139ffc464692060c374d2ae748e13144521
+    - k8s.gcr.io/heapster-amd64:v1.6.0-beta.1
+    sizeBytes: 76016169
+  - names:
+    - k8s.gcr.io/ingress-glbc-amd64@sha256:31d36bbd9c44caffa135fc78cf0737266fcf25e3cf0cd1c2fcbfbc4f7309cc52
+    - k8s.gcr.io/ingress-glbc-amd64:v1.1.1
+    sizeBytes: 67801919
+  - names:
+    - k8s.gcr.io/kube-addon-manager@sha256:d53486c3a0b49ebee019932878dc44232735d5622a51dbbdcec7124199020d09
+    - k8s.gcr.io/kube-addon-manager:v8.7
+    sizeBytes: 63322109
+  - names:
+    - nginx@sha256:4aacdcf186934dcb02f642579314075910f1855590fd3039d8fa4c9f96e48315
+    - nginx:1.10-alpine
+    sizeBytes: 54042627
+  - names:
+    - k8s.gcr.io/cpvpa-amd64@sha256:cfe7b0a11c9c8e18c87b1eb34fef9a7cbb8480a8da11fc2657f78dbf4739f869
+    - k8s.gcr.io/cpvpa-amd64:v0.6.0
+    sizeBytes: 51785854
+  - names:
+    - k8s.gcr.io/cluster-proportional-autoscaler-amd64@sha256:003f98d9f411ddfa6ff6d539196355e03ddd69fa4ed38c7ffb8fec6f729afe2d
+    - k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.1.2-r2
+    sizeBytes: 49648481
+  - names:
+    - k8s.gcr.io/ip-masq-agent-amd64@sha256:1ffda57d87901bc01324c82ceb2145fe6a0448d3f0dd9cb65aa76a867cd62103
+    - k8s.gcr.io/ip-masq-agent-amd64:v2.1.1
+    sizeBytes: 49612505
+  - names:
+    - k8s.gcr.io/k8s-dns-kube-dns-amd64@sha256:b99fc3eee2a9f052f7eb4cc00f15eb12fc405fa41019baa2d6b79847ae7284a8
+    - k8s.gcr.io/k8s-dns-kube-dns-amd64:1.14.10
+    sizeBytes: 49549457
+  - names:
+    - k8s.gcr.io/rescheduler@sha256:156cfbfd05a5a815206fd2eeb6cbdaf1596d71ea4b415d3a6c43071dd7b99450
+    - k8s.gcr.io/rescheduler:v0.4.0
+    sizeBytes: 48973149
+  - names:
+    - k8s.gcr.io/event-exporter@sha256:16ca66e2b5dc7a1ce6a5aafcb21d0885828b75cdfc08135430480f7ad2364adc
+    - k8s.gcr.io/event-exporter:v0.2.4
+    sizeBytes: 47261019
+  - names:
+    - k8s.gcr.io/coredns@sha256:db2bf53126ed1c761d5a41f24a1b82a461c85f736ff6e90542e9522be4757848
+    - k8s.gcr.io/coredns:1.1.3
+    sizeBytes: 45587362
+  - names:
+    - prom/prometheus@sha256:483f4c9d7733699ba79facca9f8bcce1cef1af43dfc3e7c5a1882aa85f53cb74
+    - prom/prometheus:v1.1.3
+    sizeBytes: 45493941
+  nodeInfo:
+    architecture: amd64
+    bootID: a32eca78-4ad4-4b76-9252-f143d6c2ae61
+    containerRuntimeVersion: docker://17.3.2
+    kernelVersion: 4.14.127+
+    kubeProxyVersion: v1.11.10-gke.5
+    kubeletVersion: v1.11.10-gke.5
+    machineID: 1739555e5b231057f0f9a0b5fa29511b
+    operatingSystem: linux
+    osImage: Container-Optimized OS from Google
+    systemUUID: 1739555E-5B23-1057-F0F9-A0B5FA29511B
+  volumesAttached:
+  - devicePath: /dev/disk/by-id/b9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
+  - devicePath: /dev/disk/by-id/b9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+  volumesInUse:
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/pod.yaml
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/pod.yaml
@ -0,0 +1,121 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: some-app
+    plugin1: some-value
+    plugin2: some-value
+    plugin3: some-value
+    plugin4: some-value
+  name: some-name
+  namespace: default
+  ownerReferences:
+  - apiVersion: apps/v1
+    blockOwnerDeletion: true
+    controller: true
+    kind: ReplicaSet
+    name: some-name
+    uid: 0a9d2b9e-779e-11e7-b422-42010a8001be
+spec:
+  containers:
+  - args:
+    - one
+    - two
+    - three
+    - four
+    - five
+    - six
+    - seven
+    - eight
+    - nine
+    env:
+    - name: VAR_3
+      valueFrom:
+        secretKeyRef:
+          key: some-other-key
+          name: some-oher-name
+    - name: VAR_2
+      valueFrom:
+        secretKeyRef:
+          key: other-key
+          name: other-name
+    - name: VAR_1
+      valueFrom:
+        secretKeyRef:
+          key: some-key
+          name: some-name
+    image: some-image-name
+    imagePullPolicy: IfNotPresent
+    name: some-name
+    resources:
+      requests:
+        cpu: '0'
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    volumeMounts:
+    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      name: default-token-hu5jz
+      readOnly: true
+  dnsPolicy: ClusterFirst
+  nodeName: node-name
+  priority: 0
+  restartPolicy: Always
+  schedulerName: default-scheduler
+  securityContext: {}
+  serviceAccount: default
+  serviceAccountName: default
+  terminationGracePeriodSeconds: 30
+  tolerations:
+  - effect: NoExecute
+    key: node.kubernetes.io/not-ready
+    operator: Exists
+    tolerationSeconds: 300
+  - effect: NoExecute
+    key: node.kubernetes.io/unreachable
+    operator: Exists
+    tolerationSeconds: 300
+  volumes:
+  - name: default-token-hu5jz
+    secret:
+      defaultMode: 420
+      secretName: default-token-hu5jz
+status:
+  conditions:
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:31:18Z'
+    status: 'True'
+    type: Initialized
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:41:59Z'
+    status: 'True'
+    type: Ready
+  - lastProbeTime: null
+    lastTransitionTime: null
+    status: 'True'
+    type: ContainersReady
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:31:18Z'
+    status: 'True'
+    type: PodScheduled
+  containerStatuses:
+  - containerID: docker://885e82a1ed0b7356541bb410a0126921ac42439607c09875cd8097dd5d7b5376
+    image: some-image-name
+    imageID: docker-pullable://some-image-id
+    lastState:
+      terminated:
+        containerID: docker://d57290f9e00fad626b20d2dd87a3cf69bbc22edae07985374f86a8b2b4e39565
+        exitCode: 255
+        finishedAt: '2019-07-08T09:39:09Z'
+        reason: Error
+        startedAt: '2019-07-08T09:38:54Z'
+    name: name
+    ready: true
+    restartCount: 6
+    state:
+      running:
+        startedAt: '2019-07-08T09:41:59Z'
+  hostIP: 10.0.0.1
+  phase: Running
+  podIP: 10.0.0.1
+  qosClass: BestEffort
+  startTime: '2019-07-08T09:31:18Z'
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/skipnonapplied.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/skipnonapplied.go
@ -0,0 +1,66 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldmanager
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type skipNonAppliedManager struct {
+	fieldManager           Manager
+	objectCreater          runtime.ObjectCreater
+	gvk                    schema.GroupVersionKind
+	beforeApplyManagerName string
+}
+
+var _ Manager = &skipNonAppliedManager{}
+
+// NewSkipNonAppliedManager creates a new wrapped FieldManager that only starts tracking managers after the first apply.
+func NewSkipNonAppliedManager(fieldManager Manager, objectCreater runtime.ObjectCreater, gvk schema.GroupVersionKind) Manager {
+	return &skipNonAppliedManager{
+		fieldManager:           fieldManager,
+		objectCreater:          objectCreater,
+		gvk:                    gvk,
+		beforeApplyManagerName: "before-first-apply",
+	}
+}
+
+// Update implements Manager.
+func (f *skipNonAppliedManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	if len(managed.Fields()) == 0 {
+		return newObj, managed, nil
+	}
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *skipNonAppliedManager) Apply(liveObj runtime.Object, patch []byte, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	if len(managed.Fields()) == 0 {
+		emptyObj, err := f.objectCreater.New(f.gvk)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create empty object of type %v: %v", f.gvk, err)
+		}
+		liveObj, managed, err = f.fieldManager.Update(emptyObj, liveObj, managed, f.beforeApplyManagerName)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create manager for existing fields: %v", err)
+		}
+	}
+	return f.fieldManager.Apply(liveObj, patch, managed, fieldManager, force)
+}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/stripmeta.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/stripmeta.go
@ -0,0 +1,90 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldmanager
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/fieldpath"
+)
+
+type stripMetaManager struct {
+	fieldManager Manager
+
+	// stripSet is the list of fields that should never be part of a mangedFields.
+	stripSet *fieldpath.Set
+}
+
+var _ Manager = &stripMetaManager{}
+
+// NewStripMetaManager creates a new Manager that strips metadata and typemeta fields from the manager's fieldset.
+func NewStripMetaManager(fieldManager Manager) Manager {
+	return &stripMetaManager{
+		fieldManager: fieldManager,
+		stripSet: fieldpath.NewSet(
+			fieldpath.MakePathOrDie("apiVersion"),
+			fieldpath.MakePathOrDie("kind"),
+			fieldpath.MakePathOrDie("metadata"),
+			fieldpath.MakePathOrDie("metadata", "name"),
+			fieldpath.MakePathOrDie("metadata", "namespace"),
+			fieldpath.MakePathOrDie("metadata", "creationTimestamp"),
+			fieldpath.MakePathOrDie("metadata", "selfLink"),
+			fieldpath.MakePathOrDie("metadata", "uid"),
+			fieldpath.MakePathOrDie("metadata", "clusterName"),
+			fieldpath.MakePathOrDie("metadata", "generation"),
+			fieldpath.MakePathOrDie("metadata", "managedFields"),
+			fieldpath.MakePathOrDie("metadata", "resourceVersion"),
+		),
