diff --git a/go.mod b/go.mod
index 5e345a99..a729b65e 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/hashicorp/go-hclog v0.12.0
 	github.com/hashicorp/go-uuid v1.0.2
 	github.com/hashicorp/vault/api v1.0.5-0.20200215224050-f6547fa8e820
-	github.com/hashicorp/vault/sdk v0.1.14-0.20200215224050-f6547fa8e820
+	github.com/hashicorp/vault/sdk v0.1.14-0.20200427170607-03332aaf8d18
 	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
 	github.com/stretchr/testify v1.3.0
 	golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a
diff --git a/go.sum b/go.sum
index f718730f..377f88a0 100644
--- a/go.sum
+++ b/go.sum
@@ -98,8 +98,8 @@ github.com/hashicorp/vault/api v1.0.5-0.20200215224050-f6547fa8e820 h1:biZidYDDE
 github.com/hashicorp/vault/api v1.0.5-0.20200215224050-f6547fa8e820/go.mod h1:3f12BMfgDGjTsTtIUj+ZKZwSobQpZtYGFIEehOv5z1o=
 github.com/hashicorp/vault/sdk v0.1.14-0.20200215195600-2ca765f0a500 h1:tiMX2ewq4ble+e2zENzBvaH2dMoFHe80NbnrF5Ir9Kk=
 github.com/hashicorp/vault/sdk v0.1.14-0.20200215195600-2ca765f0a500/go.mod h1:WX57W2PwkrOPQ6rVQk+dy5/htHIaB4aBM70EwKThu10=
-github.com/hashicorp/vault/sdk v0.1.14-0.20200215224050-f6547fa8e820 h1:TmDZ1sS6gU0hFeFlFuyJVUwRPEzifZIHCBeS2WF2uSc=
-github.com/hashicorp/vault/sdk v0.1.14-0.20200215224050-f6547fa8e820/go.mod h1:WX57W2PwkrOPQ6rVQk+dy5/htHIaB4aBM70EwKThu10=
+github.com/hashicorp/vault/sdk v0.1.14-0.20200427170607-03332aaf8d18 h1:xnQPngs9nbaMNx7keJMa1ccVAvs97ZHTno9o1Iz5x8Y=
+github.com/hashicorp/vault/sdk v0.1.14-0.20200427170607-03332aaf8d18/go.mod h1:WX57W2PwkrOPQ6rVQk+dy5/htHIaB4aBM70EwKThu10=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
diff --git a/plugin/backend_test.go b/plugin/backend_test.go
index e0548a60..36933491 100644
--- a/plugin/backend_test.go
+++ b/plugin/backend_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/hashicorp/go-gcp-common/gcputil"
 	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/helper/authmetadata"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -40,7 +41,9 @@ func testBackendWithCreds(tb testing.TB) (*GcpAuthBackend, logical.Storage, *gcp
 	ctx := context.Background()
 
 	entry, err := logical.StorageEntryJSON("config", &gcpConfig{
-		Credentials: creds,
+		Credentials:     creds,
+		GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+		IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 	})
 	if err != nil {
 		tb.Fatal(err)
diff --git a/plugin/gcp_config.go b/plugin/gcp_config.go
index 6968cca3..899c3487 100644
--- a/plugin/gcp_config.go
+++ b/plugin/gcp_config.go
@@ -9,15 +9,18 @@ import (
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/go-gcp-common/gcputil"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/authmetadata"
 	"google.golang.org/api/compute/v1"
 	"google.golang.org/api/iam/v1"
 )
 
 // gcpConfig contains all config required for the GCP backend.
 type gcpConfig struct {
-	Credentials  *gcputil.GcpCredentials `json:"credentials"`
-	IAMAliasType string                  `json:"iam_alias"`
-	GCEAliasType string                  `json:"gce_alias"`
+	Credentials     *gcputil.GcpCredentials `json:"credentials"`
+	IAMAliasType    string                  `json:"iam_alias"`
+	IAMAuthMetadata *authmetadata.Handler   `json:"iam_auth_metadata_handler"`
+	GCEAliasType    string                  `json:"gce_alias"`
+	GCEAuthMetadata *authmetadata.Handler   `json:"gce_auth_metadata_handler"`
 }
 
 // standardizedCreds wraps gcputil.GcpCredentials with a type to allow
@@ -44,25 +47,22 @@ func (c *gcpConfig) formatAndMarshalCredentials() ([]byte, error) {
 }
 
 // Update sets gcpConfig values parsed from the FieldData.
-func (c *gcpConfig) Update(d *framework.FieldData) (bool, error) {
+func (c *gcpConfig) Update(d *framework.FieldData) error {
 	if d == nil {
-		return false, nil
+		return nil
 	}
 
-	changed := false
-
 	if v, ok := d.GetOk("credentials"); ok {
 		creds, err := gcputil.Credentials(v.(string))
 		if err != nil {
-			return false, errwrap.Wrapf("failed to read credentials: {{err}}", err)
+			return errwrap.Wrapf("failed to read credentials: {{err}}", err)
 		}
 
 		if len(creds.PrivateKeyId) == 0 {
-			return false, errors.New("missing private key in credentials")
+			return errors.New("missing private key in credentials")
 		}
 
 		c.Credentials = creds
-		changed = true
 	}
 
 	rawIamAlias, exists := d.GetOk("iam_alias")
@@ -70,20 +70,23 @@ func (c *gcpConfig) Update(d *framework.FieldData) (bool, error) {
 		iamAlias := rawIamAlias.(string)
 		if iamAlias != c.IAMAliasType {
 			c.IAMAliasType = iamAlias
-			changed = true
 		}
 	}
+	if err := c.IAMAuthMetadata.ParseAuthMetadata(d); err != nil {
+		return errwrap.Wrapf("failed to parse iam metadata: {{err}}", err)
+	}
 
 	rawGceAlias, exists := d.GetOk("gce_alias")
 	if exists {
 		gceAlias := rawGceAlias.(string)
 		if gceAlias != c.GCEAliasType {
 			c.GCEAliasType = gceAlias
-			changed = true
 		}
 	}
-
-	return changed, nil
+	if err := c.GCEAuthMetadata.ParseAuthMetadata(d); err != nil {
+		return errwrap.Wrapf("failed to parse gce metadata: {{err}}", err)
+	}
+	return nil
 }
 
 func (c *gcpConfig) getIAMAlias(role *gcpRole, svcAccount *iam.ServiceAccount) (alias string, err error) {
diff --git a/plugin/path_config.go b/plugin/path_config.go
index 4bf8f258..4b80a049 100644
--- a/plugin/path_config.go
+++ b/plugin/path_config.go
@@ -6,9 +6,45 @@ import (
 
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/authmetadata"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
+var (
+	// The default gce_alias is "instance_id". The default fields
+	// below are selected because they're unlikely to change often
+	// for a particular instance ID.
+	gceAuthMetadataFields = &authmetadata.Fields{
+		FieldName: "gce_metadata",
+		Default: []string{
+			"instance_creation_timestamp",
+			"instance_id",
+			"instance_name",
+			"project_id",
+			"project_number",
+			"role",
+			"service_account_id",
+			"service_account_email",
+			"zone",
+		},
+		AvailableToAdd: []string{},
+	}
+
+	// The default iam_alias is "unique_id". The default fields
+	// below are selected because they're unlikely to change often
+	// for a particular instance ID.
+	iamAuthMetadataFields = &authmetadata.Fields{
+		FieldName: "iam_metadata",
+		Default: []string{
+			"project_id",
+			"role",
+			"service_account_id",
+			"service_account_email",
+		},
+		AvailableToAdd: []string{},
+	}
+)
+
 func pathConfig(b *GcpAuthBackend) *framework.Path {
 	return &framework.Path{
 		Pattern: "config",
@@ -27,11 +63,13 @@ If not specified, will use application default credentials`,
 				Default:     defaultIAMAlias,
 				Description: "Indicates what value to use when generating an alias for IAM authentications.",
 			},
+			iamAuthMetadataFields.FieldName: authmetadata.FieldSchema(iamAuthMetadataFields),
 			"gce_alias": {
 				Type:        framework.TypeString,
 				Default:     defaultGCEAlias,
 				Description: "Indicates what value to use when generating an alias for GCE authentications.",
 			},
+			gceAuthMetadataFields.FieldName: authmetadata.FieldSchema(gceAuthMetadataFields),
 
 			// Deprecated
 			"google_certs_endpoint": {
@@ -64,36 +102,28 @@ func (b *GcpAuthBackend) pathConfigWrite(ctx context.Context, req *logical.Reque
 	}
 
 	c, err := b.config(ctx, req.Storage)
-
 	if err != nil {
 		return nil, err
 	}
-	if c == nil {
-		c = &gcpConfig{}
-	}
 
-	changed, err := c.Update(d)
-	if err != nil {
+	if err := c.Update(d); err != nil {
 		return nil, logical.CodedError(http.StatusBadRequest, err.Error())
 	}
 
-	// Only do the following if the config is different
-	if changed {
-		// Generate a new storage entry
-		entry, err := logical.StorageEntryJSON("config", c)
-		if err != nil {
-			return nil, errwrap.Wrapf("failed to generate JSON configuration: {{err}}", err)
-		}
-
-		// Save the storage entry
-		if err := req.Storage.Put(ctx, entry); err != nil {
-			return nil, errwrap.Wrapf("failed to persist configuration to storage: {{err}}", err)
-		}
+	// Create/update the storage entry
+	entry, err := logical.StorageEntryJSON("config", c)
+	if err != nil {
+		return nil, errwrap.Wrapf("failed to generate JSON configuration: {{err}}", err)
+	}
 
