add iam crd

Signed-off-by: hongming <talonwan@yunify.com>
2020-04-05 03:52:12 +08:00
parent 3c73471f79
commit 0e814bb5e4
879 changed files with 5869 additions and 139213 deletions
--- a/cmd/controller-manager/app/server.go
+++ b/cmd/controller-manager/app/server.go
@@ -151,6 +151,14 @@ func Run(s *options.KubeSphereControllerManagerOptions, stopCh <-chan struct{})
 		// Start cache data after all informer is registered
 		informerFactory.Start(stopCh)

+		// Setup webhooks TODO enable webhook
+		//klog.Info("setting up webhook server")
+		//hookServer := mgr.GetWebhookServer()
+		//
+		//klog.Info("registering webhooks to the webhook server")
+		//hookServer.Register("//mutating-encrypt-password-iam-kubesphere-io-v1alpha2-user", &webhook.Admission{Handler: &user.PasswordCipher{Client: mgr.GetClient()}})
+		//hookServer.Register("/validate-email-iam-kubesphere-io-v1alpha2-user", &webhook.Admission{Handler: &user.EmailValidator{Client: mgr.GetClient()}})
+
 		klog.V(0).Info("Starting the controllers.")
 		if err = mgr.Start(stopCh); err != nil {
 			klog.Fatalf("unable to run the manager: %v", err)
--- a/config/crds/iam.kubesphere.io_policyrules.yaml
+++ b/config/crds/iam.kubesphere.io_policyrules.yaml
@@ -0,0 +1,53 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: (devel)
+  creationTimestamp: null
+  name: policyrules.iam.kubesphere.io
+spec:
+  group: iam.kubesphere.io
+  names:
+    categories:
+    - iam
+    kind: PolicyRule
+    listKind: PolicyRuleList
+    plural: policyrules
+    singular: policyrule
+  scope: Cluster
+  validation:
+    openAPIV3Schema:
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        level:
+          type: string
+        metadata:
+          type: object
+        rego:
+          type: string
+      required:
+      - level
+      - rego
+      type: object
+  version: v1alpha2
+  versions:
+  - name: v1alpha2
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
--- a/config/crds/iam.kubesphere.io_rolebindings.yaml
+++ b/config/crds/iam.kubesphere.io_rolebindings.yaml
@@ -0,0 +1,93 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: (devel)
+  creationTimestamp: null
+  name: rolebindings.iam.kubesphere.io
+spec:
+  group: iam.kubesphere.io
+  names:
+    categories:
+    - iam
+    kind: RoleBinding
+    listKind: RoleBindingList
+    plural: rolebindings
+    singular: rolebinding
+  scope: Cluster
+  validation:
+    openAPIV3Schema:
+      description: RoleBinding is the Schema for the rolebindings API
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        level:
+          type: string
+        metadata:
+          type: object
+        roleRef:
+          description: RoleRef contains information that points to the role being
+            used
+          properties:
+            apiGroup:
+              description: APIGroup is the group for the resource being referenced
+              type: string
+            kind:
+              description: Kind is the type of resource being referenced
+              type: string
+            name:
+              description: Name is the name of resource being referenced
+              type: string
+          required:
+          - apiGroup
+          - kind
+          - name
+          type: object
+        subjects:
+          description: Subjects holds references to the users the role applies to.
+          items:
+            description: or a value for non-objects such as user and group names.
+            properties:
+              apiGroup:
+                description: APIGroup holds the API group of the referenced subject.
+                type: string
+              kind:
+                description: Kind of object being referenced. Values defined by this
+                  API group are "User", "Group", and "ServiceAccount". If the Authorizer
+                  does not recognized the kind value, the Authorizer should report
+                  an error.
+                type: string
+              name:
+                description: Name of the object being referenced.
+                type: string
+            required:
+            - apiGroup
+            - kind
+            - name
+            type: object
+          type: array
+      required:
+      - level
+      - roleRef
+      type: object
+  version: v1alpha2
+  versions:
+  - name: v1alpha2
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
--- a/config/crds/iam.kubesphere.io_roles.yaml
+++ b/config/crds/iam.kubesphere.io_roles.yaml
@@ -0,0 +1,81 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: (devel)
+  creationTimestamp: null
+  name: roles.iam.kubesphere.io
+spec:
+  group: iam.kubesphere.io
+  names:
+    categories:
+    - iam
+    kind: Role
+    listKind: RoleList
+    plural: roles
+    singular: role
+  scope: Cluster
+  validation:
+    openAPIV3Schema:
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        rules:
+          items:
+            description: RuleRef contains information that points to the role being
+              used
+            properties:
+              apiGroup:
+                description: APIGroup is the group for the resource being referenced
+                type: string
+              kind:
+                description: Kind is the type of resource being referenced
+                type: string
+              name:
+                description: Name is the name of resource being referenced
+                type: string
+            required:
+            - apiGroup
+            - kind
+            - name
+            type: object
+          type: array
+        scope:
+          properties:
+            level:
+              type: string
+            scopes:
+              items:
+                type: string
+              type: array
+          required:
+          - level
+          - scopes
+          type: object
+      required:
+      - rules
+      - scope
+      type: object
+  version: v1alpha2
+  versions:
+  - name: v1alpha2
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
--- a/config/samples/iam_v1alpha2_policyrule.yaml
+++ b/config/samples/iam_v1alpha2_policyrule.yaml
@@ -0,0 +1,9 @@
+apiVersion: iam.kubesphere.io/v1alpha2
+kind: PolicyRule
+metadata:
+  labels:
+    controller-tools.k8s.io: "1.0"
+  name: policyrule-sample
+spec:
+  # Add fields here
+  foo: bar
--- a/config/samples/iam_v1alpha2_role.yaml
+++ b/config/samples/iam_v1alpha2_role.yaml
@@ -0,0 +1,9 @@
+apiVersion: iam.kubesphere.io/v1alpha2
+kind: Role
+metadata:
+  labels:
+    controller-tools.k8s.io: "1.0"
+  name: role-sample
+spec:
+  # Add fields here
+  foo: bar
--- a/config/samples/iam_v1alpha2_rolebinding.yaml
+++ b/config/samples/iam_v1alpha2_rolebinding.yaml
@@ -0,0 +1,9 @@
+apiVersion: iam.kubesphere.io/v1alpha2
+kind: RoleBinding
+metadata:
+  labels:
+    controller-tools.k8s.io: "1.0"
+  name: rolebinding-sample
+spec:
+  # Add fields here
+  foo: bar
--- a/config/samples/iam_v1alpha2_user.yaml
+++ b/config/samples/iam_v1alpha2_user.yaml
@@ -6,4 +6,4 @@ metadata:
  name: admin
 spec:
  email: admin@kubesphere.io
-  password: d41d8cd98f00b204e9800998ecf8427e
+  password: $2a$04$wr/XmTQ99uQpgi335xPyoOM08h34ZQk265pdqHMv5Yw6Xo2vfiO/6
--- a/config/webhook/iam.yaml
+++ b/config/webhook/iam.yaml
@@ -0,0 +1,55 @@
+
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: kubesphere-iam-validator
+webhooks:
+  - admissionReviewVersions:
+      - v1beta1
+    clientConfig:
+      caBundle: <caBundle>
+      service:
+        name: webhook-service
+        namespace: kubesphere-system
+        path: /validate-email-iam-kubesphere-io-v1alpha2-user
+    failurePolicy: Fail
+    name: vemail.iam.kubesphere.io
+    rules:
+      - apiGroups:
+          - iam.kubesphere.io
+        apiVersions:
+          - v1alpha2
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - users
+
+---
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: kubesphere-iam-injector
+webhooks:
+  - admissionReviewVersions:
+      - v1beta1
+    clientConfig:
+      caBundle: <caBundle>
+      service:
+        name: webhook-service
+        namespace: kubesphere-system
+        path: /mutating-encrypt-password-iam-kubesphere-io-v1alpha2-user
+    failurePolicy: Fail
+    name: mpassword.iam.kubesphere.io
+    reinvocationPolicy: Never
+    rules:
+      - apiGroups:
+          - iam.kubesphere.io
+        apiVersions:
+          - v1alpha2
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - users
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,6 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a
 	github.com/aws/aws-sdk-go v1.22.2
 	github.com/beevik/etree v1.1.0
-	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/docker/distribution v2.7.1+incompatible
 	github.com/docker/docker v1.4.2-0.20190822205725-ed20165a37b4
@@ -54,24 +53,19 @@ require (
 	github.com/json-iterator/go v1.1.8
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
 	github.com/kiali/kiali v0.15.1-0.20191210080139-edbbad1ef779
-	github.com/klauspost/cpuid v1.2.1 // indirect
 	github.com/kubernetes-sigs/application v0.0.0-20191210100950-18cc93526ab4
 	github.com/kubesphere/sonargo v0.0.2
 	github.com/leodido/go-urn v1.1.0 // indirect
 	github.com/lib/pq v1.2.0 // indirect
-	github.com/lucas-clemente/quic-go v0.11.1 // indirect
 	github.com/mailru/easyjson v0.7.0 // indirect
 	github.com/mattn/go-sqlite3 v1.11.0 // indirect
-	github.com/mholt/caddy v1.0.0
-	github.com/mholt/certmagic v0.5.1 // indirect
-	github.com/miekg/dns v1.1.9 // indirect
 	github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c // indirect
 	github.com/onsi/ginkgo v1.8.0
 	github.com/onsi/gomega v1.5.0
 	github.com/open-policy-agent/opa v0.18.0
 	github.com/opencontainers/go-digest v1.0.0-rc1
 	github.com/opencontainers/image-spec v1.0.1 // indirect
-	github.com/openshift/api v3.9.0+incompatible // indirect
+	github.com/openshift/api v0.0.0-20180801171038-322a19404e37 // indirect
 	github.com/pkg/errors v0.8.1
 	github.com/projectcalico/libcalico-go v1.7.2-0.20191104213956-8f81e1e344ce
 	github.com/prometheus/common v0.4.0
@@ -82,23 +76,22 @@ require (
 	github.com/spf13/viper v1.4.0
 	github.com/stretchr/testify v1.4.0
 	github.com/xanzy/ssh-agent v0.2.1 // indirect
-	golang.org/x/net v0.0.0-20191004110552-13f9640d40b9
-	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
+	golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392
+	golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553
 	google.golang.org/grpc v1.23.1
 	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
 	gopkg.in/go-playground/validator.v9 v9.29.1 // indirect
-	gopkg.in/square/go-jose.v2 v2.3.1 // indirect
 	gopkg.in/src-d/go-billy.v4 v4.3.0 // indirect
 	gopkg.in/src-d/go-git.v4 v4.11.0
 	gopkg.in/yaml.v2 v2.2.4
 	istio.io/api v0.0.0-20191111210003-35e06ef8d838
 	istio.io/client-go v0.0.0-20191113122552-9bd0ba57c3d2
-	k8s.io/api v0.0.0-20191114100352-16d7abae0d2a
+	k8s.io/api v0.18.0
 	k8s.io/apiextensions-apiserver v0.0.0-20191114105449-027877536833
-	k8s.io/apimachinery v0.0.0-20191028221656-72ed19daf4bb
+	k8s.io/apimachinery v0.18.0
 	k8s.io/apiserver v0.0.0-20191114103151-9ca1dc586682
 	k8s.io/client-go v0.0.0-20191114101535-6c5935290e33
-	k8s.io/code-generator v0.0.0-20191004115455-8e001e5d1894
+	k8s.io/code-generator v0.18.0
 	k8s.io/component-base v0.0.0-20191114102325-35a9586014f7
 	k8s.io/gengo v0.0.0-20191120174120-e74f70b9b27e // indirect
 	k8s.io/klog v1.0.0
@@ -301,7 +294,8 @@ replace (
 	github.com/open-policy-agent/opa => github.com/open-policy-agent/opa v0.18.0
 	github.com/opencontainers/go-digest => github.com/opencontainers/go-digest v1.0.0-rc1
 	github.com/opencontainers/image-spec => github.com/opencontainers/image-spec v1.0.1
-	github.com/openshift/api => github.com/openshift/api v3.9.0+incompatible
+	github.com/openshift/api => github.com/openshift/api v0.0.0-20180801171038-322a19404e37
+	github.com/openshift/build-machinery-go => github.com/openshift/build-machinery-go v0.0.0-20200211121458-5e3d6e570160
 	github.com/pborman/uuid => github.com/pborman/uuid v1.2.0
 	github.com/pelletier/go-buffruneio => github.com/pelletier/go-buffruneio v0.2.0
 	github.com/pelletier/go-toml => github.com/pelletier/go-toml v1.2.0
--- a/go.sum
+++ b/go.sum
@@ -58,12 +58,8 @@ github.com/blang/semver v3.5.0+incompatible h1:CGxCgetQ64DKk7rdZ++Vfnb1+ogGNnB17
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
-github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
-github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cheekybits/genny v1.0.0 h1:uGGa4nei+j20rOSeDeP5Of12XVm7TGUd4dJA9RDitfE=
-github.com/cheekybits/genny v1.0.0/go.mod h1:+tQajlRqAUrPI7DOSpB0XAqZYtQakVtB7wXkRAgjxjQ=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.3 h1:n6AiVyVRKQFNb6mJlwESEvvLoDyiTzXX7ORAUlkeBdY=
 github.com/coreos/bbolt v1.3.3/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
@@ -96,8 +92,6 @@ github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
 github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c h1:ZfSZ3P3BedhKGUhzj7BQlPSU4OvT6tfOKe3DVHzOA7s=
 github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/elastic/go-elasticsearch/v5 v5.6.1 h1:RnL2wcXepOT5SdoKMMO1j1OBX0vxHYbBtkQNL2E3xs4=
 github.com/elastic/go-elasticsearch/v5 v5.6.1/go.mod h1:r7uV7HidpfkYh7D8SB4lkS13TNlNy3oa5GNmTZvuVqY=
 github.com/elastic/go-elasticsearch/v6 v6.8.2 h1:rp5DGrd63V5c6nHLjF6QEXUpZSvs0+QM3ld7m9VhV2g=
@@ -133,8 +127,6 @@ github.com/gliderlabs/ssh v0.1.1 h1:j3L6gSLQalDETeEg/Jg0mGY0/y/N6zI2xX1978P0Uqw=
 github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8 h1:DujepqpGd1hyOd7aW59XpK7Qymp8iy83xq74fLr21is=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
-github.com/go-acme/lego v2.5.0+incompatible h1:5fNN9yRQfv8ymH3DSsxla+4aYeQt2IgfZqHKVnK8f0s=
-github.com/go-acme/lego v2.5.0+incompatible/go.mod h1:yzMNe9CasVUhkquNvti5nAtPmG94USbYxYrZfTkIn0M=
 github.com/go-kit/kit v0.8.0 h1:Wz+5lgoB0kkuqLEc6NVmwRknTKP6dTGbSqvhZtBI/j0=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-ldap/ldap v3.0.3+incompatible h1:HTeSZO8hWMS1Rgb2Ziku6b8a7qRIZZMHjsvuZyatzwk=
@@ -225,8 +217,6 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92Bcuy
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.6 h1:8p0pcgLlw2iuZVsdHdPaMUXFOA+6gDixcXbHEMzSyW8=
 github.com/grpc-ecosystem/grpc-gateway v1.9.6/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/hashicorp/go-syslog v1.0.0 h1:KaodqZuhUoZereWVIYmpUgZysurB1kBLX2j0MwMrUAE=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-version v1.2.0 h1:3vNe/fWF5CBgRIguda1meWhsZHy3m8gCJ5wx+dIzX/E=
 github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.3 h1:YPkqC67at8FYaadspW/6uE0COsBxS2656RLEr8Bppgk=
@@ -242,8 +232,6 @@ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANyt
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jimstudt/http-authentication v0.0.0-20140401203705-3eca13d6893a h1:BcF8coBl0QFVhe8vAMMlD+CV8EISiu9MGKLoj6ZEyJA=
-github.com/jimstudt/http-authentication v0.0.0-20140401203705-3eca13d6893a/go.mod h1:wK6yTYYcgjHE1Z1QtXACPDjcFJyBskHEdagmnq3vsP8=
 github.com/jinzhu/gorm v1.9.2/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
 github.com/jinzhu/inflection v0.0.0-20180308033659-04140366298a/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.0.0/go.mod h1:oHTiXerJ20+SfYcrdlBO7rzZRJWGwSTQ0iUY2jI6Gfc=
@@ -263,8 +251,6 @@ github.com/kevinburke/ssh_config v0.0.0-20180830205328-81db2a75821e/go.mod h1:CT
 github.com/keybase/go-ps v0.0.0-20161005175911-668c8856d999/go.mod h1:hY+WOq6m2FpbvyrI93sMaypsttvaIL5nhVR92dTMUcQ=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/cpuid v1.2.1 h1:vJi+O/nMdFt0vqm8NZBI6wzALWdA2X+egi0ogNyrC/w=
-github.com/klauspost/cpuid v1.2.1/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/koding/multiconfig v0.0.0-20171124222453-69c27309b2d7 h1:SWlt7BoQNASbhTUD0Oy5yysI2seJ7vWuGUp///OM4TM=
 github.com/koding/multiconfig v0.0.0-20171124222453-69c27309b2d7/go.mod h1:Y2SaZf2Rzd0pXkLVhLlCiAXFCLSXAIbTKDivVgff/AM=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
@@ -282,20 +268,14 @@ github.com/kubesphere/kiali v0.15.1-0.20191210080139-edbbad1ef779 h1:52StEbBn6dR
 github.com/kubesphere/kiali v0.15.1-0.20191210080139-edbbad1ef779/go.mod h1:Y1EqeixoXkKkU8I+yvOfhdh21+8+etFE6wYOVT2XFdI=
 github.com/kubesphere/sonargo v0.0.2 h1:hsSRE3sv3mkPcUAeSABdp7rtfcNW2zzeHXzFa01CTkU=
 github.com/kubesphere/sonargo v0.0.2/go.mod h1:ww8n9ANlDXhX5PBZ18iaRnCgEkXN0GMml3/KZXOZ11w=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348 h1:MtvEpTB6LX3vkb4ax0b5D2DHbNAUsen0Gx5wZoq3lV4=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/leodido/go-urn v1.1.0 h1:Sm1gr51B1kKyfD2BlRcLSiEkffoG96g6TPv6eRoEiB8=
 github.com/leodido/go-urn v1.1.0/go.mod h1:+cyI34gQWZcE1eQU7NVgKkkzdXDQHr1dBMtdAPozLkw=
 github.com/lib/pq v1.2.0 h1:LXpIM/LZ5xGFhOpXAQUIMM1HdyqzVYM13zNdjCEEcA0=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lucas-clemente/quic-go v0.11.1 h1:zasajC848Dqq/+WqfqBCkmPw+YHNe1MBts/z7y7nXf4=
-github.com/lucas-clemente/quic-go v0.11.1/go.mod h1:PpMmPfPKO9nKJ/psF49ESTAGQSdfXxlg1otPbEB2nOw=
 github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
-github.com/marten-seemann/qtls v0.2.3 h1:0yWJ43C62LsZt08vuQJDK1uC1czUc3FJeCLPoNAI4vA=
-github.com/marten-seemann/qtls v0.2.3/go.mod h1:xzjG7avBwGGbdZ8dTGxlBnLArsVKLvwmjgmPuiQEcYk=
 github.com/mattn/go-colorable v0.1.2 h1:/bC9yWikZXAL9uJdulbSfyVNIR3n3trXl+v8+1sx8mU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.8 h1:HLtExJ+uU2HOZ+wI0Tt5DtUDrx8yhUqDcp7fYERX4CE=
@@ -305,12 +285,6 @@ github.com/mattn/go-sqlite3 v1.11.0 h1:LDdKkqtYlom37fkvqs8rMPFKAMe8+SgjbwZ6ex1/A
 github.com/mattn/go-sqlite3 v1.11.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mholt/caddy v1.0.0 h1:KI6RPGih2GFzWRPG8s9clKK28Ns4ZlVMKR/v7mxq6+c=
-github.com/mholt/caddy v1.0.0/go.mod h1:PzUpQ3yGCTuEuy0KSxEeB4TZOi3zBZ8BR/zY0RBP414=
-github.com/mholt/certmagic v0.5.1 h1:8Pf6Hwwlh5sbT3nwn3ovXyXWxHCEM54wvfLzTrQ+UiM=
-github.com/mholt/certmagic v0.5.1/go.mod h1:g4cOPxcjV0oFq3qwpjSA30LReKD8AoIfwAY9VvG35NY=
-github.com/miekg/dns v1.1.9 h1:OIdC9wT96RzuZMf2PfKRhFgsStHUUBZLM/lo1LqiM9E=
-github.com/miekg/dns v1.1.9/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
@@ -327,10 +301,6 @@ github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8m
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/naoina/go-stringutil v0.1.0 h1:rCUeRUHjBjGTSHl0VC00jUPLz8/F9dDzYI70Hzifhks=
-github.com/naoina/go-stringutil v0.1.0/go.mod h1:XJ2SJL9jCtBh+P9q5btrd/Ylo8XwT/h1USek5+NqSA0=
-github.com/naoina/toml v0.1.1 h1:PT/lllxVVN0gzzSqSlHEmP8MJB4MY2U7STGxiouV4X8=
-github.com/naoina/toml v0.1.1/go.mod h1:NBIhNtsFMo3G2szEBne+bO4gS192HuIYRqfvOWb4i1E=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/onsi/ginkgo v1.8.0 h1:VkHVNpR4iVnU8XQR6DBm8BqYjN7CRzw+xKUbVVbbW9w=
@@ -343,8 +313,10 @@ github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2i
 github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/openshift/api v3.9.0+incompatible h1:fJ/KsefYuZAjmrr3+5U9yZIZbTOpVkDDLDLFresAeYs=
-github.com/openshift/api v3.9.0+incompatible/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
+github.com/openshift/api v0.0.0-20180801171038-322a19404e37/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
+github.com/openshift/api v0.0.0-20200331152225-585af27e34fd h1:f4iPC9iCf1an7qEWpEFvp/swsM79vvBRsJ2twU4D30s=
+github.com/openshift/api v0.0.0-20200331152225-585af27e34fd/go.mod h1:RKMJ5CBnljLfnej+BJ/xnOWc3kZDvJUaIAEq2oKSPtE=
+github.com/openshift/build-machinery-go v0.0.0-20200211121458-5e3d6e570160/go.mod h1:1CkcsT3aVebzRBzVTSbiKSkJMsC/CASqxesfqEMfJEc=
 github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-buffruneio v0.2.0 h1:U4t4R6YkofJ5xHm3dJzuRpPZ0mr5MMCoAWooScCR7aA=
@@ -492,8 +464,6 @@ gopkg.in/go-playground/validator.v9 v9.29.1 h1:SvGtYmN60a5CVKTOzMSyfzWDeZRxRuGvR
 gopkg.in/go-playground/validator.v9 v9.29.1/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/mcuadros/go-syslog.v2 v2.2.1 h1:60g8zx1BijSVSgLTzLCW9UC4/+i1Ih9jJ1DR5Tgp9vE=
-gopkg.in/mcuadros/go-syslog.v2 v2.2.1/go.mod h1:l5LPIyOOyIdQquNg+oU6Z3524YwrcqEm0aKH+5zpt2U=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
--- a/pkg/api/iam/user.go
+++ b/pkg/api/iam/user.go
@@ -1,41 +0,0 @@
-package iam
-
-import (
-	"kubesphere.io/kubesphere/pkg/server/errors"
-	"time"
-)
-
-type User struct {
-	Name        string    `json:"username"`
-	UID         string    `json:"uid"`
-	Email       string    `json:"email"`
-	Lang        string    `json:"lang,omitempty"`
-	Description string    `json:"description"`
-	CreateTime  time.Time `json:"createTime"`
-	Groups      []string  `json:"groups,omitempty"`
-	Password    string    `json:"password,omitempty"`
-}
-
-func (u *User) GetName() string {
-	return u.Name
-}
-
-func (u *User) GetUID() string {
-	return u.UID
-}
-
-func (u *User) GetEmail() string {
-	return u.Email
-}
-
-func (u *User) Validate() error {
-	if u.Name == "" {
-		return errors.New("username can not be empty")
-	}
-
-	if u.Password == "" {
-		return errors.New("password can not be empty")
-	}
-
-	return nil
-}
--- a/pkg/api/types.go
+++ b/pkg/api/types.go
@@ -6,8 +6,8 @@ import (
 )

 type ListResult struct {
-	Items      []interface{} `json:"items,omitempty"`
-	TotalItems int           `json:"totalItems,omitempty"`
+	Items      []interface{} `json:"items"`
+	TotalItems int           `json:"totalItems"`
 }

 type ResourceQuota struct {
--- a/pkg/apis/iam/v1alpha2/register.go
+++ b/pkg/apis/iam/v1alpha2/register.go
@@ -25,8 +25,9 @@ limitations under the License.
 package v1alpha2

 import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"sigs.k8s.io/controller-runtime/pkg/runtime/scheme"
 )

 var (
@@ -34,7 +35,7 @@ var (
 	SchemeGroupVersion = schema.GroupVersion{Group: "iam.kubesphere.io", Version: "v1alpha2"}

 	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
-	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)

 	// AddToScheme is required by pkg/client/...
 	AddToScheme = SchemeBuilder.AddToScheme
@@ -44,3 +45,18 @@ var (
 func Resource(resource string) schema.GroupResource {
 	return SchemeGroupVersion.WithResource(resource).GroupResource()
 }
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&User{},
+		&Role{},
+		&RoleList{},
+		&RoleBinding{},
+		&RoleBindingList{},
+		&PolicyRule{},
+		&PolicyRuleList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
--- a/pkg/apis/iam/v1alpha2/user_types.go
+++ b/pkg/apis/iam/v1alpha2/user_types.go
@@ -20,14 +20,12 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )

-// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
-// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
-
-// User is the Schema for the users API
-// +k8s:openapi-gen=true
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +genclient:nonNamespaced
+// +k8s:openapi-gen=true
+
+// User is the Schema for the users API
 // +kubebuilder:printcolumn:name="Email",type="string",JSONPath=".spec.email"
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.state"
 // +kubebuilder:resource:categories="iam",scope="Cluster"
@@ -119,7 +117,6 @@ const (
 )

 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +genclient:nonNamespaced

 // UserList contains a list of User
 type UserList struct {
@@ -128,6 +125,112 @@ type UserList struct {
 	Items           []User `json:"items"`
 }

-func init() {
-	SchemeBuilder.Register(&User{}, &UserList{})
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// +kubebuilder:resource:categories="iam",scope="Cluster"
+type Role struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Scope Scope     `json:"scope"`
+	Rules []RuleRef `json:"rules"`
+}
+
+type Scope struct {
+	Level  Level    `json:"level"`
+	Scopes []string `json:"scopes"`
+}
+
+type Level string
+
+const (
+	LevelGlobal    Level = "Global"
+	LevelCluster   Level = "Cluster"
+	LevelWorkspace Level = "Workspace"
+	LevelNamespace Level = "Namespace"
+	ScopeALL             = "*"
+)
+
+// RuleRef contains information that points to the role being used
+type RuleRef struct {
+	// APIGroup is the group for the resource being referenced
+	APIGroup string `json:"apiGroup"`
+	// Kind is the type of resource being referenced
+	Kind string `json:"kind"`
+	// Name is the name of resource being referenced
+	Name string `json:"name"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// RoleList contains a list of Role
+type RoleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Role `json:"items"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// +kubebuilder:resource:categories="iam",scope="Cluster"
+type PolicyRule struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Level Level  `json:"level"`
+	Rego  string `json:"rego"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PolicyRuleList contains a list of PolicyRule
+type PolicyRuleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []PolicyRule `json:"items"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// RoleBinding is the Schema for the rolebindings API
+// +kubebuilder:resource:categories="iam",scope="Cluster"
+type RoleBinding struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Level   Level   `json:"level"`
+	RoleRef RoleRef `json:"roleRef"`
+	// Subjects holds references to the users the role applies to.
+	// +optional
+	Subjects []Subject `json:"subjects,omitempty"`
+}
+
+// RoleRef contains information that points to the role being used
+type RoleRef struct {
+	// APIGroup is the group for the resource being referenced
+	APIGroup string `json:"apiGroup"`
+	// Kind is the type of resource being referenced
+	Kind string `json:"kind"`
+	// Name is the name of resource being referenced
+	Name string `json:"name"`
+}
+
+// or a value for non-objects such as user and group names.
+type Subject struct {
+	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+	Kind string `json:"kind"`
+	// APIGroup holds the API group of the referenced subject.
+	APIGroup string `json:"apiGroup"`
+	// Name of the object being referenced.
+	Name string `json:"name"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// RoleBindingList contains a list of RoleBinding
+type RoleBindingList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []RoleBinding `json:"items"`
 }
--- a/pkg/apis/iam/v1alpha2/user_types_test.go
+++ b/pkg/apis/iam/v1alpha2/user_types_test.go
--- a/pkg/apis/iam/v1alpha2/zz_generated.deepcopy.go
+++ b/pkg/apis/iam/v1alpha2/zz_generated.deepcopy.go
@@ -21,9 +21,257 @@ limitations under the License.
 package v1alpha2

 import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime"
 )