+	}
+}
+
+// Update implements Manager.
+func (f *stripMetaManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	newObj, managed, err := f.fieldManager.Update(liveObj, newObj, managed, manager)
+	if err != nil {
+		return nil, nil, err
+	}
+	f.stripFields(managed.Fields(), manager)
+	return newObj, managed, nil
+}
+
+// Apply implements Manager.
+func (f *stripMetaManager) Apply(liveObj runtime.Object, patch []byte, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	newObj, managed, err := f.fieldManager.Apply(liveObj, patch, managed, manager, force)
+	if err != nil {
+		return nil, nil, err
+	}
+	f.stripFields(managed.Fields(), manager)
+	return newObj, managed, nil
+}
+
+// stripFields removes a predefined set of paths found in typed from managed
+func (f *stripMetaManager) stripFields(managed fieldpath.ManagedFields, manager string) {
+	vs, ok := managed[manager]
+	if ok {
+		if vs == nil {
+			panic(fmt.Sprintf("Found unexpected nil manager which should never happen: %s", manager))
+		}
+		newSet := vs.Set().Difference(f.stripSet)
+		if newSet.Empty() {
+			delete(managed, manager)
+		} else {
+			managed[manager] = fieldpath.NewVersionedSet(newSet, vs.APIVersion(), vs.Applied())
+		}
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/structuredmerge.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/structuredmerge.go
@ -0,0 +1,209 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fieldmanager
+
+import (
+	"fmt"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal"
+	"k8s.io/klog"
+	openapiproto "k8s.io/kube-openapi/pkg/util/proto"
+	"sigs.k8s.io/structured-merge-diff/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/merge"
+	"sigs.k8s.io/yaml"
+)
+
+type structuredMergeManager struct {
+	typeConverter   internal.TypeConverter
+	objectConverter runtime.ObjectConvertor
+	objectDefaulter runtime.ObjectDefaulter
+	groupVersion    schema.GroupVersion
+	hubVersion      schema.GroupVersion
+	updater         merge.Updater
+}
+
+var _ Manager = &structuredMergeManager{}
+
+// NewStructuredMergeManager creates a new Manager that merges apply requests
+// and update managed fields for other types of requests.
+func NewStructuredMergeManager(models openapiproto.Models, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion) (Manager, error) {
+	typeConverter, err := internal.NewTypeConverter(models, false)
+	if err != nil {
+		return nil, err
+	}
+
+	return &structuredMergeManager{
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		objectDefaulter: objectDefaulter,
+		groupVersion:    gv,
+		hubVersion:      hub,
+		updater: merge.Updater{
+			Converter: internal.NewVersionConverter(typeConverter, objectConverter, hub),
+		},
+	}, nil
+}
+
+// NewCRDStructuredMergeManager creates a new Manager specifically for
+// CRDs. This allows for the possibility of fields which are not defined
+// in models, as well as having no models defined at all.
+func NewCRDStructuredMergeManager(models openapiproto.Models, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion, preserveUnknownFields bool) (_ Manager, err error) {
+	var typeConverter internal.TypeConverter = internal.DeducedTypeConverter{}
+	if models != nil {
+		typeConverter, err = internal.NewTypeConverter(models, preserveUnknownFields)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &structuredMergeManager{
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		objectDefaulter: objectDefaulter,
+		groupVersion:    gv,
+		hubVersion:      hub,
+		updater: merge.Updater{
+			Converter: internal.NewCRDVersionConverter(typeConverter, objectConverter, hub),
+		},
+	}, nil
+}
+
+// Update implements Manager.
+func (f *structuredMergeManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	newObjVersioned, err := f.toVersioned(newObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object to proper version: %v", err)
+	}
+	liveObjVersioned, err := f.toVersioned(liveObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object to proper version: %v", err)
+	}
+	newObjTyped, err := f.typeConverter.ObjectToTyped(newObjVersioned)
+	if err != nil {
+		// Return newObj and just by-pass fields update. This really shouldn't happen.
+		klog.Errorf("[SHOULD NOT HAPPEN] failed to create typed new object: %v", err)
+		return newObj, managed, nil
+	}
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned)
+	if err != nil {
+		// Return newObj and just by-pass fields update. This really shouldn't happen.
+		klog.Errorf("[SHOULD NOT HAPPEN] failed to create typed live object: %v", err)
+		return newObj, managed, nil
+	}
+	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
+
+	// TODO(apelisse) use the first return value when unions are implemented
+	self := "current-operation"
+	_, managedFields, err := f.updater.Update(liveObjTyped, newObjTyped, apiVersion, managed.Fields(), self)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to update ManagedFields: %v", err)
+	}
+	managed = internal.NewManaged(managedFields, managed.Times())
+
+	// If the current operation took any fields from anything, it means the object changed,
+	// so update the timestamp of the managedFieldsEntry and merge with any previous updates from the same manager
+	if vs, ok := managed.Fields()[self]; ok {
+		delete(managed.Fields(), self)
+
+		managed.Times()[manager] = &metav1.Time{Time: time.Now().UTC()}
+		if previous, ok := managed.Fields()[manager]; ok {
+			managed.Fields()[manager] = fieldpath.NewVersionedSet(vs.Set().Union(previous.Set()), vs.APIVersion(), vs.Applied())
+		} else {
+			managed.Fields()[manager] = vs
+		}
+	}
+
+	return newObj, managed, nil
+}
+
+// Apply implements Manager.
+func (f *structuredMergeManager) Apply(liveObj runtime.Object, patch []byte, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	patchObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(patch, &patchObj.Object); err != nil {
+		return nil, nil, errors.NewBadRequest(fmt.Sprintf("error decoding YAML: %v", err))
+	}
+
+	// Check that the patch object has the same version as the live object
+	if patchObj.GetAPIVersion() != f.groupVersion.String() {
+		return nil, nil,
+			errors.NewBadRequest(
+				fmt.Sprintf("Incorrect version specified in apply patch. "+
+					"Specified patch version: %s, expected: %s",
+					patchObj.GetAPIVersion(), f.groupVersion.String()))
+	}
+
+	if patchObj.GetManagedFields() != nil {
+		return nil, nil, errors.NewBadRequest(fmt.Sprintf("metadata.managedFields must be nil"))
+	}
+
+	liveObjVersioned, err := f.toVersioned(liveObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object to proper version: %v", err)
+	}
+
+	patchObjTyped, err := f.typeConverter.ObjectToTyped(patchObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create typed patch object: %v", err)
+	}
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create typed live object: %v", err)
+	}
+
+	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
+	newObjTyped, managedFields, err := f.updater.Apply(liveObjTyped, patchObjTyped, apiVersion, managed.Fields(), manager, force)
+	if err != nil {
+		if conflicts, ok := err.(merge.Conflicts); ok {
+			return nil, nil, internal.NewConflictError(conflicts)
+		}
+		return nil, nil, err
+	}
+	managed = internal.NewManaged(managedFields, managed.Times())
+
+	// Update the time in the managedFieldsEntry for this operation
+	managed.Times()[manager] = &metav1.Time{Time: time.Now().UTC()}
+
+	newObj, err := f.typeConverter.TypedToObject(newObjTyped)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new typed object to object: %v", err)
+	}
+
+	newObjVersioned, err := f.toVersioned(newObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object to proper version: %v", err)
+	}
+	f.objectDefaulter.Default(newObjVersioned)
+
+	newObjUnversioned, err := f.toUnversioned(newObjVersioned)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert to unversioned: %v", err)
+	}
+	return newObjUnversioned, managed, nil
+}
+
+func (f *structuredMergeManager) toVersioned(obj runtime.Object) (runtime.Object, error) {
+	return f.objectConverter.ConvertToVersion(obj, f.groupVersion)
+}
+
+func (f *structuredMergeManager) toUnversioned(obj runtime.Object) (runtime.Object, error) {
+	return f.objectConverter.ConvertToVersion(obj, f.hubVersion)
+}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/get.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/get.go
@ -30,6 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
@ -48,7 +49,7 @@ type getterFunc func(ctx context.Context, name string, req *http.Request, trace
 // passed-in getterFunc to perform the actual get.
 func getResourceHandler(scope *RequestScope, getter getterFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
-		trace := utiltrace.New("Get " + req.URL.Path)
+		trace := utiltrace.New("Get", utiltrace.Field{Key: "url", Value: req.URL.Path}, utiltrace.Field{Key: "user-agent", Value: &lazyTruncatedUserAgent{req}}, utiltrace.Field{Key: "client", Value: &lazyClientIP{req}})
 		defer trace.LogIfLong(500 * time.Millisecond)