-		// Invalidate existing client so it reads the new configuration
-		b.ClearCaches()
+	// Save the storage entry
+	if err := req.Storage.Put(ctx, entry); err != nil {
+		return nil, errwrap.Wrapf("failed to persist configuration to storage: {{err}}", err)
 	}
 
+	// Invalidate existing client so it reads the new configuration
+	b.ClearCaches()
+
 	return nil, nil
 }
 
@@ -106,23 +136,25 @@ func (b *GcpAuthBackend) pathConfigRead(ctx context.Context, req *logical.Reques
 	if err != nil {
 		return nil, err
 	}
-	if config == nil {
-		return nil, nil
-	}
 
-	resp := make(map[string]interface{})
-
-	if v := config.Credentials.ClientEmail; v != "" {
-		resp["client_email"] = v
-	}
-	if v := config.Credentials.ClientId; v != "" {
-		resp["client_id"] = v
+	resp := map[string]interface{}{
+		gceAuthMetadataFields.FieldName: config.GCEAuthMetadata.AuthMetadata(),
+		iamAuthMetadataFields.FieldName: config.IAMAuthMetadata.AuthMetadata(),
 	}
-	if v := config.Credentials.PrivateKeyId; v != "" {
-		resp["private_key_id"] = v
-	}
-	if v := config.Credentials.ProjectId; v != "" {
-		resp["project_id"] = v
+
+	if config.Credentials != nil {
+		if v := config.Credentials.ClientEmail; v != "" {
+			resp["client_email"] = v
+		}
+		if v := config.Credentials.ClientId; v != "" {
+			resp["client_id"] = v
+		}
+		if v := config.Credentials.PrivateKeyId; v != "" {
+			resp["private_key_id"] = v
+		}
+		if v := config.Credentials.ProjectId; v != "" {
+			resp["project_id"] = v
+		}
 	}
 
 	if v := config.IAMAliasType; v != "" {
@@ -140,16 +172,17 @@ func (b *GcpAuthBackend) pathConfigRead(ctx context.Context, req *logical.Reques
 // config reads the backend's gcpConfig from storage.
 // This assumes the caller has already obtained the backend's config lock.
 func (b *GcpAuthBackend) config(ctx context.Context, s logical.Storage) (*gcpConfig, error) {
-	config := &gcpConfig{}
+	config := &gcpConfig{
+		GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+		IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
+	}
 	entry, err := s.Get(ctx, "config")
-
 	if err != nil {
 		return nil, err
 	}
 	if entry == nil {
-		return nil, nil
+		return config, nil
 	}
-
 	if err := entry.DecodeJSON(config); err != nil {
 		return nil, err
 	}
diff --git a/plugin/path_config_test.go b/plugin/path_config_test.go
index a74c0b33..7d2a032f 100644
--- a/plugin/path_config_test.go
+++ b/plugin/path_config_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/hashicorp/go-gcp-common/gcputil"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/authmetadata"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -31,9 +32,35 @@ func TestBackend_PathConfigRead(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-
-		if resp != nil {
-			t.Errorf("expected response data to be empty, got %v", resp.Data)
+		if resp == nil {
+			t.Fatal("expected non-nil response")
+		}
+		if len(resp.Data) != 2 {
+			t.Fatal("expected 2 fields")
+		}
+		expectedResp := &logical.Response{
+			Data: map[string]interface{}{
+				"iam_metadata": []string{
+					"project_id",
+					"role",
+					"service_account_id",
+					"service_account_email",
+				},
+				"gce_metadata": []string{
+					"instance_creation_timestamp",
+					"instance_id",
+					"instance_name",
+					"project_id",
+					"project_number",
+					"role",
+					"service_account_id",
+					"service_account_email",
+					"zone",
+				},
+			},
+		}
+		if !reflect.DeepEqual(resp, expectedResp) {
+			t.Fatalf("Actual: %#v\nExpected: %#v", resp, expectedResp)
 		}
 	})
 
@@ -51,8 +78,10 @@ func TestBackend_PathConfigRead(t *testing.T) {
 				PrivateKey:   "key",
 				ProjectId:    "project",
 			},
-			IAMAliasType: defaultIAMAlias,
-			GCEAliasType: defaultGCEAlias,
+			IAMAliasType:    defaultIAMAlias,
+			IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
+			GCEAliasType:    defaultGCEAlias,
+			GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
 		})
 		if err != nil {
 			t.Fatal(err)
@@ -76,7 +105,24 @@ func TestBackend_PathConfigRead(t *testing.T) {
 			"private_key_id": "key_id",
 			"project_id":     "project",
 			"iam_alias":      defaultIAMAlias,
-			"gce_alias":      defaultGCEAlias,
+			"iam_metadata": []string{
+				"project_id",
+				"role",
+				"service_account_id",
+				"service_account_email",
+			},
+			"gce_alias": defaultGCEAlias,
+			"gce_metadata": []string{
+				"instance_creation_timestamp",
+				"instance_id",
+				"instance_name",
+				"project_id",
+				"project_number",
+				"role",
+				"service_account_id",
+				"service_account_email",
+				"zone",
+			},
 		}
 
 		if !reflect.DeepEqual(resp.Data, expectedData) {
@@ -160,6 +206,8 @@ func TestBackend_PathConfigWrite(t *testing.T) {
 				PrivateKey:   "key",
 				ProjectId:    "project",
 			},
+			GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+			IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 		})
 		if err != nil {
 			t.Fatal(err)
@@ -230,9 +278,15 @@ func TestConfig_Update(t *testing.T) {
 	}{
 		{
 			"empty",
-			&gcpConfig{},
+			&gcpConfig{
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
+			},
 			nil,
-			&gcpConfig{},
+			&gcpConfig{
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
+			},
 			false,
 			false,
 		},
@@ -242,12 +296,16 @@ func TestConfig_Update(t *testing.T) {
 				Credentials: &gcputil.GcpCredentials{
 					ClientId: "foo",
 				},
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 			},
 			nil,
 			&gcpConfig{
 				Credentials: &gcputil.GcpCredentials{
 					ClientId: "foo",
 				},
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 			},
 			false,
 			false,
@@ -258,6 +316,8 @@ func TestConfig_Update(t *testing.T) {
 				Credentials: &gcputil.GcpCredentials{
 					ClientId: "foo",
 				},
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 			},
 			&framework.FieldData{
 				Raw: map[string]interface{}{
@@ -272,6 +332,8 @@ func TestConfig_Update(t *testing.T) {
 					ClientId:     "bar",
 					PrivateKeyId: "aaa",
 				},
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 			},
 			true,
 			false,
@@ -282,6 +344,8 @@ func TestConfig_Update(t *testing.T) {
 				Credentials: &gcputil.GcpCredentials{
 					ClientId: "foo",
 				},
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 			},
 			&framework.FieldData{
 				Raw: map[string]interface{}{
@@ -296,6 +360,8 @@ func TestConfig_Update(t *testing.T) {
 					ClientId:     "foo",
 					PrivateKeyId: "aaa",
 				},
+				GCEAuthMetadata: authmetadata.NewHandler(gceAuthMetadataFields),
+				IAMAuthMetadata: authmetadata.NewHandler(iamAuthMetadataFields),
 			},
 			true,
 			false,
@@ -313,13 +379,12 @@ func TestConfig_Update(t *testing.T) {
 				tc.d.Schema = pathConfig(&b).Fields
 			}
 
-			changed, err := tc.new.Update(tc.d)
-			if (err != nil) != tc.err {
-				t.Fatal(err)
+			err := tc.new.Update(tc.d)
+			if tc.err && err == nil {
+				t.Fatalf("err expected, got nil")
 			}
-
-			if changed != tc.changed {
-				t.Errorf("expected %t to be %t", changed, tc.changed)
+			if !tc.err && err != nil {
+				t.Fatalf("no error expected, got: %s", err)
 			}
 
 			if v, exp := tc.new.Credentials, tc.r.Credentials; !reflect.DeepEqual(v, exp) {
diff --git a/plugin/path_login.go b/plugin/path_login.go
index c97946d4..22ec96bd 100644
--- a/plugin/path_login.go
+++ b/plugin/path_login.go
@@ -320,9 +320,6 @@ func (b *GcpAuthBackend) pathIamLogin(ctx context.Context, req *logical.Request,
 	if err != nil {
 		return logical.ErrorResponse("unable to retrieve GCP configuration"), nil
 	}
-	if conf == nil {
-		return logical.ErrorResponse("no configuration found"), nil
-	}
 
 	alias, err := conf.getIAMAlias(role, serviceAccount)
 	if err != nil {
@@ -349,11 +346,12 @@ func (b *GcpAuthBackend) pathIamLogin(ctx context.Context, req *logical.Request,
 		Alias: &logical.Alias{
 			Name: alias,
 		},
-		Metadata:    authMetadata(loginInfo, serviceAccount),
 		DisplayName: serviceAccount.Email,
 	}
-
 	role.PopulateTokenAuth(auth)
+	if err := conf.IAMAuthMetadata.PopulateDesiredMetadata(auth, authMetadata(loginInfo, serviceAccount)); err != nil {
+		b.Logger().Warn("unable to populate iam metadata", "err", err.Error())
+	}
 