+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicyRule) DeepCopyInto(out *PolicyRule) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRule.
+func (in *PolicyRule) DeepCopy() *PolicyRule {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicyRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PolicyRule) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicyRuleList) DeepCopyInto(out *PolicyRuleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRuleList.
+func (in *PolicyRuleList) DeepCopy() *PolicyRuleList {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicyRuleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PolicyRuleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Role) DeepCopyInto(out *Role) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Scope.DeepCopyInto(&out.Scope)
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]RuleRef, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Role.
+func (in *Role) DeepCopy() *Role {
+	if in == nil {
+		return nil
+	}
+	out := new(Role)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Role) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleBinding) DeepCopyInto(out *RoleBinding) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.RoleRef = in.RoleRef
+	if in.Subjects != nil {
+		in, out := &in.Subjects, &out.Subjects
+		*out = make([]Subject, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBinding.
+func (in *RoleBinding) DeepCopy() *RoleBinding {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleBinding)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RoleBinding) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleBindingList) DeepCopyInto(out *RoleBindingList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]RoleBinding, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBindingList.
+func (in *RoleBindingList) DeepCopy() *RoleBindingList {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleBindingList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RoleBindingList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleList) DeepCopyInto(out *RoleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Role, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleList.
+func (in *RoleList) DeepCopy() *RoleList {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *RoleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoleRef) DeepCopyInto(out *RoleRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleRef.
+func (in *RoleRef) DeepCopy() *RoleRef {
+	if in == nil {
+		return nil
+	}
+	out := new(RoleRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RuleRef) DeepCopyInto(out *RuleRef) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuleRef.
+func (in *RuleRef) DeepCopy() *RuleRef {
+	if in == nil {
+		return nil
+	}
+	out := new(RuleRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Scope) DeepCopyInto(out *Scope) {
+	*out = *in
+	if in.Scopes != nil {
+		in, out := &in.Scopes, &out.Scopes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Scope.
+func (in *Scope) DeepCopy() *Scope {
+	if in == nil {
+		return nil
+	}
+	out := new(Scope)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Subject) DeepCopyInto(out *Subject) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subject.
+func (in *Subject) DeepCopy() *Subject {
+	if in == nil {
+		return nil
+	}
+	out := new(Subject)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *User) DeepCopyInto(out *User) {
 	*out = *in
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -193,7 +193,7 @@ func (s *APIServer) buildHandlerChain() {

 	// authenticators are unordered
 	authn := unionauth.New(anonymous.NewAuthenticator(),
-		basictoken.New(basic.NewBasicAuthenticator(im.NewFakeOperator())),
+		basictoken.New(basic.NewBasicAuthenticator(im.NewOperator(s.KubernetesClient.KubeSphere(), s.InformerFactory.KubeSphereSharedInformerFactory()))),
 		bearertoken.New(jwttoken.NewTokenAuthenticator(token.NewJwtTokenIssuer(token.DefaultIssuerName, s.Config.AuthenticationOptions, s.CacheClient))))
 	handler = filters.WithAuthentication(handler, authn)
 	handler = filters.WithRequestInfo(handler, requestInfoResolver)
@@ -273,6 +273,7 @@ func (s *APIServer) waitForResourceSync(stopCh <-chan struct{}) error {

 	ksGVRs := []schema.GroupVersionResource{
 		{Group: "tenant.kubesphere.io", Version: "v1alpha1", Resource: "workspaces"},
+		{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "users"},
 		{Group: "tower.kubesphere.io", Version: "v1alpha1", Resource: "agents"},
 	}

--- a/pkg/apiserver/authentication/authenticators/basic/basic.go
+++ b/pkg/apiserver/authentication/authenticators/basic/basic.go
@@ -51,7 +51,7 @@ func (t *basicAuthenticator) AuthenticatePassword(ctx context.Context, username,
 	return &authenticator.Response{
 		User: &user.DefaultInfo{
 			Name:   providedUser.GetName(),
-			UID:    providedUser.GetUID(),
+			UID:    string(providedUser.GetUID()),
 			Groups: []string{user.AllAuthenticated},
 		},
 	}, true, nil
--- a/pkg/apiserver/authentication/token/jwt.go
+++ b/pkg/apiserver/authentication/token/jwt.go
@@ -21,7 +21,7 @@ package token
 import (
 	"fmt"
 	"github.com/dgrijalva/jwt-go"
-	"kubesphere.io/kubesphere/pkg/api/iam"
+	"k8s.io/apiserver/pkg/authentication/user"
 	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/server/errors"
 	"kubesphere.io/kubesphere/pkg/simple/client/cache"
@@ -69,7 +69,7 @@ func (s *jwtTokenIssuer) Verify(tokenString string) (User, error) {
 		return nil, err
 	}

-	return &iam.User{Name: clm.Username, UID: clm.UID}, nil
+	return &user.DefaultInfo{Name: clm.Username, UID: clm.UID}, nil
 }

 func (s *jwtTokenIssuer) IssueTo(user User, expiresIn time.Duration) (string, error) {
--- a/pkg/apiserver/authentication/token/jwt_test.go
+++ b/pkg/apiserver/authentication/token/jwt_test.go
@@ -20,7 +20,7 @@ package token

 import (
 	"github.com/google/go-cmp/cmp"
-	"kubesphere.io/kubesphere/pkg/api/iam"
+	"k8s.io/apiserver/pkg/authentication/user"
 	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/simple/client/cache"
 	"testing"
@@ -48,7 +48,7 @@ func TestJwtTokenIssuer(t *testing.T) {
 	}

 	for _, testCase := range testCases {
-		user := &iam.User{
+		user := &user.DefaultInfo{
 			Name: testCase.name,
 			UID:  testCase.uid,
 		}
--- a/pkg/apiserver/query/field.go
+++ b/pkg/apiserver/query/field.go
@@ -1,16 +1,19 @@
 package query

 type Field string
+type Value string

 const (
 	FieldName                = "name"
+	FieldUID                 = "uid"
 	FieldCreationTimeStamp   = "creationTimestamp"
 	FieldLastUpdateTimestamp = "lastUpdateTimestamp"
 	FieldLabel               = "label"
+	FieldAnnotation          = "annotation"
+	FieldClusterName         = "clusterName"
 	FieldNamespace           = "namespace"
 	FieldStatus              = "status"
-	FieldApplication         = "application"
-	FieldOwner               = "owner"
+	FieldOwnerReference      = "ownerReference"
 	FieldOwnerKind           = "ownerKind"
 )

@@ -23,9 +26,12 @@ var SortableFields = []Field{
 // Field contains all the query field that can be compared
 var ComparableFields = []Field{
 	FieldName,
+	FieldUID,
+	FieldLabel,
+	FieldAnnotation,
+	FieldClusterName,
 	FieldNamespace,
 	FieldStatus,
-	FieldApplication,
-	FieldOwner,
+	FieldOwnerReference,
 	FieldOwnerKind,
 }
--- a/pkg/apiserver/query/types.go
+++ b/pkg/apiserver/query/types.go
@@ -3,7 +3,6 @@ package query
 import (
 	"github.com/emicklei/go-restful"
 	"strconv"
-	"strings"
 )

 const (
@@ -16,24 +15,6 @@ const (
 	ParameterAscending     = "ascending"
 )

-type Comparable interface {
-	Compare(Comparable) int
-
-	Contains(Comparable) bool
-}
-
-type ComparableString string
-
-func (c ComparableString) Compare(comparable Comparable) int {
-	other := comparable.(ComparableString)
-	return strings.Compare(string(c), string(other))
-}
-
-func (c ComparableString) Contains(comparable Comparable) bool {
-	other := comparable.(ComparableString)
-	return strings.Contains(string(c), string(other))
-}
-
 // Query represents api search terms
 type Query struct {
 	Pagination *Pagination
@@ -52,29 +33,30 @@ type Pagination struct {
 	// items per page
 	Limit int

-	// page number
-	Page int
+	// offset
+	Offset int
 }

-var NoPagination = newPagination(-1, -1)
+var NoPagination = newPagination(-1, 0)

-func newPagination(limit int, page int) *Pagination {
+// make sure that pagination is valid
+func newPagination(limit int, offset int) *Pagination {
 	return &Pagination{
-		Limit: limit,
-		Page:  page,
+		Limit:  limit,
+		Offset: offset,
 	}
 }

-func (p *Pagination) IsValidPagintaion() bool {
-	return p.Limit >= 0 && p.Page >= 0
-}
+func (p *Pagination) GetValidPagination(total int) (startIndex, endIndex int) {
+	if p.Limit == NoPagination.Limit {
+		return 0, total
+	}

-func (p *Pagination) IsPageAvailable(total, startIndex int) bool {
-	return total > startIndex && p.Limit > 0
-}
+	if p.Limit < 0 || p.Offset < 0 {
+		return 0, 0
+	}

-func (p *Pagination) GetPaginationSettings(total int) (startIndex, endIndex int) {
-	startIndex = p.Limit * p.Page
+	startIndex = p.Limit * p.Offset
 	endIndex = startIndex + p.Limit

 	if endIndex > total {
@@ -86,33 +68,33 @@ func (p *Pagination) GetPaginationSettings(total int) (startIndex, endIndex int)

 func New() *Query {
 	return &Query{
-		Pagination: &Pagination{
-			Limit: -1,
-			Page:  -1,
-		},
-		SortBy:    "",
-		Ascending: false,
-		Filters:   []Filter{},
+		Pagination: NoPagination,
+		SortBy:     "",
+		Ascending:  false,
+		Filters:    []Filter{},
 	}
 }

 type Filter struct {
 	Field Field
-	Value Comparable
+	Value Value
 }

 func ParseQueryParameter(request *restful.Request) *Query {
 	query := New()

-	limit, err := strconv.ParseInt(request.QueryParameter("limit"), 10, 0)
+	limit, err := strconv.Atoi(request.QueryParameter("limit"))
+	// equivalent to undefined, use the default value
 	if err != nil {
-		query.Pagination = NoPagination
+		limit = -1
+	}
+	page, err := strconv.Atoi(request.QueryParameter("page"))
+	// equivalent to undefined, use the default value
+	if err != nil {
+		page = 1
 	}

-	page, err := strconv.ParseInt(request.QueryParameter("page"), 10, 0)
-	if err == nil {
-		query.Pagination = newPagination(int(limit), int(page-1))
-	}
+	query.Pagination = newPagination(limit, page-1)

 	query.SortBy = Field(defaultString(request.QueryParameter("sortBy"), FieldCreationTimeStamp))

@@ -128,13 +110,12 @@ func ParseQueryParameter(request *restful.Request) *Query {
 		if len(f) != 0 {
 			query.Filters = append(query.Filters, Filter{
 				Field: field,
-				Value: ComparableString(f),
+				Value: Value(f),
 			})
 		}
 	}

 	return query
-
 }

 func defaultString(value, defaultValue string) string {
--- a/pkg/apiserver/query/types_test.go
+++ b/pkg/apiserver/query/types_test.go
@@ -16,7 +16,7 @@ func TestParseQueryParameter(t *testing.T) {
 	}{
 		{
 			"test normal case",
-			"name=foo&status=Running&application=book&page=1&limit=10&ascending=true",
+			"label=app.kubernetes.io/name:book&name=foo&status=Running&page=1&limit=10&ascending=true",
 			&Query{
 				Pagination: newPagination(10, 0),
 				SortBy:     FieldCreationTimeStamp,
@@ -24,15 +24,15 @@ func TestParseQueryParameter(t *testing.T) {
 				Filters: []Filter{
 					{
 						FieldName,
-						ComparableString("foo"),
+						Value("foo"),
+					},
+					{
+						FieldLabel,
+						Value("app.kubernetes.io/name:book"),
 					},
 					{
 						FieldStatus,
-						ComparableString("Running"),
-					},
-					{
-						FieldApplication,
-						ComparableString("book"),
+						Value("Running"),
 					},
 				},
 			},
@@ -41,13 +41,10 @@ func TestParseQueryParameter(t *testing.T) {
 			"test bad case",
 			"xxxx=xxxx&dsfsw=xxxx&page=abc&limit=add&ascending=ssss",
 			&Query{
-				Pagination: &Pagination{
-					Limit: -1,
-					Page:  -1,
-				},
-				SortBy:    FieldCreationTimeStamp,
-				Ascending: false,
-				Filters:   []Filter{},
+				Pagination: NoPagination,
+				SortBy:     FieldCreationTimeStamp,
+				Ascending:  false,
+				Filters:    []Filter{},
 			},
 		},
 	}
--- a/pkg/controller/clusterrolebinding/clusterrolebinding_controller.go
+++ b/pkg/controller/clusterrolebinding/clusterrolebinding_controller.go
@@ -169,7 +169,6 @@ func (r *ReconcileClusterRoleBinding) updateRoleBindings(clusterRoleBinding *rba
 	if clusterRoleBinding.Name == getWorkspaceViewerRoleBindingName(workspaceName) {

 		found := &rbac.RoleBinding{}
-
 		viewerBinding := &rbac.RoleBinding{}
 		viewerBinding.Name = "viewer"
 		viewerBinding.Namespace = namespace.Name
--- a/pkg/controller/user/user_webhook.go
+++ b/pkg/controller/user/user_webhook.go
@@ -0,0 +1,102 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package user
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"golang.org/x/crypto/bcrypt"
+	"kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"net/http"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+	"strconv"
+)
+
+type EmailValidator struct {
+	Client  client.Client
+	decoder *admission.Decoder
+}
+
+type PasswordCipher struct {
+	Client  client.Client
+	decoder *admission.Decoder
+}
+
+func (a *EmailValidator) Handle(ctx context.Context, req admission.Request) admission.Response {
+	user := &v1alpha2.User{}
+	err := a.decoder.Decode(req, user)
+	if err != nil {
+		return admission.Errored(http.StatusBadRequest, err)
+	}
+
+	email := user.Spec.Email
+
+	allUsers := v1alpha2.UserList{}
+
+	a.Client.List(ctx, &v1alpha2.UserList{}, &client.ListOptions{})
+
+	found := emailAlreadyExist(allUsers, email)
+
+	if !found {
+		return admission.Denied(fmt.Sprintf("email %s must be unique", email))
+	}
+
+	return admission.Allowed("")
+}
+
+func emailAlreadyExist(users v1alpha2.UserList, email string) bool {
+	for _, user := range users.Items {
+		if user.Spec.Email == email {
+			return true
+		}
+	}
+	return false
+}
+
+func (a *PasswordCipher) Handle(ctx context.Context, req admission.Request) admission.Response {
+	user := &v1alpha2.User{}
+	err := a.decoder.Decode(req, user)
+	if err != nil {
+		return admission.Errored(http.StatusBadRequest, err)
+	}
+
+	encrypted, err := strconv.ParseBool(user.Annotations["iam.kubesphere.io/password-encrypted"])
+
+	if err != nil || !encrypted {
+		password, err := hashPassword(user.Spec.EncryptedPassword)
+		if err != nil {
+			return admission.Errored(http.StatusInternalServerError, err)
+		}
+		user.Spec.EncryptedPassword = password
+	}
+
+	marshaledUser, err := json.Marshal(user)
+	if err != nil {
+		return admission.Errored(http.StatusInternalServerError, err)
+	}
+
+	return admission.PatchResponseFromRaw(req.Object.Raw, marshaledUser)
+}
+
+func hashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
+	return string(bytes), err
+}
--- a/pkg/kapis/iam/v1alpha2/register.go
+++ b/pkg/kapis/iam/v1alpha2/register.go
@@ -44,7 +44,7 @@ func AddToContainer(c *restful.Container, k8sClient k8s.Client, factory informer
 	handler := newIAMHandler(k8sClient, factory, ldapClient, cacheClient, options)

 	// implemented by create CRD object.
-	//ws.Route(ws.POST("/users"))
+	//ws.Route(ws.POST("/users").To(handler.CreateUser))
 	//ws.Route(ws.DELETE("/users/{user}"))
 	//ws.Route(ws.PUT("/users/{user}"))
 	//ws.Route(ws.GET("/users/{user}"))
--- a/pkg/kapis/resources/v1alpha2/register.go
+++ b/pkg/kapis/resources/v1alpha2/register.go
@@ -49,6 +49,7 @@ func AddToContainer(c *restful.Container, client kubernetes.Interface, factory i

 	webservice.Route(webservice.GET("/namespaces/{namespace}/{resources}").
 		To(handler.handleListNamespaceResources).
+		Deprecate().
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.NamespaceResourcesTag}).
 		Doc("Namespace level resource query").
 		Param(webservice.PathParameter("namespace", "the name of the project")).
@@ -66,6 +67,7 @@ func AddToContainer(c *restful.Container, client kubernetes.Interface, factory i

 	webservice.Route(webservice.GET("/{resources}").
 		To(handler.handleListNamespaceResources).
+		Deprecate().
 		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.ClusterResourcesTag}).
 		Doc("Cluster level resource query").
--- a/pkg/kapis/resources/v1alpha3/handler.go
+++ b/pkg/kapis/resources/v1alpha3/handler.go
@@ -11,7 +11,7 @@ import (
 )

 type Handler struct {
-	namespacedResourceGetter *resource.NamespacedResourceGetter
+	namespacedResourceGetter *resource.ResourceGetter
 	componentsGetter         components.ComponentsGetter
 }

@@ -22,22 +22,8 @@ func New(factory informers.InformerFactory) *Handler {
 	}
 }

-func (h Handler) handleGetNamespacedResource(request *restful.Request, response *restful.Response) {
-	resource := request.PathParameter("resources")
-	namespace := request.PathParameter("namespace")
-	name := request.PathParameter("name")
-
-	result, err := h.namespacedResourceGetter.Get(resource, namespace, name)
-	if err != nil {
-		api.HandleInternalError(response, nil, err)
-		return
-	}
-
-	response.WriteHeaderAndEntity(http.StatusOK, result)
-}
-
-// handleListNamedResource retrieves namespaced scope resources
-func (h Handler) handleListNamespacedResource(request *restful.Request, response *restful.Response) {
+// handleListResources retrieves resources
+func (h Handler) handleListResources(request *restful.Request, response *restful.Response) {
 	query := query.ParseQueryParameter(request)
 	resource := request.PathParameter("resources")
 	namespace := request.PathParameter("namespace")
@@ -48,7 +34,7 @@ func (h Handler) handleListNamespacedResource(request *restful.Request, response
 		return
 	}

-	response.WriteHeaderAndEntity(http.StatusOK, result)
+	response.WriteEntity(result)
 }

 func (h Handler) handleGetComponentStatus(request *restful.Request, response *restful.Response) {
--- a/pkg/kapis/resources/v1alpha3/register.go
+++ b/pkg/kapis/resources/v1alpha3/register.go
@@ -45,14 +45,26 @@ func AddToContainer(c *restful.Container, informerFactory informers.InformerFact
 	webservice := runtime.NewWebService(GroupVersion)
 	handler := New(informerFactory)

+	webservice.Route(webservice.GET("/{resources}").
+		To(handler.handleListResources).
+		Metadata(restfulspec.KeyOpenAPITags, []string{tagNamespacedResource}).
+		Doc("Cluster level resource query").
+		Param(webservice.PathParameter("resources", "namespace level resource type, e.g. pods,jobs,configmaps,services.")).
+		Param(webservice.QueryParameter(query.ParameterName, "name used to do filtering").Required(false)).
+		Param(webservice.QueryParameter(query.ParameterPage, "page").Required(false).DataFormat("page=%d").DefaultValue("page=1")).
+		Param(webservice.QueryParameter(query.ParameterLimit, "limit").Required(false)).
+		Param(webservice.QueryParameter(query.ParameterAscending, "sort parameters, e.g. reverse=true").Required(false).DefaultValue("ascending=false")).
+		Param(webservice.QueryParameter(query.ParameterOrderBy, "sort parameters, e.g. orderBy=createTime")).
+		Returns(http.StatusOK, ok, api.ListResult{}))
+
 	webservice.Route(webservice.GET("/namespaces/{namespace}/{resources}").
-		To(handler.handleGetNamespacedResource).
+		To(handler.handleListResources).
 		Metadata(restfulspec.KeyOpenAPITags, []string{tagNamespacedResource}).
 		Doc("Namespace level resource query").
 		Param(webservice.PathParameter("namespace", "the name of the project")).
 		Param(webservice.PathParameter("resources", "namespace level resource type, e.g. pods,jobs,configmaps,services.")).
 		Param(webservice.QueryParameter(query.ParameterName, "name used to do filtering").Required(false)).
-		Param(webservice.QueryParameter(query.ParameterPage, "page").Required(false).DataFormat("page=%d").DefaultValue("page=0")).
+		Param(webservice.QueryParameter(query.ParameterPage, "page").Required(false).DataFormat("page=%d").DefaultValue("page=1")).
 		Param(webservice.QueryParameter(query.ParameterLimit, "limit").Required(false)).
 		Param(webservice.QueryParameter(query.ParameterAscending, "sort parameters, e.g. reverse=true").Required(false).DefaultValue("ascending=false")).
 		Param(webservice.QueryParameter(query.ParameterOrderBy, "sort parameters, e.g. orderBy=createTime")).
--- a/pkg/models/iam/im/im.go
+++ b/pkg/models/iam/im/im.go
@@ -19,76 +19,20 @@ package im

 import (
 	"github.com/pkg/errors"
-	"kubesphere.io/kubesphere/pkg/api/iam"
-	"kubesphere.io/kubesphere/pkg/simple/client/ldap"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 )

 type IdentityManagementInterface interface {
-	CreateUser(user *iam.User) (*iam.User, error)
+	CreateUser(user *iamv1alpha2.User) (*iamv1alpha2.User, error)
 	DeleteUser(username string) error
-	ModifyUser(user *iam.User) (*iam.User, error)
-	DescribeUser(username string) (*iam.User, error)
-	Authenticate(username, password string) (*iam.User, error)
-}
-
-type imOperator struct {
-	ldapClient ldap.Interface
+	ModifyUser(user *iamv1alpha2.User) (*iamv1alpha2.User, error)
+	DescribeUser(username string) (*iamv1alpha2.User, error)
+	Authenticate(username, password string) (*iamv1alpha2.User, error)
 }

 var (
-	AuthRateLimitExceeded = errors.New("user auth rate limit exceeded")
-	UserAlreadyExists     = errors.New("user already exists")
-	UserNotExists         = errors.New("user not exists")
+	AuthRateLimitExceeded       = errors.New("user auth rate limit exceeded")
+	AuthFailedIncorrectPassword = errors.New("incorrect password")
+	UserAlreadyExists           = errors.New("user already exists")
+	UserNotExists               = errors.New("user not exists")
 )
-
-func NewLDAPOperator(ldapClient ldap.Interface) IdentityManagementInterface {
-	return &imOperator{
-		ldapClient: ldapClient,
-	}
-
-}
-
-func (im *imOperator) ModifyUser(user *iam.User) (*iam.User, error) {
-
-	err := im.ldapClient.Update(user)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return im.ldapClient.Get(user.Name)
-}
-
-func (im *imOperator) Authenticate(username, password string) (*iam.User, error) {
-
-	user, err := im.ldapClient.Get(username)
-
-	if err != nil {
-		return nil, err
-	}
-
-	err = im.ldapClient.Authenticate(user.Name, password)
-	if err != nil {
-		return nil, err
-	}
-
-	return user, nil
-}
-
-func (im *imOperator) DescribeUser(username string) (*iam.User, error) {
-	return im.ldapClient.Get(username)
-}
-
-func (im *imOperator) DeleteUser(username string) error {
-	return im.ldapClient.Delete(username)
-}
-
-func (im *imOperator) CreateUser(user *iam.User) (*iam.User, error) {
-	err := im.ldapClient.Create(user)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return user, nil
-}
--- a/pkg/models/iam/im/im_operator.go
+++ b/pkg/models/iam/im/im_operator.go
@@ -0,0 +1,85 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package im
+
+import (
+	"golang.org/x/crypto/bcrypt"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	kubesphereclient "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+)
+
+func NewOperator(ksClient kubesphereclient.Interface, informer informers.SharedInformerFactory) IdentityManagementInterface {
+
+	return &defaultIMOperator{
+		ksClient: ksClient,
+		informer: informer,
+	}
+
+}
+
+type defaultIMOperator struct {
+	ksClient kubesphereclient.Interface
+	informer informers.SharedInformerFactory
+}
+
+func (im *defaultIMOperator) ModifyUser(user *iamv1alpha2.User) (*iamv1alpha2.User, error) {
+	return im.ksClient.IamV1alpha2().Users().Update(user)
+}
+
+func (im *defaultIMOperator) Authenticate(username, password string) (*iamv1alpha2.User, error) {
+
+	user, err := im.ksClient.IamV1alpha2().Users().Get(username, metav1.GetOptions{})
+
+	if err != nil {
+		return nil, err
+	}
+	if checkPasswordHash(password, user.Spec.EncryptedPassword) {
+		return user, nil
+	}
+	return nil, AuthFailedIncorrectPassword
+}
+
+func checkPasswordHash(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}
+
+func (im *defaultIMOperator) DescribeUser(username string) (*iamv1alpha2.User, error) {
+	user, err := im.ksClient.IamV1alpha2().Users().Get(username, metav1.GetOptions{})
+
+	if err != nil {
+		return nil, err
+	}
+	return user, nil
+}
+
+func (im *defaultIMOperator) DeleteUser(username string) error {
+	return im.ksClient.IamV1alpha2().Users().Delete(username, metav1.NewDeleteOptions(0))
+}
+
+func (im *defaultIMOperator) CreateUser(user *iamv1alpha2.User) (*iamv1alpha2.User, error) {
+	user, err := im.ksClient.IamV1alpha2().Users().Create(user)
+	if err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
--- a/pkg/models/iam/im/im_test.go
+++ b/pkg/models/iam/im/im_test.go
@@ -17,3 +17,25 @@
 */

 package im
+
+import (
+	"golang.org/x/crypto/bcrypt"
+	"testing"
+)
+
+func TestEncryptPassword(t *testing.T) {
+	password := "P@88w0rd"
+	encryptedPassword, err := hashPassword(password)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !checkPasswordHash(password, encryptedPassword) {
+		t.Fatal(err)
+	}
+	t.Log(encryptedPassword)
+}
+
+func hashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
+	return string(bytes), err
+}
--- a/pkg/models/iam/im/ldap_operator.go
+++ b/pkg/models/iam/im/ldap_operator.go
@@ -0,0 +1,80 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package im
+
+import (
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/simple/client/ldap"
+)
+
+type ldapOperator struct {
+	ldapClient ldap.Interface
+}
+
+func NewLDAPOperator(ldapClient ldap.Interface) IdentityManagementInterface {
+	return &ldapOperator{
+		ldapClient: ldapClient,
+	}
+
+}
+
+func (im *ldapOperator) ModifyUser(user *iamv1alpha2.User) (*iamv1alpha2.User, error) {
+
+	err := im.ldapClient.Update(user)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return im.ldapClient.Get(user.Name)
+}
+
+func (im *ldapOperator) Authenticate(username, password string) (*iamv1alpha2.User, error) {
+
+	user, err := im.ldapClient.Get(username)
+
+	if err != nil {
+		return nil, err
+	}
+
+	err = im.ldapClient.Authenticate(user.Name, password)
+	if err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
+
+func (im *ldapOperator) DescribeUser(username string) (*iamv1alpha2.User, error) {
+	return im.ldapClient.Get(username)
+}
+
+func (im *ldapOperator) DeleteUser(username string) error {
+	return im.ldapClient.Delete(username)
+}
+
+func (im *ldapOperator) CreateUser(user *iamv1alpha2.User) (*iamv1alpha2.User, error) {
+	err := im.ldapClient.Create(user)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
--- a/pkg/models/resources/v1alpha3/deployment/deployments.go
+++ b/pkg/models/resources/v1alpha3/deployment/deployments.go
@@ -32,9 +32,6 @@ import (
 )

 const (
-	applicationLabel = "app.kubernetes.io/name"
-	ReleaseLabel     = "relase"
-
 	statusStopped  = "stopped"
 	statusRunning  = "running"
 	statusUpdating = "updating"
@@ -80,14 +77,10 @@ func (d *deploymentsGetter) compare(left runtime.Object, right runtime.Object, f
 	}

 	switch field {
-	case query.FieldCreationTimeStamp:
-		return leftDeployment.CreationTimestamp.After(rightDeployment.CreationTimestamp.Time)
 	case query.FieldLastUpdateTimestamp:
 		return lastUpdateTime(leftDeployment).After(lastUpdateTime(rightDeployment))
 	default:
-		fallthrough
-	case query.FieldName:
-		return strings.Compare(leftDeployment.Name, rightDeployment.Name) > 0
+		return v1alpha3.DefaultObjectMetaCompare(leftDeployment.ObjectMeta, rightDeployment.ObjectMeta, field)
 	}
 }

@@ -98,18 +91,12 @@ func (d *deploymentsGetter) filter(object runtime.Object, filter query.Filter) b
 	}

 	switch filter.Field {
-	case query.FieldName:
-		return query.ComparableString(deployment.Name).Contains(filter.Value)
-	case query.FieldApplication:
-		if app, ok := deployment.Labels[applicationLabel]; ok {
-			return query.ComparableString(app).Contains(filter.Value)
-		}
+
 	case query.FieldStatus:
-		return filter.Value.Compare(query.ComparableString(deploymentStatus(deployment.Status))) == 0
+		return strings.Compare(deploymentStatus(deployment.Status), string(filter.Value)) == 0
 	default:
-		return false
+		return v1alpha3.DefaultObjectMetaFilter(deployment.ObjectMeta, filter)
 	}
-	return false
 }

 func deploymentStatus(status v1.DeploymentStatus) string {
--- a/pkg/models/resources/v1alpha3/deployment/deployments_test.go
+++ b/pkg/models/resources/v1alpha3/deployment/deployments_test.go
@@ -94,15 +94,15 @@ func TestListDeployments(t *testing.T) {
 			},
 			&query.Query{
 				Pagination: &query.Pagination{
-					Limit: 1,
-					Page:  1,
+					Limit:  1,
+					Offset: 1,
 				},
 				SortBy:    query.FieldName,
 				Ascending: false,
 				Filters: []query.Filter{
 					{
 						Field: query.FieldName,
-						Value: query.ComparableString("foo"),
+						Value: query.Value("foo"),
 					},
 				},
 			},
--- a/pkg/models/resources/v1alpha3/interface.go
+++ b/pkg/models/resources/v1alpha3/interface.go
@@ -1,10 +1,12 @@
 package v1alpha3

 import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"kubesphere.io/kubesphere/pkg/api"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
 	"sort"
+	"strings"
 )

 type Interface interface {
@@ -36,14 +38,6 @@ func DefaultList(objects []runtime.Object, query *query.Query, compareFunc Compa
 		}
 	}

