From 38839e24a8f969e58b91a4c5181398741d3e1497 Mon Sep 17 00:00:00 2001
From: Scott Ganyo <scott@ganyo.com>
Date: Thu, 7 Mar 2019 13:36:31 -0800
Subject: [PATCH 01/10] fix EnvoyFilter docs

---
 networking/v1alpha3/envoy_filter.proto | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/networking/v1alpha3/envoy_filter.proto b/networking/v1alpha3/envoy_filter.proto
index 6f271d1f0a..0ebdcd6d2d 100644
--- a/networking/v1alpha3/envoy_filter.proto
+++ b/networking/v1alpha3/envoy_filter.proto
@@ -35,8 +35,11 @@ import "google/protobuf/struct.proto";
 // The behavior is undefined if multiple EnvoyFilter configurations conflict
 // with each other.
 //
+// NOTE 3: For filters of `filterType: HTTP` you must include a `listenerMatch` section
+// with a `listenerProtocol: HTTP` or the filter have no effect.
+//
 // The following example for Kubernetes enables Envoy's Lua filter for all
-// inbound calls arriving at service port 8080 of the reviews service pod with
+// inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
 //
 // ```yaml
@@ -51,6 +54,7 @@ import "google/protobuf/struct.proto";
 //   - listenerMatch:
 //       portNumber: 8080
 //       listenerType: SIDECAR_INBOUND # will match with the inbound listener for reviews:8080
+//       listenerProtocol: HTTP
 //     filterName: envoy.lua
 //     filterType: HTTP
 //     filterConfig:
@@ -62,15 +66,12 @@ package istio.networking.v1alpha3;
 option go_package = "istio.io/api/networking/v1alpha3";
 
 message EnvoyFilter {
-  // One or more labels that indicate a specific set of pods/VMs whose
+  // Zero or more labels that indicate a specific set of pods/VMs whose
   // proxies should be configured to use these additional filters.  The
   // scope of label search is platform dependent. On Kubernetes, for
   // example, the scope includes pods running in all reachable
   // namespaces. Omitting the selector applies the filter to all proxies in
   // the mesh.
-  // NOTE: There can be only one EnvoyFilter bound to a specific workload.
-  // The behavior is undefined if multiple EnvoyFilter configurations are
-  // specified for the same workload.
   map<string, string> workload_labels = 1;
 
   // Select a listener to add the filter to based on the match conditions.

From 924f1e099299ea8a53243e1098f328c55ef4d10b Mon Sep 17 00:00:00 2001
From: Andra Cismaru <andraxylia@users.noreply.github.com>
Date: Sun, 10 Mar 2019 09:12:20 -0700
Subject: [PATCH 02/10] Hosts are not ignored in ServiceEntry for HTTPs (#833)

* Hosts are not ignored in ServiceEntry for HTTPs

* Clarify

* Reword

* Generate protos

* Address code review comments

* Fix typo

* generate
---
 networking/v1alpha3/service_entry.pb.go   | 18 ++++++++++--------
 networking/v1alpha3/service_entry.pb.html | 18 ++++++++++--------
 networking/v1alpha3/service_entry.proto   | 18 ++++++++++--------
 3 files changed, 30 insertions(+), 24 deletions(-)

diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index 97d37b99a7..6168b16ee6 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -426,17 +426,19 @@ func (ServiceEntry_Resolution) EnumDescriptor() ([]byte, []int) {
 