 	resp := &logical.Response{
 		Auth: auth,
@@ -468,9 +466,6 @@ func (b *GcpAuthBackend) pathGceLogin(ctx context.Context, req *logical.Request,
 	if err != nil {
 		return logical.ErrorResponse("unable to retrieve GCP configuration"), nil
 	}
-	if conf == nil {
-		return logical.ErrorResponse("no configuration found"), nil
-	}
 
 	alias, err := conf.getGCEAlias(role, instance)
 	if err != nil {
@@ -505,11 +500,12 @@ func (b *GcpAuthBackend) pathGceLogin(ctx context.Context, req *logical.Request,
 		Alias: &logical.Alias{
 			Name: alias,
 		},
-		Metadata:    authMetadata(loginInfo, serviceAccount),
 		DisplayName: instance.Name,
 	}
-
 	role.PopulateTokenAuth(auth)
+	if err := conf.GCEAuthMetadata.PopulateDesiredMetadata(auth, authMetadata(loginInfo, serviceAccount)); err != nil {
+		b.Logger().Warn("unable to populate gce metadata", "err", err.Error())
+	}
 
 	resp := &logical.Response{
 		Auth: auth,
diff --git a/plugin/path_login_test.go b/plugin/path_login_test.go
index 650b15f5..9fb7fb3c 100644
--- a/plugin/path_login_test.go
+++ b/plugin/path_login_test.go
@@ -217,13 +217,14 @@ func TestLogin_IAM(t *testing.T) {
 				}
 				tc.exp.Auth.DisplayName = creds.ClientEmail
 
-				tc.exp.Auth.Metadata = map[string]string{
+				metadata := map[string]string{
 					"role":                  role,
 					"project_id":            creds.ProjectId,
 					"service_account_email": creds.ClientEmail,
 					"service_account_id":    creds.ClientId,
 				}
-
+				tc.exp.Auth.Metadata = metadata
+				tc.exp.Auth.Alias.Metadata = metadata
 				tc.exp.Auth.LeaseOptions.Renewable = true
 				tc.exp.Auth.Policies = tc.role.Policies
 