-	start, end := query.Pagination.GetPaginationSettings(len(filtered))
-	if !query.Pagination.IsPageAvailable(len(filtered), start) {
-		return &api.ListResult{
-			Items:      nil,
-			TotalItems: 0,
-		}
-	}
-
 	// sort by sortBy field
 	sort.Slice(filtered, func(i, j int) bool {
 		if !query.Ascending {
@@ -52,14 +46,88 @@ func DefaultList(objects []runtime.Object, query *query.Query, compareFunc Compa
 		return compareFunc(filtered[i], filtered[j], query.SortBy)
 	})

+	start, end := query.Pagination.GetValidPagination(len(filtered))
+
 	return &api.ListResult{
 		Items:      objectsToInterfaces(filtered[start:end]),
 		TotalItems: len(filtered),
 	}
 }

+func DefaultObjectMetaCompare(left, right metav1.ObjectMeta, sortBy query.Field) bool {
+	switch sortBy {
+	// ?sortBy=name
+	case query.FieldName:
+		return strings.Compare(left.Name, right.Name) > 0
+	//	?sortBy=creationTimestamp
+	case query.FieldCreationTimeStamp:
+		return left.CreationTimestamp.After(right.CreationTimestamp.Time)
+	default:
+		return false
+	}
+}
+
+//  Default metadata filter
+func DefaultObjectMetaFilter(item metav1.ObjectMeta, filter query.Filter) bool {
+	switch filter.Field {
+	// /namespaces?page=1&limit=10&name=default
+	case query.FieldName:
+		return strings.Contains(item.Name, string(filter.Value))
+		// /namespaces?page=1&limit=10&uid=a8a8d6cf-f6a5-4fea-9c1b-e57610115706
+	case query.FieldUID:
+		return strings.Compare(string(item.UID), string(filter.Value)) == 0
+		// /deployments?page=1&limit=10&namespace=kubesphere-system
+	case query.FieldNamespace:
+		return strings.Compare(item.Namespace, string(filter.Value)) == 0
+		// /namespaces?page=1&limit=10&ownerReference=a8a8d6cf-f6a5-4fea-9c1b-e57610115706
+	case query.FieldOwnerReference:
+		for _, ownerReference := range item.OwnerReferences {
+			if strings.Compare(string(ownerReference.UID), string(filter.Value)) == 0 {
+				return true
+			}
+		}
+		return false
+		// /namespaces?page=1&limit=10&ownerKind=Workspace
+	case query.FieldOwnerKind:
+		for _, ownerReference := range item.OwnerReferences {
+			if strings.Compare(ownerReference.Kind, string(filter.Value)) == 0 {
+				return true
+			}
+		}
+		return false
+		// /namespaces?page=1&limit=10&annotation=openpitrix_runtime
+	case query.FieldAnnotation:
+		return containsAnyValue(item.Annotations, string(filter.Value))
+		// /namespaces?page=1&limit=10&label=kubesphere.io/workspace:system-workspace
+	case query.FieldLabel:
+		return containsAnyValue(item.Labels, string(filter.Value))
+	case query.FieldClusterName:
+		return strings.Compare(item.ClusterName, string(filter.Value)) == 0
+	default:
+		return false
+	}
+}
+
+// Filter format <key:><value>,if the key is defined, the key must match exactly, value match according to strings.Contains.
+func containsAnyValue(keyValues map[string]string, filter string) bool {
+	fields := strings.SplitN(filter, ":", 2)
+	var keyFilter, valueFilter string
+	if len(fields) == 2 {
+		keyFilter = fields[0]
+		valueFilter = fields[1]
+	} else {
+		valueFilter = fields[0]
+	}
+	for key, value := range keyValues {
+		if (key == keyFilter || keyFilter == "") && strings.Contains(value, valueFilter) {
+			return true
+		}
+	}
+	return false
+}
+
 func objectsToInterfaces(objs []runtime.Object) []interface{} {
-	var res []interface{}
+	res := make([]interface{}, 0)
 	for _, obj := range objs {
 		res = append(res, obj)
 	}
--- a/pkg/models/resources/v1alpha3/namespace/namespaces.go
+++ b/pkg/models/resources/v1alpha3/namespace/namespaces.go
@@ -15,7 +15,7 @@ type namespaceGetter struct {
 	informers informers.SharedInformerFactory
 }

-func NewNamespaceGetter(informers informers.SharedInformerFactory) v1alpha3.Interface {
+func New(informers informers.SharedInformerFactory) v1alpha3.Interface {
 	return &namespaceGetter{informers: informers}
 }

@@ -42,14 +42,11 @@ func (n namespaceGetter) filter(item runtime.Object, filter query.Filter) bool {
 	if !ok {
 		return false
 	}
-
 	switch filter.Field {
-	case query.FieldName:
-		return query.ComparableString(namespace.Name).Contains(filter.Value)
 	case query.FieldStatus:
-		return query.ComparableString(namespace.Status.Phase).Compare(filter.Value) == 0
+		return strings.Compare(string(namespace.Status.Phase), string(filter.Value)) == 0
 	default:
-		return false
+		return v1alpha3.DefaultObjectMetaFilter(namespace.ObjectMeta, filter)
 	}
 }

@@ -63,13 +60,5 @@ func (n namespaceGetter) compare(left runtime.Object, right runtime.Object, fiel
 	if !ok {
 		return true
 	}
-
-	switch field {
-	case query.FieldName:
-		return strings.Compare(leftNs.Name, rightNs.Name) > 0
-	case query.FieldCreationTimeStamp:
-		return leftNs.CreationTimestamp.After(rightNs.CreationTimestamp.Time)
-	default:
-		return false
-	}
+	return v1alpha3.DefaultObjectMetaCompare(leftNs.ObjectMeta, rightNs.ObjectMeta, field)
 }
--- a/pkg/models/resources/v1alpha3/resource/resource.go
+++ b/pkg/models/resources/v1alpha3/resource/resource.go
@@ -8,27 +8,29 @@ import (
 	"kubesphere.io/kubesphere/pkg/informers"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/deployment"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/namespace"
 )

 var ErrResourceNotSupported = errors.New("resource is not supported")

-type NamespacedResourceGetter struct {
+type ResourceGetter struct {
 	getters map[schema.GroupVersionResource]v1alpha3.Interface
 }

-func New(factory informers.InformerFactory) *NamespacedResourceGetter {
+func New(factory informers.InformerFactory) *ResourceGetter {
 	getters := make(map[schema.GroupVersionResource]v1alpha3.Interface)

 	getters[schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}] = deployment.New(factory.KubernetesSharedInformerFactory())
+	getters[schema.GroupVersionResource{Group: "", Version: "v1", Resource: "namespaces"}] = namespace.New(factory.KubernetesSharedInformerFactory())

-	return &NamespacedResourceGetter{
+	return &ResourceGetter{
 		getters: getters,
 	}
 }

 // tryResource will retrieve a getter with resource name, it doesn't guarantee find resource with correct group version
 // need to refactor this use schema.GroupVersionResource
-func (r *NamespacedResourceGetter) tryResource(resource string) v1alpha3.Interface {
+func (r *ResourceGetter) tryResource(resource string) v1alpha3.Interface {
 	for k, v := range r.getters {
 		if k.Resource == resource {
 			return v
@@ -38,21 +40,18 @@ func (r *NamespacedResourceGetter) tryResource(resource string) v1alpha3.Interfa
 	return nil
 }

-func (r *NamespacedResourceGetter) Get(resource, namespace, name string) (interface{}, error) {
+func (r *ResourceGetter) Get(resource, namespace, name string) (interface{}, error) {
 	getter := r.tryResource(resource)
 	if getter == nil {
 		return nil, ErrResourceNotSupported
 	}
-
 	return getter.Get(namespace, name)
 }

-func (r *NamespacedResourceGetter) List(resource, namespace string, query *query.Query) (*api.ListResult, error) {
+func (r *ResourceGetter) List(resource, namespace string, query *query.Query) (*api.ListResult, error) {
 	getter := r.tryResource(resource)
 	if getter == nil {
 		return nil, ErrResourceNotSupported
 	}
-
 	return getter.List(namespace, query)
-
 }
--- a/pkg/models/resources/v1alpha3/resource/resource_test.go
+++ b/pkg/models/resources/v1alpha3/resource/resource_test.go
@@ -0,0 +1,111 @@
+/*
+ *
+ * Copyright 2020 The KubeSphere Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package resource
+
+import (
+	"github.com/google/go-cmp/cmp"
+	fakeapp "github.com/kubernetes-sigs/application/pkg/client/clientset/versioned/fake"
+	fakeistio "istio.io/client-go/pkg/clientset/versioned/fake"
+	v1 "k8s.io/api/core/v1"
+	corev1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	fakek8s "k8s.io/client-go/kubernetes/fake"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	fakeks "kubesphere.io/kubesphere/pkg/client/clientset/versioned/fake"
+	"kubesphere.io/kubesphere/pkg/informers"
+	"testing"
+)
+
+func TestResourceGetter(t *testing.T) {
+
+	namespaces := make([]interface{}, 0)
+	defaultNamespace := &v1.Namespace{
+		ObjectMeta: corev1.ObjectMeta{
+			Name:   "default",
+			Labels: map[string]string{"kubesphere.io/workspace": "system-workspace"},
+		},
+	}
+	kubesphereNamespace := &v1.Namespace{
+		ObjectMeta: corev1.ObjectMeta{
+			Name:   "kubesphere-system",
+			Labels: map[string]string{"kubesphere.io/workspace": "system-workspace"},
+		},
+	}
+
+	namespaces = append(namespaces, defaultNamespace, kubesphereNamespace)
+
+	ksClient := fakeks.NewSimpleClientset()
+	k8sClient := fakek8s.NewSimpleClientset(defaultNamespace, kubesphereNamespace)
+	istioClient := fakeistio.NewSimpleClientset()
+	appClient := fakeapp.NewSimpleClientset()
+	fakeInformerFactory := informers.NewInformerFactories(k8sClient, ksClient, istioClient, appClient)
+
+	k8sInformerFactory := fakeInformerFactory.KubernetesSharedInformerFactory()
+	for _, namespace := range namespaces {
+		err := k8sInformerFactory.Core().V1().Namespaces().Informer().GetIndexer().Add(namespace)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	resource := New(fakeInformerFactory)
+
+	tests := []struct {
+		Name           string
+		Resource       string
+		Namespace      string
+		Query          *query.Query
+		ExpectError    error
+		ExpectResponse *api.ListResult
+	}{
+		{
+			Name:      "normal case",
+			Resource:  "namespaces",
+			Namespace: "",
+			Query: &query.Query{
+				Pagination: &query.Pagination{
+					Limit:  10,
+					Offset: 0,
+				},
+				SortBy:    query.FieldName,
+				Ascending: false,
+				Filters:   []query.Filter{},
+			},
+			ExpectError: nil,
+			ExpectResponse: &api.ListResult{
+				Items:      namespaces,
+				TotalItems: 2,
+			},
+		},
+	}
+
+	for _, test := range tests {
+
+		result, err := resource.List(test.Resource, test.Namespace, test.Query)
+
+		t.Logf("%+v", result)
+		if err != test.ExpectError {
+			t.Errorf("expected error: %s, got: %s", test.ExpectError, err)
+		}
+		if diff := cmp.Diff(test.ExpectResponse, result); diff != "" {
+			t.Errorf(diff)
+		}
+	}
+
+}
--- a/pkg/models/tenant/workspaces.go
+++ b/pkg/models/tenant/workspaces.go
@@ -22,6 +22,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
 	"kubesphere.io/kubesphere/pkg/client/informers/externalversions"
 	"kubesphere.io/kubesphere/pkg/constants"
@@ -37,12 +38,10 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
-
-	iamapi "kubesphere.io/kubesphere/pkg/api/iam"
 )

 type InWorkspaceUser struct {
-	*iamapi.User
+	*iamv1alpha2.User
 	WorkspaceRole string `json:"workspaceRole"`
 }

--- a/pkg/simple/client/ldap/interface.go
+++ b/pkg/simple/client/ldap/interface.go
@@ -1,20 +1,22 @@
 package ldap

-import "kubesphere.io/kubesphere/pkg/api/iam"
+import (
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+)

 // Interface defines CRUD behaviors of manipulating users
 type Interface interface {
 	// Create create a new user in ldap
-	Create(user *iam.User) error
+	Create(user *iamv1alpha2.User) error

 	// Update updates a user information, return error if user not exists
-	Update(user *iam.User) error
+	Update(user *iamv1alpha2.User) error

 	// Delete deletes a user from ldap, return nil if user not exists
 	Delete(name string) error

 	// Get gets a user by its username from ldap, return ErrUserNotExists if user not exists
-	Get(name string) (*iam.User, error)
+	Get(name string) (*iamv1alpha2.User, error)

 	// Authenticate checks if (name, password) is valid, return ErrInvalidCredentials if not
 	Authenticate(name string, password string) error
--- a/pkg/simple/client/ldap/ldap.go
+++ b/pkg/simple/client/ldap/ldap.go
@@ -21,7 +21,8 @@ import (
 	"fmt"
 	"github.com/go-ldap/ldap"
 	"github.com/google/uuid"
-	"kubesphere.io/kubesphere/pkg/api/iam"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/server/errors"
 	"sync"
 	"time"
@@ -181,7 +182,7 @@ func (l *ldapInterfaceImpl) filterForUsername(username string) string {
 	return fmt.Sprintf("(&(objectClass=inetOrgPerson)(|(uid=%s)(mail=%s)))", username, username)
 }

-func (l *ldapInterfaceImpl) Get(name string) (*iam.User, error) {
+func (l *ldapInterfaceImpl) Get(name string) (*iamv1alpha2.User, error) {
 	conn, err := l.newConn()
 	if err != nil {
 		return nil, err
@@ -215,20 +216,24 @@ func (l *ldapInterfaceImpl) Get(name string) (*iam.User, error) {

 	userEntry := searchResults.Entries[0]

-	user := &iam.User{
-		Name:        userEntry.GetAttributeValue(ldapAttributeUserID),
-		Email:       userEntry.GetAttributeValue(ldapAttributeMail),
-		Lang:        userEntry.GetAttributeValue(ldapAttributePreferredLanguage),
-		Description: userEntry.GetAttributeValue(ldapAttributeDescription),
+	user := &iamv1alpha2.User{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: userEntry.GetAttributeValue(ldapAttributeUserID),
+		},
+		Spec: iamv1alpha2.UserSpec{
+			Email:       userEntry.GetAttributeValue(ldapAttributeMail),
+			Lang:        userEntry.GetAttributeValue(ldapAttributePreferredLanguage),
+			Description: userEntry.GetAttributeValue(ldapAttributeDescription),
+		},
 	}

 	createTimestamp, _ := time.Parse(ldapAttributeCreateTimestampLayout, userEntry.GetAttributeValue(ldapAttributeCreateTimestamp))
-	user.CreateTime = createTimestamp
+	user.ObjectMeta.CreationTimestamp.Time = createTimestamp

 	return user, nil
 }

-func (l *ldapInterfaceImpl) Create(user *iam.User) error {
+func (l *ldapInterfaceImpl) Create(user *iamv1alpha2.User) error {
 	if _, err := l.Get(user.Name); err != nil {
 		return ErrUserAlreadyExisted
 	}
@@ -266,19 +271,19 @@ func (l *ldapInterfaceImpl) Create(user *iam.User) error {
 			},
 			{
 				Type: ldapAttributeMail,
-				Vals: []string{user.Email},
+				Vals: []string{user.Spec.Email},
 			},
 			{
 				Type: ldapAttributeUserPassword,
-				Vals: []string{user.Password},
+				Vals: []string{user.Spec.EncryptedPassword},
 			},
 			{
 				Type: ldapAttributePreferredLanguage,
-				Vals: []string{user.Lang},
+				Vals: []string{user.Spec.Lang},
 			},
 			{
 				Type: ldapAttributeDescription,
-				Vals: []string{user.Description},
+				Vals: []string{user.Spec.Description},
 			},
 		},
 	}
@@ -314,7 +319,7 @@ func (l *ldapInterfaceImpl) Delete(name string) error {
 	return conn.Del(deleteRequest)
 }

-func (l *ldapInterfaceImpl) Update(newUser *iam.User) error {
+func (l *ldapInterfaceImpl) Update(newUser *iamv1alpha2.User) error {
 	conn, err := l.newConn()
 	if err != nil {
 		return err
@@ -331,16 +336,16 @@ func (l *ldapInterfaceImpl) Update(newUser *iam.User) error {
 		DN: l.dnForUsername(newUser.Name),
 	}

-	if newUser.Description != "" {
-		modifyRequest.Replace(ldapAttributeDescription, []string{newUser.Description})
+	if newUser.Spec.Description != "" {
+		modifyRequest.Replace(ldapAttributeDescription, []string{newUser.Spec.Description})
 	}

-	if newUser.Lang != "" {
-		modifyRequest.Replace(ldapAttributePreferredLanguage, []string{newUser.Lang})
+	if newUser.Spec.Lang != "" {
+		modifyRequest.Replace(ldapAttributePreferredLanguage, []string{newUser.Spec.Lang})
 	}

-	if newUser.Password != "" {
-		modifyRequest.Replace(ldapAttributeUserPassword, []string{newUser.Password})
+	if newUser.Spec.EncryptedPassword != "" {
+		modifyRequest.Replace(ldapAttributeUserPassword, []string{newUser.Spec.EncryptedPassword})
 	}

 	return conn.Modify(modifyRequest)
--- a/pkg/simple/client/ldap/simple_ldap.go
+++ b/pkg/simple/client/ldap/simple_ldap.go
@@ -1,40 +1,43 @@
 package ldap

 import (
-	"kubesphere.io/kubesphere/pkg/api/iam"
-	"time"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 )

 // simpleLdap is a implementation of ldap.Interface, you should never use this in production env!
 type simpleLdap struct {
-	store map[string]*iam.User
+	store map[string]*iamv1alpha2.User
 }

 func NewSimpleLdap() Interface {
 	sl := &simpleLdap{
-		store: map[string]*iam.User{},
+		store: map[string]*iamv1alpha2.User{},
 	}

 	// initialize with a admin user
-	admin := &iam.User{
-		Name:        "admin",
-		Email:       "admin@kubesphere.io",
-		Lang:        "eng",
-		Description: "administrator",
-		CreateTime:  time.Now(),
-		Groups:      nil,
-		Password:    "P@88w0rd",
+	admin := &iamv1alpha2.User{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "admin",
+		},
+		Spec: iamv1alpha2.UserSpec{
+			Email:             "admin@kubesphere.io",
+			Lang:              "eng",
+			Description:       "administrator",
+			Groups:            nil,
+			EncryptedPassword: "P@88w0rd",
+		},
 	}
 	sl.store[admin.Name] = admin
 	return sl
 }

-func (s simpleLdap) Create(user *iam.User) error {
+func (s simpleLdap) Create(user *iamv1alpha2.User) error {
 	s.store[user.Name] = user
 	return nil
 }

-func (s simpleLdap) Update(user *iam.User) error {
+func (s simpleLdap) Update(user *iamv1alpha2.User) error {
 	_, err := s.Get(user.Name)
 	if err != nil {
 		return err
@@ -52,7 +55,7 @@ func (s simpleLdap) Delete(name string) error {
 	return nil
 }

-func (s simpleLdap) Get(name string) (*iam.User, error) {
+func (s simpleLdap) Get(name string) (*iamv1alpha2.User, error) {
 	if user, ok := s.store[name]; !ok {
 		return nil, ErrUserNotExists
 	} else {
@@ -64,7 +67,7 @@ func (s simpleLdap) Authenticate(name string, password string) error {
 	if user, err := s.Get(name); err != nil {
 		return err
 	} else {
-		if user.Password != password {
+		if user.Spec.EncryptedPassword != password {
 			return ErrInvalidCredentials
 		}
 	}
--- a/pkg/simple/client/ldap/simple_ldap_test.go
+++ b/pkg/simple/client/ldap/simple_ldap_test.go
@@ -2,22 +2,26 @@ package ldap

 import (
 	"github.com/google/go-cmp/cmp"
-	"kubesphere.io/kubesphere/pkg/api/iam"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"testing"
-	"time"
 )

 func TestSimpleLdap(t *testing.T) {
 	ldapClient := NewSimpleLdap()

-	foo := &iam.User{
-		Name:        "jerry",
-		Email:       "jerry@kubesphere.io",
-		Lang:        "en",
-		Description: "Jerry is kind and gentle.",
-		CreateTime:  time.Now(),
-		Groups:      []string{},
-		Password:    "P@88w0rd",
+	foo := &iamv1alpha2.User{
+		TypeMeta: metav1.TypeMeta{APIVersion: iamv1alpha2.SchemeGroupVersion.String()},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "jerry",
+		},
+		Spec: iamv1alpha2.UserSpec{
+			Email:             "jerry@kubesphere.io",
+			Lang:              "en",
+			Description:       "Jerry is kind and gentle.",
+			Groups:            []string{},
+			EncryptedPassword: "P@88w0rd",
+		},
 	}

 	t.Run("should create user", func(t *testing.T) {
@@ -44,7 +48,7 @@ func TestSimpleLdap(t *testing.T) {
 			t.Fatal(err)
 		}

-		foo.Description = "Jerry needs some drinks."
+		foo.Spec.Description = "Jerry needs some drinks."
 		err = ldapClient.Update(foo)
 		if err != nil {
 			t.Fatal(err)
@@ -85,7 +89,7 @@ func TestSimpleLdap(t *testing.T) {
 			t.Fatal(err)
 		}