 type ServiceEntry struct {
 	// REQUIRED. The hosts associated with the ServiceEntry. Could be a DNS
-	// name with wildcard prefix (external services only). DNS names in hosts
-	// will be ignored if the application accesses the service over non-HTTP
-	// protocols such as mongo/opaque TCP/HTTPS. In such scenarios, the
-	// IP addresses specified in the Addresses field or the port will be used
-	// to uniquely identify the destination.
+	// name with wildcard prefix (external services only). For HTTP traffic
+	// the HTTP Host/Authority header will be matched against the hosts field.
+	// For HTTPs or TLS traffic containing Server Name Indication (SNI), the SNI value
+	// will be matched against the hosts field. For all other protocols
+	// the hosts will be ignored, and the port and addresses fields
+	// will be used if present. Note that when resolution is set to type DNS
+	// and no endpoints are specified, the host field will be used as the DNS name
+	// of the endpoint to route traffic to.
 	Hosts []string `protobuf:"bytes,1,rep,name=hosts,proto3" json:"hosts,omitempty"`
 	// The virtual IP addresses associated with the service. Could be CIDR
-	// prefix. For HTTP services, the addresses field will be ignored and
+	// prefix. For HTTP traffic the addresses field will be ignored and
 	// the destination will be identified based on the HTTP Host/Authority
-	// header. For non-HTTP protocols such as mongo/opaque TCP/HTTPS,
-	// the hosts will be ignored. If one or more IP addresses are specified,
+	// header. If one or more IP addresses are specified,
 	// the incoming traffic will be identified as belonging to this service
 	// if the destination IP matches the IP/CIDRs specified in the addresses
 	// field. If the Addresses field is empty, traffic will be identified
diff --git a/networking/v1alpha3/service_entry.pb.html b/networking/v1alpha3/service_entry.pb.html
index 8aaf60b847..419590bd63 100644
--- a/networking/v1alpha3/service_entry.pb.html
+++ b/networking/v1alpha3/service_entry.pb.html
@@ -323,11 +323,14 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 <td><code>string[]</code></td>
 <td>
 <p>REQUIRED. The hosts associated with the ServiceEntry. Could be a DNS
-name with wildcard prefix (external services only). DNS names in hosts
-will be ignored if the application accesses the service over non-HTTP
-protocols such as mongo/opaque TCP/HTTPS. In such scenarios, the
-IP addresses specified in the Addresses field or the port will be used
-to uniquely identify the destination.</p>
+name with wildcard prefix (external services only). For HTTP traffic
+the HTTP Host/Authority header will be matched against the hosts field.
+For HTTPs or TLS traffic containing Server Name Indication (SNI), the SNI value
+will be matched against the hosts field. For all other protocols
+the hosts will be ignored, and the port and addresses fields
+will be used if present. Note that when resolution is set to type DNS
+and no endpoints are specified, the host field will be used as the DNS name
+of the endpoint to route traffic to.</p>
 
 </td>
 </tr>
@@ -336,10 +339,9 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 <td><code>string[]</code></td>
 <td>
 <p>The virtual IP addresses associated with the service. Could be CIDR
-prefix. For HTTP services, the addresses field will be ignored and
+prefix. For HTTP traffic the addresses field will be ignored and
 the destination will be identified based on the HTTP Host/Authority
-header. For non-HTTP protocols such as mongo/opaque TCP/HTTPS,
-the hosts will be ignored. If one or more IP addresses are specified,
+header. If one or more IP addresses are specified,
 the incoming traffic will be identified as belonging to this service
 if the destination IP matches the IP/CIDRs specified in the addresses
 field. If the Addresses field is empty, traffic will be identified
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index 8db08dff8f..7a61b47aae 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -339,18 +339,20 @@ option go_package = "istio.io/api/networking/v1alpha3";
 
 message ServiceEntry {
   // REQUIRED. The hosts associated with the ServiceEntry. Could be a DNS
-  // name with wildcard prefix (external services only). DNS names in hosts
-  // will be ignored if the application accesses the service over non-HTTP
-  // protocols such as mongo/opaque TCP/HTTPS. In such scenarios, the
-  // IP addresses specified in the Addresses field or the port will be used
-  // to uniquely identify the destination.
+  // name with wildcard prefix (external services only). For HTTP traffic
+  // the HTTP Host/Authority header will be matched against the hosts field.
+  // For HTTPs or TLS traffic containing Server Name Indication (SNI), the SNI value
+  // will be matched against the hosts field. For all other protocols
+  // the hosts will be ignored, and the port and addresses fields
+  // will be used if present. Note that when resolution is set to type DNS
+  // and no endpoints are specified, the host field will be used as the DNS name
+  // of the endpoint to route traffic to.
   repeated string hosts = 1;
 
   // The virtual IP addresses associated with the service. Could be CIDR
-  // prefix. For HTTP services, the addresses field will be ignored and
+  // prefix. For HTTP traffic the addresses field will be ignored and
   // the destination will be identified based on the HTTP Host/Authority
-  // header. For non-HTTP protocols such as mongo/opaque TCP/HTTPS,
-  // the hosts will be ignored. If one or more IP addresses are specified,
+  // header. If one or more IP addresses are specified,
   // the incoming traffic will be identified as belonging to this service
   // if the destination IP matches the IP/CIDRs specified in the addresses
   // field. If the Addresses field is empty, traffic will be identified

From 0791ae64224c0c50dad4899d94c6d2e3f35d8d4a Mon Sep 17 00:00:00 2001
From: Kuat <kyessenov@users.noreply.github.com>
Date: Mon, 11 Mar 2019 10:48:19 -0700
Subject: [PATCH 03/10] make mixer config marshal deterministic (#846)