diff --git a/vendor/github.com/golang/mock/AUTHORS b/vendor/github.com/golang/mock/AUTHORS
new file mode 100644
index 00000000..660b8ccc
--- /dev/null
+++ b/vendor/github.com/golang/mock/AUTHORS
@@ -0,0 +1,12 @@
+# This is the official list of GoMock authors for copyright purposes.
+# This file is distinct from the CONTRIBUTORS files.
+# See the latter for an explanation.
+
+# Names should be added to this file as
+#	Name or Organization <email address>
+# The email address is not required for organizations.
+
+# Please keep the list sorted.
+
+Alex Reece <awreece@gmail.com>
+Google Inc.
diff --git a/vendor/github.com/golang/mock/CONTRIBUTORS b/vendor/github.com/golang/mock/CONTRIBUTORS
new file mode 100644
index 00000000..def849ca
--- /dev/null
+++ b/vendor/github.com/golang/mock/CONTRIBUTORS
@@ -0,0 +1,37 @@
+# This is the official list of people who can contribute (and typically
+# have contributed) code to the gomock repository.
+# The AUTHORS file lists the copyright holders; this file
+# lists people.  For example, Google employees are listed here
+# but not in AUTHORS, because Google holds the copyright.
+#
+# The submission process automatically checks to make sure
+# that people submitting code are listed in this file (by email address).
+#
+# Names should be added to this file only after verifying that
+# the individual or the individual's organization has agreed to
+# the appropriate Contributor License Agreement, found here:
+#
+#     http://code.google.com/legal/individual-cla-v1.0.html
+#     http://code.google.com/legal/corporate-cla-v1.0.html
+#
+# The agreement for individuals can be filled out on the web.
+#
+# When adding J Random Contributor's name to this file,
+# either J's name or J's organization's name should be
+# added to the AUTHORS file, depending on whether the
+# individual or corporate CLA was used.
+
+# Names should be added to this file like so:
+#     Name <email address>
+#
+# An entry with two email addresses specifies that the
+# first address should be used in the submit logs and
+# that the second address should be recognized as the
+# same person when interacting with Rietveld.
+
+# Please keep the list sorted.
+
+Aaron Jacobs <jacobsa@google.com> <aaronjjacobs@gmail.com>
+Alex Reece <awreece@gmail.com>
+David Symonds <dsymonds@golang.org>
+Ryan Barrett <ryanb@google.com>
diff --git a/vendor/github.com/golang/mock/LICENSE b/vendor/github.com/golang/mock/LICENSE
new file mode 100644
index 00000000..d6456956
--- /dev/null
+++ b/vendor/github.com/golang/mock/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/golang/mock/gomock/call.go b/vendor/github.com/golang/mock/gomock/call.go
new file mode 100644
index 00000000..7345f654
--- /dev/null
+++ b/vendor/github.com/golang/mock/gomock/call.go
@@ -0,0 +1,427 @@
+// Copyright 2010 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gomock
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+)
+
+// Call represents an expected call to a mock.
+type Call struct {
+	t TestHelper // for triggering test failures on invalid call setup
+
+	receiver   interface{}  // the receiver of the method call
+	method     string       // the name of the method
+	methodType reflect.Type // the type of the method
+	args       []Matcher    // the args
+	origin     string       // file and line number of call setup
+
+	preReqs []*Call // prerequisite calls
+
+	// Expectations
+	minCalls, maxCalls int
+
+	numCalls int // actual number made
+
+	// actions are called when this Call is called. Each action gets the args and
+	// can set the return values by returning a non-nil slice. Actions run in the
+	// order they are created.
+	actions []func([]interface{}) []interface{}
+}
+
+// newCall creates a *Call. It requires the method type in order to support
+// unexported methods.
+func newCall(t TestHelper, receiver interface{}, method string, methodType reflect.Type, args ...interface{}) *Call {
+	t.Helper()
+
+	// TODO: check arity, types.
+	margs := make([]Matcher, len(args))
+	for i, arg := range args {
+		if m, ok := arg.(Matcher); ok {
+			margs[i] = m
+		} else if arg == nil {
+			// Handle nil specially so that passing a nil interface value
+			// will match the typed nils of concrete args.
+			margs[i] = Nil()
+		} else {
+			margs[i] = Eq(arg)
+		}
+	}
+
+	origin := callerInfo(3)
+	actions := []func([]interface{}) []interface{}{func([]interface{}) []interface{} {
+		// Synthesize the zero value for each of the return args' types.
+		rets := make([]interface{}, methodType.NumOut())
+		for i := 0; i < methodType.NumOut(); i++ {
+			rets[i] = reflect.Zero(methodType.Out(i)).Interface()
+		}
+		return rets
+	}}
+	return &Call{t: t, receiver: receiver, method: method, methodType: methodType,
+		args: margs, origin: origin, minCalls: 1, maxCalls: 1, actions: actions}
+}
+
+// AnyTimes allows the expectation to be called 0 or more times
+func (c *Call) AnyTimes() *Call {
+	c.minCalls, c.maxCalls = 0, 1e8 // close enough to infinity
+	return c
+}
+
+// MinTimes requires the call to occur at least n times. If AnyTimes or MaxTimes have not been called or if MaxTimes
+// was previously called with 1, MinTimes also sets the maximum number of calls to infinity.
+func (c *Call) MinTimes(n int) *Call {
+	c.minCalls = n
+	if c.maxCalls == 1 {
+		c.maxCalls = 1e8
+	}
+	return c
+}
+
+// MaxTimes limits the number of calls to n times. If AnyTimes or MinTimes have not been called or if MinTimes was
+// previously called with 1, MaxTimes also sets the minimum number of calls to 0.
+func (c *Call) MaxTimes(n int) *Call {
+	c.maxCalls = n
+	if c.minCalls == 1 {
+		c.minCalls = 0
+	}
+	return c
+}
+
+// DoAndReturn declares the action to run when the call is matched.
+// The return values from this function are returned by the mocked function.
+// It takes an interface{} argument to support n-arity functions.
+func (c *Call) DoAndReturn(f interface{}) *Call {
+	// TODO: Check arity and types here, rather than dying badly elsewhere.
+	v := reflect.ValueOf(f)
+
+	c.addAction(func(args []interface{}) []interface{} {
+		vargs := make([]reflect.Value, len(args))
+		ft := v.Type()
+		for i := 0; i < len(args); i++ {
+			if args[i] != nil {
+				vargs[i] = reflect.ValueOf(args[i])
+			} else {
+				// Use the zero value for the arg.
+				vargs[i] = reflect.Zero(ft.In(i))
+			}
+		}
+		vrets := v.Call(vargs)
+		rets := make([]interface{}, len(vrets))
+		for i, ret := range vrets {
+			rets[i] = ret.Interface()
+		}
+		return rets
+	})
+	return c
+}
+
+// Do declares the action to run when the call is matched. The function's
+// return values are ignored to retain backward compatibility. To use the
+// return values call DoAndReturn.
+// It takes an interface{} argument to support n-arity functions.
+func (c *Call) Do(f interface{}) *Call {
+	// TODO: Check arity and types here, rather than dying badly elsewhere.
+	v := reflect.ValueOf(f)
+
+	c.addAction(func(args []interface{}) []interface{} {
+		vargs := make([]reflect.Value, len(args))
+		ft := v.Type()
+		for i := 0; i < len(args); i++ {
+			if args[i] != nil {
+				vargs[i] = reflect.ValueOf(args[i])
+			} else {
+				// Use the zero value for the arg.
+				vargs[i] = reflect.Zero(ft.In(i))
+			}
+		}
+		v.Call(vargs)
+		return nil
+	})
+	return c
+}
+
+// Return declares the values to be returned by the mocked function call.
+func (c *Call) Return(rets ...interface{}) *Call {
+	c.t.Helper()
+
+	mt := c.methodType
+	if len(rets) != mt.NumOut() {
+		c.t.Fatalf("wrong number of arguments to Return for %T.%v: got %d, want %d [%s]",
+			c.receiver, c.method, len(rets), mt.NumOut(), c.origin)
+	}
+	for i, ret := range rets {
+		if got, want := reflect.TypeOf(ret), mt.Out(i); got == want {
+			// Identical types; nothing to do.
+		} else if got == nil {
+			// Nil needs special handling.
+			switch want.Kind() {
+			case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Ptr, reflect.Slice:
+				// ok
+			default:
+				c.t.Fatalf("argument %d to Return for %T.%v is nil, but %v is not nillable [%s]",
+					i, c.receiver, c.method, want, c.origin)
+			}
+		} else if got.AssignableTo(want) {
+			// Assignable type relation. Make the assignment now so that the generated code
+			// can return the values with a type assertion.
+			v := reflect.New(want).Elem()
+			v.Set(reflect.ValueOf(ret))
+			rets[i] = v.Interface()
+		} else {
+			c.t.Fatalf("wrong type of argument %d to Return for %T.%v: %v is not assignable to %v [%s]",
+				i, c.receiver, c.method, got, want, c.origin)
+		}
+	}
+
+	c.addAction(func([]interface{}) []interface{} {
+		return rets
+	})
+
+	return c
+}
+
+// Times declares the exact number of times a function call is expected to be executed.
+func (c *Call) Times(n int) *Call {
+	c.minCalls, c.maxCalls = n, n
+	return c
+}
+
+// SetArg declares an action that will set the nth argument's value,
+// indirected through a pointer. Or, in the case of a slice, SetArg
+// will copy value's elements into the nth argument.
+func (c *Call) SetArg(n int, value interface{}) *Call {
+	c.t.Helper()
+
+	mt := c.methodType
+	// TODO: This will break on variadic methods.
+	// We will need to check those at invocation time.
+	if n < 0 || n >= mt.NumIn() {
+		c.t.Fatalf("SetArg(%d, ...) called for a method with %d args [%s]",
+			n, mt.NumIn(), c.origin)
+	}
+	// Permit setting argument through an interface.
+	// In the interface case, we don't (nay, can't) check the type here.
+	at := mt.In(n)
+	switch at.Kind() {
+	case reflect.Ptr:
+		dt := at.Elem()
+		if vt := reflect.TypeOf(value); !vt.AssignableTo(dt) {
+			c.t.Fatalf("SetArg(%d, ...) argument is a %v, not assignable to %v [%s]",
+				n, vt, dt, c.origin)
+		}
+	case reflect.Interface:
+		// nothing to do
+	case reflect.Slice:
+		// nothing to do
+	default:
+		c.t.Fatalf("SetArg(%d, ...) referring to argument of non-pointer non-interface non-slice type %v [%s]",
+			n, at, c.origin)
+	}
+
+	c.addAction(func(args []interface{}) []interface{} {
+		v := reflect.ValueOf(value)
+		switch reflect.TypeOf(args[n]).Kind() {
+		case reflect.Slice:
+			setSlice(args[n], v)
+		default:
+			reflect.ValueOf(args[n]).Elem().Set(v)
+		}
+		return nil
+	})
+	return c
+}
+
+// isPreReq returns true if other is a direct or indirect prerequisite to c.
+func (c *Call) isPreReq(other *Call) bool {
+	for _, preReq := range c.preReqs {
+		if other == preReq || preReq.isPreReq(other) {
+			return true
+		}
+	}
+	return false
+}
+
+// After declares that the call may only match after preReq has been exhausted.
+func (c *Call) After(preReq *Call) *Call {
+	c.t.Helper()
+
+	if c == preReq {
+		c.t.Fatalf("A call isn't allowed to be its own prerequisite")
+	}
+	if preReq.isPreReq(c) {
+		c.t.Fatalf("Loop in call order: %v is a prerequisite to %v (possibly indirectly).", c, preReq)
+	}
+
+	c.preReqs = append(c.preReqs, preReq)
+	return c
+}
+
+// Returns true if the minimum number of calls have been made.
+func (c *Call) satisfied() bool {
+	return c.numCalls >= c.minCalls
+}
+
+// Returns true if the maximum number of calls have been made.
+func (c *Call) exhausted() bool {
+	return c.numCalls >= c.maxCalls
+}
+
+func (c *Call) String() string {
+	args := make([]string, len(c.args))
+	for i, arg := range c.args {
+		args[i] = arg.String()
+	}
+	arguments := strings.Join(args, ", ")