-		err = ldapClient.Authenticate(foo.Name, foo.Password)
+		err = ldapClient.Authenticate(foo.Name, foo.Spec.EncryptedPassword)
 		if err != nil {
 			t.Fatalf("should pass but got an error %v", err)
 		}
--- a/vendor/github.com/cenkalti/backoff/.gitignore
+++ b/vendor/github.com/cenkalti/backoff/.gitignore
@@ -1,22 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
--- a/vendor/github.com/cenkalti/backoff/.travis.yml
+++ b/vendor/github.com/cenkalti/backoff/.travis.yml
@@ -1,10 +0,0 @@
-language: go
-go:
-  - 1.7
-  - 1.x
-  - tip
-before_install:
-  - go get github.com/mattn/goveralls
-  - go get golang.org/x/tools/cmd/cover
-script:
-  - $HOME/gopath/bin/goveralls -service=travis-ci
--- a/vendor/github.com/cenkalti/backoff/LICENSE
+++ b/vendor/github.com/cenkalti/backoff/LICENSE
@@ -1,20 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2014 Cenk Altı
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software is furnished to do so,
-subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
--- a/vendor/github.com/cenkalti/backoff/README.md
+++ b/vendor/github.com/cenkalti/backoff/README.md
@@ -1,30 +0,0 @@
-# Exponential Backoff [![GoDoc][godoc image]][godoc] [![Build Status][travis image]][travis] [![Coverage Status][coveralls image]][coveralls]
-
-This is a Go port of the exponential backoff algorithm from [Google's HTTP Client Library for Java][google-http-java-client].
-
-[Exponential backoff][exponential backoff wiki]
-is an algorithm that uses feedback to multiplicatively decrease the rate of some process,
-in order to gradually find an acceptable rate.
-The retries exponentially increase and stop increasing when a certain threshold is met.
-
-## Usage
-
-See https://godoc.org/github.com/cenkalti/backoff#pkg-examples
-
-## Contributing
-
-* I would like to keep this library as small as possible.
-* Please don't send a PR without opening an issue and discussing it first.
-* If proposed change is not a common use case, I will probably not accept it.
-
-[godoc]: https://godoc.org/github.com/cenkalti/backoff
-[godoc image]: https://godoc.org/github.com/cenkalti/backoff?status.png
-[travis]: https://travis-ci.org/cenkalti/backoff
-[travis image]: https://travis-ci.org/cenkalti/backoff.png?branch=master
-[coveralls]: https://coveralls.io/github/cenkalti/backoff?branch=master
-[coveralls image]: https://coveralls.io/repos/github/cenkalti/backoff/badge.svg?branch=master
-
-[google-http-java-client]: https://github.com/google/google-http-java-client/blob/da1aa993e90285ec18579f1553339b00e19b3ab5/google-http-client/src/main/java/com/google/api/client/util/ExponentialBackOff.java
-[exponential backoff wiki]: http://en.wikipedia.org/wiki/Exponential_backoff
-
-[advanced example]: https://godoc.org/github.com/cenkalti/backoff#example_
--- a/vendor/github.com/cenkalti/backoff/backoff.go
+++ b/vendor/github.com/cenkalti/backoff/backoff.go
@@ -1,66 +0,0 @@
-// Package backoff implements backoff algorithms for retrying operations.
-//
-// Use Retry function for retrying operations that may fail.
-// If Retry does not meet your needs,
-// copy/paste the function into your project and modify as you wish.
-//
-// There is also Ticker type similar to time.Ticker.
-// You can use it if you need to work with channels.
-//
-// See Examples section below for usage examples.
-package backoff
-
-import "time"
-
-// BackOff is a backoff policy for retrying an operation.
-type BackOff interface {
-	// NextBackOff returns the duration to wait before retrying the operation,
-	// or backoff. Stop to indicate that no more retries should be made.
-	//
-	// Example usage:
-	//
-	// 	duration := backoff.NextBackOff();
-	// 	if (duration == backoff.Stop) {
-	// 		// Do not retry operation.
-	// 	} else {
-	// 		// Sleep for duration and retry operation.
-	// 	}
-	//
-	NextBackOff() time.Duration
-
-	// Reset to initial state.
-	Reset()
-}
-
-// Stop indicates that no more retries should be made for use in NextBackOff().
-const Stop time.Duration = -1
-
-// ZeroBackOff is a fixed backoff policy whose backoff time is always zero,
-// meaning that the operation is retried immediately without waiting, indefinitely.
-type ZeroBackOff struct{}
-
-func (b *ZeroBackOff) Reset() {}
-
-func (b *ZeroBackOff) NextBackOff() time.Duration { return 0 }
-
-// StopBackOff is a fixed backoff policy that always returns backoff.Stop for
-// NextBackOff(), meaning that the operation should never be retried.
-type StopBackOff struct{}
-
-func (b *StopBackOff) Reset() {}
-
-func (b *StopBackOff) NextBackOff() time.Duration { return Stop }
-
-// ConstantBackOff is a backoff policy that always returns the same backoff delay.
-// This is in contrast to an exponential backoff policy,
-// which returns a delay that grows longer as you call NextBackOff() over and over again.
-type ConstantBackOff struct {
-	Interval time.Duration
-}
-
-func (b *ConstantBackOff) Reset()                     {}
-func (b *ConstantBackOff) NextBackOff() time.Duration { return b.Interval }
-
-func NewConstantBackOff(d time.Duration) *ConstantBackOff {
-	return &ConstantBackOff{Interval: d}
-}
--- a/vendor/github.com/cenkalti/backoff/context.go
+++ b/vendor/github.com/cenkalti/backoff/context.go
@@ -1,63 +0,0 @@
-package backoff
-
-import (
-	"context"
-	"time"
-)
-
-// BackOffContext is a backoff policy that stops retrying after the context
-// is canceled.
-type BackOffContext interface {
-	BackOff
-	Context() context.Context
-}
-
-type backOffContext struct {
-	BackOff
-	ctx context.Context
-}
-
-// WithContext returns a BackOffContext with context ctx
-//
-// ctx must not be nil
-func WithContext(b BackOff, ctx context.Context) BackOffContext {
-	if ctx == nil {
-		panic("nil context")
-	}
-
-	if b, ok := b.(*backOffContext); ok {
-		return &backOffContext{
-			BackOff: b.BackOff,
-			ctx:     ctx,
-		}
-	}
-
-	return &backOffContext{
-		BackOff: b,
-		ctx:     ctx,
-	}
-}
-
-func ensureContext(b BackOff) BackOffContext {
-	if cb, ok := b.(BackOffContext); ok {
-		return cb
-	}
-	return WithContext(b, context.Background())
-}
-
-func (b *backOffContext) Context() context.Context {
-	return b.ctx
-}
-
-func (b *backOffContext) NextBackOff() time.Duration {
-	select {
-	case <-b.ctx.Done():
-		return Stop
-	default:
-	}
-	next := b.BackOff.NextBackOff()
-	if deadline, ok := b.ctx.Deadline(); ok && deadline.Sub(time.Now()) < next {
-		return Stop
-	}
-	return next
-}
--- a/vendor/github.com/cenkalti/backoff/exponential.go
+++ b/vendor/github.com/cenkalti/backoff/exponential.go
@@ -1,153 +0,0 @@
-package backoff
-
-import (
-	"math/rand"
-	"time"
-)
-
-/*
-ExponentialBackOff is a backoff implementation that increases the backoff
-period for each retry attempt using a randomization function that grows exponentially.
-
-NextBackOff() is calculated using the following formula:
-
- randomized interval =
-     RetryInterval * (random value in range [1 - RandomizationFactor, 1 + RandomizationFactor])
-
-In other words NextBackOff() will range between the randomization factor
-percentage below and above the retry interval.
-
-For example, given the following parameters:
-
- RetryInterval = 2
- RandomizationFactor = 0.5
- Multiplier = 2
-
-the actual backoff period used in the next retry attempt will range between 1 and 3 seconds,
-multiplied by the exponential, that is, between 2 and 6 seconds.
-
-Note: MaxInterval caps the RetryInterval and not the randomized interval.
-
-If the time elapsed since an ExponentialBackOff instance is created goes past the
-MaxElapsedTime, then the method NextBackOff() starts returning backoff.Stop.
-
-The elapsed time can be reset by calling Reset().
-
-Example: Given the following default arguments, for 10 tries the sequence will be,
-and assuming we go over the MaxElapsedTime on the 10th try:
-
- Request #  RetryInterval (seconds)  Randomized Interval (seconds)
-
-  1          0.5                     [0.25,   0.75]
-  2          0.75                    [0.375,  1.125]
-  3          1.125                   [0.562,  1.687]
-  4          1.687                   [0.8435, 2.53]
-  5          2.53                    [1.265,  3.795]
-  6          3.795                   [1.897,  5.692]
-  7          5.692                   [2.846,  8.538]
-  8          8.538                   [4.269, 12.807]
-  9         12.807                   [6.403, 19.210]
- 10         19.210                   backoff.Stop
-
-Note: Implementation is not thread-safe.
-*/
-type ExponentialBackOff struct {
-	InitialInterval     time.Duration
-	RandomizationFactor float64
-	Multiplier          float64
-	MaxInterval         time.Duration
-	// After MaxElapsedTime the ExponentialBackOff stops.
-	// It never stops if MaxElapsedTime == 0.
-	MaxElapsedTime time.Duration
-	Clock          Clock
-
-	currentInterval time.Duration
-	startTime       time.Time
-}
-
-// Clock is an interface that returns current time for BackOff.
-type Clock interface {
-	Now() time.Time
-}
-
-// Default values for ExponentialBackOff.
-const (
-	DefaultInitialInterval     = 500 * time.Millisecond
-	DefaultRandomizationFactor = 0.5
-	DefaultMultiplier          = 1.5
-	DefaultMaxInterval         = 60 * time.Second
-	DefaultMaxElapsedTime      = 15 * time.Minute
-)
-
-// NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
-func NewExponentialBackOff() *ExponentialBackOff {
-	b := &ExponentialBackOff{
-		InitialInterval:     DefaultInitialInterval,
-		RandomizationFactor: DefaultRandomizationFactor,
-		Multiplier:          DefaultMultiplier,
-		MaxInterval:         DefaultMaxInterval,
-		MaxElapsedTime:      DefaultMaxElapsedTime,
-		Clock:               SystemClock,
-	}
-	b.Reset()
-	return b
-}
-
-type systemClock struct{}
-
-func (t systemClock) Now() time.Time {
-	return time.Now()
-}
-
-// SystemClock implements Clock interface that uses time.Now().
-var SystemClock = systemClock{}
-
-// Reset the interval back to the initial retry interval and restarts the timer.
-func (b *ExponentialBackOff) Reset() {
-	b.currentInterval = b.InitialInterval
-	b.startTime = b.Clock.Now()
-}
-
-// NextBackOff calculates the next backoff interval using the formula:
-// 	Randomized interval = RetryInterval +/- (RandomizationFactor * RetryInterval)
-func (b *ExponentialBackOff) NextBackOff() time.Duration {
-	// Make sure we have not gone over the maximum elapsed time.
-	if b.MaxElapsedTime != 0 && b.GetElapsedTime() > b.MaxElapsedTime {
-		return Stop
-	}
-	defer b.incrementCurrentInterval()
-	return getRandomValueFromInterval(b.RandomizationFactor, rand.Float64(), b.currentInterval)
-}
-
-// GetElapsedTime returns the elapsed time since an ExponentialBackOff instance
-// is created and is reset when Reset() is called.
-//
-// The elapsed time is computed using time.Now().UnixNano(). It is
-// safe to call even while the backoff policy is used by a running
-// ticker.
-func (b *ExponentialBackOff) GetElapsedTime() time.Duration {
-	return b.Clock.Now().Sub(b.startTime)
-}
-
-// Increments the current interval by multiplying it with the multiplier.
-func (b *ExponentialBackOff) incrementCurrentInterval() {
-	// Check for overflow, if overflow is detected set the current interval to the max interval.
-	if float64(b.currentInterval) >= float64(b.MaxInterval)/b.Multiplier {
-		b.currentInterval = b.MaxInterval
-	} else {
-		b.currentInterval = time.Duration(float64(b.currentInterval) * b.Multiplier)
-	}
-}
-
-// Returns a random value from the following interval:
-// 	[randomizationFactor * currentInterval, randomizationFactor * currentInterval].
-func getRandomValueFromInterval(randomizationFactor, random float64, currentInterval time.Duration) time.Duration {
-	var delta = randomizationFactor * float64(currentInterval)
-	var minInterval = float64(currentInterval) - delta
-	var maxInterval = float64(currentInterval) + delta
-
-	// Get a random value from the range [minInterval, maxInterval].
-	// The formula used below has a +1 because if the minInterval is 1 and the maxInterval is 3 then
-	// we want a 33% chance for selecting either 1, 2 or 3.
-	return time.Duration(minInterval + (random * (maxInterval - minInterval + 1)))
-}
--- a/vendor/github.com/cenkalti/backoff/retry.go
+++ b/vendor/github.com/cenkalti/backoff/retry.go
@@ -1,82 +0,0 @@
-package backoff
-
-import "time"
-
-// An Operation is executing by Retry() or RetryNotify().
-// The operation will be retried using a backoff policy if it returns an error.
-type Operation func() error
-
-// Notify is a notify-on-error function. It receives an operation error and
-// backoff delay if the operation failed (with an error).
-//
-// NOTE that if the backoff policy stated to stop retrying,
-// the notify function isn't called.
-type Notify func(error, time.Duration)
-
-// Retry the operation o until it does not return error or BackOff stops.
-// o is guaranteed to be run at least once.
-//
-// If o returns a *PermanentError, the operation is not retried, and the
-// wrapped error is returned.
-//
-// Retry sleeps the goroutine for the duration returned by BackOff after a
-// failed operation returns.
-func Retry(o Operation, b BackOff) error { return RetryNotify(o, b, nil) }
-
-// RetryNotify calls notify function with the error and wait duration
-// for each failed attempt before sleep.
-func RetryNotify(operation Operation, b BackOff, notify Notify) error {
-	var err error
-	var next time.Duration
-	var t *time.Timer
-
-	cb := ensureContext(b)
-
-	b.Reset()
-	for {
-		if err = operation(); err == nil {
-			return nil
-		}
-
-		if permanent, ok := err.(*PermanentError); ok {
-			return permanent.Err
-		}
-
-		if next = cb.NextBackOff(); next == Stop {
-			return err
-		}
-
-		if notify != nil {
-			notify(err, next)
-		}
-
-		if t == nil {
-			t = time.NewTimer(next)
-			defer t.Stop()
-		} else {
-			t.Reset(next)
-		}
-
-		select {
-		case <-cb.Context().Done():
-			return err
-		case <-t.C:
-		}
-	}
-}
-
-// PermanentError signals that the operation should not be retried.
-type PermanentError struct {
-	Err error
-}
-
-func (e *PermanentError) Error() string {
-	return e.Err.Error()
-}
-
-// Permanent wraps the given err in a *PermanentError.
-func Permanent(err error) *PermanentError {
-	return &PermanentError{
-		Err: err,
-	}
-}
--- a/vendor/github.com/cenkalti/backoff/ticker.go
+++ b/vendor/github.com/cenkalti/backoff/ticker.go
@@ -1,82 +0,0 @@
-package backoff
-
-import (
-	"sync"
-	"time"
-)
-
-// Ticker holds a channel that delivers `ticks' of a clock at times reported by a BackOff.
-//
-// Ticks will continue to arrive when the previous operation is still running,
-// so operations that take a while to fail could run in quick succession.
-type Ticker struct {
-	C        <-chan time.Time
-	c        chan time.Time
-	b        BackOffContext
-	stop     chan struct{}
-	stopOnce sync.Once
-}
-
-// NewTicker returns a new Ticker containing a channel that will send
-// the time at times specified by the BackOff argument. Ticker is
-// guaranteed to tick at least once.  The channel is closed when Stop
-// method is called or BackOff stops. It is not safe to manipulate the
-// provided backoff policy (notably calling NextBackOff or Reset)
-// while the ticker is running.
-func NewTicker(b BackOff) *Ticker {
-	c := make(chan time.Time)
-	t := &Ticker{
-		C:    c,
-		c:    c,
-		b:    ensureContext(b),
-		stop: make(chan struct{}),
-	}
-	t.b.Reset()
-	go t.run()
-	return t
-}
-
-// Stop turns off a ticker. After Stop, no more ticks will be sent.
-func (t *Ticker) Stop() {
-	t.stopOnce.Do(func() { close(t.stop) })
-}
-
-func (t *Ticker) run() {
-	c := t.c
-	defer close(c)
-
-	// Ticker is guaranteed to tick at least once.
-	afterC := t.send(time.Now())
-
-	for {
-		if afterC == nil {
-			return
-		}
-
-		select {
-		case tick := <-afterC:
-			afterC = t.send(tick)
-		case <-t.stop:
-			t.c = nil // Prevent future ticks from being sent to the channel.
-			return
-		case <-t.b.Context().Done():
-			return
-		}
-	}
-}
-
-func (t *Ticker) send(tick time.Time) <-chan time.Time {
-	select {
-	case t.c <- tick:
-	case <-t.stop:
-		return nil
-	}
-
-	next := t.b.NextBackOff()
-	if next == Stop {
-		t.Stop()
-		return nil
-	}
-
-	return time.After(next)
-}
--- a/vendor/github.com/cenkalti/backoff/tries.go
+++ b/vendor/github.com/cenkalti/backoff/tries.go
@@ -1,35 +0,0 @@
-package backoff
-
-import "time"
-
-/*
-WithMaxRetries creates a wrapper around another BackOff, which will
-return Stop if NextBackOff() has been called too many times since
-the last time Reset() was called
-
-Note: Implementation is not thread-safe.
-*/
-func WithMaxRetries(b BackOff, max uint64) BackOff {
-	return &backOffTries{delegate: b, maxTries: max}
-}
-
-type backOffTries struct {
-	delegate BackOff
-	maxTries uint64
-	numTries uint64
-}
-
-func (b *backOffTries) NextBackOff() time.Duration {
-	if b.maxTries > 0 {
-		if b.maxTries <= b.numTries {
-			return Stop
-		}
-		b.numTries++
-	}
-	return b.delegate.NextBackOff()
-}
-
-func (b *backOffTries) Reset() {
-	b.numTries = 0
-	b.delegate.Reset()
-}
--- a/vendor/github.com/cheekybits/genny/LICENSE
+++ b/vendor/github.com/cheekybits/genny/LICENSE
@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2014 cheekybits
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
--- a/vendor/github.com/cheekybits/genny/generic/doc.go
+++ b/vendor/github.com/cheekybits/genny/generic/doc.go
@@ -1,2 +0,0 @@
-// Package generic contains the generic marker types.
-package generic
--- a/vendor/github.com/cheekybits/genny/generic/generic.go
+++ b/vendor/github.com/cheekybits/genny/generic/generic.go
@@ -1,13 +0,0 @@
-package generic
-
-// Type is the placeholder type that indicates a generic value.
-// When genny is executed, variables of this type will be replaced with
-// references to the specific types.
-//      var GenericType generic.Type
-type Type interface{}
-
-// Number is the placehoder type that indiccates a generic numerical value.
-// When genny is executed, variables of this type will be replaced with
-// references to the specific types.
-//      var GenericType generic.Number
-type Number float64
--- a/vendor/github.com/dustin/go-humanize/.travis.yml
+++ b/vendor/github.com/dustin/go-humanize/.travis.yml
@@ -1,21 +0,0 @@
-sudo: false
-language: go
-go:
-  - 1.3.x
-  - 1.5.x
-  - 1.6.x
-  - 1.7.x
-  - 1.8.x
-  - 1.9.x
-  - master
-matrix:
-  allow_failures:
-    - go: master
-  fast_finish: true
-install:
-  - # Do nothing. This is needed to prevent default install action "go get -t -v ./..." from happening here (we want it to happen inside script step).
-script:
-  - go get -t -v ./...
-  - diff -u <(echo -n) <(gofmt -d -s .)
-  - go tool vet .
-  - go test -v -race ./...
--- a/vendor/github.com/dustin/go-humanize/LICENSE
+++ b/vendor/github.com/dustin/go-humanize/LICENSE
@@ -1,21 +0,0 @@
-Copyright (c) 2005-2008  Dustin Sallings <dustin@spy.net>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-<http://www.opensource.org/licenses/mit-license.php>
--- a/vendor/github.com/dustin/go-humanize/README.markdown
+++ b/vendor/github.com/dustin/go-humanize/README.markdown
@@ -1,124 +0,0 @@
-# Humane Units [![Build Status](https://travis-ci.org/dustin/go-humanize.svg?branch=master)](https://travis-ci.org/dustin/go-humanize) [![GoDoc](https://godoc.org/github.com/dustin/go-humanize?status.svg)](https://godoc.org/github.com/dustin/go-humanize)
-
-Just a few functions for helping humanize times and sizes.
-
-`go get` it as `github.com/dustin/go-humanize`, import it as
-`"github.com/dustin/go-humanize"`, use it as `humanize`.
-
-See [godoc](https://godoc.org/github.com/dustin/go-humanize) for
-complete documentation.
-
-## Sizes
-
-This lets you take numbers like `82854982` and convert them to useful
-strings like, `83 MB` or `79 MiB` (whichever you prefer).
-
-Example:
-
-```go
-fmt.Printf("That file is %s.", humanize.Bytes(82854982)) // That file is 83 MB.
-```
-
-## Times
-
-This lets you take a `time.Time` and spit it out in relative terms.
-For example, `12 seconds ago` or `3 days from now`.
-
-Example:
-
-```go
-fmt.Printf("This was touched %s.", humanize.Time(someTimeInstance)) // This was touched 7 hours ago.
-```
-
-Thanks to Kyle Lemons for the time implementation from an IRC
-conversation one day. It's pretty neat.
-
-## Ordinals
-
-From a [mailing list discussion][odisc] where a user wanted to be able
-to label ordinals.
-
-    0 -> 0th
-    1 -> 1st
-    2 -> 2nd
-    3 -> 3rd
-    4 -> 4th
-    [...]
-
-Example:
-
-```go
-fmt.Printf("You're my %s best friend.", humanize.Ordinal(193)) // You are my 193rd best friend.
-```
-
-## Commas
-
-Want to shove commas into numbers? Be my guest.
-
-    0 -> 0
-    100 -> 100
-    1000 -> 1,000
-    1000000000 -> 1,000,000,000
-    -100000 -> -100,000
-
-Example:
-
-```go
-fmt.Printf("You owe $%s.\n", humanize.Comma(6582491)) // You owe $6,582,491.
-```
-
-## Ftoa
-
-Nicer float64 formatter that removes trailing zeros.
-
-```go
-fmt.Printf("%f", 2.24)                // 2.240000
-fmt.Printf("%s", humanize.Ftoa(2.24)) // 2.24
-fmt.Printf("%f", 2.0)                 // 2.000000
-fmt.Printf("%s", humanize.Ftoa(2.0))  // 2
-```
-
-## SI notation
-
-Format numbers with [SI notation][sinotation].
-
-Example:
-
-```go
-humanize.SI(0.00000000223, "M") // 2.23 nM
-```
-
-## English-specific functions
-
-The following functions are in the `humanize/english` subpackage.
-
-### Plurals
-
-Simple English pluralization
-
-```go
-english.PluralWord(1, "object", "") // object
-english.PluralWord(42, "object", "") // objects
-english.PluralWord(2, "bus", "") // buses
-english.PluralWord(99, "locus", "loci") // loci
-
-english.Plural(1, "object", "") // 1 object
-english.Plural(42, "object", "") // 42 objects
-english.Plural(2, "bus", "") // 2 buses
-english.Plural(99, "locus", "loci") // 99 loci
-```
-
-### Word series
-
-Format comma-separated words lists with conjuctions:
-
-```go
-english.WordSeries([]string{"foo"}, "and") // foo
-english.WordSeries([]string{"foo", "bar"}, "and") // foo and bar
-english.WordSeries([]string{"foo", "bar", "baz"}, "and") // foo, bar and baz
-
-english.OxfordWordSeries([]string{"foo", "bar", "baz"}, "and") // foo, bar, and baz
-```
-
-[odisc]: https://groups.google.com/d/topic/golang-nuts/l8NhI74jl-4/discussion
-[sinotation]: http://en.wikipedia.org/wiki/Metric_prefix
--- a/vendor/github.com/dustin/go-humanize/big.go
+++ b/vendor/github.com/dustin/go-humanize/big.go
@@ -1,31 +0,0 @@
-package humanize
-
-import (
-	"math/big"
-)
-
-// order of magnitude (to a max order)
-func oomm(n, b *big.Int, maxmag int) (float64, int) {
-	mag := 0
-	m := &big.Int{}
-	for n.Cmp(b) >= 0 {
-		n.DivMod(n, b, m)
-		mag++
-		if mag == maxmag && maxmag >= 0 {
-			break
-		}
-	}
-	return float64(n.Int64()) + (float64(m.Int64()) / float64(b.Int64())), mag
-}
-
-// total order of magnitude
-// (same as above, but with no upper limit)
-func oom(n, b *big.Int) (float64, int) {
-	mag := 0
-	m := &big.Int{}
-	for n.Cmp(b) >= 0 {
-		n.DivMod(n, b, m)
-		mag++
-	}
-	return float64(n.Int64()) + (float64(m.Int64()) / float64(b.Int64())), mag
-}
--- a/vendor/github.com/dustin/go-humanize/bigbytes.go
+++ b/vendor/github.com/dustin/go-humanize/bigbytes.go
@@ -1,173 +0,0 @@
-package humanize
-
-import (
-	"fmt"
-	"math/big"
-	"strings"
-	"unicode"
-)
-
-var (
-	bigIECExp = big.NewInt(1024)
-
-	// BigByte is one byte in bit.Ints
-	BigByte = big.NewInt(1)
-	// BigKiByte is 1,024 bytes in bit.Ints
-	BigKiByte = (&big.Int{}).Mul(BigByte, bigIECExp)
-	// BigMiByte is 1,024 k bytes in bit.Ints
-	BigMiByte = (&big.Int{}).Mul(BigKiByte, bigIECExp)
-	// BigGiByte is 1,024 m bytes in bit.Ints
-	BigGiByte = (&big.Int{}).Mul(BigMiByte, bigIECExp)
-	// BigTiByte is 1,024 g bytes in bit.Ints
-	BigTiByte = (&big.Int{}).Mul(BigGiByte, bigIECExp)
-	// BigPiByte is 1,024 t bytes in bit.Ints
-	BigPiByte = (&big.Int{}).Mul(BigTiByte, bigIECExp)
-	// BigEiByte is 1,024 p bytes in bit.Ints
-	BigEiByte = (&big.Int{}).Mul(BigPiByte, bigIECExp)
-	// BigZiByte is 1,024 e bytes in bit.Ints
-	BigZiByte = (&big.Int{}).Mul(BigEiByte, bigIECExp)
-	// BigYiByte is 1,024 z bytes in bit.Ints
-	BigYiByte = (&big.Int{}).Mul(BigZiByte, bigIECExp)
-)
-
-var (
-	bigSIExp = big.NewInt(1000)
-
-	// BigSIByte is one SI byte in big.Ints
-	BigSIByte = big.NewInt(1)
-	// BigKByte is 1,000 SI bytes in big.Ints
-	BigKByte = (&big.Int{}).Mul(BigSIByte, bigSIExp)
-	// BigMByte is 1,000 SI k bytes in big.Ints
-	BigMByte = (&big.Int{}).Mul(BigKByte, bigSIExp)
-	// BigGByte is 1,000 SI m bytes in big.Ints
-	BigGByte = (&big.Int{}).Mul(BigMByte, bigSIExp)
-	// BigTByte is 1,000 SI g bytes in big.Ints
-	BigTByte = (&big.Int{}).Mul(BigGByte, bigSIExp)
-	// BigPByte is 1,000 SI t bytes in big.Ints
-	BigPByte = (&big.Int{}).Mul(BigTByte, bigSIExp)
-	// BigEByte is 1,000 SI p bytes in big.Ints
-	BigEByte = (&big.Int{}).Mul(BigPByte, bigSIExp)
-	// BigZByte is 1,000 SI e bytes in big.Ints
-	BigZByte = (&big.Int{}).Mul(BigEByte, bigSIExp)
-	// BigYByte is 1,000 SI z bytes in big.Ints
-	BigYByte = (&big.Int{}).Mul(BigZByte, bigSIExp)
-)
-
-var bigBytesSizeTable = map[string]*big.Int{
-	"b":   BigByte,
-	"kib": BigKiByte,
-	"kb":  BigKByte,
-	"mib": BigMiByte,
-	"mb":  BigMByte,
-	"gib": BigGiByte,
-	"gb":  BigGByte,
-	"tib": BigTiByte,
-	"tb":  BigTByte,
-	"pib": BigPiByte,
-	"pb":  BigPByte,
-	"eib": BigEiByte,
-	"eb":  BigEByte,
-	"zib": BigZiByte,
-	"zb":  BigZByte,
-	"yib": BigYiByte,
-	"yb":  BigYByte,
-	// Without suffix
-	"":   BigByte,
-	"ki": BigKiByte,
-	"k":  BigKByte,
-	"mi": BigMiByte,
-	"m":  BigMByte,
-	"gi": BigGiByte,
-	"g":  BigGByte,
-	"ti": BigTiByte,
-	"t":  BigTByte,
-	"pi": BigPiByte,
-	"p":  BigPByte,
-	"ei": BigEiByte,
-	"e":  BigEByte,
-	"z":  BigZByte,
-	"zi": BigZiByte,
-	"y":  BigYByte,
-	"yi": BigYiByte,
-}
-
-var ten = big.NewInt(10)
-
-func humanateBigBytes(s, base *big.Int, sizes []string) string {
-	if s.Cmp(ten) < 0 {
-		return fmt.Sprintf("%d B", s)
-	}
-	c := (&big.Int{}).Set(s)
-	val, mag := oomm(c, base, len(sizes)-1)
-	suffix := sizes[mag]
-	f := "%.0f %s"
-	if val < 10 {
-		f = "%.1f %s"
-	}
-
-	return fmt.Sprintf(f, val, suffix)
-
-}
-
-// BigBytes produces a human readable representation of an SI size.
-//
-// See also: ParseBigBytes.
-//
-// BigBytes(82854982) -> 83 MB
-func BigBytes(s *big.Int) string {
-	sizes := []string{"B", "kB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB"}
-	return humanateBigBytes(s, bigSIExp, sizes)
-}
-
-// BigIBytes produces a human readable representation of an IEC size.
-//
-// See also: ParseBigBytes.
-//
-// BigIBytes(82854982) -> 79 MiB
-func BigIBytes(s *big.Int) string {
-	sizes := []string{"B", "KiB", "MiB", "GiB", "TiB", "PiB", "EiB", "ZiB", "YiB"}
-	return humanateBigBytes(s, bigIECExp, sizes)
-}
-
-// ParseBigBytes parses a string representation of bytes into the number
-// of bytes it represents.
-//
-// See also: BigBytes, BigIBytes.
-//
-// ParseBigBytes("42 MB") -> 42000000, nil
-// ParseBigBytes("42 mib") -> 44040192, nil
-func ParseBigBytes(s string) (*big.Int, error) {
-	lastDigit := 0
-	hasComma := false
-	for _, r := range s {
-		if !(unicode.IsDigit(r) || r == '.' || r == ',') {
-			break
-		}
-		if r == ',' {
-			hasComma = true
-		}
-		lastDigit++
-	}
-
-	num := s[:lastDigit]
-	if hasComma {
-		num = strings.Replace(num, ",", "", -1)
-	}
-
-	val := &big.Rat{}
-	_, err := fmt.Sscanf(num, "%f", val)
-	if err != nil {
-		return nil, err
-	}
-
-	extra := strings.ToLower(strings.TrimSpace(s[lastDigit:]))
-	if m, ok := bigBytesSizeTable[extra]; ok {
-		mv := (&big.Rat{}).SetInt(m)
-		val.Mul(val, mv)
-		rv := &big.Int{}
-		rv.Div(val.Num(), val.Denom())
-		return rv, nil
-	}
-
-	return nil, fmt.Errorf("unhandled size name: %v", extra)
-}
--- a/vendor/github.com/dustin/go-humanize/bytes.go
+++ b/vendor/github.com/dustin/go-humanize/bytes.go
@@ -1,143 +0,0 @@
-package humanize
-
-import (