Signed-off-by: Kuat Yessenov <kuat@google.com>
---
 mixer/v1/attributes.pb.go                     | 251 ++++++++++--------
 mixer/v1/attributes.proto                     |   1 +
 mixer/v1/config/client/api_spec.pb.go         | 138 ++++------
 mixer/v1/config/client/api_spec.proto         |   1 +
 mixer/v1/config/client/client_config.pb.go    | 197 +++++++-------
 mixer/v1/config/client/client_config.proto    |   1 +
 mixer/v1/config/client/quota.pb.go            | 173 ++++++------
 mixer/v1/config/client/quota.proto            |   1 +
 mixer/v1/config/client/service.pb.go          |  63 ++---
 mixer/v1/config/client/service.proto          |   1 +
 python/istio_api/mixer/v1/attributes_pb2.py   |   4 +-
 .../mixer/v1/config/client/api_spec_pb2.py    |   4 +-
 .../v1/config/client/client_config_pb2.py     |   4 +-
 .../mixer/v1/config/client/quota_pb2.py       |   4 +-
 .../mixer/v1/config/client/service_pb2.py     |   4 +-
 15 files changed, 415 insertions(+), 432 deletions(-)

diff --git a/mixer/v1/attributes.pb.go b/mixer/v1/attributes.pb.go
index af3a17af5b..00bad919e6 100644
--- a/mixer/v1/attributes.pb.go
+++ b/mixer/v1/attributes.pb.go
@@ -79,16 +79,12 @@ func (m *Attributes) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *Attributes) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Attributes.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *Attributes) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_Attributes.Merge(m, src)
@@ -127,16 +123,12 @@ func (m *Attributes_AttributeValue) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *Attributes_AttributeValue) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Attributes_AttributeValue.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *Attributes_AttributeValue) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_Attributes_AttributeValue.Merge(m, src)
@@ -437,16 +429,12 @@ func (m *Attributes_StringMap) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *Attributes_StringMap) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Attributes_StringMap.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *Attributes_StringMap) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_Attributes_StringMap.Merge(m, src)
@@ -497,16 +485,12 @@ func (m *CompressedAttributes) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *CompressedAttributes) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_CompressedAttributes.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *CompressedAttributes) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_CompressedAttributes.Merge(m, src)
@@ -536,16 +520,12 @@ func (m *StringMap) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *StringMap) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_StringMap.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *StringMap) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_StringMap.Merge(m, src)
@@ -581,58 +561,58 @@ func init() {
 func init() { proto.RegisterFile("mixer/v1/attributes.proto", fileDescriptor_6504964367320bd3) }
 