 		namespace, name, err := scope.Namer.Name(req)
@ -85,7 +86,7 @@ func GetResource(r rest.Getter, e rest.Exporter, scope *RequestScope) http.Handl
 			options := metav1.GetOptions{}
 			if values := req.URL.Query(); len(values) > 0 {
 				exports := metav1.ExportOptions{}
-				if err := metainternalversion.ParameterCodec.DecodeParameters(values, scope.MetaGroupVersion, &exports); err != nil {
+				if err := metainternalversionscheme.ParameterCodec.DecodeParameters(values, scope.MetaGroupVersion, &exports); err != nil {
 					err = errors.NewBadRequest(err.Error())
 					return nil, err
 				}
@ -95,7 +96,7 @@ func GetResource(r rest.Getter, e rest.Exporter, scope *RequestScope) http.Handl
 					}
 					return e.Export(ctx, name, exports)
 				}
-				if err := metainternalversion.ParameterCodec.DecodeParameters(values, scope.MetaGroupVersion, &options); err != nil {
+				if err := metainternalversionscheme.ParameterCodec.DecodeParameters(values, scope.MetaGroupVersion, &options); err != nil {
 					err = errors.NewBadRequest(err.Error())
 					return nil, err
 				}
@ -165,7 +166,7 @@ func getRequestOptions(req *http.Request, scope *RequestScope, into runtime.Obje
 func ListResource(r rest.Lister, rw rest.Watcher, scope *RequestScope, forceWatch bool, minRequestTimeout time.Duration) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		// For performance tracking purposes.
-		trace := utiltrace.New("List " + req.URL.Path)
+		trace := utiltrace.New("List", utiltrace.Field{Key: "url", Value: req.URL.Path}, utiltrace.Field{Key: "user-agent", Value: &lazyTruncatedUserAgent{req}}, utiltrace.Field{Key: "client", Value: &lazyClientIP{req}})