-	"fmt"
-	"math"
-	"strconv"
-	"strings"
-	"unicode"
-)
-
-// IEC Sizes.
-// kibis of bits
-const (
-	Byte = 1 << (iota * 10)
-	KiByte
-	MiByte
-	GiByte
-	TiByte
-	PiByte
-	EiByte
-)
-
-// SI Sizes.
-const (
-	IByte = 1
-	KByte = IByte * 1000
-	MByte = KByte * 1000
-	GByte = MByte * 1000
-	TByte = GByte * 1000
-	PByte = TByte * 1000
-	EByte = PByte * 1000
-)
-
-var bytesSizeTable = map[string]uint64{
-	"b":   Byte,
-	"kib": KiByte,
-	"kb":  KByte,
-	"mib": MiByte,
-	"mb":  MByte,
-	"gib": GiByte,
-	"gb":  GByte,
-	"tib": TiByte,
-	"tb":  TByte,
-	"pib": PiByte,
-	"pb":  PByte,
-	"eib": EiByte,
-	"eb":  EByte,
-	// Without suffix
-	"":   Byte,
-	"ki": KiByte,
-	"k":  KByte,
-	"mi": MiByte,
-	"m":  MByte,
-	"gi": GiByte,
-	"g":  GByte,
-	"ti": TiByte,
-	"t":  TByte,
-	"pi": PiByte,
-	"p":  PByte,
-	"ei": EiByte,
-	"e":  EByte,
-}
-
-func logn(n, b float64) float64 {
-	return math.Log(n) / math.Log(b)
-}
-
-func humanateBytes(s uint64, base float64, sizes []string) string {
-	if s < 10 {
-		return fmt.Sprintf("%d B", s)
-	}
-	e := math.Floor(logn(float64(s), base))
-	suffix := sizes[int(e)]
-	val := math.Floor(float64(s)/math.Pow(base, e)*10+0.5) / 10
-	f := "%.0f %s"
-	if val < 10 {
-		f = "%.1f %s"
-	}
-
-	return fmt.Sprintf(f, val, suffix)
-}
-
-// Bytes produces a human readable representation of an SI size.
-//
-// See also: ParseBytes.
-//
-// Bytes(82854982) -> 83 MB
-func Bytes(s uint64) string {
-	sizes := []string{"B", "kB", "MB", "GB", "TB", "PB", "EB"}
-	return humanateBytes(s, 1000, sizes)
-}
-
-// IBytes produces a human readable representation of an IEC size.
-//
-// See also: ParseBytes.
-//
-// IBytes(82854982) -> 79 MiB
-func IBytes(s uint64) string {
-	sizes := []string{"B", "KiB", "MiB", "GiB", "TiB", "PiB", "EiB"}
-	return humanateBytes(s, 1024, sizes)
-}
-
-// ParseBytes parses a string representation of bytes into the number
-// of bytes it represents.
-//
-// See Also: Bytes, IBytes.
-//
-// ParseBytes("42 MB") -> 42000000, nil
-// ParseBytes("42 mib") -> 44040192, nil
-func ParseBytes(s string) (uint64, error) {
-	lastDigit := 0
-	hasComma := false
-	for _, r := range s {
-		if !(unicode.IsDigit(r) || r == '.' || r == ',') {
-			break
-		}
-		if r == ',' {
-			hasComma = true
-		}
-		lastDigit++
-	}
-
-	num := s[:lastDigit]
-	if hasComma {
-		num = strings.Replace(num, ",", "", -1)
-	}
-
-	f, err := strconv.ParseFloat(num, 64)
-	if err != nil {
-		return 0, err
-	}
-
-	extra := strings.ToLower(strings.TrimSpace(s[lastDigit:]))
-	if m, ok := bytesSizeTable[extra]; ok {
-		f *= float64(m)
-		if f >= math.MaxUint64 {
-			return 0, fmt.Errorf("too large: %v", s)
-		}
-		return uint64(f), nil
-	}
-
-	return 0, fmt.Errorf("unhandled size name: %v", extra)
-}
--- a/vendor/github.com/dustin/go-humanize/comma.go
+++ b/vendor/github.com/dustin/go-humanize/comma.go
@@ -1,116 +0,0 @@
-package humanize
-
-import (
-	"bytes"
-	"math"
-	"math/big"
-	"strconv"
-	"strings"
-)
-
-// Comma produces a string form of the given number in base 10 with
-// commas after every three orders of magnitude.
-//
-// e.g. Comma(834142) -> 834,142
-func Comma(v int64) string {
-	sign := ""
-
-	// Min int64 can't be negated to a usable value, so it has to be special cased.
-	if v == math.MinInt64 {
-		return "-9,223,372,036,854,775,808"
-	}
-
-	if v < 0 {
-		sign = "-"
-		v = 0 - v
-	}
-
-	parts := []string{"", "", "", "", "", "", ""}
-	j := len(parts) - 1
-
-	for v > 999 {
-		parts[j] = strconv.FormatInt(v%1000, 10)
-		switch len(parts[j]) {
-		case 2:
-			parts[j] = "0" + parts[j]
-		case 1:
-			parts[j] = "00" + parts[j]
-		}
-		v = v / 1000
-		j--
-	}
-	parts[j] = strconv.Itoa(int(v))
-	return sign + strings.Join(parts[j:], ",")
-}
-
-// Commaf produces a string form of the given number in base 10 with
-// commas after every three orders of magnitude.
-//
-// e.g. Commaf(834142.32) -> 834,142.32
-func Commaf(v float64) string {
-	buf := &bytes.Buffer{}
-	if v < 0 {
-		buf.Write([]byte{'-'})
-		v = 0 - v
-	}
-
-	comma := []byte{','}
-
-	parts := strings.Split(strconv.FormatFloat(v, 'f', -1, 64), ".")
-	pos := 0
-	if len(parts[0])%3 != 0 {
-		pos += len(parts[0]) % 3
-		buf.WriteString(parts[0][:pos])
-		buf.Write(comma)
-	}
-	for ; pos < len(parts[0]); pos += 3 {
-		buf.WriteString(parts[0][pos : pos+3])
-		buf.Write(comma)
-	}
-	buf.Truncate(buf.Len() - 1)
-
-	if len(parts) > 1 {
-		buf.Write([]byte{'.'})
-		buf.WriteString(parts[1])
-	}
-	return buf.String()
-}
-
-// CommafWithDigits works like the Commaf but limits the resulting
-// string to the given number of decimal places.
-//
-// e.g. CommafWithDigits(834142.32, 1) -> 834,142.3
-func CommafWithDigits(f float64, decimals int) string {
-	return stripTrailingDigits(Commaf(f), decimals)
-}
-
-// BigComma produces a string form of the given big.Int in base 10
-// with commas after every three orders of magnitude.
-func BigComma(b *big.Int) string {
-	sign := ""
-	if b.Sign() < 0 {
-		sign = "-"
-		b.Abs(b)
-	}
-
-	athousand := big.NewInt(1000)
-	c := (&big.Int{}).Set(b)
-	_, m := oom(c, athousand)
-	parts := make([]string, m+1)
-	j := len(parts) - 1
-
-	mod := &big.Int{}
-	for b.Cmp(athousand) >= 0 {
-		b.DivMod(b, athousand, mod)
-		parts[j] = strconv.FormatInt(mod.Int64(), 10)
-		switch len(parts[j]) {
-		case 2:
-			parts[j] = "0" + parts[j]
-		case 1:
-			parts[j] = "00" + parts[j]
-		}
-		j--
-	}
-	parts[j] = strconv.Itoa(int(b.Int64()))
-	return sign + strings.Join(parts[j:], ",")
-}
--- a/vendor/github.com/dustin/go-humanize/commaf.go
+++ b/vendor/github.com/dustin/go-humanize/commaf.go
@@ -1,40 +0,0 @@
-// +build go1.6
-
-package humanize
-
-import (
-	"bytes"
-	"math/big"
-	"strings"
-)
-
-// BigCommaf produces a string form of the given big.Float in base 10
-// with commas after every three orders of magnitude.
-func BigCommaf(v *big.Float) string {
-	buf := &bytes.Buffer{}
-	if v.Sign() < 0 {
-		buf.Write([]byte{'-'})
-		v.Abs(v)
-	}
-
-	comma := []byte{','}
-
-	parts := strings.Split(v.Text('f', -1), ".")
-	pos := 0
-	if len(parts[0])%3 != 0 {
-		pos += len(parts[0]) % 3
-		buf.WriteString(parts[0][:pos])
-		buf.Write(comma)
-	}
-	for ; pos < len(parts[0]); pos += 3 {
-		buf.WriteString(parts[0][pos : pos+3])
-		buf.Write(comma)
-	}
-	buf.Truncate(buf.Len() - 1)
-
-	if len(parts) > 1 {
-		buf.Write([]byte{'.'})
-		buf.WriteString(parts[1])
-	}
-	return buf.String()
-}
--- a/vendor/github.com/dustin/go-humanize/ftoa.go
+++ b/vendor/github.com/dustin/go-humanize/ftoa.go
@@ -1,46 +0,0 @@
-package humanize
-
-import (
-	"strconv"
-	"strings"
-)
-
-func stripTrailingZeros(s string) string {
-	offset := len(s) - 1
-	for offset > 0 {
-		if s[offset] == '.' {
-			offset--
-			break
-		}
-		if s[offset] != '0' {
-			break
-		}
-		offset--
-	}
-	return s[:offset+1]
-}
-
-func stripTrailingDigits(s string, digits int) string {
-	if i := strings.Index(s, "."); i >= 0 {
-		if digits <= 0 {
-			return s[:i]
-		}
-		i++
-		if i+digits >= len(s) {
-			return s
-		}
-		return s[:i+digits]
-	}
-	return s
-}
-
-// Ftoa converts a float to a string with no trailing zeros.
-func Ftoa(num float64) string {
-	return stripTrailingZeros(strconv.FormatFloat(num, 'f', 6, 64))
-}
-
-// FtoaWithDigits converts a float to a string but limits the resulting string
-// to the given number of decimal places, and no trailing zeros.
-func FtoaWithDigits(num float64, digits int) string {
-	return stripTrailingZeros(stripTrailingDigits(strconv.FormatFloat(num, 'f', 6, 64), digits))
-}
--- a/vendor/github.com/dustin/go-humanize/humanize.go
+++ b/vendor/github.com/dustin/go-humanize/humanize.go
@@ -1,8 +0,0 @@
-/*
-Package humanize converts boring ugly numbers to human-friendly strings and back.
-
-Durations can be turned into strings such as "3 days ago", numbers
-representing sizes like 82854982 into useful strings like, "83 MB" or
-"79 MiB" (whichever you prefer).
-*/
-package humanize
--- a/vendor/github.com/dustin/go-humanize/number.go
+++ b/vendor/github.com/dustin/go-humanize/number.go
@@ -1,192 +0,0 @@
-package humanize
-
-/*
-Slightly adapted from the source to fit go-humanize.
-
-Author: https://github.com/gorhill
-Source: https://gist.github.com/gorhill/5285193
-
-*/
-
-import (
-	"math"
-	"strconv"
-)
-
-var (
-	renderFloatPrecisionMultipliers = [...]float64{
-		1,
-		10,
-		100,
-		1000,
-		10000,
-		100000,
-		1000000,
-		10000000,
-		100000000,
-		1000000000,
-	}
-
-	renderFloatPrecisionRounders = [...]float64{
-		0.5,
-		0.05,
-		0.005,
-		0.0005,
-		0.00005,
-		0.000005,
-		0.0000005,
-		0.00000005,
-		0.000000005,
-		0.0000000005,
-	}
-)
-
-// FormatFloat produces a formatted number as string based on the following user-specified criteria:
-// * thousands separator
-// * decimal separator
-// * decimal precision
-//
-// Usage: s := RenderFloat(format, n)
-// The format parameter tells how to render the number n.
-//
-// See examples: http://play.golang.org/p/LXc1Ddm1lJ
-//
-// Examples of format strings, given n = 12345.6789:
-// "#,###.##" => "12,345.67"
-// "#,###." => "12,345"
-// "#,###" => "12345,678"
-// "#\u202F###,##" => "12 345,68"
-// "#.###,###### => 12.345,678900
-// "" (aka default format) => 12,345.67
-//
-// The highest precision allowed is 9 digits after the decimal symbol.
-// There is also a version for integer number, FormatInteger(),
-// which is convenient for calls within template.
-func FormatFloat(format string, n float64) string {
-	// Special cases:
-	//   NaN = "NaN"
-	//   +Inf = "+Infinity"
-	//   -Inf = "-Infinity"
-	if math.IsNaN(n) {
-		return "NaN"
-	}
-	if n > math.MaxFloat64 {
-		return "Infinity"
-	}
-	if n < -math.MaxFloat64 {
-		return "-Infinity"
-	}
-
-	// default format
-	precision := 2
-	decimalStr := "."
-	thousandStr := ","
-	positiveStr := ""
-	negativeStr := "-"
-
-	if len(format) > 0 {
-		format := []rune(format)
-
-		// If there is an explicit format directive,
-		// then default values are these:
-		precision = 9
-		thousandStr = ""
-
-		// collect indices of meaningful formatting directives
-		formatIndx := []int{}
-		for i, char := range format {
-			if char != '#' && char != '0' {
-				formatIndx = append(formatIndx, i)
-			}
-		}
-
-		if len(formatIndx) > 0 {
-			// Directive at index 0:
-			//   Must be a '+'
-			//   Raise an error if not the case
-			// index: 0123456789
-			//        +0.000,000
-			//        +000,000.0
-			//        +0000.00
-			//        +0000
-			if formatIndx[0] == 0 {
-				if format[formatIndx[0]] != '+' {
-					panic("RenderFloat(): invalid positive sign directive")
-				}
-				positiveStr = "+"
-				formatIndx = formatIndx[1:]
-			}
-
-			// Two directives:
-			//   First is thousands separator
-			//   Raise an error if not followed by 3-digit
-			// 0123456789
-			// 0.000,000
-			// 000,000.00
-			if len(formatIndx) == 2 {
-				if (formatIndx[1] - formatIndx[0]) != 4 {
-					panic("RenderFloat(): thousands separator directive must be followed by 3 digit-specifiers")
-				}
-				thousandStr = string(format[formatIndx[0]])
-				formatIndx = formatIndx[1:]
-			}
-
-			// One directive:
-			//   Directive is decimal separator
-			//   The number of digit-specifier following the separator indicates wanted precision
-			// 0123456789
-			// 0.00
-			// 000,0000
-			if len(formatIndx) == 1 {
-				decimalStr = string(format[formatIndx[0]])
-				precision = len(format) - formatIndx[0] - 1
-			}
-		}
-	}
-
-	// generate sign part
-	var signStr string
-	if n >= 0.000000001 {
-		signStr = positiveStr
-	} else if n <= -0.000000001 {
-		signStr = negativeStr
-		n = -n
-	} else {
-		signStr = ""
-		n = 0.0
-	}
-
-	// split number into integer and fractional parts
-	intf, fracf := math.Modf(n + renderFloatPrecisionRounders[precision])
-
-	// generate integer part string
-	intStr := strconv.FormatInt(int64(intf), 10)
-
-	// add thousand separator if required
-	if len(thousandStr) > 0 {
-		for i := len(intStr); i > 3; {
-			i -= 3
-			intStr = intStr[:i] + thousandStr + intStr[i:]
-		}
-	}
-
-	// no fractional part, we can leave now
-	if precision == 0 {
-		return signStr + intStr
-	}
-
-	// generate fractional part
-	fracStr := strconv.Itoa(int(fracf * renderFloatPrecisionMultipliers[precision]))
-	// may need padding
-	if len(fracStr) < precision {
-		fracStr = "000000000000000"[:precision-len(fracStr)] + fracStr
-	}
-
-	return signStr + intStr + decimalStr + fracStr
-}
-
-// FormatInteger produces a formatted number as string.
-// See FormatFloat.
-func FormatInteger(format string, n int) string {
-	return FormatFloat(format, float64(n))
-}
--- a/vendor/github.com/dustin/go-humanize/ordinals.go
+++ b/vendor/github.com/dustin/go-humanize/ordinals.go
@@ -1,25 +0,0 @@
-package humanize
-
-import "strconv"
-
-// Ordinal gives you the input number in a rank/ordinal format.
-//
-// Ordinal(3) -> 3rd
-func Ordinal(x int) string {
-	suffix := "th"
-	switch x % 10 {
-	case 1:
-		if x%100 != 11 {
-			suffix = "st"
-		}
-	case 2:
-		if x%100 != 12 {
-			suffix = "nd"
-		}
-	case 3:
-		if x%100 != 13 {
-			suffix = "rd"
-		}
-	}
-	return strconv.Itoa(x) + suffix
-}
--- a/vendor/github.com/dustin/go-humanize/si.go
+++ b/vendor/github.com/dustin/go-humanize/si.go
@@ -1,123 +0,0 @@
-package humanize
-
-import (
-	"errors"
-	"math"
-	"regexp"
-	"strconv"
-)
-
-var siPrefixTable = map[float64]string{
-	-24: "y", // yocto
-	-21: "z", // zepto
-	-18: "a", // atto
-	-15: "f", // femto
-	-12: "p", // pico
-	-9:  "n", // nano
-	-6:  "µ", // micro
-	-3:  "m", // milli
-	0:   "",
-	3:   "k", // kilo
-	6:   "M", // mega
-	9:   "G", // giga
-	12:  "T", // tera
-	15:  "P", // peta
-	18:  "E", // exa
-	21:  "Z", // zetta
-	24:  "Y", // yotta
-}
-
-var revSIPrefixTable = revfmap(siPrefixTable)
-
-// revfmap reverses the map and precomputes the power multiplier
-func revfmap(in map[float64]string) map[string]float64 {
-	rv := map[string]float64{}
-	for k, v := range in {
-		rv[v] = math.Pow(10, k)
-	}
-	return rv
-}
-
-var riParseRegex *regexp.Regexp
-
-func init() {
-	ri := `^([\-0-9.]+)\s?([`
-	for _, v := range siPrefixTable {
-		ri += v
-	}
-	ri += `]?)(.*)`
-
-	riParseRegex = regexp.MustCompile(ri)
-}
-
-// ComputeSI finds the most appropriate SI prefix for the given number
-// and returns the prefix along with the value adjusted to be within
-// that prefix.
-//
-// See also: SI, ParseSI.
-//
-// e.g. ComputeSI(2.2345e-12) -> (2.2345, "p")
-func ComputeSI(input float64) (float64, string) {
-	if input == 0 {
-		return 0, ""
-	}
-	mag := math.Abs(input)
-	exponent := math.Floor(logn(mag, 10))
-	exponent = math.Floor(exponent/3) * 3
-
-	value := mag / math.Pow(10, exponent)
-
-	// Handle special case where value is exactly 1000.0
-	// Should return 1 M instead of 1000 k
-	if value == 1000.0 {
-		exponent += 3
-		value = mag / math.Pow(10, exponent)
-	}
-
-	value = math.Copysign(value, input)
-
-	prefix := siPrefixTable[exponent]
-	return value, prefix
-}
-
-// SI returns a string with default formatting.
-//
-// SI uses Ftoa to format float value, removing trailing zeros.
-//
-// See also: ComputeSI, ParseSI.
-//
-// e.g. SI(1000000, "B") -> 1 MB
-// e.g. SI(2.2345e-12, "F") -> 2.2345 pF
-func SI(input float64, unit string) string {
-	value, prefix := ComputeSI(input)
-	return Ftoa(value) + " " + prefix + unit
-}
-
-// SIWithDigits works like SI but limits the resulting string to the
-// given number of decimal places.
-//
-// e.g. SIWithDigits(1000000, 0, "B") -> 1 MB
-// e.g. SIWithDigits(2.2345e-12, 2, "F") -> 2.23 pF
-func SIWithDigits(input float64, decimals int, unit string) string {
-	value, prefix := ComputeSI(input)
-	return FtoaWithDigits(value, decimals) + " " + prefix + unit
-}
-
-var errInvalid = errors.New("invalid input")
-
-// ParseSI parses an SI string back into the number and unit.
-//
-// See also: SI, ComputeSI.
-//
-// e.g. ParseSI("2.2345 pF") -> (2.2345e-12, "F", nil)
-func ParseSI(input string) (float64, string, error) {
-	found := riParseRegex.FindStringSubmatch(input)
-	if len(found) != 4 {
-		return 0, "", errInvalid
-	}
-	mag := revSIPrefixTable[found[2]]
-	unit := found[3]
-
-	base, err := strconv.ParseFloat(found[1], 64)
-	return base * mag, unit, err
-}
--- a/vendor/github.com/dustin/go-humanize/times.go
+++ b/vendor/github.com/dustin/go-humanize/times.go
@@ -1,117 +0,0 @@
-package humanize
-
-import (
-	"fmt"
-	"math"
-	"sort"
-	"time"
-)
-
-// Seconds-based time units
-const (
-	Day      = 24 * time.Hour
-	Week     = 7 * Day
-	Month    = 30 * Day
-	Year     = 12 * Month
-	LongTime = 37 * Year
-)
-
-// Time formats a time into a relative string.
-//
-// Time(someT) -> "3 weeks ago"
-func Time(then time.Time) string {
-	return RelTime(then, time.Now(), "ago", "from now")
-}
-
-// A RelTimeMagnitude struct contains a relative time point at which
-// the relative format of time will switch to a new format string.  A
-// slice of these in ascending order by their "D" field is passed to
-// CustomRelTime to format durations.
-//
-// The Format field is a string that may contain a "%s" which will be
-// replaced with the appropriate signed label (e.g. "ago" or "from
-// now") and a "%d" that will be replaced by the quantity.
-//
-// The DivBy field is the amount of time the time difference must be
-// divided by in order to display correctly.
-//
-// e.g. if D is 2*time.Minute and you want to display "%d minutes %s"
-// DivBy should be time.Minute so whatever the duration is will be
-// expressed in minutes.
-type RelTimeMagnitude struct {
-	D      time.Duration
-	Format string
-	DivBy  time.Duration
-}
-
-var defaultMagnitudes = []RelTimeMagnitude{
-	{time.Second, "now", time.Second},
-	{2 * time.Second, "1 second %s", 1},
-	{time.Minute, "%d seconds %s", time.Second},
-	{2 * time.Minute, "1 minute %s", 1},
-	{time.Hour, "%d minutes %s", time.Minute},
-	{2 * time.Hour, "1 hour %s", 1},
-	{Day, "%d hours %s", time.Hour},
-	{2 * Day, "1 day %s", 1},
-	{Week, "%d days %s", Day},
-	{2 * Week, "1 week %s", 1},
-	{Month, "%d weeks %s", Week},
-	{2 * Month, "1 month %s", 1},
-	{Year, "%d months %s", Month},
-	{18 * Month, "1 year %s", 1},
-	{2 * Year, "2 years %s", 1},
-	{LongTime, "%d years %s", Year},
-	{math.MaxInt64, "a long while %s", 1},
-}
-
-// RelTime formats a time into a relative string.
-//
-// It takes two times and two labels.  In addition to the generic time
-// delta string (e.g. 5 minutes), the labels are used applied so that
-// the label corresponding to the smaller time is applied.
-//
-// RelTime(timeInPast, timeInFuture, "earlier", "later") -> "3 weeks earlier"
-func RelTime(a, b time.Time, albl, blbl string) string {
-	return CustomRelTime(a, b, albl, blbl, defaultMagnitudes)
-}
-
-// CustomRelTime formats a time into a relative string.
-//
-// It takes two times two labels and a table of relative time formats.
-// In addition to the generic time delta string (e.g. 5 minutes), the
-// labels are used applied so that the label corresponding to the
-// smaller time is applied.
-func CustomRelTime(a, b time.Time, albl, blbl string, magnitudes []RelTimeMagnitude) string {
-	lbl := albl
-	diff := b.Sub(a)
-
-	if a.After(b) {
-		lbl = blbl
-		diff = a.Sub(b)
-	}
-
-	n := sort.Search(len(magnitudes), func(i int) bool {
-		return magnitudes[i].D > diff
-	})
-
-	if n >= len(magnitudes) {
-		n = len(magnitudes) - 1
-	}
-	mag := magnitudes[n]
-	args := []interface{}{}
-	escaped := false
-	for _, ch := range mag.Format {
-		if escaped {
-			switch ch {
-			case 's':
-				args = append(args, lbl)
-			case 'd':
-				args = append(args, diff/mag.DivBy)
-			}
-			escaped = false
-		} else {
-			escaped = ch == '%'
-		}
-	}
-	return fmt.Sprintf(mag.Format, args...)
-}
--- a/vendor/github.com/flynn/go-shlex/COPYING
+++ b/vendor/github.com/flynn/go-shlex/COPYING
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--- a/vendor/github.com/flynn/go-shlex/Makefile
+++ b/vendor/github.com/flynn/go-shlex/Makefile
@@ -1,21 +0,0 @@
-# Copyright 2011 Google Inc. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-include $(GOROOT)/src/Make.inc
-
-TARG=shlex
-GOFILES=\
-	shlex.go\
-
-include $(GOROOT)/src/Make.pkg
--- a/vendor/github.com/flynn/go-shlex/README.md
+++ b/vendor/github.com/flynn/go-shlex/README.md
@@ -1,2 +0,0 @@
-go-shlex is a simple lexer for go that supports shell-style quoting,
-commenting, and escaping.
--- a/vendor/github.com/flynn/go-shlex/shlex.go
+++ b/vendor/github.com/flynn/go-shlex/shlex.go
@@ -1,457 +0,0 @@
-/*
-Copyright 2012 Google Inc. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package shlex
-
-/*
-Package shlex implements a simple lexer which splits input in to tokens using
-shell-style rules for quoting and commenting.
-*/
-import (
-	"bufio"
-	"errors"
-	"fmt"
-	"io"
-	"strings"
-)
-
-/*
-A TokenType is a top-level token; a word, space, comment, unknown.
-*/
-type TokenType int
-
-/*
-A RuneTokenType is the type of a UTF-8 character; a character, quote, space, escape.
-*/
-type RuneTokenType int
-
-type lexerState int
-
-type Token struct {
-	tokenType TokenType
-	value     string
-}
-
-/*
-Two tokens are equal if both their types and values are equal. A nil token can
-never equal another token.
-*/
-func (a *Token) Equal(b *Token) bool {
-	if a == nil || b == nil {
-		return false
-	}
-	if a.tokenType != b.tokenType {
-		return false
-	}
-	return a.value == b.value
-}
-
-const (
-	RUNE_CHAR              string = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789._-,/@$*()+=><:;&^%~|!?[]{}"
-	RUNE_SPACE             string = " \t\r\n"
-	RUNE_ESCAPING_QUOTE    string = "\""
-	RUNE_NONESCAPING_QUOTE string = "'"
-	RUNE_ESCAPE                   = "\\"
-	RUNE_COMMENT                  = "#"
-
-	RUNETOKEN_UNKNOWN           RuneTokenType = 0
-	RUNETOKEN_CHAR              RuneTokenType = 1
-	RUNETOKEN_SPACE             RuneTokenType = 2
-	RUNETOKEN_ESCAPING_QUOTE    RuneTokenType = 3
-	RUNETOKEN_NONESCAPING_QUOTE RuneTokenType = 4
-	RUNETOKEN_ESCAPE            RuneTokenType = 5
-	RUNETOKEN_COMMENT           RuneTokenType = 6
-	RUNETOKEN_EOF               RuneTokenType = 7
-
-	TOKEN_UNKNOWN TokenType = 0
-	TOKEN_WORD    TokenType = 1
-	TOKEN_SPACE   TokenType = 2
-	TOKEN_COMMENT TokenType = 3
-
-	STATE_START           lexerState = 0
-	STATE_INWORD          lexerState = 1
-	STATE_ESCAPING        lexerState = 2
-	STATE_ESCAPING_QUOTED lexerState = 3
-	STATE_QUOTED_ESCAPING lexerState = 4
-	STATE_QUOTED          lexerState = 5
-	STATE_COMMENT         lexerState = 6
-
-	INITIAL_TOKEN_CAPACITY int = 100
-)
-
-/*
-A type for classifying characters. This allows for different sorts of
-classifiers - those accepting extended non-ascii chars, or strict posix
-compatibility, for example.
-*/
-type TokenClassifier struct {
-	typeMap map[int32]RuneTokenType
-}
-
-func addRuneClass(typeMap *map[int32]RuneTokenType, runes string, tokenType RuneTokenType) {
-	for _, rune := range runes {
-		(*typeMap)[int32(rune)] = tokenType
-	}
-}
-
-/*
-Create a new classifier for basic ASCII characters.
-*/
-func NewDefaultClassifier() *TokenClassifier {
-	typeMap := map[int32]RuneTokenType{}
-	addRuneClass(&typeMap, RUNE_CHAR, RUNETOKEN_CHAR)
-	addRuneClass(&typeMap, RUNE_SPACE, RUNETOKEN_SPACE)
-	addRuneClass(&typeMap, RUNE_ESCAPING_QUOTE, RUNETOKEN_ESCAPING_QUOTE)
-	addRuneClass(&typeMap, RUNE_NONESCAPING_QUOTE, RUNETOKEN_NONESCAPING_QUOTE)
-	addRuneClass(&typeMap, RUNE_ESCAPE, RUNETOKEN_ESCAPE)
-	addRuneClass(&typeMap, RUNE_COMMENT, RUNETOKEN_COMMENT)
-	return &TokenClassifier{
-		typeMap: typeMap}
-}
-
-func (classifier *TokenClassifier) ClassifyRune(rune int32) RuneTokenType {
-	return classifier.typeMap[rune]
-}
-
-/*
-A type for turning an input stream in to a sequence of strings. Whitespace and
-comments are skipped.
-*/
-type Lexer struct {
-	tokenizer *Tokenizer
-}
-
-/*
-Create a new lexer.
-*/
-func NewLexer(r io.Reader) (*Lexer, error) {
-
-	tokenizer, err := NewTokenizer(r)
-	if err != nil {
-		return nil, err
-	}
-	lexer := &Lexer{tokenizer: tokenizer}
-	return lexer, nil
-}
-
-/*
-Return the next word, and an error value. If there are no more words, the error
-will be io.EOF.
-*/
-func (l *Lexer) NextWord() (string, error) {
-	var token *Token
-	var err error
-	for {
-		token, err = l.tokenizer.NextToken()
-		if err != nil {
-			return "", err
-		}
-		switch token.tokenType {
-		case TOKEN_WORD:
-			{
-				return token.value, nil
-			}
-		case TOKEN_COMMENT:
-			{
-				// skip comments
-			}
-		default:
-			{
-				panic(fmt.Sprintf("Unknown token type: %v", token.tokenType))
-			}
-		}
-	}
-	return "", io.EOF
-}
-
-/*
-A type for turning an input stream in to a sequence of typed tokens.
-*/
-type Tokenizer struct {
-	input      *bufio.Reader
-	classifier *TokenClassifier
-}
-
-/*
-Create a new tokenizer.
-*/
-func NewTokenizer(r io.Reader) (*Tokenizer, error) {
-	input := bufio.NewReader(r)
-	classifier := NewDefaultClassifier()
-	tokenizer := &Tokenizer{
-		input:      input,
-		classifier: classifier}
-	return tokenizer, nil
-}
-
-/*
-Scan the stream for the next token.
-
-This uses an internal state machine. It will panic if it encounters a character
-which it does not know how to handle.
-*/
-func (t *Tokenizer) scanStream() (*Token, error) {
-	state := STATE_START
-	var tokenType TokenType
-	value := make([]int32, 0, INITIAL_TOKEN_CAPACITY)
-	var (
-		nextRune     int32
-		nextRuneType RuneTokenType
-		err          error
-	)
-SCAN:
-	for {
-		nextRune, _, err = t.input.ReadRune()
-		nextRuneType = t.classifier.ClassifyRune(nextRune)
-		if err != nil {
-			if err == io.EOF {
-				nextRuneType = RUNETOKEN_EOF
-				err = nil
-			} else {
-				return nil, err
-			}
-		}
-		switch state {
-		case STATE_START: // no runes read yet
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						return nil, io.EOF
-					}
-				case RUNETOKEN_CHAR:
-					{
-						tokenType = TOKEN_WORD
-						value = append(value, nextRune)
-						state = STATE_INWORD
-					}
-				case RUNETOKEN_SPACE:
-					{
-					}
-				case RUNETOKEN_ESCAPING_QUOTE:
-					{
-						tokenType = TOKEN_WORD
-						state = STATE_QUOTED_ESCAPING
-					}
-				case RUNETOKEN_NONESCAPING_QUOTE:
-					{
-						tokenType = TOKEN_WORD
-						state = STATE_QUOTED
-					}
-				case RUNETOKEN_ESCAPE:
-					{
-						tokenType = TOKEN_WORD
-						state = STATE_ESCAPING
-					}
-				case RUNETOKEN_COMMENT:
-					{
-						tokenType = TOKEN_COMMENT
-						state = STATE_COMMENT
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Unknown rune: %v", nextRune))
-					}
-				}
-			}
-		case STATE_INWORD: // in a regular word
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						break SCAN
-					}
-				case RUNETOKEN_CHAR, RUNETOKEN_COMMENT:
-					{
-						value = append(value, nextRune)
-					}
-				case RUNETOKEN_SPACE:
-					{
-						t.input.UnreadRune()
-						break SCAN
-					}
-				case RUNETOKEN_ESCAPING_QUOTE:
-					{
-						state = STATE_QUOTED_ESCAPING
-					}
-				case RUNETOKEN_NONESCAPING_QUOTE:
-					{
-						state = STATE_QUOTED
-					}
-				case RUNETOKEN_ESCAPE:
-					{
-						state = STATE_ESCAPING
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Uknown rune: %v", nextRune))
-					}
-				}
-			}
-		case STATE_ESCAPING: // the next rune after an escape character
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						err = errors.New("EOF found after escape character")
-						break SCAN
-					}
-				case RUNETOKEN_CHAR, RUNETOKEN_SPACE, RUNETOKEN_ESCAPING_QUOTE, RUNETOKEN_NONESCAPING_QUOTE, RUNETOKEN_ESCAPE, RUNETOKEN_COMMENT:
-					{
-						state = STATE_INWORD
-						value = append(value, nextRune)
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Uknown rune: %v", nextRune))
-					}
-				}
-			}
-		case STATE_ESCAPING_QUOTED: // the next rune after an escape character, in double quotes
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						err = errors.New("EOF found after escape character")
-						break SCAN
-					}