 var fileDescriptor_6504964367320bd3 = []byte{
-	// 815 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x96, 0xcd, 0x6f, 0xd3, 0x48,
-	0x18, 0xc6, 0x67, 0x9a, 0xe6, 0xc3, 0x6f, 0xb2, 0x49, 0x6b, 0x65, 0x25, 0x37, 0x87, 0x49, 0xb6,
-	0xbb, 0x5a, 0x65, 0xf7, 0x60, 0xf7, 0x4b, 0xa8, 0xf4, 0x02, 0x84, 0x46, 0x0a, 0x20, 0x24, 0x64,
-	0x10, 0x5f, 0x95, 0x40, 0x89, 0x62, 0x82, 0x45, 0x12, 0x47, 0x1e, 0xa7, 0x90, 0x1b, 0x12, 0x27,
-	0x6e, 0x3d, 0x70, 0xe0, 0x3f, 0x80, 0x3f, 0xa5, 0xc7, 0x1e, 0x7b, 0x02, 0x92, 0x5e, 0xb8, 0x20,
-	0xf5, 0xc8, 0x11, 0x79, 0x66, 0xec, 0x4c, 0x42, 0xda, 0x38, 0x37, 0x7b, 0xe6, 0x7d, 0x7e, 0x7e,
-	0x66, 0xe6, 0x99, 0x37, 0x81, 0xb5, 0x8e, 0xfd, 0xc6, 0x72, 0x8d, 0xc3, 0x4d, 0xa3, 0xee, 0x79,
-	0xae, 0xdd, 0xe8, 0x7b, 0x16, 0xd5, 0x7b, 0xae, 0xe3, 0x39, 0x6a, 0xd6, 0xa6, 0x9e, 0xed, 0xe8,
-	0xac, 0x40, 0x3f, 0xdc, 0x2c, 0xe4, 0x5b, 0x4e, 0xcb, 0x61, 0x53, 0x86, 0xff, 0xc4, 0xab, 0x0a,
-	0xa4, 0xe5, 0x38, 0xad, 0xb6, 0x65, 0xb0, 0xb7, 0x46, 0xff, 0x85, 0xd1, 0xec, 0xbb, 0x75, 0xcf,
-	0x76, 0xba, 0x62, 0xbe, 0x38, 0x3d, 0xef, 0xd9, 0x1d, 0x8b, 0x7a, 0xf5, 0x4e, 0x8f, 0x17, 0xac,
-	0xbf, 0x4b, 0x00, 0xdc, 0x08, 0xbf, 0xad, 0xde, 0x06, 0x18, 0x3b, 0xd1, 0x70, 0x29, 0x56, 0x4e,
-	0x6f, 0xfd, 0xaf, 0x4f, 0x5a, 0xd1, 0xc7, 0xf5, 0xd2, 0x63, 0xb5, 0xeb, 0xb9, 0x03, 0x53, 0x52,
-	0x17, 0x5e, 0x42, 0x6e, 0x6a, 0x5a, 0x5d, 0x81, 0xd8, 0x2b, 0x6b, 0xa0, 0xe1, 0x12, 0x2e, 0x2b,
-	0xa6, 0xff, 0xa8, 0x5e, 0x83, 0xf8, 0x61, 0xbd, 0xdd, 0xb7, 0xb4, 0xa5, 0x12, 0x2e, 0xa7, 0xb7,
-	0xfe, 0x8b, 0xf2, 0xad, 0x87, 0xbe, 0xc0, 0xe4, 0xba, 0xbd, 0xa5, 0x5d, 0x5c, 0xf8, 0x14, 0x83,
-	0xec, 0xe4, 0xac, 0xfa, 0x37, 0x64, 0xa8, 0xe7, 0xda, 0xdd, 0xd6, 0xf3, 0x31, 0x5e, 0xa9, 0x21,
-	0x33, 0xcd, 0x47, 0x79, 0xd1, 0x5f, 0x90, 0xb6, 0xbb, 0xde, 0x95, 0x1d, 0x51, 0x13, 0x2b, 0xe1,
-	0x72, 0xac, 0x86, 0x4c, 0x60, 0x83, 0x21, 0xa7, 0xe9, 0xf4, 0x1b, 0x6d, 0x4b, 0xd4, 0x2c, 0x97,
-	0x70, 0x19, 0xfb, 0x1c, 0x3e, 0xca, 0x8b, 0x8a, 0x00, 0x0d, 0xc7, 0x69, 0x8b, 0x92, 0x78, 0x09,
-	0x97, 0x53, 0x35, 0x64, 0x2a, 0xfe, 0x58, 0xf8, 0xa1, 0xc6, 0xc0, 0xb3, 0xa8, 0xa8, 0x48, 0x94,
-	0x70, 0x39, 0xe3, 0x7f, 0x88, 0x0d, 0xf2, 0x92, 0x2a, 0xe4, 0xc2, 0xb3, 0x11, 0x65, 0x49, 0xb6,
-	0x25, 0x05, 0x9d, 0x9f, 0xa1, 0x1e, 0x9c, 0xa1, 0xfe, 0x20, 0xa8, 0xab, 0x21, 0x33, 0x1b, 0x8a,
-	0x38, 0xa6, 0x02, 0xd9, 0x20, 0x02, 0x82, 0x92, 0x62, 0x94, 0xb5, 0xdf, 0x28, 0xfb, 0xa2, 0xac,
-	0x86, 0xcc, 0x3f, 0x02, 0x09, 0x67, 0xdc, 0x83, 0x15, 0xb1, 0x77, 0x9d, 0x7a, 0xe0, 0x45, 0x61,