+	return fmt.Sprintf("%T.%v(%s) %s", c.receiver, c.method, arguments, c.origin)
+}
+
+// Tests if the given call matches the expected call.
+// If yes, returns nil. If no, returns error with message explaining why it does not match.
+func (c *Call) matches(args []interface{}) error {
+	if !c.methodType.IsVariadic() {
+		if len(args) != len(c.args) {
+			return fmt.Errorf("expected call at %s has the wrong number of arguments. Got: %d, want: %d",
+				c.origin, len(args), len(c.args))
+		}
+
+		for i, m := range c.args {
+			if !m.Matches(args[i]) {
+				got := fmt.Sprintf("%v", args[i])
+				if gs, ok := m.(GotFormatter); ok {
+					got = gs.Got(args[i])
+				}
+
+				return fmt.Errorf(
+					"expected call at %s doesn't match the argument at index %d.\nGot: %v\nWant: %v",
+					c.origin, i, got, m,
+				)
+			}
+		}
+	} else {
+		if len(c.args) < c.methodType.NumIn()-1 {
+			return fmt.Errorf("expected call at %s has the wrong number of matchers. Got: %d, want: %d",
+				c.origin, len(c.args), c.methodType.NumIn()-1)
+		}
+		if len(c.args) != c.methodType.NumIn() && len(args) != len(c.args) {
+			return fmt.Errorf("expected call at %s has the wrong number of arguments. Got: %d, want: %d",
+				c.origin, len(args), len(c.args))
+		}
+		if len(args) < len(c.args)-1 {
+			return fmt.Errorf("expected call at %s has the wrong number of arguments. Got: %d, want: greater than or equal to %d",
+				c.origin, len(args), len(c.args)-1)
+		}
+
+		for i, m := range c.args {
+			if i < c.methodType.NumIn()-1 {
+				// Non-variadic args
+				if !m.Matches(args[i]) {
+					return fmt.Errorf("expected call at %s doesn't match the argument at index %s.\nGot: %v\nWant: %v",
+						c.origin, strconv.Itoa(i), args[i], m)
+				}
+				continue
+			}
+			// The last arg has a possibility of a variadic argument, so let it branch
+
+			// sample: Foo(a int, b int, c ...int)
+			if i < len(c.args) && i < len(args) {
+				if m.Matches(args[i]) {
+					// Got Foo(a, b, c) want Foo(matcherA, matcherB, gomock.Any())
+					// Got Foo(a, b, c) want Foo(matcherA, matcherB, someSliceMatcher)
+					// Got Foo(a, b, c) want Foo(matcherA, matcherB, matcherC)
+					// Got Foo(a, b) want Foo(matcherA, matcherB)
+					// Got Foo(a, b, c, d) want Foo(matcherA, matcherB, matcherC, matcherD)
+					continue
+				}
+			}
+
+			// The number of actual args don't match the number of matchers,
+			// or the last matcher is a slice and the last arg is not.
+			// If this function still matches it is because the last matcher
+			// matches all the remaining arguments or the lack of any.
+			// Convert the remaining arguments, if any, into a slice of the
+			// expected type.
+			vargsType := c.methodType.In(c.methodType.NumIn() - 1)
+			vargs := reflect.MakeSlice(vargsType, 0, len(args)-i)
+			for _, arg := range args[i:] {
+				vargs = reflect.Append(vargs, reflect.ValueOf(arg))
+			}
+			if m.Matches(vargs.Interface()) {
+				// Got Foo(a, b, c, d, e) want Foo(matcherA, matcherB, gomock.Any())
+				// Got Foo(a, b, c, d, e) want Foo(matcherA, matcherB, someSliceMatcher)
+				// Got Foo(a, b) want Foo(matcherA, matcherB, gomock.Any())
+				// Got Foo(a, b) want Foo(matcherA, matcherB, someEmptySliceMatcher)
+				break
+			}
+			// Wrong number of matchers or not match. Fail.
+			// Got Foo(a, b) want Foo(matcherA, matcherB, matcherC, matcherD)
+			// Got Foo(a, b, c) want Foo(matcherA, matcherB, matcherC, matcherD)
+			// Got Foo(a, b, c, d) want Foo(matcherA, matcherB, matcherC, matcherD, matcherE)
+			// Got Foo(a, b, c, d, e) want Foo(matcherA, matcherB, matcherC, matcherD)
+			// Got Foo(a, b, c) want Foo(matcherA, matcherB)
+			return fmt.Errorf("Expected call at %s doesn't match the argument at index %s.\nGot: %v\nWant: %v",
+				c.origin, strconv.Itoa(i), args[i:], c.args[i])
+
+		}
+	}
+
+	// Check that all prerequisite calls have been satisfied.
+	for _, preReqCall := range c.preReqs {
+		if !preReqCall.satisfied() {
+			return fmt.Errorf("Expected call at %s doesn't have a prerequisite call satisfied:\n%v\nshould be called before:\n%v",
+				c.origin, preReqCall, c)
+		}
+	}
+
+	// Check that the call is not exhausted.
+	if c.exhausted() {
+		return fmt.Errorf("expected call at %s has already been called the max number of times", c.origin)
+	}
+
+	return nil
+}
+
+// dropPrereqs tells the expected Call to not re-check prerequisite calls any
+// longer, and to return its current set.
+func (c *Call) dropPrereqs() (preReqs []*Call) {
+	preReqs = c.preReqs
+	c.preReqs = nil
+	return
+}
+
+func (c *Call) call() []func([]interface{}) []interface{} {
+	c.numCalls++
+	return c.actions
+}
+
+// InOrder declares that the given calls should occur in order.
+func InOrder(calls ...*Call) {
+	for i := 1; i < len(calls); i++ {
+		calls[i].After(calls[i-1])
+	}
+}
+
+func setSlice(arg interface{}, v reflect.Value) {
+	va := reflect.ValueOf(arg)
+	for i := 0; i < v.Len(); i++ {
+		va.Index(i).Set(v.Index(i))
+	}
+}
+
+func (c *Call) addAction(action func([]interface{}) []interface{}) {
+	c.actions = append(c.actions, action)
+}
diff --git a/vendor/github.com/golang/mock/gomock/callset.go b/vendor/github.com/golang/mock/gomock/callset.go
new file mode 100644
index 00000000..b046b525
--- /dev/null
+++ b/vendor/github.com/golang/mock/gomock/callset.go
@@ -0,0 +1,108 @@
+// Copyright 2011 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gomock
+
+import (
+	"bytes"
+	"fmt"
+)
+
+// callSet represents a set of expected calls, indexed by receiver and method
+// name.
+type callSet struct {
+	// Calls that are still expected.
+	expected map[callSetKey][]*Call
+	// Calls that have been exhausted.
+	exhausted map[callSetKey][]*Call
+}
+
+// callSetKey is the key in the maps in callSet
+type callSetKey struct {
+	receiver interface{}
+	fname    string
+}
+
+func newCallSet() *callSet {
+	return &callSet{make(map[callSetKey][]*Call), make(map[callSetKey][]*Call)}
+}
+
+// Add adds a new expected call.
+func (cs callSet) Add(call *Call) {
+	key := callSetKey{call.receiver, call.method}
+	m := cs.expected
+	if call.exhausted() {
+		m = cs.exhausted
+	}
+	m[key] = append(m[key], call)
+}
+
+// Remove removes an expected call.
+func (cs callSet) Remove(call *Call) {
+	key := callSetKey{call.receiver, call.method}
+	calls := cs.expected[key]
+	for i, c := range calls {
+		if c == call {
+			// maintain order for remaining calls
+			cs.expected[key] = append(calls[:i], calls[i+1:]...)
+			cs.exhausted[key] = append(cs.exhausted[key], call)
+			break
+		}
+	}
+}
+
+// FindMatch searches for a matching call. Returns error with explanation message if no call matched.
+func (cs callSet) FindMatch(receiver interface{}, method string, args []interface{}) (*Call, error) {
+	key := callSetKey{receiver, method}
+
+	// Search through the expected calls.
+	expected := cs.expected[key]
+	var callsErrors bytes.Buffer
+	for _, call := range expected {
+		err := call.matches(args)
+		if err != nil {
+			_, _ = fmt.Fprintf(&callsErrors, "\n%v", err)
+		} else {
+			return call, nil
+		}
+	}
+
+	// If we haven't found a match then search through the exhausted calls so we
+	// get useful error messages.
+	exhausted := cs.exhausted[key]
+	for _, call := range exhausted {
+		if err := call.matches(args); err != nil {
+			_, _ = fmt.Fprintf(&callsErrors, "\n%v", err)
+		}
+	}
+
+	if len(expected)+len(exhausted) == 0 {
+		_, _ = fmt.Fprintf(&callsErrors, "there are no expected calls of the method %q for that receiver", method)
+	}
+
+	return nil, fmt.Errorf(callsErrors.String())
+}
+
+// Failures returns the calls that are not satisfied.
+func (cs callSet) Failures() []*Call {
+	failures := make([]*Call, 0, len(cs.expected))
+	for _, calls := range cs.expected {
+		for _, call := range calls {
+			if !call.satisfied() {
+				failures = append(failures, call)
+			}
+		}
+	}
+	return failures
+}
diff --git a/vendor/github.com/golang/mock/gomock/controller.go b/vendor/github.com/golang/mock/gomock/controller.go
new file mode 100644
index 00000000..d7c3c656
--- /dev/null
+++ b/vendor/github.com/golang/mock/gomock/controller.go
@@ -0,0 +1,264 @@
+// Copyright 2010 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package gomock is a mock framework for Go.
+//
+// Standard usage:
+//   (1) Define an interface that you wish to mock.
+//         type MyInterface interface {
+//           SomeMethod(x int64, y string)
+//         }
+//   (2) Use mockgen to generate a mock from the interface.
+//   (3) Use the mock in a test:
+//         func TestMyThing(t *testing.T) {
+//           mockCtrl := gomock.NewController(t)
+//           defer mockCtrl.Finish()
+//
+//           mockObj := something.NewMockMyInterface(mockCtrl)
+//           mockObj.EXPECT().SomeMethod(4, "blah")
+//           // pass mockObj to a real object and play with it.
+//         }
+//
+// By default, expected calls are not enforced to run in any particular order.
+// Call order dependency can be enforced by use of InOrder and/or Call.After.
+// Call.After can create more varied call order dependencies, but InOrder is
+// often more convenient.
+//
+// The following examples create equivalent call order dependencies.
+//
+// Example of using Call.After to chain expected call order:
+//
+//     firstCall := mockObj.EXPECT().SomeMethod(1, "first")
+//     secondCall := mockObj.EXPECT().SomeMethod(2, "second").After(firstCall)
+//     mockObj.EXPECT().SomeMethod(3, "third").After(secondCall)
+//
+// Example of using InOrder to declare expected call order:
+//
+//     gomock.InOrder(
+//         mockObj.EXPECT().SomeMethod(1, "first"),
+//         mockObj.EXPECT().SomeMethod(2, "second"),
+//         mockObj.EXPECT().SomeMethod(3, "third"),
+//     )
+//
+// TODO:
+//	- Handle different argument/return types (e.g. ..., chan, map, interface).
+package gomock
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"runtime"
+	"sync"
+)
+
+// A TestReporter is something that can be used to report test failures.  It
+// is satisfied by the standard library's *testing.T.
+type TestReporter interface {
+	Errorf(format string, args ...interface{})
+	Fatalf(format string, args ...interface{})
+}
+
+// TestHelper is a TestReporter that has the Helper method.  It is satisfied
+// by the standard library's *testing.T.
+type TestHelper interface {
+	TestReporter
+	Helper()
+}
+
+// A Controller represents the top-level control of a mock ecosystem.  It
+// defines the scope and lifetime of mock objects, as well as their
+// expectations.  It is safe to call Controller's methods from multiple
+// goroutines. Each test should create a new Controller and invoke Finish via
+// defer.
+//
+//   func TestFoo(t *testing.T) {
+//     ctrl := gomock.NewController(t)
+//     defer ctrl.Finish()
+//     // ..
+//   }
+//
+//   func TestBar(t *testing.T) {
+//     t.Run("Sub-Test-1", st) {
+//       ctrl := gomock.NewController(st)
+//       defer ctrl.Finish()
+//       // ..
+//     })
+//     t.Run("Sub-Test-2", st) {
+//       ctrl := gomock.NewController(st)
+//       defer ctrl.Finish()
+//       // ..
+//     })
+//   })
+type Controller struct {
+	// T should only be called within a generated mock. It is not intended to
+	// be used in user code and may be changed in future versions. T is the