-				case RUNETOKEN_CHAR, RUNETOKEN_SPACE, RUNETOKEN_ESCAPING_QUOTE, RUNETOKEN_NONESCAPING_QUOTE, RUNETOKEN_ESCAPE, RUNETOKEN_COMMENT:
-					{
-						state = STATE_QUOTED_ESCAPING
-						value = append(value, nextRune)
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Uknown rune: %v", nextRune))
-					}
-				}
-			}
-		case STATE_QUOTED_ESCAPING: // in escaping double quotes
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						err = errors.New("EOF found when expecting closing quote.")
-						break SCAN
-					}
-				case RUNETOKEN_CHAR, RUNETOKEN_UNKNOWN, RUNETOKEN_SPACE, RUNETOKEN_NONESCAPING_QUOTE, RUNETOKEN_COMMENT:
-					{
-						value = append(value, nextRune)
-					}
-				case RUNETOKEN_ESCAPING_QUOTE:
-					{
-						state = STATE_INWORD
-					}
-				case RUNETOKEN_ESCAPE:
-					{
-						state = STATE_ESCAPING_QUOTED
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Uknown rune: %v", nextRune))
-					}
-				}
-			}
-		case STATE_QUOTED: // in non-escaping single quotes
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						err = errors.New("EOF found when expecting closing quote.")
-						break SCAN
-					}
-				case RUNETOKEN_CHAR, RUNETOKEN_UNKNOWN, RUNETOKEN_SPACE, RUNETOKEN_ESCAPING_QUOTE, RUNETOKEN_ESCAPE, RUNETOKEN_COMMENT:
-					{
-						value = append(value, nextRune)
-					}
-				case RUNETOKEN_NONESCAPING_QUOTE:
-					{
-						state = STATE_INWORD
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Uknown rune: %v", nextRune))
-					}
-				}
-			}
-		case STATE_COMMENT:
-			{
-				switch nextRuneType {
-				case RUNETOKEN_EOF:
-					{
-						break SCAN
-					}
-				case RUNETOKEN_CHAR, RUNETOKEN_UNKNOWN, RUNETOKEN_ESCAPING_QUOTE, RUNETOKEN_ESCAPE, RUNETOKEN_COMMENT, RUNETOKEN_NONESCAPING_QUOTE:
-					{
-						value = append(value, nextRune)
-					}
-				case RUNETOKEN_SPACE:
-					{
-						if nextRune == '\n' {
-							state = STATE_START
-							break SCAN
-						} else {
-							value = append(value, nextRune)
-						}
-					}
-				default:
-					{
-						return nil, errors.New(fmt.Sprintf("Uknown rune: %v", nextRune))
-					}
-				}
-			}
-		default:
-			{
-				panic(fmt.Sprintf("Unexpected state: %v", state))
-			}
-		}
-	}
-	token := &Token{
-		tokenType: tokenType,
-		value:     string(value)}
-	return token, err
-}
-
-/*
-Return the next token in the stream, and an error value. If there are no more
-tokens available, the error value will be io.EOF.
-*/
-func (t *Tokenizer) NextToken() (*Token, error) {
-	return t.scanStream()
-}
-
-/*
-Split a string in to a slice of strings, based upon shell-style rules for
-quoting, escaping, and spaces.
-*/
-func Split(s string) ([]string, error) {
-	l, err := NewLexer(strings.NewReader(s))
-	if err != nil {
-		return nil, err
-	}
-	subStrings := []string{}
-	for {
-		word, err := l.NextWord()
-		if err != nil {
-			if err == io.EOF {
-				return subStrings, nil
-			}
-			return subStrings, err
-		}
-		subStrings = append(subStrings, word)
-	}
-	return subStrings, nil
-}
--- a/vendor/github.com/globalsign/mgo/bson/bson_corpus_spec_test_generator.go
+++ b/vendor/github.com/globalsign/mgo/bson/bson_corpus_spec_test_generator.go
@@ -1,294 +0,0 @@
-// +build ignore
-
-package main
-
-import (
-	"bytes"
-	"fmt"
-	"go/format"
-	"html/template"
-	"io/ioutil"
-	"log"
-	"path/filepath"
-	"strings"
-
-	"github.com/globalsign/mgo/internal/json"
-)
-
-func main() {
-	log.SetFlags(0)
-	log.SetPrefix(name + ": ")
-
-	var g Generator
-
-	fmt.Fprintf(&g, "// Code generated by \"%s.go\"; DO NOT EDIT\n\n", name)
-
-	src := g.generate()
-
-	err := ioutil.WriteFile(fmt.Sprintf("%s.go", strings.TrimSuffix(name, "_generator")), src, 0644)
-	if err != nil {
-		log.Fatalf("writing output: %s", err)
-	}
-}
-
-// Generator holds the state of the analysis. Primarily used to buffer
-// the output for format.Source.
-type Generator struct {
-	bytes.Buffer // Accumulated output.
-}
-
-// format returns the gofmt-ed contents of the Generator's buffer.
-func (g *Generator) format() []byte {
-	src, err := format.Source(g.Bytes())
-	if err != nil {
-		// Should never happen, but can arise when developing this code.
-		// The user can compile the output to see the error.
-		log.Printf("warning: internal error: invalid Go generated: %s", err)
-		log.Printf("warning: compile the package to analyze the error")
-		return g.Bytes()
-	}
-	return src
-}
-
-// EVERYTHING ABOVE IS CONSTANT BETWEEN THE GENERATORS
-
-const name = "bson_corpus_spec_test_generator"
-
-func (g *Generator) generate() []byte {
-
-	testFiles, err := filepath.Glob("./specdata/specifications/source/bson-corpus/tests/*.json")
-	if err != nil {
-		log.Fatalf("error reading bson-corpus files: %s", err)
-	}
-
-	tests, err := g.loadTests(testFiles)
-	if err != nil {
-		log.Fatalf("error loading tests: %s", err)
-	}
-
-	tmpl, err := g.getTemplate()
-	if err != nil {
-		log.Fatalf("error loading template: %s", err)
-	}
-
-	tmpl.Execute(&g.Buffer, tests)
-
-	return g.format()
-}
-
-func (g *Generator) loadTests(filenames []string) ([]*testDef, error) {
-	var tests []*testDef
-	for _, filename := range filenames {
-		test, err := g.loadTest(filename)
-		if err != nil {
-			return nil, err
-		}
-
-		tests = append(tests, test)
-	}
-
-	return tests, nil
-}
-
-func (g *Generator) loadTest(filename string) (*testDef, error) {
-	content, err := ioutil.ReadFile(filename)
-	if err != nil {
-		return nil, err
-	}
-
-	var testDef testDef
-	err = json.Unmarshal(content, &testDef)
-	if err != nil {
-		return nil, err
-	}
-
-	names := make(map[string]struct{})
-
-	for i := len(testDef.Valid) - 1; i >= 0; i-- {
-		if testDef.BsonType == "0x05" && testDef.Valid[i].Description == "subtype 0x02" {
-			testDef.Valid = append(testDef.Valid[:i], testDef.Valid[i+1:]...)
-			continue
-		}
-
-		name := cleanupFuncName(testDef.Description + "_" + testDef.Valid[i].Description)
-		nameIdx := name
-		j := 1
-		for {
-			if _, ok := names[nameIdx]; !ok {
-				break
-			}
-
-			nameIdx = fmt.Sprintf("%s_%d", name, j)
-		}
-
-		names[nameIdx] = struct{}{}
-
-		testDef.Valid[i].TestDef = &testDef
-		testDef.Valid[i].Name = nameIdx
-		testDef.Valid[i].StructTest = testDef.TestKey != "" &&
-			(testDef.BsonType != "0x05" || strings.Contains(testDef.Valid[i].Description, "0x00")) &&
-			!testDef.Deprecated
-	}
-
-	for i := len(testDef.DecodeErrors) - 1; i >= 0; i-- {
-		if strings.Contains(testDef.DecodeErrors[i].Description, "UTF-8") {
-			testDef.DecodeErrors = append(testDef.DecodeErrors[:i], testDef.DecodeErrors[i+1:]...)
-			continue
-		}
-
-		name := cleanupFuncName(testDef.Description + "_" + testDef.DecodeErrors[i].Description)
-		nameIdx := name
-		j := 1
-		for {
-			if _, ok := names[nameIdx]; !ok {
-				break
-			}
-
-			nameIdx = fmt.Sprintf("%s_%d", name, j)
-		}
-		names[nameIdx] = struct{}{}
-
-		testDef.DecodeErrors[i].Name = nameIdx
-	}
-
-	return &testDef, nil
-}
-
-func (g *Generator) getTemplate() (*template.Template, error) {
-	content := `package bson_test
-
-import (
-    "encoding/hex"
-	"time"
-
-	. "gopkg.in/check.v1"
-    "github.com/globalsign/mgo/bson"
-)
-
-func testValid(c *C, in []byte, expected []byte, result interface{}) {
-	err := bson.Unmarshal(in, result)
-	c.Assert(err, IsNil)
-
-	out, err := bson.Marshal(result)
-	c.Assert(err, IsNil)
-
-	c.Assert(string(expected), Equals, string(out), Commentf("roundtrip failed for %T, expected '%x' but got '%x'", result, expected, out))
-}
-
-func testDecodeSkip(c *C, in []byte) {
-	err := bson.Unmarshal(in, &struct{}{})
-	c.Assert(err, IsNil)
-}
-
-func testDecodeError(c *C, in []byte, result interface{}) {
-	err := bson.Unmarshal(in, result)
-	c.Assert(err, Not(IsNil))
-}
-
-{{range .}}
-{{range .Valid}}
-func (s *S) Test{{.Name}}(c *C) {
-    b, err := hex.DecodeString("{{.Bson}}")
-	c.Assert(err, IsNil)
-
-    {{if .CanonicalBson}}
-    cb, err := hex.DecodeString("{{.CanonicalBson}}")
-	c.Assert(err, IsNil)
-	{{else}}
-    cb := b
-    {{end}}
-
-    var resultD bson.D
-	testValid(c, b, cb, &resultD)
-	{{if .StructTest}}var resultS struct {
-		Element {{.TestDef.GoType}} ` + "`bson:\"{{.TestDef.TestKey}}\"`" + `
-	}
-	testValid(c, b, cb, &resultS){{end}}
-
-	testDecodeSkip(c, b)
-}
-{{end}}
-
-{{range .DecodeErrors}}
-func (s *S) Test{{.Name}}(c *C) {
-	b, err := hex.DecodeString("{{.Bson}}")
-	c.Assert(err, IsNil)
-
-	var resultD bson.D
-	testDecodeError(c, b, &resultD)
-}
-{{end}}
-{{end}}
-`
-	tmpl, err := template.New("").Parse(content)
-	if err != nil {
-		return nil, err
-	}
-	return tmpl, nil
-}
-
-func cleanupFuncName(name string) string {
-	return strings.Map(func(r rune) rune {
-		if (r >= 48 && r <= 57) || (r >= 65 && r <= 90) || (r >= 97 && r <= 122) {
-			return r
-		}
-		return '_'
-	}, name)
-}
-
-type testDef struct {
-	Description  string         `json:"description"`
-	BsonType     string         `json:"bson_type"`
-	TestKey      string         `json:"test_key"`
-	Valid        []*valid       `json:"valid"`
-	DecodeErrors []*decodeError `json:"decodeErrors"`
-	Deprecated   bool           `json:"deprecated"`
-}
-
-func (t *testDef) GoType() string {
-	switch t.BsonType {
-	case "0x01":
-		return "float64"
-	case "0x02":
-		return "string"
-	case "0x03":
-		return "bson.D"
-	case "0x04":
-		return "[]interface{}"
-	case "0x05":
-		return "[]byte"
-	case "0x07":
-		return "bson.ObjectId"
-	case "0x08":
-		return "bool"
-	case "0x09":
-		return "time.Time"
-	case "0x0E":
-		return "string"
-	case "0x10":
-		return "int32"
-	case "0x12":
-		return "int64"
-	case "0x13":
-		return "bson.Decimal"
-	default:
-		return "interface{}"
-	}
-}
-
-type valid struct {
-	Description   string `json:"description"`
-	Bson          string `json:"bson"`
-	CanonicalBson string `json:"canonical_bson"`
-
-	Name       string
-	StructTest bool
-	TestDef    *testDef
-}
-
-type decodeError struct {
-	Description string `json:"description"`
-	Bson        string `json:"bson"`
-
-	Name string
-}
--- a/vendor/github.com/go-acme/lego/LICENSE
+++ b/vendor/github.com/go-acme/lego/LICENSE
@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015-2017 Sebastian Erhart
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/vendor/github.com/go-acme/lego/acme/api/account.go
+++ b/vendor/github.com/go-acme/lego/acme/api/account.go
@@ -1,69 +0,0 @@
-package api
-
-import (
-	"encoding/base64"
-	"errors"
-	"fmt"
-
-	"github.com/go-acme/lego/acme"
-)
-
-type AccountService service
-
-// New Creates a new account.
-func (a *AccountService) New(req acme.Account) (acme.ExtendedAccount, error) {
-	var account acme.Account
-	resp, err := a.core.post(a.core.GetDirectory().NewAccountURL, req, &account)
-	location := getLocation(resp)
-
-	if len(location) > 0 {
-		a.core.jws.SetKid(location)
-	}
-
-	if err != nil {
-		return acme.ExtendedAccount{Location: location}, err
-	}
-
-	return acme.ExtendedAccount{Account: account, Location: location}, nil
-}
-
-// NewEAB Creates a new account with an External Account Binding.
-func (a *AccountService) NewEAB(accMsg acme.Account, kid string, hmacEncoded string) (acme.ExtendedAccount, error) {
-	hmac, err := base64.RawURLEncoding.DecodeString(hmacEncoded)
-	if err != nil {
-		return acme.ExtendedAccount{}, fmt.Errorf("acme: could not decode hmac key: %v", err)
-	}
-
-	eabJWS, err := a.core.signEABContent(a.core.GetDirectory().NewAccountURL, kid, hmac)
-	if err != nil {
-		return acme.ExtendedAccount{}, fmt.Errorf("acme: error signing eab content: %v", err)
-	}
-	accMsg.ExternalAccountBinding = eabJWS
-
-	return a.New(accMsg)
-}
-
-// Get Retrieves an account.
-func (a *AccountService) Get(accountURL string) (acme.Account, error) {
-	if len(accountURL) == 0 {
-		return acme.Account{}, errors.New("account[get]: empty URL")
-	}
-
-	var account acme.Account
-	_, err := a.core.post(accountURL, acme.Account{}, &account)
-	if err != nil {
-		return acme.Account{}, err
-	}
-	return account, nil
-}
-
-// Deactivate Deactivates an account.
-func (a *AccountService) Deactivate(accountURL string) error {
-	if len(accountURL) == 0 {
-		return errors.New("account[deactivate]: empty URL")
-	}
-
-	req := acme.Account{Status: acme.StatusDeactivated}
-	_, err := a.core.post(accountURL, req, nil)
-	return err
-}
--- a/vendor/github.com/go-acme/lego/acme/api/api.go
+++ b/vendor/github.com/go-acme/lego/acme/api/api.go
@@ -1,166 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"context"
-	"crypto"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/cenkalti/backoff"
-	"github.com/go-acme/lego/acme"
-	"github.com/go-acme/lego/acme/api/internal/nonces"
-	"github.com/go-acme/lego/acme/api/internal/secure"
-	"github.com/go-acme/lego/acme/api/internal/sender"
-	"github.com/go-acme/lego/log"
-)
-
-// Core ACME/LE core API.
-type Core struct {
-	doer         *sender.Doer
-	nonceManager *nonces.Manager
-	jws          *secure.JWS
-	directory    acme.Directory
-	HTTPClient   *http.Client
-
-	common         service // Reuse a single struct instead of allocating one for each service on the heap.
-	Accounts       *AccountService
-	Authorizations *AuthorizationService
-	Certificates   *CertificateService
-	Challenges     *ChallengeService
-	Orders         *OrderService
-}
-
-// New Creates a new Core.
-func New(httpClient *http.Client, userAgent string, caDirURL, kid string, privateKey crypto.PrivateKey) (*Core, error) {
-	doer := sender.NewDoer(httpClient, userAgent)
-
-	dir, err := getDirectory(doer, caDirURL)
-	if err != nil {
-		return nil, err
-	}
-
-	nonceManager := nonces.NewManager(doer, dir.NewNonceURL)
-
-	jws := secure.NewJWS(privateKey, kid, nonceManager)
-
-	c := &Core{doer: doer, nonceManager: nonceManager, jws: jws, directory: dir, HTTPClient: httpClient}
-
-	c.common.core = c
-	c.Accounts = (*AccountService)(&c.common)
-	c.Authorizations = (*AuthorizationService)(&c.common)
-	c.Certificates = (*CertificateService)(&c.common)
-	c.Challenges = (*ChallengeService)(&c.common)
-	c.Orders = (*OrderService)(&c.common)
-
-	return c, nil
-}
-
-// post performs an HTTP POST request and parses the response body as JSON,
-// into the provided respBody object.
-func (a *Core) post(uri string, reqBody, response interface{}) (*http.Response, error) {
-	content, err := json.Marshal(reqBody)
-	if err != nil {
-		return nil, errors.New("failed to marshal message")
-	}
-
-	return a.retrievablePost(uri, content, response)
-}
-
-// postAsGet performs an HTTP POST ("POST-as-GET") request.
-// https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-6.3
-func (a *Core) postAsGet(uri string, response interface{}) (*http.Response, error) {
-	return a.retrievablePost(uri, []byte{}, response)
-}
-
-func (a *Core) retrievablePost(uri string, content []byte, response interface{}) (*http.Response, error) {
-	// during tests, allow to support ~90% of bad nonce with a minimum of attempts.
-	bo := backoff.NewExponentialBackOff()
-	bo.InitialInterval = 200 * time.Millisecond
-	bo.MaxInterval = 5 * time.Second
-	bo.MaxElapsedTime = 20 * time.Second
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	var resp *http.Response
-	operation := func() error {
-		var err error
-		resp, err = a.signedPost(uri, content, response)
-		if err != nil {
-			switch err.(type) {
-			// Retry if the nonce was invalidated
-			case *acme.NonceError:
-				log.Infof("nonce error retry: %s", err)
-				return err
-			default:
-				cancel()
-				return err
-			}
-		}
-
-		return nil
-	}
-
-	err := backoff.Retry(operation, backoff.WithContext(bo, ctx))
-	if err != nil {
-		return nil, err
-	}
-
-	return resp, nil
-}
-
-func (a *Core) signedPost(uri string, content []byte, response interface{}) (*http.Response, error) {
-	signedContent, err := a.jws.SignContent(uri, content)
-	if err != nil {
-		return nil, fmt.Errorf("failed to post JWS message -> failed to sign content -> %v", err)
-	}
-
-	signedBody := bytes.NewBuffer([]byte(signedContent.FullSerialize()))
-
-	resp, err := a.doer.Post(uri, signedBody, "application/jose+json", response)
-
-	// nonceErr is ignored to keep the root error.
-	nonce, nonceErr := nonces.GetFromResponse(resp)
-	if nonceErr == nil {
-		a.nonceManager.Push(nonce)
-	}
-
-	return resp, err
-}
-
-func (a *Core) signEABContent(newAccountURL, kid string, hmac []byte) ([]byte, error) {
-	eabJWS, err := a.jws.SignEABContent(newAccountURL, kid, hmac)
-	if err != nil {
-		return nil, err
-	}
-
-	return []byte(eabJWS.FullSerialize()), nil
-}
-
-// GetKeyAuthorization Gets the key authorization
-func (a *Core) GetKeyAuthorization(token string) (string, error) {
-	return a.jws.GetKeyAuthorization(token)
-}
-
-func (a *Core) GetDirectory() acme.Directory {
-	return a.directory
-}
-
-func getDirectory(do *sender.Doer, caDirURL string) (acme.Directory, error) {
-	var dir acme.Directory
-	if _, err := do.Get(caDirURL, &dir); err != nil {
-		return dir, fmt.Errorf("get directory at '%s': %v", caDirURL, err)
-	}
-
-	if dir.NewAccountURL == "" {
-		return dir, errors.New("directory missing new registration URL")
-	}
-	if dir.NewOrderURL == "" {
-		return dir, errors.New("directory missing new order URL")
-	}
-
-	return dir, nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/authorization.go
+++ b/vendor/github.com/go-acme/lego/acme/api/authorization.go
@@ -1,34 +0,0 @@
-package api
-
-import (
-	"errors"
-
-	"github.com/go-acme/lego/acme"
-)
-
-type AuthorizationService service
-
-// Get Gets an authorization.
-func (c *AuthorizationService) Get(authzURL string) (acme.Authorization, error) {
-	if len(authzURL) == 0 {
-		return acme.Authorization{}, errors.New("authorization[get]: empty URL")
-	}
-
-	var authz acme.Authorization
-	_, err := c.core.postAsGet(authzURL, &authz)
-	if err != nil {
-		return acme.Authorization{}, err
-	}
-	return authz, nil
-}
-
-// Deactivate Deactivates an authorization.
-func (c *AuthorizationService) Deactivate(authzURL string) error {
-	if len(authzURL) == 0 {
-		return errors.New("authorization[deactivate]: empty URL")
-	}
-
-	var disabledAuth acme.Authorization
-	_, err := c.core.post(authzURL, acme.Authorization{Status: acme.StatusDeactivated}, &disabledAuth)
-	return err
-}
--- a/vendor/github.com/go-acme/lego/acme/api/certificate.go
+++ b/vendor/github.com/go-acme/lego/acme/api/certificate.go
@@ -1,99 +0,0 @@
-package api
-
-import (
-	"crypto/x509"
-	"encoding/pem"
-	"errors"
-	"io/ioutil"
-	"net/http"
-
-	"github.com/go-acme/lego/acme"
-	"github.com/go-acme/lego/certcrypto"
-	"github.com/go-acme/lego/log"
-)
-
-// maxBodySize is the maximum size of body that we will read.
-const maxBodySize = 1024 * 1024
-
-type CertificateService service
-
-// Get Returns the certificate and the issuer certificate.
-// 'bundle' is only applied if the issuer is provided by the 'up' link.
-func (c *CertificateService) Get(certURL string, bundle bool) ([]byte, []byte, error) {
-	cert, up, err := c.get(certURL)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Get issuerCert from bundled response from Let's Encrypt
-	// See https://community.letsencrypt.org/t/acme-v2-no-up-link-in-response/64962
-	_, issuer := pem.Decode(cert)
-	if issuer != nil {
-		return cert, issuer, nil
-	}
-
-	issuer, err = c.getIssuerFromLink(up)
-	if err != nil {
-		// If we fail to acquire the issuer cert, return the issued certificate - do not fail.
-		log.Warnf("acme: Could not bundle issuer certificate [%s]: %v", certURL, err)
-	} else if len(issuer) > 0 {
-		// If bundle is true, we want to return a certificate bundle.
-		// To do this, we append the issuer cert to the issued cert.
-		if bundle {
-			cert = append(cert, issuer...)
-		}
-	}
-
-	return cert, issuer, nil
-}
-
-// Revoke Revokes a certificate.
-func (c *CertificateService) Revoke(req acme.RevokeCertMessage) error {
-	_, err := c.core.post(c.core.GetDirectory().RevokeCertURL, req, nil)
-	return err
-}
-
-// get Returns the certificate and the "up" link.
-func (c *CertificateService) get(certURL string) ([]byte, string, error) {
-	if len(certURL) == 0 {
-		return nil, "", errors.New("certificate[get]: empty URL")
-	}
-
-	resp, err := c.core.postAsGet(certURL, nil)
-	if err != nil {
-		return nil, "", err
-	}
-
-	cert, err := ioutil.ReadAll(http.MaxBytesReader(nil, resp.Body, maxBodySize))
-	if err != nil {
-		return nil, "", err
-	}
-
-	// The issuer certificate link may be supplied via an "up" link
-	// in the response headers of a new certificate.
-	// See https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.4.2
-	up := getLink(resp.Header, "up")
-
-	return cert, up, err
-}
-
-// getIssuerFromLink requests the issuer certificate
-func (c *CertificateService) getIssuerFromLink(up string) ([]byte, error) {
-	if len(up) == 0 {
-		return nil, nil
-	}
-
-	log.Infof("acme: Requesting issuer cert from %s", up)
-
-	cert, _, err := c.get(up)
-	if err != nil {
-		return nil, err
-	}
-
-	_, err = x509.ParseCertificate(cert)
-	if err != nil {
-		return nil, err
-	}
-
-	return certcrypto.PEMEncode(certcrypto.DERCertificateBytes(cert)), nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/challenge.go
+++ b/vendor/github.com/go-acme/lego/acme/api/challenge.go
@@ -1,45 +0,0 @@
-package api
-
-import (
-	"errors"
-
-	"github.com/go-acme/lego/acme"
-)
-
-type ChallengeService service
-
-// New Creates a challenge.
-func (c *ChallengeService) New(chlgURL string) (acme.ExtendedChallenge, error) {
-	if len(chlgURL) == 0 {
-		return acme.ExtendedChallenge{}, errors.New("challenge[new]: empty URL")
-	}
-
-	// Challenge initiation is done by sending a JWS payload containing the trivial JSON object `{}`.
-	// We use an empty struct instance as the postJSON payload here to achieve this result.
-	var chlng acme.ExtendedChallenge
-	resp, err := c.core.post(chlgURL, struct{}{}, &chlng)
-	if err != nil {
-		return acme.ExtendedChallenge{}, err
-	}
-
-	chlng.AuthorizationURL = getLink(resp.Header, "up")
-	chlng.RetryAfter = getRetryAfter(resp)
-	return chlng, nil
-}
-
-// Get Gets a challenge.
-func (c *ChallengeService) Get(chlgURL string) (acme.ExtendedChallenge, error) {
-	if len(chlgURL) == 0 {
-		return acme.ExtendedChallenge{}, errors.New("challenge[get]: empty URL")
-	}
-
-	var chlng acme.ExtendedChallenge
-	resp, err := c.core.postAsGet(chlgURL, &chlng)
-	if err != nil {
-		return acme.ExtendedChallenge{}, err
-	}
-
-	chlng.AuthorizationURL = getLink(resp.Header, "up")
-	chlng.RetryAfter = getRetryAfter(resp)
-	return chlng, nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/internal/nonces/nonce_manager.go
+++ b/vendor/github.com/go-acme/lego/acme/api/internal/nonces/nonce_manager.go
@@ -1,78 +0,0 @@
-package nonces
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"sync"
-
-	"github.com/go-acme/lego/acme/api/internal/sender"
-)
-
-// Manager Manages nonces.
-type Manager struct {
-	do       *sender.Doer
-	nonceURL string
-	nonces   []string
-	sync.Mutex
-}
-
-// NewManager Creates a new Manager.
-func NewManager(do *sender.Doer, nonceURL string) *Manager {
-	return &Manager{
-		do:       do,
-		nonceURL: nonceURL,
-	}
-}
-
-// Pop Pops a nonce.
-func (n *Manager) Pop() (string, bool) {
-	n.Lock()
-	defer n.Unlock()
-
-	if len(n.nonces) == 0 {
-		return "", false
-	}
-
-	nonce := n.nonces[len(n.nonces)-1]
-	n.nonces = n.nonces[:len(n.nonces)-1]
-	return nonce, true
-}
-
-// Push Pushes a nonce.
-func (n *Manager) Push(nonce string) {
-	n.Lock()
-	defer n.Unlock()
-	n.nonces = append(n.nonces, nonce)
-}
-
-// Nonce implement jose.NonceSource
-func (n *Manager) Nonce() (string, error) {
-	if nonce, ok := n.Pop(); ok {
-		return nonce, nil
-	}
-	return n.getNonce()
-}
-
-func (n *Manager) getNonce() (string, error) {
-	resp, err := n.do.Head(n.nonceURL)
-	if err != nil {
-		return "", fmt.Errorf("failed to get nonce from HTTP HEAD -> %v", err)
-	}
-
-	return GetFromResponse(resp)
-}
-
-// GetFromResponse Extracts a nonce from a HTTP response.
-func GetFromResponse(resp *http.Response) (string, error) {
-	if resp == nil {
-		return "", errors.New("nil response")
-	}
-
-	nonce := resp.Header.Get("Replay-Nonce")
-	if nonce == "" {
-		return "", fmt.Errorf("server did not respond with a proper nonce header")
-	}
-
-	return nonce, nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/internal/secure/jws.go
+++ b/vendor/github.com/go-acme/lego/acme/api/internal/secure/jws.go
@@ -1,130 +0,0 @@
-package secure
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"encoding/base64"
-	"fmt"
-
-	"github.com/go-acme/lego/acme/api/internal/nonces"
-	jose "gopkg.in/square/go-jose.v2"
-)
-
-// JWS Represents a JWS.
-type JWS struct {
-	privKey crypto.PrivateKey
-	kid     string // Key identifier
-	nonces  *nonces.Manager
-}
-
-// NewJWS Create a new JWS.
-func NewJWS(privateKey crypto.PrivateKey, kid string, nonceManager *nonces.Manager) *JWS {
-	return &JWS{
-		privKey: privateKey,
-		nonces:  nonceManager,
-		kid:     kid,
-	}
-}
-
-// SetKid Sets a key identifier.
-func (j *JWS) SetKid(kid string) {
-	j.kid = kid
-}
-
-// SignContent Signs a content with the JWS.
-func (j *JWS) SignContent(url string, content []byte) (*jose.JSONWebSignature, error) {
-	var alg jose.SignatureAlgorithm
-	switch k := j.privKey.(type) {
-	case *rsa.PrivateKey:
-		alg = jose.RS256
-	case *ecdsa.PrivateKey:
-		if k.Curve == elliptic.P256() {
-			alg = jose.ES256
-		} else if k.Curve == elliptic.P384() {
-			alg = jose.ES384
-		}
-	}
-
-	signKey := jose.SigningKey{
-		Algorithm: alg,
-		Key:       jose.JSONWebKey{Key: j.privKey, KeyID: j.kid},
-	}
-
-	options := jose.SignerOptions{
-		NonceSource: j.nonces,
-		ExtraHeaders: map[jose.HeaderKey]interface{}{
-			"url": url,
-		},
-	}
-
-	if j.kid == "" {
-		options.EmbedJWK = true
-	}
-
-	signer, err := jose.NewSigner(signKey, &options)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create jose signer -> %v", err)
-	}
-
-	signed, err := signer.Sign(content)
-	if err != nil {
-		return nil, fmt.Errorf("failed to sign content -> %v", err)
-	}
-	return signed, nil
-}
-
-// SignEABContent Signs an external account binding content with the JWS.
-func (j *JWS) SignEABContent(url, kid string, hmac []byte) (*jose.JSONWebSignature, error) {
-	jwk := jose.JSONWebKey{Key: j.privKey}
-	jwkJSON, err := jwk.Public().MarshalJSON()
-	if err != nil {
-		return nil, fmt.Errorf("acme: error encoding eab jwk key: %v", err)
-	}
-
-	signer, err := jose.NewSigner(
-		jose.SigningKey{Algorithm: jose.HS256, Key: hmac},
-		&jose.SignerOptions{
-			EmbedJWK: false,
-			ExtraHeaders: map[jose.HeaderKey]interface{}{
-				"kid": kid,
-				"url": url,
-			},
-		},
-	)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create External Account Binding jose signer -> %v", err)
-	}
-
-	signed, err := signer.Sign(jwkJSON)
-	if err != nil {
-		return nil, fmt.Errorf("failed to External Account Binding sign content -> %v", err)
-	}
-
-	return signed, nil
-}
-
-// GetKeyAuthorization Gets the key authorization for a token.
-func (j *JWS) GetKeyAuthorization(token string) (string, error) {
-	var publicKey crypto.PublicKey
-	switch k := j.privKey.(type) {
-	case *ecdsa.PrivateKey:
-		publicKey = k.Public()
-	case *rsa.PrivateKey:
-		publicKey = k.Public()
-	}
-
-	// Generate the Key Authorization for the challenge
-	jwk := &jose.JSONWebKey{Key: publicKey}
-
-	thumbBytes, err := jwk.Thumbprint(crypto.SHA256)
-	if err != nil {
-		return "", err
-	}
-
-	// unpad the base64URL
-	keyThumb := base64.RawURLEncoding.EncodeToString(thumbBytes)
-
-	return token + "." + keyThumb, nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/internal/sender/sender.go
+++ b/vendor/github.com/go-acme/lego/acme/api/internal/sender/sender.go
@@ -1,146 +0,0 @@
-package sender
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net/http"
-	"runtime"
-	"strings"
-
-	"github.com/go-acme/lego/acme"
-)
-
-type RequestOption func(*http.Request) error
-
-func contentType(ct string) RequestOption {
-	return func(req *http.Request) error {
-		req.Header.Set("Content-Type", ct)
-		return nil
-	}
-}
-
-type Doer struct {
-	httpClient *http.Client