-	0x94, 0x7f, 0x2e, 0x39, 0x9e, 0xfb, 0x4c, 0x72, 0xb7, 0xce, 0x5c, 0xd1, 0xe0, 0x85, 0x11, 0x2b,
-	0x49, 0x71, 0xca, 0x85, 0x0f, 0x18, 0x94, 0xb0, 0x50, 0xbd, 0x03, 0x49, 0xab, 0xeb, 0xb9, 0x76,
-	0x18, 0xb5, 0xcd, 0x28, 0x7c, 0xbd, 0xca, 0x35, 0x3c, 0x71, 0x01, 0xa1, 0xb0, 0x07, 0x19, 0x79,
-	0x62, 0x46, 0xd6, 0xf2, 0x72, 0xd6, 0x14, 0x29, 0x40, 0xeb, 0x3f, 0x14, 0xc8, 0xdf, 0x74, 0x3a,
-	0x3d, 0xd7, 0xa2, 0xd4, 0x6a, 0x4a, 0xf7, 0x21, 0x0f, 0xf1, 0xd7, 0x8e, 0xdb, 0xe4, 0xfe, 0x14,
-	0x93, 0xbf, 0xf8, 0xbe, 0xf9, 0x02, 0xa9, 0xb6, 0x34, 0xdb, 0xf7, 0x2c, 0x98, 0x58, 0x41, 0xe0,
-	0x5b, 0x10, 0xd4, 0x1a, 0x24, 0x58, 0xde, 0xa8, 0x16, 0x63, 0xac, 0x8d, 0x48, 0xac, 0x5b, 0x4c,
-	0xc2, 0x51, 0x42, 0xef, 0xdb, 0xe2, 0xa9, 0xa4, 0xda, 0xf2, 0x02, 0xb6, 0xf6, 0xb9, 0x46, 0xd8,
-	0x12, 0x04, 0xb5, 0x0a, 0x71, 0x3f, 0xbf, 0x54, 0x8b, 0x33, 0x94, 0x11, 0x09, 0x55, 0xf1, 0x15,
-	0x1c, 0xc4, 0xd5, 0xea, 0x33, 0x80, 0x30, 0xa1, 0x54, 0x4b, 0x30, 0xd6, 0x4e, 0x24, 0x56, 0x98,
-	0x72, 0x0e, 0xac, 0xa4, 0x8e, 0xbf, 0x14, 0xd1, 0xd1, 0xd7, 0x22, 0x36, 0x25, 0xa2, 0x7a, 0x00,
-	0x4a, 0x10, 0x5e, 0xaa, 0x25, 0x19, 0x7e, 0x3b, 0xda, 0xaa, 0x03, 0x95, 0x44, 0xff, 0xe8, 0xd3,
-	0xc7, 0x3c, 0xb6, 0x07, 0xfe, 0x0d, 0xd5, 0x52, 0x8b, 0xec, 0xc1, 0x20, 0xec, 0x86, 0x5c, 0xad,
-	0x1e, 0x40, 0x7a, 0x7c, 0x9f, 0xa8, 0xa6, 0x2c, 0xb0, 0x09, 0x61, 0xe8, 0x85, 0xcd, 0x65, 0xdf,
-	0xa6, 0x09, 0xe1, 0xf5, 0x62, 0xb1, 0x97, 0x73, 0x25, 0xc7, 0x7e, 0x75, 0x46, 0xec, 0x57, 0xe5,
-	0xbe, 0x79, 0x15, 0xd2, 0x52, 0x8e, 0xe6, 0x49, 0x63, 0xb2, 0x74, 0x0f, 0x32, 0x72, 0x6e, 0xe6,
-	0x69, 0xb1, 0xac, 0xdd, 0x05, 0x18, 0x07, 0x65, 0x9e, 0x32, 0x25, 0x2b, 0x9f, 0x40, 0x6e, 0x2a,
-	0x16, 0x33, 0xe4, 0x1b, 0x93, 0x3f, 0x29, 0x97, 0xf4, 0x4f, 0x19, 0xfd, 0x08, 0xb2, 0x93, 0x91,
-	0x98, 0x41, 0x36, 0x26, 0xc9, 0x17, 0xf7, 0xd4, 0xe9, 0xd5, 0x0e, 0xbc, 0x88, 0xfb, 0x94, 0x91,
-	0x95, 0x8f, 0x21, 0x37, 0x75, 0xfe, 0x51, 0x3c, 0x4d, 0xc5, 0x2a, 0x24, 0xc8, 0xfd, 0xee, 0xfd,
-	0x44, 0x1b, 0xbe, 0x3e, 0xdd, 0x86, 0xff, 0xbd, 0x10, 0xb2, 0x78, 0xef, 0x9d, 0x17, 0xc2, 0x8a,
-	0x79, 0x3c, 0x24, 0xe8, 0x64, 0x48, 0xd0, 0xe9, 0x90, 0xa0, 0xf3, 0x21, 0x41, 0x6f, 0x47, 0x04,
-	0x7f, 0x1e, 0x11, 0x74, 0x3c, 0x22, 0xf8, 0x64, 0x44, 0xf0, 0xb7, 0x11, 0xc1, 0xdf, 0x47, 0x04,
-	0x9d, 0x8f, 0x08, 0x3e, 0x3a, 0x23, 0xe8, 0xe4, 0x8c, 0xa0, 0xd3, 0x33, 0x82, 0x9e, 0xfe, 0xc9,
-	0x5d, 0xda, 0x8e, 0x51, 0xef, 0xd9, 0x46, 0xf0, 0x57, 0xea, 0x27, 0xc6, 0x8d, 0x04, 0x3b, 0x91,
-	0xed, 0x5f, 0x01, 0x00, 0x00, 0xff, 0xff, 0xb3, 0xaa, 0x85, 0xf6, 0x60, 0x09, 0x00, 0x00,