+	// TestReporter passed in when creating the Controller via NewController.
+	// If the TestReporter does not implement a TestHelper it will be wrapped
+	// with a nopTestHelper.
+	T             TestHelper
+	mu            sync.Mutex
+	expectedCalls *callSet
+	finished      bool
+}
+
+// NewController returns a new Controller. It is the preferred way to create a
+// Controller.
+func NewController(t TestReporter) *Controller {
+	h, ok := t.(TestHelper)
+	if !ok {
+		h = nopTestHelper{t}
+	}
+
+	return &Controller{
+		T:             h,
+		expectedCalls: newCallSet(),
+	}
+}
+
+type cancelReporter struct {
+	TestHelper
+	cancel func()
+}
+
+func (r *cancelReporter) Errorf(format string, args ...interface{}) {
+	r.TestHelper.Errorf(format, args...)
+}
+func (r *cancelReporter) Fatalf(format string, args ...interface{}) {
+	defer r.cancel()
+	r.TestHelper.Fatalf(format, args...)
+}
+
+// WithContext returns a new Controller and a Context, which is cancelled on any
+// fatal failure.
+func WithContext(ctx context.Context, t TestReporter) (*Controller, context.Context) {
+	h, ok := t.(TestHelper)
+	if !ok {
+		h = nopTestHelper{t}
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	return NewController(&cancelReporter{h, cancel}), ctx
+}
+
+type nopTestHelper struct {
+	TestReporter
+}
+
+func (h nopTestHelper) Helper() {}
+
+// RecordCall is called by a mock. It should not be called by user code.
+func (ctrl *Controller) RecordCall(receiver interface{}, method string, args ...interface{}) *Call {
+	ctrl.T.Helper()
+
+	recv := reflect.ValueOf(receiver)
+	for i := 0; i < recv.Type().NumMethod(); i++ {
+		if recv.Type().Method(i).Name == method {
+			return ctrl.RecordCallWithMethodType(receiver, method, recv.Method(i).Type(), args...)
+		}
+	}
+	ctrl.T.Fatalf("gomock: failed finding method %s on %T", method, receiver)
+	panic("unreachable")
+}
+
+// RecordCallWithMethodType is called by a mock. It should not be called by user code.
+func (ctrl *Controller) RecordCallWithMethodType(receiver interface{}, method string, methodType reflect.Type, args ...interface{}) *Call {
+	ctrl.T.Helper()
+
+	call := newCall(ctrl.T, receiver, method, methodType, args...)
+
+	ctrl.mu.Lock()
+	defer ctrl.mu.Unlock()
+	ctrl.expectedCalls.Add(call)
+
+	return call
+}
+
+// Call is called by a mock. It should not be called by user code.
+func (ctrl *Controller) Call(receiver interface{}, method string, args ...interface{}) []interface{} {
+	ctrl.T.Helper()
+
+	// Nest this code so we can use defer to make sure the lock is released.
+	actions := func() []func([]interface{}) []interface{} {
+		ctrl.T.Helper()
+		ctrl.mu.Lock()
+		defer ctrl.mu.Unlock()
+
+		expected, err := ctrl.expectedCalls.FindMatch(receiver, method, args)
+		if err != nil {
+			origin := callerInfo(2)
+			ctrl.T.Fatalf("Unexpected call to %T.%v(%v) at %s because: %s", receiver, method, args, origin, err)
+		}
+
+		// Two things happen here:
+		// * the matching call no longer needs to check prerequite calls,
+		// * and the prerequite calls are no longer expected, so remove them.
+		preReqCalls := expected.dropPrereqs()
+		for _, preReqCall := range preReqCalls {
+			ctrl.expectedCalls.Remove(preReqCall)
+		}
+
+		actions := expected.call()
+		if expected.exhausted() {
+			ctrl.expectedCalls.Remove(expected)
+		}
+		return actions
+	}()
+
+	var rets []interface{}
+	for _, action := range actions {
+		if r := action(args); r != nil {
+			rets = r
+		}
+	}
+
+	return rets
+}
+
+// Finish checks to see if all the methods that were expected to be called
+// were called. It should be invoked for each Controller. It is not idempotent
+// and therefore can only be invoked once.
+func (ctrl *Controller) Finish() {
+	ctrl.T.Helper()
+
+	ctrl.mu.Lock()
+	defer ctrl.mu.Unlock()
+
+	if ctrl.finished {
+		ctrl.T.Fatalf("Controller.Finish was called more than once. It has to be called exactly once.")
+	}
+	ctrl.finished = true
+
+	// If we're currently panicking, probably because this is a deferred call,
+	// pass through the panic.
+	if err := recover(); err != nil {
+		panic(err)
+	}
+
+	// Check that all remaining expected calls are satisfied.
+	failures := ctrl.expectedCalls.Failures()
+	for _, call := range failures {
+		ctrl.T.Errorf("missing call(s) to %v", call)
+	}
+	if len(failures) != 0 {
+		ctrl.T.Fatalf("aborting test due to missing call(s)")
+	}
+}
+
+func callerInfo(skip int) string {
+	if _, file, line, ok := runtime.Caller(skip + 1); ok {
+		return fmt.Sprintf("%s:%d", file, line)
+	}
+	return "unknown file"
+}
diff --git a/vendor/github.com/golang/mock/gomock/matchers.go b/vendor/github.com/golang/mock/gomock/matchers.go
new file mode 100644
index 00000000..7bfc07be
--- /dev/null
+++ b/vendor/github.com/golang/mock/gomock/matchers.go
@@ -0,0 +1,255 @@
+// Copyright 2010 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gomock
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// A Matcher is a representation of a class of values.
+// It is used to represent the valid or expected arguments to a mocked method.
+type Matcher interface {
+	// Matches returns whether x is a match.
+	Matches(x interface{}) bool
+
+	// String describes what the matcher matches.
+	String() string
+}
+
+// WantFormatter modifies the given Matcher's String() method to the given
+// Stringer. This allows for control on how the "Want" is formatted when
+// printing .
+func WantFormatter(s fmt.Stringer, m Matcher) Matcher {
+	type matcher interface {
+		Matches(x interface{}) bool
+	}
+
+	return struct {
+		matcher
+		fmt.Stringer
+	}{
+		matcher:  m,
+		Stringer: s,
+	}
+}
+
+// StringerFunc type is an adapter to allow the use of ordinary functions as
+// a Stringer. If f is a function with the appropriate signature,
+// StringerFunc(f) is a Stringer that calls f.
+type StringerFunc func() string
+
+// String implements fmt.Stringer.
+func (f StringerFunc) String() string {
+	return f()
+}
+
+// GotFormatter is used to better print failure messages. If a matcher
+// implements GotFormatter, it will use the result from Got when printing
+// the failure message.
+type GotFormatter interface {
+	// Got is invoked with the received value. The result is used when
+	// printing the failure message.
+	Got(got interface{}) string
+}
+
+// GotFormatterFunc type is an adapter to allow the use of ordinary
+// functions as a GotFormatter. If f is a function with the appropriate
+// signature, GotFormatterFunc(f) is a GotFormatter that calls f.
+type GotFormatterFunc func(got interface{}) string
+
+// Got implements GotFormatter.
+func (f GotFormatterFunc) Got(got interface{}) string {
+	return f(got)
+}
+
+// GotFormatterAdapter attaches a GotFormatter to a Matcher.
+func GotFormatterAdapter(s GotFormatter, m Matcher) Matcher {
+	return struct {
+		GotFormatter
+		Matcher
+	}{
+		GotFormatter: s,
+		Matcher:      m,
+	}
+}
+
+type anyMatcher struct{}
+
+func (anyMatcher) Matches(interface{}) bool {
+	return true
+}
+
+func (anyMatcher) String() string {
+	return "is anything"
+}
+
+type eqMatcher struct {
+	x interface{}
+}
+
+func (e eqMatcher) Matches(x interface{}) bool {
+	return reflect.DeepEqual(e.x, x)
+}
+
+func (e eqMatcher) String() string {
+	return fmt.Sprintf("is equal to %v", e.x)
+}
+
+type nilMatcher struct{}
+
+func (nilMatcher) Matches(x interface{}) bool {
+	if x == nil {
+		return true
+	}
+
+	v := reflect.ValueOf(x)
+	switch v.Kind() {
+	case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map,
+		reflect.Ptr, reflect.Slice:
+		return v.IsNil()
+	}
+
+	return false
+}
+
+func (nilMatcher) String() string {
+	return "is nil"
+}
+
+type notMatcher struct {
+	m Matcher
+}
+
+func (n notMatcher) Matches(x interface{}) bool {
+	return !n.m.Matches(x)
+}
+
+func (n notMatcher) String() string {
+	// TODO: Improve this if we add a NotString method to the Matcher interface.
+	return "not(" + n.m.String() + ")"
+}
+
+type assignableToTypeOfMatcher struct {
+	targetType reflect.Type
+}
+
+func (m assignableToTypeOfMatcher) Matches(x interface{}) bool {
+	return reflect.TypeOf(x).AssignableTo(m.targetType)
+}
+
+func (m assignableToTypeOfMatcher) String() string {
+	return "is assignable to " + m.targetType.Name()
+}
+
+type allMatcher struct {
+	matchers []Matcher
+}
+
+func (am allMatcher) Matches(x interface{}) bool {
+	for _, m := range am.matchers {
+		if !m.Matches(x) {
+			return false
+		}
+	}
+	return true
+}
+
+func (am allMatcher) String() string {
+	ss := make([]string, 0, len(am.matchers))
+	for _, matcher := range am.matchers {
+		ss = append(ss, matcher.String())
+	}
+	return strings.Join(ss, "; ")
+}
+
+type lenMatcher struct {
+	i int
+}
+
+func (m lenMatcher) Matches(x interface{}) bool {
+	v := reflect.ValueOf(x)
+	switch v.Kind() {
+	case reflect.Array, reflect.Chan, reflect.Map, reflect.Slice, reflect.String:
+		return v.Len() == m.i
+	default:
+		return false
+	}
+}
+
+func (m lenMatcher) String() string {
+	return fmt.Sprintf("has length %d", m.i)
+}
+
+// Constructors
+
+// All returns a composite Matcher that returns true if and only all of the
+// matchers return true.
+func All(ms ...Matcher) Matcher { return allMatcher{ms} }
+
+// Any returns a matcher that always matches.
+func Any() Matcher { return anyMatcher{} }
+
+// Eq returns a matcher that matches on equality.
+//
+// Example usage:
+//   Eq(5).Matches(5) // returns true
+//   Eq(5).Matches(4) // returns false
+func Eq(x interface{}) Matcher { return eqMatcher{x} }
+
+// Len returns a matcher that matches on length. This matcher returns false if
+// is compared to a type that is not an array, chan, map, slice, or string.
+func Len(i int) Matcher {
+	return lenMatcher{i}
+}
+
+// Nil returns a matcher that matches if the received value is nil.
+//
+// Example usage:
+//   var x *bytes.Buffer
+//   Nil().Matches(x) // returns true
+//   x = &bytes.Buffer{}
+//   Nil().Matches(x) // returns false
+func Nil() Matcher { return nilMatcher{} }
+
+// Not reverses the results of its given child matcher.
+//
+// Example usage:
+//   Not(Eq(5)).Matches(4) // returns true
+//   Not(Eq(5)).Matches(5) // returns false
+func Not(x interface{}) Matcher {
+	if m, ok := x.(Matcher); ok {
+		return notMatcher{m}
+	}
+	return notMatcher{Eq(x)}
+}
+
+// AssignableToTypeOf is a Matcher that matches if the parameter to the mock
+// function is assignable to the type of the parameter to this function.
+//
+// Example usage:
+//   var s fmt.Stringer = &bytes.Buffer{}
+//   AssignableToTypeOf(s).Matches(time.Second) // returns true
+//   AssignableToTypeOf(s).Matches(99) // returns false
+//
+//   var ctx = reflect.TypeOf((*context.Context)).Elem()
+//   AssignableToTypeOf(ctx).Matches(context.Background()) // returns true
+func AssignableToTypeOf(x interface{}) Matcher {
+	if xt, ok := x.(reflect.Type); ok {
+		return assignableToTypeOfMatcher{xt}
+	}
+	return assignableToTypeOfMatcher{reflect.TypeOf(x)}
+}
diff --git a/vendor/github.com/hashicorp/vault/sdk/framework/path.go b/vendor/github.com/hashicorp/vault/sdk/framework/path.go
index 8f5dd5be..87ba5d43 100644
--- a/vendor/github.com/hashicorp/vault/sdk/framework/path.go
+++ b/vendor/github.com/hashicorp/vault/sdk/framework/path.go
@@ -190,8 +190,8 @@ type DisplayAttributes struct {
 	// Action is the verb to use for the operation.
 	Action string `json:"action,omitempty"`
 