-	userAgent  string
-}
-
-// NewDoer Creates a new Doer.
-func NewDoer(client *http.Client, userAgent string) *Doer {
-	return &Doer{
-		httpClient: client,
-		userAgent:  userAgent,
-	}
-}
-
-// Get performs a GET request with a proper User-Agent string.
-// If "response" is not provided, callers should close resp.Body when done reading from it.
-func (d *Doer) Get(url string, response interface{}) (*http.Response, error) {
-	req, err := d.newRequest(http.MethodGet, url, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return d.do(req, response)
-}
-
-// Head performs a HEAD request with a proper User-Agent string.
-// The response body (resp.Body) is already closed when this function returns.
-func (d *Doer) Head(url string) (*http.Response, error) {
-	req, err := d.newRequest(http.MethodHead, url, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return d.do(req, nil)
-}
-
-// Post performs a POST request with a proper User-Agent string.
-// If "response" is not provided, callers should close resp.Body when done reading from it.
-func (d *Doer) Post(url string, body io.Reader, bodyType string, response interface{}) (*http.Response, error) {
-	req, err := d.newRequest(http.MethodPost, url, body, contentType(bodyType))
-	if err != nil {
-		return nil, err
-	}
-
-	return d.do(req, response)
-}
-
-func (d *Doer) newRequest(method, uri string, body io.Reader, opts ...RequestOption) (*http.Request, error) {
-	req, err := http.NewRequest(method, uri, body)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %v", err)
-	}
-
-	req.Header.Set("User-Agent", d.formatUserAgent())
-
-	for _, opt := range opts {
-		err = opt(req)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create request: %v", err)
-		}
-	}
-
-	return req, nil
-}
-
-func (d *Doer) do(req *http.Request, response interface{}) (*http.Response, error) {
-	resp, err := d.httpClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-
-	if err = checkError(req, resp); err != nil {
-		return resp, err
-	}
-
-	if response != nil {
-		raw, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return resp, err
-		}
-
-		defer resp.Body.Close()
-
-		err = json.Unmarshal(raw, response)
-		if err != nil {
-			return resp, fmt.Errorf("failed to unmarshal %q to type %T: %v", raw, response, err)
-		}
-	}
-
-	return resp, nil
-}
-
-// formatUserAgent builds and returns the User-Agent string to use in requests.
-func (d *Doer) formatUserAgent() string {
-	ua := fmt.Sprintf("%s %s (%s; %s; %s)", d.userAgent, ourUserAgent, ourUserAgentComment, runtime.GOOS, runtime.GOARCH)
-	return strings.TrimSpace(ua)
-}
-
-func checkError(req *http.Request, resp *http.Response) error {
-	if resp.StatusCode >= http.StatusBadRequest {
-
-		body, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return fmt.Errorf("%d :: %s :: %s :: %v", resp.StatusCode, req.Method, req.URL, err)
-		}
-
-		var errorDetails *acme.ProblemDetails
-		err = json.Unmarshal(body, &errorDetails)
-		if err != nil {
-			return fmt.Errorf("%d ::%s :: %s :: %v :: %s", resp.StatusCode, req.Method, req.URL, err, string(body))
-		}
-
-		errorDetails.Method = req.Method
-		errorDetails.URL = req.URL.String()
-
-		// Check for errors we handle specifically
-		if errorDetails.HTTPStatus == http.StatusBadRequest && errorDetails.Type == acme.BadNonceErr {
-			return &acme.NonceError{ProblemDetails: errorDetails}
-		}
-
-		return errorDetails
-	}
-	return nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/internal/sender/useragent.go
+++ b/vendor/github.com/go-acme/lego/acme/api/internal/sender/useragent.go
@@ -1,14 +0,0 @@
-package sender
-
-// CODE GENERATED AUTOMATICALLY
-// THIS FILE MUST NOT BE EDITED BY HAND
-
-const (
-	// ourUserAgent is the User-Agent of this underlying library package.
-	ourUserAgent = "xenolf-acme/2.5.0"
-
-	// ourUserAgentComment is part of the UA comment linked to the version status of this underlying library package.
-	// values: detach|release
-	// NOTE: Update this with each tagged release.
-	ourUserAgentComment = "release"
-)
--- a/vendor/github.com/go-acme/lego/acme/api/order.go
+++ b/vendor/github.com/go-acme/lego/acme/api/order.go
@@ -1,65 +0,0 @@
-package api
-
-import (
-	"encoding/base64"
-	"errors"
-
-	"github.com/go-acme/lego/acme"
-)
-
-type OrderService service
-
-// New Creates a new order.
-func (o *OrderService) New(domains []string) (acme.ExtendedOrder, error) {
-	var identifiers []acme.Identifier
-	for _, domain := range domains {
-		identifiers = append(identifiers, acme.Identifier{Type: "dns", Value: domain})
-	}
-
-	orderReq := acme.Order{Identifiers: identifiers}
-
-	var order acme.Order
-	resp, err := o.core.post(o.core.GetDirectory().NewOrderURL, orderReq, &order)
-	if err != nil {
-		return acme.ExtendedOrder{}, err
-	}
-
-	return acme.ExtendedOrder{
-		Location: resp.Header.Get("Location"),
-		Order:    order,
-	}, nil
-}
-
-// Get Gets an order.
-func (o *OrderService) Get(orderURL string) (acme.Order, error) {
-	if len(orderURL) == 0 {
-		return acme.Order{}, errors.New("order[get]: empty URL")
-	}
-
-	var order acme.Order
-	_, err := o.core.postAsGet(orderURL, &order)
-	if err != nil {
-		return acme.Order{}, err
-	}
-
-	return order, nil
-}
-
-// UpdateForCSR Updates an order for a CSR.
-func (o *OrderService) UpdateForCSR(orderURL string, csr []byte) (acme.Order, error) {
-	csrMsg := acme.CSRMessage{
-		Csr: base64.RawURLEncoding.EncodeToString(csr),
-	}
-
-	var order acme.Order
-	_, err := o.core.post(orderURL, csrMsg, &order)
-	if err != nil {
-		return acme.Order{}, err
-	}
-
-	if order.Status == acme.StatusInvalid {
-		return acme.Order{}, order.Error
-	}
-
-	return order, nil
-}
--- a/vendor/github.com/go-acme/lego/acme/api/service.go
+++ b/vendor/github.com/go-acme/lego/acme/api/service.go
@@ -1,45 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"regexp"
-)
-
-type service struct {
-	core *Core
-}
-
-// getLink get a rel into the Link header
-func getLink(header http.Header, rel string) string {
-	var linkExpr = regexp.MustCompile(`<(.+?)>;\s*rel="(.+?)"`)
-
-	for _, link := range header["Link"] {
-		for _, m := range linkExpr.FindAllStringSubmatch(link, -1) {
-			if len(m) != 3 {
-				continue
-			}
-			if m[2] == rel {
-				return m[1]
-			}
-		}
-	}
-	return ""
-}
-
-// getLocation get the value of the header Location
-func getLocation(resp *http.Response) string {
-	if resp == nil {
-		return ""
-	}
-
-	return resp.Header.Get("Location")
-}
-
-// getRetryAfter get the value of the header Retry-After
-func getRetryAfter(resp *http.Response) string {
-	if resp == nil {
-		return ""
-	}
-
-	return resp.Header.Get("Retry-After")
-}
--- a/vendor/github.com/go-acme/lego/acme/commons.go
+++ b/vendor/github.com/go-acme/lego/acme/commons.go
@@ -1,284 +0,0 @@
-// Package acme contains all objects related the ACME endpoints.
-// https://tools.ietf.org/html/draft-ietf-acme-acme-16
-package acme
-
-import (
-	"encoding/json"
-	"time"
-)
-
-// Challenge statuses
-// https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.6
-const (
-	StatusPending     = "pending"
-	StatusInvalid     = "invalid"
-	StatusValid       = "valid"
-	StatusProcessing  = "processing"
-	StatusDeactivated = "deactivated"
-	StatusExpired     = "expired"
-	StatusRevoked     = "revoked"
-)
-
-// Directory the ACME directory object.
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.1
-type Directory struct {
-	NewNonceURL   string `json:"newNonce"`
-	NewAccountURL string `json:"newAccount"`
-	NewOrderURL   string `json:"newOrder"`
-	NewAuthzURL   string `json:"newAuthz"`
-	RevokeCertURL string `json:"revokeCert"`
-	KeyChangeURL  string `json:"keyChange"`
-	Meta          Meta   `json:"meta"`
-}
-
-// Meta the ACME meta object (related to Directory).
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.1
-type Meta struct {
-	// termsOfService (optional, string):
-	// A URL identifying the current terms of service.
-	TermsOfService string `json:"termsOfService"`
-
-	// website (optional, string):
-	// An HTTP or HTTPS URL locating a website providing more information about the ACME server.
-	Website string `json:"website"`
-
-	// caaIdentities (optional, array of string):
-	// The hostnames that the ACME server recognizes as referring to itself
-	// for the purposes of CAA record validation as defined in [RFC6844].
-	// Each string MUST represent the same sequence of ASCII code points
-	// that the server will expect to see as the "Issuer Domain Name" in a CAA issue or issuewild property tag.
-	// This allows clients to determine the correct issuer domain name to use when configuring CAA records.
-	CaaIdentities []string `json:"caaIdentities"`
-
-	// externalAccountRequired (optional, boolean):
-	// If this field is present and set to "true",
-	// then the CA requires that all new- account requests include an "externalAccountBinding" field
-	// associating the new account with an external account.
-	ExternalAccountRequired bool `json:"externalAccountRequired"`
-}
-
-// ExtendedAccount a extended Account.
-type ExtendedAccount struct {
-	Account
-	// Contains the value of the response header `Location`
-	Location string `json:"-"`
-}
-
-// Account the ACME account Object.
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.2
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.3
-type Account struct {
-	// status (required, string):
-	// The status of this account.
-	// Possible values are: "valid", "deactivated", and "revoked".
-	// The value "deactivated" should be used to indicate client-initiated deactivation
-	// whereas "revoked" should be used to indicate server- initiated deactivation. (See Section 7.1.6)
-	Status string `json:"status,omitempty"`
-
-	// contact (optional, array of string):
-	// An array of URLs that the server can use to contact the client for issues related to this account.
-	// For example, the server may wish to notify the client about server-initiated revocation or certificate expiration.
-	// For information on supported URL schemes, see Section 7.3
-	Contact []string `json:"contact,omitempty"`
-
-	// termsOfServiceAgreed (optional, boolean):
-	// Including this field in a new-account request,
-	// with a value of true, indicates the client's agreement with the terms of service.
-	// This field is not updateable by the client.
-	TermsOfServiceAgreed bool `json:"termsOfServiceAgreed,omitempty"`
-
-	// orders (required, string):
-	// A URL from which a list of orders submitted by this account can be fetched via a POST-as-GET request,
-	// as described in Section 7.1.2.1.
-	Orders string `json:"orders,omitempty"`
-
-	// onlyReturnExisting (optional, boolean):
-	// If this field is present with the value "true",
-	// then the server MUST NOT create a new account if one does not already exist.
-	// This allows a client to look up an account URL based on an account key (see Section 7.3.1).
-	OnlyReturnExisting bool `json:"onlyReturnExisting,omitempty"`
-
-	// externalAccountBinding (optional, object):
-	// An optional field for binding the new account with an existing non-ACME account (see Section 7.3.4).
-	ExternalAccountBinding json.RawMessage `json:"externalAccountBinding,omitempty"`
-}
-
-// ExtendedOrder a extended Order.
-type ExtendedOrder struct {
-	Order
-	// The order URL, contains the value of the response header `Location`
-	Location string `json:"-"`
-}
-
-// Order the ACME order Object.
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.3
-type Order struct {
-	// status (required, string):
-	// The status of this order.
-	// Possible values are: "pending", "ready", "processing", "valid", and "invalid".
-	Status string `json:"status,omitempty"`
-
-	// expires (optional, string):
-	// The timestamp after which the server will consider this order invalid,
-	// encoded in the format specified in RFC 3339 [RFC3339].
-	// This field is REQUIRED for objects with "pending" or "valid" in the status field.
-	Expires string `json:"expires,omitempty"`
-
-	// identifiers (required, array of object):
-	// An array of identifier objects that the order pertains to.
-	Identifiers []Identifier `json:"identifiers"`
-
-	// notBefore (optional, string):
-	// The requested value of the notBefore field in the certificate,
-	// in the date format defined in [RFC3339].
-	NotBefore string `json:"notBefore,omitempty"`
-
-	// notAfter (optional, string):
-	// The requested value of the notAfter field in the certificate,
-	// in the date format defined in [RFC3339].
-	NotAfter string `json:"notAfter,omitempty"`
-
-	// error (optional, object):
-	// The error that occurred while processing the order, if any.
-	// This field is structured as a problem document [RFC7807].
-	Error *ProblemDetails `json:"error,omitempty"`
-
-	// authorizations (required, array of string):
-	// For pending orders,
-	// the authorizations that the client needs to complete before the requested certificate can be issued (see Section 7.5),
-	// including unexpired authorizations that the client has completed in the past for identifiers specified in the order.
-	// The authorizations required are dictated by server policy
-	// and there may not be a 1:1 relationship between the order identifiers and the authorizations required.
-	// For final orders (in the "valid" or "invalid" state), the authorizations that were completed.
-	// Each entry is a URL from which an authorization can be fetched with a POST-as-GET request.
-	Authorizations []string `json:"authorizations,omitempty"`
-
-	// finalize (required, string):
-	// A URL that a CSR must be POSTed to once all of the order's authorizations are satisfied to finalize the order.
-	// The result of a successful finalization will be the population of the certificate URL for the order.
-	Finalize string `json:"finalize,omitempty"`
-
-	// certificate (optional, string):
-	// A URL for the certificate that has been issued in response to this order
-	Certificate string `json:"certificate,omitempty"`
-}
-
-// Authorization the ACME authorization object.
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.4
-type Authorization struct {
-	// status (required, string):
-	// The status of this authorization.
-	// Possible values are: "pending", "valid", "invalid", "deactivated", "expired", and "revoked".
-	Status string `json:"status"`
-
-	// expires (optional, string):
-	// The timestamp after which the server will consider this authorization invalid,
-	// encoded in the format specified in RFC 3339 [RFC3339].
-	// This field is REQUIRED for objects with "valid" in the "status" field.
-	Expires time.Time `json:"expires,omitempty"`
-
-	// identifier (required, object):
-	// The identifier that the account is authorized to represent
-	Identifier Identifier `json:"identifier,omitempty"`
-
-	// challenges (required, array of objects):
-	// For pending authorizations, the challenges that the client can fulfill in order to prove possession of the identifier.
-	// For valid authorizations, the challenge that was validated.
-	// For invalid authorizations, the challenge that was attempted and failed.
-	// Each array entry is an object with parameters required to validate the challenge.
-	// A client should attempt to fulfill one of these challenges,
-	// and a server should consider any one of the challenges sufficient to make the authorization valid.
-	Challenges []Challenge `json:"challenges,omitempty"`
-
-	// wildcard (optional, boolean):
-	// For authorizations created as a result of a newOrder request containing a DNS identifier
-	// with a value that contained a wildcard prefix this field MUST be present, and true.
-	Wildcard bool `json:"wildcard,omitempty"`
-}
-
-// ExtendedChallenge a extended Challenge.
-type ExtendedChallenge struct {
-	Challenge
-	// Contains the value of the response header `Retry-After`
-	RetryAfter string `json:"-"`
-	// Contains the value of the response header `Link` rel="up"
-	AuthorizationURL string `json:"-"`
-}
-
-// Challenge the ACME challenge object.
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.5
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-8
-type Challenge struct {
-	// type (required, string):
-	// The type of challenge encoded in the object.
-	Type string `json:"type"`
-
-	// url (required, string):
-	// The URL to which a response can be posted.
-	URL string `json:"url"`
-
-	// status (required, string):
-	// The status of this challenge. Possible values are: "pending", "processing", "valid", and "invalid".
-	Status string `json:"status"`
-
-	// validated (optional, string):
-	// The time at which the server validated this challenge,
-	// encoded in the format specified in RFC 3339 [RFC3339].
-	// This field is REQUIRED if the "status" field is "valid".
-	Validated time.Time `json:"validated,omitempty"`
-
-	// error (optional, object):
-	// Error that occurred while the server was validating the challenge, if any,
-	// structured as a problem document [RFC7807].
-	// Multiple errors can be indicated by using subproblems Section 6.7.1.
-	// A challenge object with an error MUST have status equal to "invalid".
-	Error *ProblemDetails `json:"error,omitempty"`
-
-	// token (required, string):
-	// A random value that uniquely identifies the challenge.
-	// This value MUST have at least 128 bits of entropy.
-	// It MUST NOT contain any characters outside the base64url alphabet,
-	// and MUST NOT include base64 padding characters ("=").
-	// See [RFC4086] for additional information on randomness requirements.
-	// https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-8.3
-	// https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-8.4
-	Token string `json:"token"`
-
-	// https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-8.1
-	KeyAuthorization string `json:"keyAuthorization"`
-}
-
-// Identifier the ACME identifier object.
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-9.7.7
-type Identifier struct {
-	Type  string `json:"type"`
-	Value string `json:"value"`
-}
-
-// CSRMessage Certificate Signing Request
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.4
-type CSRMessage struct {
-	// csr (required, string):
-	// A CSR encoding the parameters for the certificate being requested [RFC2986].
-	// The CSR is sent in the base64url-encoded version of the DER format.
-	// (Note: Because this field uses base64url, and does not include headers, it is different from PEM.).
-	Csr string `json:"csr"`
-}
-
-// RevokeCertMessage a certificate revocation message
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.6
-// - https://tools.ietf.org/html/rfc5280#section-5.3.1
-type RevokeCertMessage struct {
-	// certificate (required, string):
-	// The certificate to be revoked, in the base64url-encoded version of the DER format.
-	// (Note: Because this field uses base64url, and does not include headers, it is different from PEM.)
-	Certificate string `json:"certificate"`
-
-	// reason (optional, int):
-	// One of the revocation reasonCodes defined in Section 5.3.1 of [RFC5280] to be used when generating OCSP responses and CRLs.
-	// If this field is not set the server SHOULD omit the reasonCode CRL entry extension when generating OCSP responses and CRLs.
-	// The server MAY disallow a subset of reasonCodes from being used by the user.
-	// If a request contains a disallowed reasonCode the server MUST reject it with the error type "urn:ietf:params:acme:error:badRevocationReason".
-	// The problem document detail SHOULD indicate which reasonCodes are allowed.
-	Reason *uint `json:"reason,omitempty"`
-}
--- a/vendor/github.com/go-acme/lego/acme/errors.go
+++ b/vendor/github.com/go-acme/lego/acme/errors.go
@@ -1,58 +0,0 @@
-package acme
-
-import (
-	"fmt"
-)
-
-// Errors types
-const (
-	errNS       = "urn:ietf:params:acme:error:"
-	BadNonceErr = errNS + "badNonce"
-)
-
-// ProblemDetails the problem details object
-// - https://tools.ietf.org/html/rfc7807#section-3.1
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.3.3
-type ProblemDetails struct {
-	Type        string       `json:"type,omitempty"`
-	Detail      string       `json:"detail,omitempty"`
-	HTTPStatus  int          `json:"status,omitempty"`
-	Instance    string       `json:"instance,omitempty"`
-	SubProblems []SubProblem `json:"subproblems,omitempty"`
-
-	// additional values to have a better error message (Not defined by the RFC)
-	Method string `json:"method,omitempty"`
-	URL    string `json:"url,omitempty"`
-}
-
-// SubProblem a "subproblems"
-// - https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-6.7.1
-type SubProblem struct {
-	Type       string     `json:"type,omitempty"`
-	Detail     string     `json:"detail,omitempty"`
-	Identifier Identifier `json:"identifier,omitempty"`
-}
-
-func (p ProblemDetails) Error() string {
-	msg := fmt.Sprintf("acme: error: %d", p.HTTPStatus)
-	if len(p.Method) != 0 || len(p.URL) != 0 {
-		msg += fmt.Sprintf(" :: %s :: %s", p.Method, p.URL)
-	}
-	msg += fmt.Sprintf(" :: %s :: %s", p.Type, p.Detail)
-
-	for _, sub := range p.SubProblems {
-		msg += fmt.Sprintf(", problem: %q :: %s", sub.Type, sub.Detail)
-	}
-
-	if len(p.Instance) == 0 {
-		msg += ", url: " + p.Instance
-	}
-
-	return msg
-}
-
-// NonceError represents the error which is returned
-// if the nonce sent by the client was not accepted by the server.
-type NonceError struct {
-	*ProblemDetails
-}
--- a/vendor/github.com/go-acme/lego/certcrypto/crypto.go
+++ b/vendor/github.com/go-acme/lego/certcrypto/crypto.go
@@ -1,256 +0,0 @@
-package certcrypto
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"math/big"
-	"time"
-
-	"golang.org/x/crypto/ocsp"
-)
-
-// Constants for all key types we support.
-const (
-	EC256   = KeyType("P256")
-	EC384   = KeyType("P384")
-	RSA2048 = KeyType("2048")
-	RSA4096 = KeyType("4096")
-	RSA8192 = KeyType("8192")
-)
-
-const (
-	// OCSPGood means that the certificate is valid.
-	OCSPGood = ocsp.Good
-	// OCSPRevoked means that the certificate has been deliberately revoked.
-	OCSPRevoked = ocsp.Revoked
-	// OCSPUnknown means that the OCSP responder doesn't know about the certificate.
-	OCSPUnknown = ocsp.Unknown
-	// OCSPServerFailed means that the OCSP responder failed to process the request.
-	OCSPServerFailed = ocsp.ServerFailed
-)
-
-// Constants for OCSP must staple
-var (
-	tlsFeatureExtensionOID = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 24}
-	ocspMustStapleFeature  = []byte{0x30, 0x03, 0x02, 0x01, 0x05}
-)
-
-// KeyType represents the key algo as well as the key size or curve to use.
-type KeyType string
-
-type DERCertificateBytes []byte
-
-// ParsePEMBundle parses a certificate bundle from top to bottom and returns
-// a slice of x509 certificates. This function will error if no certificates are found.
-func ParsePEMBundle(bundle []byte) ([]*x509.Certificate, error) {
-	var certificates []*x509.Certificate
-	var certDERBlock *pem.Block
-
-	for {
-		certDERBlock, bundle = pem.Decode(bundle)
-		if certDERBlock == nil {
-			break
-		}
-
-		if certDERBlock.Type == "CERTIFICATE" {
-			cert, err := x509.ParseCertificate(certDERBlock.Bytes)
-			if err != nil {
-				return nil, err
-			}
-			certificates = append(certificates, cert)
-		}
-	}
-
-	if len(certificates) == 0 {
-		return nil, errors.New("no certificates were found while parsing the bundle")
-	}
-
-	return certificates, nil
-}
-
-func ParsePEMPrivateKey(key []byte) (crypto.PrivateKey, error) {
-	keyBlock, _ := pem.Decode(key)
-
-	switch keyBlock.Type {
-	case "RSA PRIVATE KEY":
-		return x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
-	case "EC PRIVATE KEY":
-		return x509.ParseECPrivateKey(keyBlock.Bytes)
-	default:
-		return nil, errors.New("unknown PEM header value")
-	}
-}
-
-func GeneratePrivateKey(keyType KeyType) (crypto.PrivateKey, error) {
-	switch keyType {
-	case EC256:
-		return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	case EC384:
-		return ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
-	case RSA2048:
-		return rsa.GenerateKey(rand.Reader, 2048)
-	case RSA4096:
-		return rsa.GenerateKey(rand.Reader, 4096)
-	case RSA8192:
-		return rsa.GenerateKey(rand.Reader, 8192)
-	}
-
-	return nil, fmt.Errorf("invalid KeyType: %s", keyType)
-}
-
-func GenerateCSR(privateKey crypto.PrivateKey, domain string, san []string, mustStaple bool) ([]byte, error) {
-	template := x509.CertificateRequest{
-		Subject:  pkix.Name{CommonName: domain},
-		DNSNames: san,
-	}
-
-	if mustStaple {
-		template.ExtraExtensions = append(template.ExtraExtensions, pkix.Extension{
-			Id:    tlsFeatureExtensionOID,
-			Value: ocspMustStapleFeature,
-		})
-	}
-
-	return x509.CreateCertificateRequest(rand.Reader, &template, privateKey)
-}
-
-func PEMEncode(data interface{}) []byte {
-	return pem.EncodeToMemory(PEMBlock(data))
-}
-
-func PEMBlock(data interface{}) *pem.Block {
-	var pemBlock *pem.Block
-	switch key := data.(type) {
-	case *ecdsa.PrivateKey:
-		keyBytes, _ := x509.MarshalECPrivateKey(key)
-		pemBlock = &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}
-	case *rsa.PrivateKey:
-		pemBlock = &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
-	case *x509.CertificateRequest:
-		pemBlock = &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: key.Raw}
-	case DERCertificateBytes:
-		pemBlock = &pem.Block{Type: "CERTIFICATE", Bytes: []byte(data.(DERCertificateBytes))}
-	}
-
-	return pemBlock
-}
-
-func pemDecode(data []byte) (*pem.Block, error) {
-	pemBlock, _ := pem.Decode(data)
-	if pemBlock == nil {
-		return nil, fmt.Errorf("PEM decode did not yield a valid block. Is the certificate in the right format?")
-	}
-
-	return pemBlock, nil
-}
-
-func PemDecodeTox509CSR(pem []byte) (*x509.CertificateRequest, error) {
-	pemBlock, err := pemDecode(pem)
-	if pemBlock == nil {
-		return nil, err
-	}
-
-	if pemBlock.Type != "CERTIFICATE REQUEST" {
-		return nil, fmt.Errorf("PEM block is not a certificate request")
-	}
-
-	return x509.ParseCertificateRequest(pemBlock.Bytes)
-}
-
-// ParsePEMCertificate returns Certificate from a PEM encoded certificate.
-// The certificate has to be PEM encoded. Any other encodings like DER will fail.
-func ParsePEMCertificate(cert []byte) (*x509.Certificate, error) {
-	pemBlock, err := pemDecode(cert)
-	if pemBlock == nil {
-		return nil, err
-	}
-
-	// from a DER encoded certificate
-	return x509.ParseCertificate(pemBlock.Bytes)
-}
-
-func ExtractDomains(cert *x509.Certificate) []string {
-	domains := []string{cert.Subject.CommonName}
-
-	// Check for SAN certificate
-	for _, sanDomain := range cert.DNSNames {
-		if sanDomain == cert.Subject.CommonName {
-			continue
-		}
-		domains = append(domains, sanDomain)
-	}
-
-	return domains
-}
-
-func ExtractDomainsCSR(csr *x509.CertificateRequest) []string {
-	domains := []string{csr.Subject.CommonName}
-
-	// loop over the SubjectAltName DNS names
-	for _, sanName := range csr.DNSNames {
-		if containsSAN(domains, sanName) {
-			// Duplicate; skip this name
-			continue
-		}
-
-		// Name is unique
-		domains = append(domains, sanName)
-	}
-
-	return domains
-}
-
-func containsSAN(domains []string, sanName string) bool {
-	for _, existingName := range domains {
-		if existingName == sanName {
-			return true
-		}
-	}
-	return false
-}
-
-func GeneratePemCert(privateKey *rsa.PrivateKey, domain string, extensions []pkix.Extension) ([]byte, error) {
-	derBytes, err := generateDerCert(privateKey, time.Time{}, domain, extensions)
-	if err != nil {
-		return nil, err
-	}
-
-	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes}), nil
-}
-
-func generateDerCert(privateKey *rsa.PrivateKey, expiration time.Time, domain string, extensions []pkix.Extension) ([]byte, error) {
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
-	if err != nil {
-		return nil, err
-	}
-
-	if expiration.IsZero() {
-		expiration = time.Now().Add(365)
-	}
-
-	template := x509.Certificate{
-		SerialNumber: serialNumber,