 		namespace, err := scope.Namer.Namespace(req)
 		if err != nil {
@ -191,7 +192,7 @@ func ListResource(r rest.Lister, rw rest.Watcher, scope *RequestScope, forceWatc
 		}

 		opts := metainternalversion.ListOptions{}
-		if err := metainternalversion.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, &opts); err != nil {
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, &opts); err != nil {
 			err = errors.NewBadRequest(err.Error())
 			scope.err(err, w, req)
 			return
@ -273,6 +274,6 @@ func ListResource(r rest.Lister, rw rest.Watcher, scope *RequestScope, forceWatc
 		trace.Step("Listing from storage done")

 		transformResponseObject(ctx, scope, trace, req, w, http.StatusOK, outputMediaType, result)
-		trace.Step(fmt.Sprintf("Writing http response done (%d items)", meta.LenList(result)))
+		trace.Step("Writing http response done", utiltrace.Field{"count", meta.LenList(result)})
 	}
 }
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/helpers.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/helpers.go
@ -0,0 +1,60 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package handlers
+
+import (
+	"net/http"
+
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+)
+
+const (
+	maxUserAgentLength      = 1024
+	userAgentTruncateSuffix = "...TRUNCATED"
+)
+
+// lazyTruncatedUserAgent implements String() string and it will
+// return user-agent which may be truncated.
+type lazyTruncatedUserAgent struct {
+	req *http.Request
+}
+
+func (lazy *lazyTruncatedUserAgent) String() string {
+	ua := "unknown"
+	if lazy.req != nil {
+		ua = utilnet.GetHTTPClient(lazy.req)
+		if len(ua) > maxUserAgentLength {
+			ua = ua[:maxUserAgentLength] + userAgentTruncateSuffix
+		}
+	}
+	return ua
+}
+
+// LazyClientIP implements String() string and it will
+// calls GetClientIP() lazily only when required.
+type lazyClientIP struct {
+	req *http.Request
+}
+
+func (lazy *lazyClientIP) String() string {
+	if lazy.req != nil {
+		if ip := utilnet.GetClientIP(lazy.req); ip != nil {
+			return ip.String()
+		}
+	}
+	return "unknown"
+}
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/negotiation/negotiate.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/negotiation/negotiate.go
@ -234,13 +234,6 @@ func acceptMediaTypeOptions(params map[string]string, accepts *runtime.Serialize
 	return options, true
 }

-type candidateMediaType struct {
-	accepted *runtime.SerializerInfo
-	clauses  goautoneg.Accept
-}
-
-type candidateMediaTypeSlice []candidateMediaType
-
 // NegotiateMediaTypeOptions returns the most appropriate content type given the accept header and
 // a list of alternatives along with the accepted media type parameters.
 func NegotiateMediaTypeOptions(header string, accepted []runtime.SerializerInfo, endpoint EndpointRestrictions) (MediaTypeOptions, bool) {
@ -250,25 +243,21 @@ func NegotiateMediaTypeOptions(header string, accepted []runtime.SerializerInfo,
 		}, true
 	}

-	var candidates candidateMediaTypeSlice
 	clauses := goautoneg.ParseAccept(header)
-	for _, clause := range clauses {
+	for i := range clauses {
+		clause := &clauses[i]
 		for i := range accepted {
 			accepts := &accepted[i]
 			switch {
 			case clause.Type == accepts.MediaTypeType && clause.SubType == accepts.MediaTypeSubType,
 				clause.Type == accepts.MediaTypeType && clause.SubType == "*",
 				clause.Type == "*" && clause.SubType == "*":
-				candidates = append(candidates, candidateMediaType{accepted: accepts, clauses: clause})
+				if retVal, ret := acceptMediaTypeOptions(clause.Params, accepts, endpoint); ret {
+					return retVal, true
+				}
 			}
 		}
 	}

-	for _, v := range candidates {
-		if retVal, ret := acceptMediaTypeOptions(v.clauses.Params, v.accepted, endpoint); ret {
-			return retVal, true
-		}
-	}
-
 	return MediaTypeOptions{}, false
 }
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/patch.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/patch.go
@ -26,7 +26,7 @@ import (
 	jsonpatch "github.com/evanphx/json-patch"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
-	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/runtime"
@ -36,6 +36,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/mergepatch"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/audit"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
@ -58,7 +59,7 @@ const (
 func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interface, patchTypes []string) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		// For performance tracking purposes.
-		trace := utiltrace.New("Patch " + req.URL.Path)
+		trace := utiltrace.New("Patch", utiltrace.Field{Key: "url", Value: req.URL.Path}, utiltrace.Field{Key: "user-agent", Value: &lazyTruncatedUserAgent{req}}, utiltrace.Field{Key: "client", Value: &lazyClientIP{req}})
 		defer trace.LogIfLong(500 * time.Millisecond)

 		if isDryRun(req.URL) && !utilfeature.DefaultFeatureGate.Enabled(features.DryRun) {
@ -92,7 +93,8 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac
 			return
 		}

-		ctx := req.Context()
+		ctx, cancel := context.WithTimeout(req.Context(), timeout)
+		defer cancel()
 		ctx = request.WithNamespace(ctx, namespace)

 		outputMediaType, _, err := negotiation.NegotiateOutputMediaType(req, scope.Serializer, scope)
@ -108,7 +110,7 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac
 		}

 		options := &metav1.PatchOptions{}
-		if err := metainternalversion.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
 			err = errors.NewBadRequest(err.Error())
 			scope.err(err, w, req)
 			return
@ -223,12 +225,7 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac
 		}
 		trace.Step("Object stored in database")