+	// 816 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x96, 0xbd, 0x6f, 0xd3, 0x4e,
+	0x18, 0xc7, 0x7d, 0x4d, 0xf3, 0xe2, 0x27, 0xf9, 0x25, 0xad, 0x95, 0x9f, 0xe4, 0x66, 0xb8, 0x84,
+	0x82, 0x50, 0x60, 0xb0, 0xfb, 0x26, 0x54, 0xba, 0x00, 0xa1, 0x91, 0x02, 0x08, 0x09, 0x19, 0x54,
+	0x5e, 0x2a, 0x81, 0x12, 0xc5, 0x04, 0x8b, 0x24, 0x8e, 0x7c, 0x4e, 0x21, 0x1b, 0x12, 0x13, 0x5b,
+	0x07, 0x06, 0xfe, 0x03, 0xf8, 0x53, 0x3a, 0x76, 0xec, 0x04, 0xc4, 0x5d, 0x58, 0x90, 0x3a, 0x32,
+	0x22, 0xdf, 0x9d, 0x9d, 0x4b, 0x48, 0x1b, 0x67, 0xb3, 0xef, 0x9e, 0xef, 0xc7, 0xdf, 0xbb, 0xfb,
+	0xde, 0x93, 0xc0, 0x4a, 0xc7, 0x7a, 0x6f, 0x3a, 0xfa, 0xc1, 0xba, 0x5e, 0x77, 0x5d, 0xc7, 0x6a,
+	0xf4, 0x5d, 0x93, 0x68, 0x3d, 0xc7, 0x76, 0x6d, 0x25, 0x6b, 0x11, 0xd7, 0xb2, 0x35, 0x5a, 0xa0,
+	0x1d, 0xac, 0x17, 0xf2, 0x2d, 0xbb, 0x65, 0xd3, 0x29, 0xdd, 0x7f, 0x62, 0x55, 0x05, 0xdc, 0xb2,
+	0xed, 0x56, 0xdb, 0xd4, 0xe9, 0x5b, 0xa3, 0xff, 0x5a, 0x6f, 0xf6, 0x9d, 0xba, 0x6b, 0xd9, 0x5d,
+	0x3e, 0x5f, 0x9c, 0x9c, 0x77, 0xad, 0x8e, 0x49, 0xdc, 0x7a, 0xa7, 0xc7, 0x0a, 0x56, 0x3f, 0x26,
+	0x00, 0xee, 0x84, 0xdf, 0x56, 0xee, 0x03, 0x8c, 0x9c, 0xa8, 0xa8, 0x14, 0x2b, 0xa7, 0x37, 0xae,
+	0x6b, 0xe3, 0x56, 0xb4, 0x51, 0xbd, 0xf0, 0x58, 0xed, 0xba, 0xce, 0xc0, 0x10, 0xd4, 0x85, 0x37,
+	0x90, 0x9b, 0x98, 0x56, 0x96, 0x20, 0xf6, 0xd6, 0x1c, 0xa8, 0xa8, 0x84, 0xca, 0xb2, 0xe1, 0x3f,
+	0x2a, 0xb7, 0x20, 0x7e, 0x50, 0x6f, 0xf7, 0x4d, 0x75, 0xa1, 0x84, 0xca, 0xe9, 0x8d, 0x6b, 0x51,
+	0xbe, 0xb5, 0xe7, 0x0b, 0x0c, 0xa6, 0xdb, 0x59, 0xd8, 0x46, 0x85, 0xaf, 0x31, 0xc8, 0x8e, 0xcf,
+	0x2a, 0x97, 0x21, 0x43, 0x5c, 0xc7, 0xea, 0xb6, 0x5e, 0x8d, 0xf0, 0x72, 0x4d, 0x32, 0xd2, 0x6c,
+	0x94, 0x15, 0x5d, 0x82, 0xb4, 0xd5, 0x75, 0x6f, 0x6c, 0xf1, 0x9a, 0x58, 0x09, 0x95, 0x63, 0x35,
+	0xc9, 0x00, 0x3a, 0x18, 0x72, 0x9a, 0x76, 0xbf, 0xd1, 0x36, 0x79, 0xcd, 0x62, 0x09, 0x95, 0x91,
+	0xcf, 0x61, 0xa3, 0xac, 0xa8, 0x08, 0xd0, 0xb0, 0xed, 0x36, 0x2f, 0x89, 0x97, 0x50, 0x39, 0x55,
+	0x93, 0x0c, 0xd9, 0x1f, 0x0b, 0x3f, 0xd4, 0x18, 0xb8, 0x26, 0xe1, 0x15, 0x89, 0x12, 0x2a, 0x67,
+	0xfc, 0x0f, 0xd1, 0x41, 0x56, 0x52, 0x85, 0x5c, 0x78, 0x36, 0xbc, 0x2c, 0x49, 0xb7, 0xa4, 0xa0,
+	0xb1, 0x33, 0xd4, 0x82, 0x33, 0xd4, 0x9e, 0x04, 0x75, 0x35, 0xc9, 0xc8, 0x86, 0x22, 0x86, 0xa9,
+	0x40, 0x36, 0x88, 0x00, 0xa7, 0xa4, 0x28, 0x65, 0xe5, 0x1f, 0xca, 0x2e, 0x2f, 0xab, 0x49, 0xc6,
+	0x7f, 0x81, 0x84, 0x31, 0x1e, 0xc1, 0x12, 0xdf, 0xbb, 0x4e, 0x3d, 0xf0, 0x22, 0x53, 0xca, 0x95,