-	// EditType is the type of form field needed for a property
-	// e.g. "textarea" or "file"
+	// EditType is the optional type of form field needed for a property
+	// This is only necessary for a "textarea" or "file"
 	EditType string `json:"editType,omitempty"`
 }
 
diff --git a/vendor/github.com/hashicorp/vault/sdk/helper/consts/replication.go b/vendor/github.com/hashicorp/vault/sdk/helper/consts/replication.go
index 55cfc4ae..546f533e 100644
--- a/vendor/github.com/hashicorp/vault/sdk/helper/consts/replication.go
+++ b/vendor/github.com/hashicorp/vault/sdk/helper/consts/replication.go
@@ -18,6 +18,7 @@ const (
 	// manager.  It should contain a character that is not allowed in secondary
 	// ids to ensure it doesn't collide.
 	CurrentReplicatedSecondaryIdentifier = ".current"
+	CoreFeatureFlagPath                  = "core/cluster/feature-flags"
 )
 
 type ReplicationState uint32
diff --git a/vendor/github.com/hashicorp/vault/sdk/logical/identity.pb.go b/vendor/github.com/hashicorp/vault/sdk/logical/identity.pb.go
index 94102de7..26ba18a4 100644
--- a/vendor/github.com/hashicorp/vault/sdk/logical/identity.pb.go
+++ b/vendor/github.com/hashicorp/vault/sdk/logical/identity.pb.go
@@ -114,7 +114,12 @@ type Alias struct {
 	MountAccessor string `sentinel:"" protobuf:"bytes,2,opt,name=mount_accessor,json=mountAccessor,proto3" json:"mount_accessor,omitempty"`
 	// Name is the identifier of this identity in its authentication source
 	Name string `sentinel:"" protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
-	// Metadata represents the custom data tied to this alias
+	// Metadata represents the custom data tied to this alias. Fields added
+	// to it should have a low rate of change (or no change) because each
+	// change incurs a storage write, so quickly-changing fields can have
+	// a significant performance impact at scale. See the SDK's
+	// "aliasmetadata" package for a helper that eases and standardizes
+	// using this safely.
 	Metadata map[string]string `sentinel:"" protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// ID is the unique identifier for the alias
 	ID string `sentinel:"" protobuf:"bytes,5,opt,name=ID,proto3" json:"ID,omitempty"`
@@ -270,31 +275,33 @@ func init() {
 	proto.RegisterMapType((map[string]string)(nil), "logical.Group.MetadataEntry")
 }
 
-func init() { proto.RegisterFile("sdk/logical/identity.proto", fileDescriptor_4a34d35719c603a1) }
+func init() {
+	proto.RegisterFile("sdk/logical/identity.proto", fileDescriptor_4a34d35719c603a1)
+}
 