-		requestInfo, ok := request.RequestInfoFrom(ctx)
-		if !ok {
-			scope.err(fmt.Errorf("missing requestInfo"), w, req)
-			return
-		}
-		if err := setSelfLink(result, requestInfo, scope.Namer); err != nil {
+		if err := setObjectSelfLink(ctx, result, req, scope.Namer); err != nil {
 			scope.err(err, w, req)
 			return
 		}
@ -242,7 +239,7 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac
 	}
 }

-type mutateObjectUpdateFunc func(obj, old runtime.Object) error
+type mutateObjectUpdateFunc func(ctx context.Context, obj, old runtime.Object) error

 // patcher breaks the process of patch application and retries into smaller
 // pieces of functionality.
@ -318,7 +315,9 @@ func (p *jsonPatcher) applyPatchToCurrentObject(currentObject runtime.Object) (r
 	// Construct the resulting typed, unversioned object.
 	objToUpdate := p.restPatcher.New()
 	if err := runtime.DecodeInto(p.codec, patchedObjJS, objToUpdate); err != nil {
-		return nil, err
+		return nil, errors.NewInvalid(schema.GroupKind{}, "", field.ErrorList{
+			field.Invalid(field.NewPath("patch"), string(patchedObjJS), err.Error()),
+		})
 	}

 	if p.fieldManager != nil {
@ -342,7 +341,7 @@ func (p *jsonPatcher) applyJSPatch(versionedJS []byte) (patchedJS []byte, retErr
 		// TODO(liggitt): drop this once golang json parser limits stack depth (https://github.com/golang/go/issues/31789)
 		if len(p.patchBytes) > 1024*1024 {
 			v := []interface{}{}
-			if err := json.Unmarshal(p.patchBytes, v); err != nil {
+			if err := json.Unmarshal(p.patchBytes, &v); err != nil {
 				return nil, errors.NewBadRequest(fmt.Sprintf("error decoding patch: %v", err))
 			}
 		}
@ -366,7 +365,7 @@ func (p *jsonPatcher) applyJSPatch(versionedJS []byte) (patchedJS []byte, retErr
 		// TODO(liggitt): drop this once golang json parser limits stack depth (https://github.com/golang/go/issues/31789)
 		if len(p.patchBytes) > 1024*1024 {
 			v := map[string]interface{}{}
-			if err := json.Unmarshal(p.patchBytes, v); err != nil {
+			if err := json.Unmarshal(p.patchBytes, &v); err != nil {
 				return nil, errors.NewBadRequest(fmt.Sprintf("error decoding patch: %v", err))
 			}
 		}
@ -440,7 +439,7 @@ func (p *applyPatcher) applyPatchToCurrentObject(obj runtime.Object) (runtime.Ob
 func (p *applyPatcher) createNewObject() (runtime.Object, error) {
 	obj, err := p.creater.New(p.kind)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create new object: %v", obj)
+		return nil, fmt.Errorf("failed to create new object: %v", err)
 	}
 	return p.applyPatchToCurrentObject(obj)
 }
@ -534,7 +533,7 @@ func (p *patcher) applyAdmission(ctx context.Context, patchedObject runtime.Obje
 	}
 	if p.admissionCheck != nil && p.admissionCheck.Handles(operation) {
 		attributes := p.admissionAttributes(ctx, patchedObject, currentObject, operation, options)
-		return patchedObject, p.admissionCheck.Admit(attributes, p.objectInterfaces)
+		return patchedObject, p.admissionCheck.Admit(ctx, attributes, p.objectInterfaces)
 	}
 	return patchedObject, nil
 }
@ -601,7 +600,9 @@ func applyPatchToObject(

 	// Rather than serialize the patched map to JSON, then decode it to an object, we go directly from a map to an object
 	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(patchedObjMap, objToUpdate); err != nil {
-		return err
+		return errors.NewInvalid(schema.GroupKind{}, "", field.ErrorList{
+			field.Invalid(field.NewPath("patch"), fmt.Sprintf("%+v", patchMap), err.Error()),
+		})
 	}
 	// Decoding from JSON to a versioned object would apply defaults, so we do the same here
 	defaulter.Default(objToUpdate)
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/response.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/response.go
@ -23,7 +23,7 @@ import (

 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
-	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation"
@ -38,6 +38,24 @@ import (
 // the client's desired form, as well as ensuring any API level fields like self-link
 // are properly set.
 func transformObject(ctx context.Context, obj runtime.Object, opts interface{}, mediaType negotiation.MediaTypeOptions, scope *RequestScope, req *http.Request) (runtime.Object, error) {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		if mediaType.Convert != nil {
+			// Non-nil mediaType.Convert means that some conversion of the object
+			// has to happen. Currently conversion may potentially modify the
+			// object or assume something about it (e.g. asTable operates on
+			// reflection, which won't work for any wrapper).
+			// To ensure it will work correctly, let's operate on base objects
+			// and not cache it for now.
+			//
+			// TODO: Long-term, transformObject should be changed so that it
+			// implements runtime.Encoder interface.
+			return doTransformObject(ctx, co.GetObject(), opts, mediaType, scope, req)
+		}
+	}
+	return doTransformObject(ctx, obj, opts, mediaType, scope, req)
+}
+
+func doTransformObject(ctx context.Context, obj runtime.Object, opts interface{}, mediaType negotiation.MediaTypeOptions, scope *RequestScope, req *http.Request) (runtime.Object, error) {
 	if _, ok := obj.(*metav1.Status); ok {
 		return obj, nil
 	}
@ -63,7 +81,7 @@ func transformObject(ctx context.Context, obj runtime.Object, opts interface{},
 		return asTable(ctx, obj, options, scope, target.GroupVersion())