+	0x0b, 0x8e, 0xe7, 0x31, 0x95, 0x3c, 0xac, 0x53, 0x57, 0x24, 0x78, 0xa1, 0xc4, 0x4a, 0x92, 0x9f,
+	0x72, 0xe1, 0x33, 0x02, 0x39, 0x2c, 0x54, 0x1e, 0x40, 0xd2, 0xec, 0xba, 0x8e, 0x15, 0x46, 0x6d,
+	0x3d, 0x0a, 0x5f, 0xab, 0x32, 0x0d, 0x4b, 0x5c, 0x40, 0x28, 0xec, 0x40, 0x46, 0x9c, 0x98, 0x92,
+	0xb5, 0xbc, 0x98, 0x35, 0x59, 0x08, 0xd0, 0xea, 0x6f, 0x19, 0xf2, 0x77, 0xed, 0x4e, 0xcf, 0x31,
+	0x09, 0x31, 0x9b, 0xc2, 0x7d, 0xc8, 0x43, 0xfc, 0x9d, 0xed, 0x34, 0x99, 0x3f, 0xd9, 0x60, 0x2f,
+	0xbe, 0x6f, 0xb6, 0x40, 0xa2, 0x2e, 0x4c, 0xf7, 0x3d, 0x0d, 0xc6, 0x57, 0x10, 0xf8, 0xe6, 0x04,
+	0xa5, 0x06, 0x09, 0x9a, 0x37, 0xa2, 0xc6, 0x28, 0x6b, 0x2d, 0x12, 0xeb, 0x1e, 0x95, 0x30, 0x14,
+	0xd7, 0xfb, 0xb6, 0x58, 0x2a, 0x89, 0xba, 0x38, 0x87, 0xad, 0x5d, 0xa6, 0xe1, 0xb6, 0x38, 0x41,
+	0xa9, 0x42, 0xdc, 0xcf, 0x2f, 0x51, 0xe3, 0x14, 0xa5, 0x47, 0x42, 0x55, 0x7c, 0x05, 0x03, 0x31,
+	0xb5, 0xf2, 0x12, 0x20, 0x4c, 0x28, 0x51, 0x13, 0x94, 0xb5, 0x15, 0x89, 0x15, 0xa6, 0x9c, 0x01,
+	0x2b, 0xa9, 0xa3, 0xef, 0x45, 0xe9, 0xf0, 0x47, 0x11, 0x19, 0x02, 0x51, 0xd9, 0x07, 0x39, 0x08,
+	0x2f, 0x51, 0x93, 0x14, 0xbf, 0x19, 0x6d, 0xd5, 0x81, 0x4a, 0xa0, 0x7f, 0xf1, 0xe9, 0x23, 0x1e,
+	0xdd, 0x03, 0xff, 0x86, 0xaa, 0xa9, 0x79, 0xf6, 0x60, 0x10, 0x76, 0x43, 0xa6, 0x56, 0xf6, 0x21,
+	0x3d, 0xba, 0x4f, 0x44, 0x95, 0xe7, 0xd8, 0x84, 0x30, 0xf4, 0xdc, 0xe6, 0xa2, 0x6f, 0xd3, 0x80,
+	0xf0, 0x7a, 0xd1, 0xd8, 0x8b, 0xb9, 0x12, 0x63, 0xbf, 0x3c, 0x25, 0xf6, 0xcb, 0x62, 0xdf, 0xbc,
+	0x09, 0x69, 0x21, 0x47, 0xb3, 0xa4, 0x31, 0x51, 0xba, 0x03, 0x19, 0x31, 0x37, 0xb3, 0xb4, 0x48,
+	0xd4, 0x6e, 0x03, 0x8c, 0x82, 0x32, 0x4b, 0x99, 0x12, 0x95, 0xcf, 0x21, 0x37, 0x11, 0x8b, 0x29,
+	0xf2, 0xb5, 0xf1, 0x9f, 0x94, 0x0b, 0xfa, 0xa7, 0x88, 0x7e, 0x0a, 0xd9, 0xf1, 0x48, 0x4c, 0x21,
+	0xeb, 0xe3, 0xe4, 0xf3, 0x7b, 0xea, 0xe4, 0x6a, 0x07, 0x6e, 0xc4, 0x7d, 0xca, 0x88, 0xca, 0x67,
+	0x90, 0x9b, 0x38, 0xff, 0x28, 0x9e, 0x26, 0x62, 0x15, 0x12, 0xc4, 0x7e, 0xf7, 0x69, 0xac, 0x0d,
+	0xdf, 0x9e, 0x6c, 0xc3, 0x57, 0xcf, 0x85, 0xcc, 0xdf, 0x7b, 0x67, 0x85, 0xb0, 0xb2, 0x77, 0x34,
+	0xc4, 0xd2, 0xf1, 0x10, 0x4b, 0x27, 0x43, 0x2c, 0x9d, 0x0d, 0xb1, 0xf4, 0xc1, 0xc3, 0xe8, 0x9b,
+	0x87, 0xa5, 0x23, 0x0f, 0xa3, 0x63, 0x0f, 0xa3, 0x13, 0x0f, 0xa3, 0x9f, 0x1e, 0x46, 0xbf, 0x3c,
+	0x2c, 0x9d, 0x79, 0x18, 0x1d, 0x9e, 0x62, 0xe9, 0xf8, 0x14, 0x4b, 0x27, 0xa7, 0x58, 0x7a, 0xf1,
+	0x3f, 0x73, 0x6a, 0xd9, 0x7a, 0xbd, 0x67, 0xe9, 0xc1, 0xdf, 0xa9, 0x3f, 0x08, 0x35, 0x12, 0xf4,
+	0x54, 0x36, 0xff, 0x06, 0x00, 0x00, 0xff, 0xff, 0xfb, 0xc0, 0x1f, 0x1b, 0x64, 0x09, 0x00, 0x00,
 }
 