-		Subject: pkix.Name{
-			CommonName: "ACME Challenge TEMP",
-		},
-		NotBefore: time.Now(),
-		NotAfter:  expiration,
-
-		KeyUsage:              x509.KeyUsageKeyEncipherment,
-		BasicConstraintsValid: true,
-		DNSNames:              []string{domain},
-		ExtraExtensions:       extensions,
-	}
-
-	return x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
-}
--- a/vendor/github.com/go-acme/lego/certificate/authorization.go
+++ b/vendor/github.com/go-acme/lego/certificate/authorization.go
@@ -1,69 +0,0 @@
-package certificate
-
-import (
-	"time"
-
-	"github.com/go-acme/lego/acme"
-	"github.com/go-acme/lego/log"
-)
-
-const (
-	// overallRequestLimit is the overall number of request per second
-	// limited on the "new-reg", "new-authz" and "new-cert" endpoints.
-	// From the documentation the limitation is 20 requests per second,
-	// but using 20 as value doesn't work but 18 do
-	overallRequestLimit = 18
-)
-
-func (c *Certifier) getAuthorizations(order acme.ExtendedOrder) ([]acme.Authorization, error) {
-	resc, errc := make(chan acme.Authorization), make(chan domainError)
-
-	delay := time.Second / overallRequestLimit
-
-	for _, authzURL := range order.Authorizations {
-		time.Sleep(delay)
-
-		go func(authzURL string) {
-			authz, err := c.core.Authorizations.Get(authzURL)
-			if err != nil {
-				errc <- domainError{Domain: authz.Identifier.Value, Error: err}
-				return
-			}
-
-			resc <- authz
-		}(authzURL)
-	}
-
-	var responses []acme.Authorization
-	failures := make(obtainError)
-	for i := 0; i < len(order.Authorizations); i++ {
-		select {
-		case res := <-resc:
-			responses = append(responses, res)
-		case err := <-errc:
-			failures[err.Domain] = err.Error
-		}
-	}
-
-	for i, auth := range order.Authorizations {
-		log.Infof("[%s] AuthURL: %s", order.Identifiers[i].Value, auth)
-	}
-
-	close(resc)
-	close(errc)
-
-	// be careful to not return an empty failures map;
-	// even if empty, they become non-nil error values
-	if len(failures) > 0 {
-		return responses, failures
-	}
-	return responses, nil
-}
-
-func (c *Certifier) deactivateAuthorizations(order acme.ExtendedOrder) {
-	for _, auth := range order.Authorizations {
-		if err := c.core.Authorizations.Deactivate(auth); err != nil {
-			log.Infof("Unable to deactivated authorizations: %s", auth)
-		}
-	}
-}
--- a/vendor/github.com/go-acme/lego/certificate/certificates.go
+++ b/vendor/github.com/go-acme/lego/certificate/certificates.go
@@ -1,495 +0,0 @@
-package certificate
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/x509"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/go-acme/lego/acme"
-	"github.com/go-acme/lego/acme/api"
-	"github.com/go-acme/lego/certcrypto"
-	"github.com/go-acme/lego/challenge"
-	"github.com/go-acme/lego/log"
-	"github.com/go-acme/lego/platform/wait"
-	"golang.org/x/crypto/ocsp"
-	"golang.org/x/net/idna"
-)
-
-// maxBodySize is the maximum size of body that we will read.
-const maxBodySize = 1024 * 1024
-
-// Resource represents a CA issued certificate.
-// PrivateKey, Certificate and IssuerCertificate are all
-// already PEM encoded and can be directly written to disk.
-// Certificate may be a certificate bundle,
-// depending on the options supplied to create it.
-type Resource struct {
-	Domain            string `json:"domain"`
-	CertURL           string `json:"certUrl"`
-	CertStableURL     string `json:"certStableUrl"`
-	PrivateKey        []byte `json:"-"`
-	Certificate       []byte `json:"-"`
-	IssuerCertificate []byte `json:"-"`
-	CSR               []byte `json:"-"`
-}
-
-// ObtainRequest The request to obtain certificate.
-//
-// The first domain in domains is used for the CommonName field of the certificate,
-// all other domains are added using the Subject Alternate Names extension.
-//
-// A new private key is generated for every invocation of the function Obtain.
-// If you do not want that you can supply your own private key in the privateKey parameter.
-// If this parameter is non-nil it will be used instead of generating a new one.
-//
-// If bundle is true, the []byte contains both the issuer certificate and your issued certificate as a bundle.
-type ObtainRequest struct {
-	Domains    []string
-	Bundle     bool
-	PrivateKey crypto.PrivateKey
-	MustStaple bool
-}
-
-type resolver interface {
-	Solve(authorizations []acme.Authorization) error
-}
-
-type CertifierOptions struct {
-	KeyType certcrypto.KeyType
-	Timeout time.Duration
-}
-
-// Certifier A service to obtain/renew/revoke certificates.
-type Certifier struct {
-	core     *api.Core
-	resolver resolver
-	options  CertifierOptions
-}
-
-// NewCertifier creates a Certifier.
-func NewCertifier(core *api.Core, resolver resolver, options CertifierOptions) *Certifier {
-	return &Certifier{
-		core:     core,
-		resolver: resolver,
-		options:  options,
-	}
-}
-
-// Obtain tries to obtain a single certificate using all domains passed into it.
-//
-// This function will never return a partial certificate.
-// If one domain in the list fails, the whole certificate will fail.
-func (c *Certifier) Obtain(request ObtainRequest) (*Resource, error) {
-	if len(request.Domains) == 0 {
-		return nil, errors.New("no domains to obtain a certificate for")
-	}
-
-	domains := sanitizeDomain(request.Domains)
-
-	if request.Bundle {
-		log.Infof("[%s] acme: Obtaining bundled SAN certificate", strings.Join(domains, ", "))
-	} else {
-		log.Infof("[%s] acme: Obtaining SAN certificate", strings.Join(domains, ", "))
-	}
-
-	order, err := c.core.Orders.New(domains)
-	if err != nil {
-		return nil, err
-	}
-
-	authz, err := c.getAuthorizations(order)
-	if err != nil {
-		// If any challenge fails, return. Do not generate partial SAN certificates.
-		c.deactivateAuthorizations(order)
-		return nil, err
-	}
-
-	err = c.resolver.Solve(authz)
-	if err != nil {
-		// If any challenge fails, return. Do not generate partial SAN certificates.
-		c.deactivateAuthorizations(order)
-		return nil, err
-	}
-
-	log.Infof("[%s] acme: Validations succeeded; requesting certificates", strings.Join(domains, ", "))
-
-	failures := make(obtainError)
-	cert, err := c.getForOrder(domains, order, request.Bundle, request.PrivateKey, request.MustStaple)
-	if err != nil {
-		for _, auth := range authz {
-			failures[challenge.GetTargetedDomain(auth)] = err
-		}
-	}
-
-	// Do not return an empty failures map, because
-	// it would still be a non-nil error value
-	if len(failures) > 0 {
-		return cert, failures
-	}
-	return cert, nil
-}
-
-// ObtainForCSR tries to obtain a certificate matching the CSR passed into it.
-//
-// The domains are inferred from the CommonName and SubjectAltNames, if any.
-// The private key for this CSR is not required.
-//
-// If bundle is true, the []byte contains both the issuer certificate and your issued certificate as a bundle.
-//
-// This function will never return a partial certificate.
-// If one domain in the list fails, the whole certificate will fail.
-func (c *Certifier) ObtainForCSR(csr x509.CertificateRequest, bundle bool) (*Resource, error) {
-	// figure out what domains it concerns
-	// start with the common name
-	domains := certcrypto.ExtractDomainsCSR(&csr)
-
-	if bundle {
-		log.Infof("[%s] acme: Obtaining bundled SAN certificate given a CSR", strings.Join(domains, ", "))
-	} else {
-		log.Infof("[%s] acme: Obtaining SAN certificate given a CSR", strings.Join(domains, ", "))
-	}
-
-	order, err := c.core.Orders.New(domains)
-	if err != nil {
-		return nil, err
-	}
-
-	authz, err := c.getAuthorizations(order)
-	if err != nil {
-		// If any challenge fails, return. Do not generate partial SAN certificates.
-		c.deactivateAuthorizations(order)
-		return nil, err
-	}
-
-	err = c.resolver.Solve(authz)
-	if err != nil {
-		// If any challenge fails, return. Do not generate partial SAN certificates.
-		c.deactivateAuthorizations(order)
-		return nil, err
-	}
-
-	log.Infof("[%s] acme: Validations succeeded; requesting certificates", strings.Join(domains, ", "))
-
-	failures := make(obtainError)
-	cert, err := c.getForCSR(domains, order, bundle, csr.Raw, nil)
-	if err != nil {
-		for _, auth := range authz {
-			failures[challenge.GetTargetedDomain(auth)] = err
-		}
-	}
-
-	if cert != nil {
-		// Add the CSR to the certificate so that it can be used for renewals.
-		cert.CSR = certcrypto.PEMEncode(&csr)
-	}
-
-	// Do not return an empty failures map,
-	// because it would still be a non-nil error value
-	if len(failures) > 0 {
-		return cert, failures
-	}
-	return cert, nil
-}
-
-func (c *Certifier) getForOrder(domains []string, order acme.ExtendedOrder, bundle bool, privateKey crypto.PrivateKey, mustStaple bool) (*Resource, error) {
-	if privateKey == nil {
-		var err error
-		privateKey, err = certcrypto.GeneratePrivateKey(c.options.KeyType)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// Determine certificate name(s) based on the authorization resources
-	commonName := domains[0]
-
-	// ACME draft Section 7.4 "Applying for Certificate Issuance"
-	// https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.4
-	// says:
-	//   Clients SHOULD NOT make any assumptions about the sort order of
-	//   "identifiers" or "authorizations" elements in the returned order
-	//   object.
-	san := []string{commonName}
-	for _, auth := range order.Identifiers {
-		if auth.Value != commonName {
-			san = append(san, auth.Value)
-		}
-	}
-
-	// TODO: should the CSR be customizable?
-	csr, err := certcrypto.GenerateCSR(privateKey, commonName, san, mustStaple)
-	if err != nil {
-		return nil, err
-	}
-
-	return c.getForCSR(domains, order, bundle, csr, certcrypto.PEMEncode(privateKey))
-}
-
-func (c *Certifier) getForCSR(domains []string, order acme.ExtendedOrder, bundle bool, csr []byte, privateKeyPem []byte) (*Resource, error) {
-	respOrder, err := c.core.Orders.UpdateForCSR(order.Finalize, csr)
-	if err != nil {
-		return nil, err
-	}
-
-	commonName := domains[0]
-	certRes := &Resource{
-		Domain:     commonName,
-		CertURL:    respOrder.Certificate,
-		PrivateKey: privateKeyPem,
-	}
-
-	if respOrder.Status == acme.StatusValid {
-		// if the certificate is available right away, short cut!
-		ok, errR := c.checkResponse(respOrder, certRes, bundle)
-		if errR != nil {
-			return nil, errR
-		}
-
-		if ok {
-			return certRes, nil
-		}
-	}
-
-	timeout := c.options.Timeout
-	if c.options.Timeout <= 0 {
-		timeout = 30 * time.Second
-	}
-
-	err = wait.For("certificate", timeout, timeout/60, func() (bool, error) {
-		ord, errW := c.core.Orders.Get(order.Location)
-		if errW != nil {
-			return false, errW
-		}
-
-		done, errW := c.checkResponse(ord, certRes, bundle)
-		if errW != nil {
-			return false, errW
-		}
-
-		return done, nil
-	})
-
-	return certRes, err
-}
-
-// checkResponse checks to see if the certificate is ready and a link is contained in the response.
-//
-// If so, loads it into certRes and returns true.
-// If the cert is not yet ready, it returns false.
-//
-// The certRes input should already have the Domain (common name) field populated.
-//
-// If bundle is true, the certificate will be bundled with the issuer's cert.
-func (c *Certifier) checkResponse(order acme.Order, certRes *Resource, bundle bool) (bool, error) {
-	valid, err := checkOrderStatus(order)
-	if err != nil || !valid {
-		return valid, err
-	}
-
-	cert, issuer, err := c.core.Certificates.Get(order.Certificate, bundle)
-	if err != nil {
-		return false, err
-	}
-
-	log.Infof("[%s] Server responded with a certificate.", certRes.Domain)
-
-	certRes.IssuerCertificate = issuer
-	certRes.Certificate = cert
-	certRes.CertURL = order.Certificate
-	certRes.CertStableURL = order.Certificate
-
-	return true, nil
-}
-
-// Revoke takes a PEM encoded certificate or bundle and tries to revoke it at the CA.
-func (c *Certifier) Revoke(cert []byte) error {
-	certificates, err := certcrypto.ParsePEMBundle(cert)
-	if err != nil {
-		return err
-	}
-
-	x509Cert := certificates[0]
-	if x509Cert.IsCA {
-		return fmt.Errorf("certificate bundle starts with a CA certificate")
-	}
-
-	revokeMsg := acme.RevokeCertMessage{
-		Certificate: base64.RawURLEncoding.EncodeToString(x509Cert.Raw),
-	}
-
-	return c.core.Certificates.Revoke(revokeMsg)
-}
-
-// Renew takes a Resource and tries to renew the certificate.
-//
-// If the renewal process succeeds, the new certificate will ge returned in a new CertResource.
-// Please be aware that this function will return a new certificate in ANY case that is not an error.
-// If the server does not provide us with a new cert on a GET request to the CertURL
-// this function will start a new-cert flow where a new certificate gets generated.
-//
-// If bundle is true, the []byte contains both the issuer certificate and your issued certificate as a bundle.
-//
-// For private key reuse the PrivateKey property of the passed in Resource should be non-nil.
-func (c *Certifier) Renew(certRes Resource, bundle, mustStaple bool) (*Resource, error) {
-	// Input certificate is PEM encoded.
-	// Decode it here as we may need the decoded cert later on in the renewal process.
-	// The input may be a bundle or a single certificate.
-	certificates, err := certcrypto.ParsePEMBundle(certRes.Certificate)
-	if err != nil {
-		return nil, err
-	}
-
-	x509Cert := certificates[0]
-	if x509Cert.IsCA {
-		return nil, fmt.Errorf("[%s] Certificate bundle starts with a CA certificate", certRes.Domain)
-	}
-
-	// This is just meant to be informal for the user.
-	timeLeft := x509Cert.NotAfter.Sub(time.Now().UTC())
-	log.Infof("[%s] acme: Trying renewal with %d hours remaining", certRes.Domain, int(timeLeft.Hours()))
-
-	// We always need to request a new certificate to renew.
-	// Start by checking to see if the certificate was based off a CSR,
-	// and use that if it's defined.
-	if len(certRes.CSR) > 0 {
-		csr, errP := certcrypto.PemDecodeTox509CSR(certRes.CSR)
-		if errP != nil {
-			return nil, errP
-		}
-
-		return c.ObtainForCSR(*csr, bundle)
-	}
-
-	var privateKey crypto.PrivateKey
-	if certRes.PrivateKey != nil {
-		privateKey, err = certcrypto.ParsePEMPrivateKey(certRes.PrivateKey)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	query := ObtainRequest{
-		Domains:    certcrypto.ExtractDomains(x509Cert),
-		Bundle:     bundle,
-		PrivateKey: privateKey,
-		MustStaple: mustStaple,
-	}
-	return c.Obtain(query)
-}
-
-// GetOCSP takes a PEM encoded cert or cert bundle returning the raw OCSP response,
-// the parsed response, and an error, if any.
-//
-// The returned []byte can be passed directly into the OCSPStaple property of a tls.Certificate.
-// If the bundle only contains the issued certificate,
-// this function will try to get the issuer certificate from the IssuingCertificateURL in the certificate.
-//
-// If the []byte and/or ocsp.Response return values are nil, the OCSP status may be assumed OCSPUnknown.
-func (c *Certifier) GetOCSP(bundle []byte) ([]byte, *ocsp.Response, error) {
-	certificates, err := certcrypto.ParsePEMBundle(bundle)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// We expect the certificate slice to be ordered downwards the chain.
-	// SRV CRT -> CA. We need to pull the leaf and issuer certs out of it,
-	// which should always be the first two certificates.
-	// If there's no OCSP server listed in the leaf cert, there's nothing to do.
-	// And if we have only one certificate so far, we need to get the issuer cert.
-
-	issuedCert := certificates[0]
-
-	if len(issuedCert.OCSPServer) == 0 {
-		return nil, nil, errors.New("no OCSP server specified in cert")
-	}
-
-	if len(certificates) == 1 {
-		// TODO: build fallback. If this fails, check the remaining array entries.
-		if len(issuedCert.IssuingCertificateURL) == 0 {
-			return nil, nil, errors.New("no issuing certificate URL")
-		}
-
-		resp, errC := c.core.HTTPClient.Get(issuedCert.IssuingCertificateURL[0])
-		if errC != nil {
-			return nil, nil, errC
-		}
-		defer resp.Body.Close()
-
-		issuerBytes, errC := ioutil.ReadAll(http.MaxBytesReader(nil, resp.Body, maxBodySize))
-		if errC != nil {
-			return nil, nil, errC
-		}
-
-		issuerCert, errC := x509.ParseCertificate(issuerBytes)
-		if errC != nil {
-			return nil, nil, errC
-		}
-
-		// Insert it into the slice on position 0
-		// We want it ordered right SRV CRT -> CA
-		certificates = append(certificates, issuerCert)
-	}
-
-	issuerCert := certificates[1]
-
-	// Finally kick off the OCSP request.
-	ocspReq, err := ocsp.CreateRequest(issuedCert, issuerCert, nil)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	resp, err := c.core.HTTPClient.Post(issuedCert.OCSPServer[0], "application/ocsp-request", bytes.NewReader(ocspReq))
-	if err != nil {
-		return nil, nil, err
-	}
-	defer resp.Body.Close()
-
-	ocspResBytes, err := ioutil.ReadAll(http.MaxBytesReader(nil, resp.Body, maxBodySize))
-	if err != nil {
-		return nil, nil, err
-	}
-
-	ocspRes, err := ocsp.ParseResponse(ocspResBytes, issuerCert)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return ocspResBytes, ocspRes, nil
-}
-
-func checkOrderStatus(order acme.Order) (bool, error) {
-	switch order.Status {
-	case acme.StatusValid:
-		return true, nil
-	case acme.StatusInvalid:
-		return false, order.Error
-	default:
-		return false, nil
-	}
-}
-
-// https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.1.4
-// The domain name MUST be encoded
-//   in the form in which it would appear in a certificate.  That is, it
-//   MUST be encoded according to the rules in Section 7 of [RFC5280].
-//
-// https://tools.ietf.org/html/rfc5280#section-7
-func sanitizeDomain(domains []string) []string {
-	var sanitizedDomains []string
-	for _, domain := range domains {
-		sanitizedDomain, err := idna.ToASCII(domain)
-		if err != nil {
-			log.Infof("skip domain %q: unable to sanitize (punnycode): %v", domain, err)
-		} else {
-			sanitizedDomains = append(sanitizedDomains, sanitizedDomain)
-		}
-	}
-	return sanitizedDomains
-}
--- a/vendor/github.com/go-acme/lego/certificate/errors.go
+++ b/vendor/github.com/go-acme/lego/certificate/errors.go
@@ -1,30 +0,0 @@
-package certificate
-
-import (
-	"bytes"
-	"fmt"
-	"sort"
-)
-
-// obtainError is returned when there are specific errors available per domain.
-type obtainError map[string]error
-
-func (e obtainError) Error() string {
-	buffer := bytes.NewBufferString("acme: Error -> One or more domains had a problem:\n")
-
-	var domains []string
-	for domain := range e {
-		domains = append(domains, domain)
-	}
-	sort.Strings(domains)
-
-	for _, domain := range domains {
-		buffer.WriteString(fmt.Sprintf("[%s] %s\n", domain, e[domain]))
-	}
-	return buffer.String()
-}
-
-type domainError struct {
-	Domain string
-	Error  error
-}
--- a/vendor/github.com/go-acme/lego/challenge/challenges.go
+++ b/vendor/github.com/go-acme/lego/challenge/challenges.go
@@ -1,44 +0,0 @@
-package challenge
-
-import (
-	"fmt"
-
-	"github.com/go-acme/lego/acme"
-)
-
-// Type is a string that identifies a particular challenge type and version of ACME challenge.
-type Type string
-
-const (
-	// HTTP01 is the "http-01" ACME challenge https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-8.3
-	// Note: ChallengePath returns the URL path to fulfill this challenge
-	HTTP01 = Type("http-01")
-
-	// DNS01 is the "dns-01" ACME challenge https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-8.4
-	// Note: GetRecord returns a DNS record which will fulfill this challenge
-	DNS01 = Type("dns-01")
-
-	// TLSALPN01 is the "tls-alpn-01" ACME challenge https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05
-	TLSALPN01 = Type("tls-alpn-01")
-)
-
-func (t Type) String() string {
-	return string(t)
-}
-
-func FindChallenge(chlgType Type, authz acme.Authorization) (acme.Challenge, error) {
-	for _, chlg := range authz.Challenges {
-		if chlg.Type == string(chlgType) {
-			return chlg, nil
-		}
-	}
-
-	return acme.Challenge{}, fmt.Errorf("[%s] acme: unable to find challenge %s", GetTargetedDomain(authz), chlgType)
-}
-
-func GetTargetedDomain(authz acme.Authorization) string {
-	if authz.Wildcard {
-		return "*." + authz.Identifier.Value
-	}
-	return authz.Identifier.Value
-}
--- a/vendor/github.com/go-acme/lego/challenge/dns01/cname.go
+++ b/vendor/github.com/go-acme/lego/challenge/dns01/cname.go
@@ -1,16 +0,0 @@
-package dns01
-
-import "github.com/miekg/dns"
-
-// Update FQDN with CNAME if any
-func updateDomainWithCName(r *dns.Msg, fqdn string) string {
-	for _, rr := range r.Answer {
-		if cn, ok := rr.(*dns.CNAME); ok {
-			if cn.Hdr.Name == fqdn {
-				return cn.Target
-			}
-		}
-	}
-
-	return fqdn
-}
--- a/vendor/github.com/go-acme/lego/challenge/dns01/dns_challenge.go
+++ b/vendor/github.com/go-acme/lego/challenge/dns01/dns_challenge.go
@@ -1,188 +0,0 @@
-package dns01
-
-import (
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/go-acme/lego/acme"
-	"github.com/go-acme/lego/acme/api"
-	"github.com/go-acme/lego/challenge"
-	"github.com/go-acme/lego/log"
-	"github.com/go-acme/lego/platform/wait"
-	"github.com/miekg/dns"
-)
-
-const (
-	// DefaultPropagationTimeout default propagation timeout
-	DefaultPropagationTimeout = 60 * time.Second
-
-	// DefaultPollingInterval default polling interval
-	DefaultPollingInterval = 2 * time.Second
-
-	// DefaultTTL default TTL
-	DefaultTTL = 120
-)
-
-type ValidateFunc func(core *api.Core, domain string, chlng acme.Challenge) error
-
-type ChallengeOption func(*Challenge) error
-
-// CondOption Conditional challenge option.
-func CondOption(condition bool, opt ChallengeOption) ChallengeOption {
-	if !condition {
-		// NoOp options
-		return func(*Challenge) error {
-			return nil
-		}
-	}
-	return opt
-}
-
-// Challenge implements the dns-01 challenge
-type Challenge struct {
-	core       *api.Core
-	validate   ValidateFunc
-	provider   challenge.Provider
-	preCheck   preCheck
-	dnsTimeout time.Duration
-}
-
-func NewChallenge(core *api.Core, validate ValidateFunc, provider challenge.Provider, opts ...ChallengeOption) *Challenge {
-	chlg := &Challenge{
-		core:       core,
-		validate:   validate,
-		provider:   provider,
-		preCheck:   newPreCheck(),
-		dnsTimeout: 10 * time.Second,
-	}
-
-	for _, opt := range opts {
-		err := opt(chlg)
-		if err != nil {
-			log.Infof("challenge option error: %v", err)
-		}
-	}
-
-	return chlg
-}
-
-// PreSolve just submits the txt record to the dns provider.
-// It does not validate record propagation, or do anything at all with the acme server.
-func (c *Challenge) PreSolve(authz acme.Authorization) error {
-	domain := challenge.GetTargetedDomain(authz)
-	log.Infof("[%s] acme: Preparing to solve DNS-01", domain)
-
-	chlng, err := challenge.FindChallenge(challenge.DNS01, authz)
-	if err != nil {
-		return err
-	}
-
-	if c.provider == nil {
-		return fmt.Errorf("[%s] acme: no DNS Provider configured", domain)
-	}
-
-	// Generate the Key Authorization for the challenge
-	keyAuth, err := c.core.GetKeyAuthorization(chlng.Token)
-	if err != nil {
-		return err
-	}
-
-	err = c.provider.Present(authz.Identifier.Value, chlng.Token, keyAuth)
-	if err != nil {
-		return fmt.Errorf("[%s] acme: error presenting token: %s", domain, err)
-	}
-
-	return nil
-}
-
-func (c *Challenge) Solve(authz acme.Authorization) error {
-	domain := challenge.GetTargetedDomain(authz)
-	log.Infof("[%s] acme: Trying to solve DNS-01", domain)
-
-	chlng, err := challenge.FindChallenge(challenge.DNS01, authz)
-	if err != nil {
-		return err
-	}
-
-	// Generate the Key Authorization for the challenge
-	keyAuth, err := c.core.GetKeyAuthorization(chlng.Token)
-	if err != nil {
-		return err
-	}
-
-	fqdn, value := GetRecord(authz.Identifier.Value, keyAuth)
-
-	var timeout, interval time.Duration
-	switch provider := c.provider.(type) {
-	case challenge.ProviderTimeout:
-		timeout, interval = provider.Timeout()
-	default:
-		timeout, interval = DefaultPropagationTimeout, DefaultPollingInterval
-	}
-
-	log.Infof("[%s] acme: Checking DNS record propagation using %+v", domain, recursiveNameservers)
-
-	err = wait.For("propagation", timeout, interval, func() (bool, error) {
-		stop, errP := c.preCheck.call(domain, fqdn, value)
-		if !stop || errP != nil {
-			log.Infof("[%s] acme: Waiting for DNS record propagation.", domain)
-		}
-		return stop, errP
-	})
-	if err != nil {
-		return err
-	}
-
-	chlng.KeyAuthorization = keyAuth
-	return c.validate(c.core, domain, chlng)
-}
-
-// CleanUp cleans the challenge.
-func (c *Challenge) CleanUp(authz acme.Authorization) error {
-	log.Infof("[%s] acme: Cleaning DNS-01 challenge", challenge.GetTargetedDomain(authz))
-
-	chlng, err := challenge.FindChallenge(challenge.DNS01, authz)
-	if err != nil {
-		return err
-	}
-
-	keyAuth, err := c.core.GetKeyAuthorization(chlng.Token)
-	if err != nil {
-		return err
-	}
-
-	return c.provider.CleanUp(authz.Identifier.Value, chlng.Token, keyAuth)
-}
-
-func (c *Challenge) Sequential() (bool, time.Duration) {
-	if p, ok := c.provider.(sequential); ok {
-		return ok, p.Sequential()
-	}
-	return false, 0
-}
-
-type sequential interface {
-	Sequential() time.Duration
-}
-
-// GetRecord returns a DNS record which will fulfill the `dns-01` challenge
-func GetRecord(domain, keyAuth string) (fqdn string, value string) {
-	keyAuthShaBytes := sha256.Sum256([]byte(keyAuth))
-	// base64URL encoding without padding
-	value = base64.RawURLEncoding.EncodeToString(keyAuthShaBytes[:sha256.Size])
-	fqdn = fmt.Sprintf("_acme-challenge.%s.", domain)
-
-	if ok, _ := strconv.ParseBool(os.Getenv("LEGO_EXPERIMENTAL_CNAME_SUPPORT")); ok {
-		r, err := dnsQuery(fqdn, dns.TypeCNAME, recursiveNameservers, true)
-		// Check if the domain has CNAME then return that
-		if err == nil && r.Rcode == dns.RcodeSuccess {
-			fqdn = updateDomainWithCName(r, fqdn)
-		}
-	}
-
-	return
-}
--- a/vendor/github.com/go-acme/lego/challenge/dns01/dns_challenge_manual.go
+++ b/vendor/github.com/go-acme/lego/challenge/dns01/dns_challenge_manual.go
@@ -1,52 +0,0 @@
-package dns01
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-)
-
-const (
-	dnsTemplate = `%s %d IN TXT "%s"`
-)
-
-// DNSProviderManual is an implementation of the ChallengeProvider interface
-type DNSProviderManual struct{}
-
-// NewDNSProviderManual returns a DNSProviderManual instance.
-func NewDNSProviderManual() (*DNSProviderManual, error) {
-	return &DNSProviderManual{}, nil
-}
-
-// Present prints instructions for manually creating the TXT record
-func (*DNSProviderManual) Present(domain, token, keyAuth string) error {
-	fqdn, value := GetRecord(domain, keyAuth)
-
-	authZone, err := FindZoneByFqdn(fqdn)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("lego: Please create the following TXT record in your %s zone:\n", authZone)
-	fmt.Printf(dnsTemplate+"\n", fqdn, DefaultTTL, value)
-	fmt.Printf("lego: Press 'Enter' when you are done\n")
-
-	_, err = bufio.NewReader(os.Stdin).ReadBytes('\n')
-
-	return err
-}
-
-// CleanUp prints instructions for manually removing the TXT record
-func (*DNSProviderManual) CleanUp(domain, token, keyAuth string) error {
-	fqdn, _ := GetRecord(domain, keyAuth)
-
-	authZone, err := FindZoneByFqdn(fqdn)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("lego: You can now remove this TXT record from your %s zone:\n", authZone)
-	fmt.Printf(dnsTemplate+"\n", fqdn, DefaultTTL, "...")
-
-	return nil
-}
--- a/vendor/github.com/go-acme/lego/challenge/dns01/fqdn.go
+++ b/vendor/github.com/go-acme/lego/challenge/dns01/fqdn.go
@@ -1,19 +0,0 @@
-package dns01
-
-// ToFqdn converts the name into a fqdn appending a trailing dot.
-func ToFqdn(name string) string {
-	n := len(name)
-	if n == 0 || name[n-1] == '.' {
-		return name
-	}
-	return name + "."
-}
-
-// UnFqdn converts the fqdn into a name removing the trailing dot.
-func UnFqdn(name string) string {
-	n := len(name)
-	if n != 0 && name[n-1] == '.' {
-		return name[:n-1]
-	}
-	return name
-}
--- a/Show More
+++ b/Show More