 	default:
-		accepted, _ := negotiation.MediaTypesForSerializer(metainternalversion.Codecs)
+		accepted, _ := negotiation.MediaTypesForSerializer(metainternalversionscheme.Codecs)
 		err := negotiation.NewNotAcceptableError(accepted)
 		return nil, err
 	}
@ -76,7 +94,7 @@ func optionsForTransform(mediaType negotiation.MediaTypeOptions, req *http.Reque
 	case target == nil:
 	case target.Kind == "Table" && (target.GroupVersion() == metav1beta1.SchemeGroupVersion || target.GroupVersion() == metav1.SchemeGroupVersion):
 		opts := &metav1beta1.TableOptions{}
-		if err := metav1beta1.ParameterCodec.DecodeParameters(req.URL.Query(), metav1beta1.SchemeGroupVersion, opts); err != nil {
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), metav1beta1.SchemeGroupVersion, opts); err != nil {
 			return nil, err
 		}
 		switch errs := validation.ValidateTableOptions(opts); len(errs) {
@ -97,7 +115,7 @@ func targetEncodingForTransform(scope *RequestScope, mediaType negotiation.Media
 	case target == nil:
 	case (target.Kind == "PartialObjectMetadata" || target.Kind == "PartialObjectMetadataList" || target.Kind == "Table") &&
 		(target.GroupVersion() == metav1beta1.SchemeGroupVersion || target.GroupVersion() == metav1.SchemeGroupVersion):
-		return *target, metainternalversion.Codecs, true
+		return *target, metainternalversionscheme.Codecs, true
 	}
 	return scope.Kind, scope.Serializer, false
 }
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/writers.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/writers.go
@ -17,11 +17,17 @@ limitations under the License.
 package responsewriters

 import (
+	"compress/gzip"
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
 	"strconv"
+	"strings"
+	"sync"
+
+	"k8s.io/apiserver/pkg/features"

 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@ -31,30 +37,11 @@ import (
 	"k8s.io/apiserver/pkg/endpoints/metrics"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/apiserver/pkg/util/flushwriter"
 	"k8s.io/apiserver/pkg/util/wsstream"
 )

-// httpResponseWriterWithInit wraps http.ResponseWriter, and implements the io.Writer interface to be used
-// with encoding. The purpose is to allow for encoding to a stream, while accommodating a custom HTTP status code
-// if encoding fails, and meeting the encoder's io.Writer interface requirement.
-type httpResponseWriterWithInit struct {
-	hasWritten bool
-	mediaType  string
-	statusCode int
-	innerW     http.ResponseWriter
-}
-
-func (w httpResponseWriterWithInit) Write(b []byte) (n int, err error) {
-	if !w.hasWritten {
-		w.innerW.Header().Set("Content-Type", w.mediaType)
-		w.innerW.WriteHeader(w.statusCode)
-		w.hasWritten = true
-	}
-
-	return w.innerW.Write(b)
-}
-
 // StreamObject performs input stream negotiation from a ResourceStreamer and writes that to the response.
 // If the client requests a websocket upgrade, negotiate for a websocket reader protocol (because many
 // browser clients cannot easily handle binary streaming protocols).
@ -96,15 +83,142 @@ func StreamObject(statusCode int, gv schema.GroupVersion, s runtime.NegotiatedSe
 }

 // SerializeObject renders an object in the content type negotiated by the client using the provided encoder.
-// The context is optional and can be nil.
-func SerializeObject(mediaType string, encoder runtime.Encoder, innerW http.ResponseWriter, req *http.Request, statusCode int, object runtime.Object) {
-	w := httpResponseWriterWithInit{mediaType: mediaType, innerW: innerW, statusCode: statusCode}
-
-	if err := encoder.Encode(object, w); err != nil {
-		errSerializationFatal(err, encoder, w)
+// The context is optional and can be nil. This method will perform optional content compression if requested by
+// a client and the feature gate for APIResponseCompression is enabled.
+func SerializeObject(mediaType string, encoder runtime.Encoder, hw http.ResponseWriter, req *http.Request, statusCode int, object runtime.Object) {
+	w := &deferredResponseWriter{
+		mediaType:       mediaType,
+		statusCode:      statusCode,
+		contentEncoding: negotiateContentEncoding(req),
+		hw:              hw,
 	}
+
+	err := encoder.Encode(object, w)
+	if err == nil {
+		err = w.Close()
+		if err == nil {
+			return
+		}
+	}
+
+	// make a best effort to write the object if a failure is detected
+	utilruntime.HandleError(fmt.Errorf("apiserver was unable to write a JSON response: %v", err))
+	status := ErrorToAPIStatus(err)
+	candidateStatusCode := int(status.Code)
+	// if the current status code is successful, allow the error's status code to overwrite it
+	if statusCode >= http.StatusOK && statusCode < http.StatusBadRequest {
+		w.statusCode = candidateStatusCode
+	}
+	output, err := runtime.Encode(encoder, status)
+	if err != nil {
+		w.mediaType = "text/plain"
+		output = []byte(fmt.Sprintf("%s: %s", status.Reason, status.Message))
+	}
+	if _, err := w.Write(output); err != nil {
+		utilruntime.HandleError(fmt.Errorf("apiserver was unable to write a fallback JSON response: %v", err))
+	}
+	w.Close()
 }

+var gzipPool = &sync.Pool{
+	New: func() interface{} {
+		gw, err := gzip.NewWriterLevel(nil, defaultGzipContentEncodingLevel)
+		if err != nil {
+			panic(err)
+		}
+		return gw
+	},
+}
+
+const (
+	// defaultGzipContentEncodingLevel is set to 4 which uses less CPU than the default level
+	defaultGzipContentEncodingLevel = 4
+	// defaultGzipThresholdBytes is compared to the size of the first write from the stream
+	// (usually the entire object), and if the size is smaller no gzipping will be performed
+	// if the client requests it.
+	defaultGzipThresholdBytes = 128 * 1024
+)
+
+// negotiateContentEncoding returns a supported client-requested content encoding for the
+// provided request. It will return the empty string if no supported content encoding was
+// found or if response compression is disabled.
+func negotiateContentEncoding(req *http.Request) string {
+	encoding := req.Header.Get("Accept-Encoding")
+	if len(encoding) == 0 {
+		return ""
+	}
+	if !utilfeature.DefaultFeatureGate.Enabled(features.APIResponseCompression) {
+		return ""
+	}
+	for len(encoding) > 0 {
+		var token string
+		if next := strings.Index(encoding, ","); next != -1 {
+			token = encoding[:next]
+			encoding = encoding[next+1:]
+		} else {
+			token = encoding
+			encoding = ""
+		}
+		switch strings.TrimSpace(token) {
+		case "gzip":
+			return "gzip"
+		}
+	}
+	return ""
+}
+
+type deferredResponseWriter struct {
+	mediaType       string
+	statusCode      int
+	contentEncoding string
+
+	hasWritten bool
+	hw         http.ResponseWriter
+	w          io.Writer
+}
+
+func (w *deferredResponseWriter) Write(p []byte) (n int, err error) {
+	if w.hasWritten {
+		return w.w.Write(p)
+	}
+	w.hasWritten = true
+
+	hw := w.hw
+	header := hw.Header()
+	switch {
+	case w.contentEncoding == "gzip" && len(p) > defaultGzipThresholdBytes:
+		header.Set("Content-Encoding", "gzip")
+		header.Add("Vary", "Accept-Encoding")
+
+		gw := gzipPool.Get().(*gzip.Writer)
+		gw.Reset(hw)
+
+		w.w = gw
+	default:
+		w.w = hw
+	}
+
+	header.Set("Content-Type", w.mediaType)
+	hw.WriteHeader(w.statusCode)
+	return w.w.Write(p)
+}
+
+func (w *deferredResponseWriter) Close() error {
+	if !w.hasWritten {
+		return nil
+	}
+	var err error
+	switch t := w.w.(type) {
+	case *gzip.Writer:
+		err = t.Close()
+		t.Reset(nil)
+		gzipPool.Put(t)
+	}
+	return err
+}
+
+var nopCloser = ioutil.NopCloser(nil)
+
 // WriteObjectNegotiated renders an object in the content type negotiated by the client.
 func WriteObjectNegotiated(s runtime.NegotiatedSerializer, restrictions negotiation.EndpointRestrictions, gv schema.GroupVersion, w http.ResponseWriter, req *http.Request, statusCode int, object runtime.Object) {
 	stream, ok := object.(rest.ResourceStreamer)
@ -157,25 +271,6 @@ func ErrorNegotiated(err error, s runtime.NegotiatedSerializer, gv schema.GroupV
 	return code
 }