 var fileDescriptor_4a34d35719c603a1 = []byte{
-	// 365 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x93, 0x4f, 0x6b, 0xfa, 0x30,
-	0x18, 0xc7, 0x69, 0x6b, 0xfd, 0xf3, 0xf8, 0x53, 0x7e, 0x84, 0x1d, 0x8a, 0x4c, 0x70, 0xc2, 0x46,
-	0x4f, 0x2d, 0x6c, 0x17, 0xb7, 0x9d, 0x1c, 0xca, 0xf0, 0xb0, 0x4b, 0xd9, 0x69, 0x17, 0x89, 0x4d,
-	0xd0, 0x60, 0xdb, 0x94, 0x26, 0x15, 0xfa, 0x1a, 0xc6, 0x5e, 0xd6, 0xde, 0xd7, 0x30, 0x8d, 0xa5,
-	0x3a, 0x84, 0x1d, 0xb6, 0x5b, 0xf2, 0x7d, 0x9e, 0x7e, 0x9b, 0xcf, 0x37, 0x79, 0x60, 0x20, 0xc8,
-	0xd6, 0x8f, 0xf8, 0x9a, 0x85, 0x38, 0xf2, 0x19, 0xa1, 0x89, 0x64, 0xb2, 0xf0, 0xd2, 0x8c, 0x4b,
-	0x8e, 0x5a, 0x5a, 0x1f, 0x7f, 0x98, 0xd0, 0x9c, 0xab, 0x0a, 0xea, 0x83, 0xb9, 0x98, 0x39, 0xc6,
-	0xc8, 0x70, 0x3b, 0x81, 0xb9, 0x98, 0x21, 0x04, 0x8d, 0x04, 0xc7, 0xd4, 0x31, 0x95, 0xa2, 0xd6,
-	0xc8, 0x85, 0x16, 0x8e, 0x18, 0x16, 0x54, 0x38, 0xd6, 0xc8, 0x72, 0xbb, 0xb7, 0x7d, 0x4f, 0x3b,
-	0x79, 0xd3, 0xbd, 0x1e, 0x1c, 0xca, 0xe8, 0x1e, 0xda, 0x31, 0x95, 0x98, 0x60, 0x89, 0x9d, 0x86,
-	0x6a, 0x1d, 0x56, 0xad, 0xe5, 0x0f, 0xbd, 0x17, 0x5d, 0x9f, 0x27, 0x32, 0x2b, 0x82, 0xaa, 0x1d,
-	0x0d, 0xa0, 0x4d, 0x98, 0xc0, 0xab, 0x88, 0x12, 0xc7, 0x1e, 0x19, 0x6e, 0x3b, 0xa8, 0xf6, 0xe8,
-	0x0a, 0xfe, 0xed, 0x0f, 0x22, 0x52, 0x1c, 0xd2, 0x25, 0x23, 0x4e, 0x53, 0x1d, 0xae, 0x5b, 0x69,
-	0x0b, 0x32, 0x78, 0x84, 0xde, 0x91, 0x33, 0xfa, 0x0f, 0xd6, 0x96, 0x16, 0x9a, 0x6c, 0xbf, 0x44,
-	0x17, 0x60, 0xef, 0x70, 0x94, 0x1f, 0xd8, 0xca, 0xcd, 0x83, 0x39, 0x31, 0xc6, 0xef, 0x26, 0xd8,
-	0x8a, 0x04, 0x0d, 0x01, 0x62, 0x9e, 0x27, 0x72, 0x29, 0x8b, 0x94, 0xea, 0x8f, 0x3b, 0x4a, 0x79,
-	0x2d, 0x52, 0x8a, 0xae, 0xa1, 0x5f, 0x96, 0x71, 0x18, 0x52, 0x21, 0x78, 0xa6, 0xbd, 0x7a, 0x4a,
-	0x9d, 0x6a, 0xb1, 0x0a, 0xd1, 0xaa, 0x85, 0x38, 0xf9, 0x16, 0xcd, 0xe5, 0x71, 0x8a, 0x67, 0x93,
-	0x29, 0xaf, 0xc8, 0xae, 0xae, 0xe8, 0xaf, 0xd3, 0xf8, 0x34, 0xc0, 0x7e, 0xce, 0x78, 0x9e, 0xfe,
-	0xe8, 0x71, 0xd4, 0xb9, 0xac, 0x13, 0x2e, 0xe5, 0x72, 0x96, 0xeb, 0x94, 0xa3, 0xf1, 0xbb, 0x1c,
-	0x4f, 0xee, 0xdb, 0xcd, 0x9a, 0xc9, 0x4d, 0xbe, 0xf2, 0x42, 0x1e, 0xfb, 0x1b, 0x2c, 0x36, 0x2c,
-	0xe4, 0x59, 0xea, 0xef, 0x70, 0x1e, 0x49, 0xbf, 0x36, 0x27, 0xab, 0xa6, 0x9a, 0x8f, 0xbb, 0xaf,
-	0x00, 0x00, 0x00, 0xff, 0xff, 0xa8, 0xe2, 0x28, 0xc0, 0x3d, 0x03, 0x00, 0x00,
+	// 363 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xb4, 0x93, 0x4f, 0x4b, 0xf3, 0x40,
+	0x10, 0xc6, 0x49, 0xd2, 0xf4, 0xcf, 0xf4, 0x6d, 0x79, 0x59, 0x3c, 0x84, 0x62, 0xa1, 0x16, 0x94,
+	0x9c, 0x12, 0xd0, 0x4b, 0xd5, 0x53, 0x45, 0x91, 0x1e, 0xbc, 0x04, 0x4f, 0x5e, 0xca, 0x36, 0xbb,
+	0xb4, 0x4b, 0x93, 0x6e, 0xc8, 0x6e, 0x0a, 0xf9, 0x0c, 0xe2, 0xc7, 0xf2, 0x7b, 0x99, 0x6e, 0xb6,
+	0x21, 0xad, 0x14, 0x3c, 0xe8, 0x6d, 0xe6, 0x99, 0xc9, 0xec, 0xfe, 0x9e, 0xcd, 0xc0, 0x40, 0x90,
+	0xb5, 0x1f, 0xf1, 0x25, 0x0b, 0x71, 0xe4, 0x33, 0x42, 0x37, 0x92, 0xc9, 0xdc, 0x4b, 0x52, 0x2e,
+	0x39, 0x6a, 0x69, 0x7d, 0xfc, 0x61, 0x42, 0xf3, 0x49, 0x55, 0x50, 0x1f, 0xcc, 0xd9, 0xa3, 0x63,
+	0x8c, 0x0c, 0xb7, 0x13, 0x14, 0x11, 0x42, 0xd0, 0xd8, 0xe0, 0x98, 0x3a, 0xa6, 0x52, 0x54, 0x8c,
+	0x5c, 0x68, 0xe1, 0x88, 0x61, 0x41, 0x85, 0x63, 0x8d, 0x2c, 0xb7, 0x7b, 0xdd, 0xf7, 0xf4, 0x24,
+	0x6f, 0xba, 0xd3, 0x83, 0x7d, 0x19, 0xdd, 0x42, 0x3b, 0xa6, 0x12, 0x13, 0x2c, 0xb1, 0xd3, 0x50,
+	0xad, 0xc3, 0xaa, 0xb5, 0x3c, 0xd0, 0x7b, 0xd1, 0xf5, 0x22, 0x4d, 0xf3, 0xa0, 0x6a, 0x47, 0x03,
+	0x68, 0x13, 0x26, 0xf0, 0x22, 0xa2, 0xc4, 0xb1, 0x8b, 0xc3, 0xdb, 0x41, 0x95, 0xa3, 0x0b, 0xf8,
+	0xb7, 0xbb, 0x88, 0x48, 0x70, 0x48, 0xe7, 0x8c, 0x38, 0x4d, 0x75, 0xb9, 0x6e, 0xa5, 0xcd, 0xc8,
+	0xe0, 0x1e, 0x7a, 0x07, 0x93, 0xd1, 0x7f, 0xb0, 0xd6, 0x34, 0xd7, 0x64, 0xbb, 0x10, 0x9d, 0x81,
+	0xbd, 0xc5, 0x51, 0xb6, 0x67, 0x2b, 0x93, 0x3b, 0x73, 0x62, 0x8c, 0xdf, 0x4d, 0xb0, 0x15, 0x09,
+	0x1a, 0x02, 0xc4, 0x3c, 0xdb, 0xc8, 0xb9, 0xcc, 0x13, 0xaa, 0x3f, 0xee, 0x28, 0xe5, 0xb5, 0x10,
+	0xd0, 0x25, 0xf4, 0xcb, 0x32, 0x0e, 0x43, 0x2a, 0x04, 0x4f, 0xf5, 0xac, 0x9e, 0x52, 0xa7, 0x5a,
+	0xac, 0x4c, 0xb4, 0x6a, 0x26, 0x4e, 0xbe, 0x59, 0x73, 0x7e, 0xe8, 0xe2, 0x49, 0x67, 0xca, 0x27,
+	0xb2, 0xab, 0x27, 0xfa, 0x6b, 0x37, 0x3e, 0x0d, 0xb0, 0x9f, 0x53, 0x9e, 0x25, 0x3f, 0xfa, 0x39,
+	0xea, 0x5c, 0xd6, 0x11, 0x97, 0x9a, 0x72, 0x92, 0xeb, 0x98, 0xa3, 0xf1, 0xbb, 0x1c, 0x0f, 0xee,
+	0xdb, 0xd5, 0x92, 0xc9, 0x55, 0xb6, 0xf0, 0x42, 0x1e, 0xfb, 0x2b, 0x2c, 0x56, 0x2c, 0xe4, 0x69,
+	0xe2, 0x6f, 0x71, 0x16, 0x49, 0xbf, 0xb6, 0x27, 0x8b, 0xa6, 0xda, 0x8f, 0x9b, 0xaf, 0x00, 0x00,
+	0x00, 0xff, 0xff, 0xa8, 0xe2, 0x28, 0xc0, 0x3d, 0x03, 0x00, 0x00,
 }
diff --git a/vendor/github.com/hashicorp/vault/sdk/logical/identity.proto b/vendor/github.com/hashicorp/vault/sdk/logical/identity.proto
index 34af579b..78c3758f 100644
--- a/vendor/github.com/hashicorp/vault/sdk/logical/identity.proto
+++ b/vendor/github.com/hashicorp/vault/sdk/logical/identity.proto
@@ -36,7 +36,12 @@ message Alias {
 	// Name is the identifier of this identity in its authentication source
 	string name = 3;
 
-	// Metadata represents the custom data tied to this alias
+	// Metadata represents the custom data tied to this alias. Fields added
+	// to it should have a low rate of change (or no change) because each
+	// change incurs a storage write, so quickly-changing fields can have
+	// a significant performance impact at scale. See the SDK's
+	// "aliasmetadata" package for a helper that eases and standardizes
+	// using this safely.
 	map<string, string> metadata = 4;
 
 	// ID is the unique identifier for the alias
diff --git a/vendor/github.com/hashicorp/vault/sdk/logical/request.go b/vendor/github.com/hashicorp/vault/sdk/logical/request.go
index 7e7de207..5c2c73c0 100644
--- a/vendor/github.com/hashicorp/vault/sdk/logical/request.go
+++ b/vendor/github.com/hashicorp/vault/sdk/logical/request.go
@@ -70,10 +70,7 @@ type Request struct {
 	// Operation is the requested operation type
 	Operation Operation `json:"operation" structs:"operation" mapstructure:"operation"`
 
-	// Path is the part of the request path not consumed by the
-	// routing. As an example, if the original request path is "prod/aws/foo"
-	// and the AWS logical backend is mounted at "prod/aws/", then the
-	// final path is "foo" since the mount prefix is trimmed.
+	// Path is the full path of the request
 	Path string `json:"path" structs:"path" mapstructure:"path" sentinel:""`
 
 	// Request data is an opaque map that must have string keys.
diff --git a/vendor/github.com/hashicorp/vault/sdk/version/version_base.go b/vendor/github.com/hashicorp/vault/sdk/version/version_base.go
index c80056f4..5d9e1434 100644
--- a/vendor/github.com/hashicorp/vault/sdk/version/version_base.go
+++ b/vendor/github.com/hashicorp/vault/sdk/version/version_base.go
@@ -8,7 +8,7 @@ var (
 	// Whether cgo is enabled or not; set at build time
 	CgoEnabled bool
 
-	Version           = "1.3.0"
+	Version           = "1.4.0"
 	VersionPrerelease = ""
 	VersionMetadata   = ""
 )
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 05336804..1822e2d8 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -6,6 +6,8 @@ github.com/armon/go-radix
 github.com/davecgh/go-spew/spew
 # github.com/fatih/color v1.7.0
 github.com/fatih/color
+# github.com/golang/mock v1.4.3
+github.com/golang/mock/gomock
 # github.com/golang/protobuf v1.3.2
 github.com/golang/protobuf/proto
 github.com/golang/protobuf/ptypes
@@ -56,7 +58,7 @@ github.com/hashicorp/hcl/json/scanner
 github.com/hashicorp/hcl/json/token
 # github.com/hashicorp/vault/api v1.0.5-0.20200215224050-f6547fa8e820
 github.com/hashicorp/vault/api
-# github.com/hashicorp/vault/sdk v0.1.14-0.20200215224050-f6547fa8e820
+# github.com/hashicorp/vault/sdk v0.1.14-0.20200427170607-03332aaf8d18
 github.com/hashicorp/vault/sdk/framework
 github.com/hashicorp/vault/sdk/helper/certutil
 github.com/hashicorp/vault/sdk/helper/cidrutil