-// errSerializationFatal renders an error to the response, and if codec fails will render plaintext.
-// Returns the HTTP status code of the error.
-func errSerializationFatal(err error, codec runtime.Encoder, w httpResponseWriterWithInit) {
-	utilruntime.HandleError(fmt.Errorf("apiserver was unable to write a JSON response: %v", err))
-	status := ErrorToAPIStatus(err)
-	candidateStatusCode := int(status.Code)
-	// If original statusCode was not successful, we need to return the original error.
-	// We cannot hide it behind serialization problems
-	if w.statusCode >= http.StatusOK && w.statusCode < http.StatusBadRequest {
-		w.statusCode = candidateStatusCode
-	}
-	output, err := runtime.Encode(codec, status)
-	if err != nil {
-		w.mediaType = "text/plain"
-		output = []byte(fmt.Sprintf("%s: %s", status.Reason, status.Message))
-	}
-	w.Write(output)
-}
-
 // WriteRawJSON writes a non-API object in JSON.
 func WriteRawJSON(statusCode int, object interface{}, w http.ResponseWriter) {
 	output, err := json.MarshalIndent(object, "", "  ")
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/rest.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/rest.go
@ -39,7 +39,9 @@ import (
 	"k8s.io/apiserver/pkg/endpoints/handlers/responsewriters"
 	"k8s.io/apiserver/pkg/endpoints/metrics"
 	"k8s.io/apiserver/pkg/endpoints/request"
+	"k8s.io/apiserver/pkg/features"
 	"k8s.io/apiserver/pkg/registry/rest"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/klog"
 )

@ -161,14 +163,14 @@ func ConnectResource(connecter rest.Connecter, scope *RequestScope, admit admiss
 			userInfo, _ := request.UserFrom(ctx)
 			// TODO: remove the mutating admission here as soon as we have ported all plugin that handle CONNECT
 			if mutatingAdmission, ok := admit.(admission.MutationInterface); ok {
-				err = mutatingAdmission.Admit(admission.NewAttributesRecord(opts, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Connect, nil, false, userInfo), scope)
+				err = mutatingAdmission.Admit(ctx, admission.NewAttributesRecord(opts, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Connect, nil, false, userInfo), scope)
 				if err != nil {
 					scope.err(err, w, req)
 					return
 				}
 			}
 			if validatingAdmission, ok := admit.(admission.ValidationInterface); ok {
-				err = validatingAdmission.Validate(admission.NewAttributesRecord(opts, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Connect, nil, false, userInfo), scope)
+				err = validatingAdmission.Validate(ctx, admission.NewAttributesRecord(opts, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Connect, nil, false, userInfo), scope)
 				if err != nil {
 					scope.err(err, w, req)
 					return
@ -218,12 +220,15 @@ func finishRequest(timeout time.Duration, fn resultFunc) (result runtime.Object,
 		defer func() {
 			panicReason := recover()
 			if panicReason != nil {
-				// Same as stdlib http server code. Manually allocate stack
-				// trace buffer size to prevent excessively large logs
-				const size = 64 << 10
-				buf := make([]byte, size)
-				buf = buf[:goruntime.Stack(buf, false)]
-				panicReason = fmt.Sprintf("%v\n%s", panicReason, buf)
+				// do not wrap the sentinel ErrAbortHandler panic value
+				if panicReason != http.ErrAbortHandler {
+					// Same as stdlib http server code. Manually allocate stack
+					// trace buffer size to prevent excessively large logs
+					const size = 64 << 10
+					buf := make([]byte, size)
+					buf = buf[:goruntime.Stack(buf, false)]
+					panicReason = fmt.Sprintf("%v\n%s", panicReason, buf)
+				}
 				// Propagate to parent goroutine
 				panicCh <- panicReason
 			}
@ -318,6 +323,10 @@ func checkName(obj runtime.Object, name, namespace string, namer ScopeNamer) err
 // TODO: remove the need for the namer LinkSetters by requiring objects implement either Object or List
 //   interfaces
 func setObjectSelfLink(ctx context.Context, obj runtime.Object, req *http.Request, namer ScopeNamer) error {
+	if utilfeature.DefaultFeatureGate.Enabled(features.RemoveSelfLink) {
+		return nil
+	}
+
 	// We only generate list links on objects that implement ListInterface - historically we duck typed this
 	// check via reflection, but as we move away from reflection we require that you not only carry Items but
 	// ListMeta into order to be identified as a list.
@ -400,7 +409,8 @@ func parseTimeout(str string) time.Duration {
 		}
 		klog.Errorf("Failed to parse %q: %v", str, err)
 	}
-	return 30 * time.Second
+	// 34 chose as a number close to 30 that is likely to be unique enough to jump out at me the next time I see a timeout.  Everyone chooses 30.
+	return 34 * time.Second
 }

 func isDryRun(url *url.URL) bool {
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/update.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/update.go
@ -24,7 +24,7 @@ import (
 	"time"

 	"k8s.io/apimachinery/pkg/api/errors"
-	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metainternalversionscheme "k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/runtime"
@ -45,7 +45,7 @@ import (
 func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interface) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		// For performance tracking purposes.
-		trace := utiltrace.New("Update " + req.URL.Path)
+		trace := utiltrace.New("Update", utiltrace.Field{Key: "url", Value: req.URL.Path}, utiltrace.Field{Key: "user-agent", Value: &lazyTruncatedUserAgent{req}}, utiltrace.Field{Key: "client", Value: &lazyClientIP{req}})
 		defer trace.LogIfLong(500 * time.Millisecond)

 		if isDryRun(req.URL) && !utilfeature.DefaultFeatureGate.Enabled(features.DryRun) {
@ -61,7 +61,8 @@ func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interfa
 			scope.err(err, w, req)
 			return
 		}
-		ctx := req.Context()
+		ctx, cancel := context.WithTimeout(req.Context(), timeout)
+		defer cancel()
 		ctx = request.WithNamespace(ctx, namespace)

 		outputMediaType, _, err := negotiation.NegotiateOutputMediaType(req, scope.Serializer, scope)
@ -77,7 +78,7 @@ func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interfa
 		}

 		options := &metav1.UpdateOptions{}
-		if err := metainternalversion.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
+		if err := metainternalversionscheme.ParameterCodec.DecodeParameters(req.URL.Query(), scope.MetaGroupVersion, options); err != nil {
 			err = errors.NewBadRequest(err.Error())
 			scope.err(err, w, req)
 			return
@ -139,11 +140,11 @@ func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interfa
 					return nil, fmt.Errorf("unexpected error when extracting UID from oldObj: %v", err.Error())
 				} else if !isNotZeroObject {
 					if mutatingAdmission.Handles(admission.Create) {
-						return newObj, mutatingAdmission.Admit(admission.NewAttributesRecord(newObj, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Create, updateToCreateOptions(options), dryrun.IsDryRun(options.DryRun), userInfo), scope)
+						return newObj, mutatingAdmission.Admit(ctx, admission.NewAttributesRecord(newObj, nil, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Create, updateToCreateOptions(options), dryrun.IsDryRun(options.DryRun), userInfo), scope)
 					}
 				} else {
 					if mutatingAdmission.Handles(admission.Update) {
-						return newObj, mutatingAdmission.Admit(admission.NewAttributesRecord(newObj, oldObj, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Update, options, dryrun.IsDryRun(options.DryRun), userInfo), scope)
+						return newObj, mutatingAdmission.Admit(ctx, admission.NewAttributesRecord(newObj, oldObj, scope.Kind, namespace, name, scope.Resource, scope.Subresource, admission.Update, options, dryrun.IsDryRun(options.DryRun), userInfo), scope)
 					}
 				}
 				return newObj, nil
@ -204,17 +205,17 @@ func withAuthorization(validate rest.ValidateObjectFunc, a authorizer.Authorizer
 	var authorizerDecision authorizer.Decision
 	var authorizerReason string
 	var authorizerErr error
-	return func(obj runtime.Object) error {
+	return func(ctx context.Context, obj runtime.Object) error {
 		if a == nil {
 			return errors.NewInternalError(fmt.Errorf("no authorizer provided, unable to authorize a create on update"))
 		}
 		once.Do(func() {
-			authorizerDecision, authorizerReason, authorizerErr = a.Authorize(attributes)
+			authorizerDecision, authorizerReason, authorizerErr = a.Authorize(ctx, attributes)
 		})
 		// an authorizer like RBAC could encounter evaluation errors and still allow the request, so authorizer decision is checked before error here.
 		if authorizerDecision == authorizer.DecisionAllow {
 			// Continue to validating admission
-			return validate(obj)
+			return validate(ctx, obj)
 		}
 		if authorizerErr != nil {
 			return errors.NewInternalError(authorizerErr)
--- a/vendor/k8s.io/apiserver/pkg/endpoints/handlers/watch.go
+++ b/vendor/k8s.io/apiserver/pkg/endpoints/handlers/watch.go
@ -165,7 +165,7 @@ func (s *WatchServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	metrics.RegisteredWatchers.WithLabelValues(kind.Group, kind.Version, kind.Kind).Inc()
 	defer metrics.RegisteredWatchers.WithLabelValues(kind.Group, kind.Version, kind.Kind).Dec()

-	w = httplog.Unlogged(w)
+	w = httplog.Unlogged(req, w)

 	if wsstream.IsWebSocketRequest(req) {
 		w.Header().Set("Content-Type", s.MediaType)
@ -225,6 +225,7 @@ func (s *WatchServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 				// End of results.
 				return
 			}
+			metrics.WatchEvents.WithLabelValues(kind.Group, kind.Version, kind.Kind).Inc()

 			obj := s.Fixup(event.Object)
 			if err := s.EmbeddedEncoder.Encode(obj, buf); err != nil {
@ -237,6 +238,7 @@ func (s *WatchServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 			// type
 			unknown.Raw = buf.Bytes()
 			event.Object = &unknown
+			metrics.WatchEventsSizes.WithLabelValues(kind.Group, kind.Version, kind.Kind).Observe(float64(len(unknown.Raw)))

 			*outEvent = metav1.WatchEvent{}

@ -283,10 +285,12 @@ func (s *WatchServer) HandleWS(ws *websocket.Conn) {
 	buf := &bytes.Buffer{}
 	streamBuf := &bytes.Buffer{}
 	ch := s.Watching.ResultChan()
+
+	defer s.Watching.Stop()
+
 	for {
 		select {
 		case <-done:
-			s.Watching.Stop()
 			return
 		case event, ok := <-ch:
 			if !ok {
@ -315,25 +319,21 @@ func (s *WatchServer) HandleWS(ws *websocket.Conn) {
 			if err != nil {
 				utilruntime.HandleError(fmt.Errorf("unable to convert watch object: %v", err))
 				// client disconnect.
-				s.Watching.Stop()
 				return
 			}
 			if err := s.Encoder.Encode(outEvent, streamBuf); err != nil {
 				// encoding error
 				utilruntime.HandleError(fmt.Errorf("unable to encode event: %v", err))
-				s.Watching.Stop()
 				return
 			}
 			if s.UseTextFraming {
 				if err := websocket.Message.Send(ws, streamBuf.String()); err != nil {
 					// Client disconnect.
-					s.Watching.Stop()
 					return
 				}
 			} else {
 				if err := websocket.Message.Send(ws, streamBuf.Bytes()); err != nil {
 					// Client disconnect.
-					s.Watching.Stop()
 					return
 				}
 			}