 func (m *Attributes) Marshal() (dAtA []byte, err error) {
@@ -651,10 +631,15 @@ func (m *Attributes) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if len(m.Attributes) > 0 {
+		keysForAttributes := make([]string, 0, len(m.Attributes))
 		for k, _ := range m.Attributes {
+			keysForAttributes = append(keysForAttributes, string(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Strings(keysForAttributes)
+		for _, k := range keysForAttributes {
 			dAtA[i] = 0xa
 			i++
-			v := m.Attributes[k]
+			v := m.Attributes[string(k)]
 			msgSize := 0
 			if v != nil {
 				msgSize = v.Size()
@@ -809,10 +794,15 @@ func (m *Attributes_StringMap) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if len(m.Entries) > 0 {
+		keysForEntries := make([]string, 0, len(m.Entries))
 		for k, _ := range m.Entries {
+			keysForEntries = append(keysForEntries, string(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Strings(keysForEntries)
+		for _, k := range keysForEntries {
 			dAtA[i] = 0xa
 			i++
-			v := m.Entries[k]
+			v := m.Entries[string(k)]
 			mapSize := 1 + len(k) + sovAttributes(uint64(len(k))) + 1 + len(v) + sovAttributes(uint64(len(v)))
 			i = encodeVarintAttributes(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0xa
@@ -859,10 +849,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Strings) > 0 {
+		keysForStrings := make([]int32, 0, len(m.Strings))
 		for k, _ := range m.Strings {
+			keysForStrings = append(keysForStrings, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForStrings)
+		for _, k := range keysForStrings {
 			dAtA[i] = 0x12
 			i++
-			v := m.Strings[k]
+			v := m.Strings[int32(k)]
 			mapSize := 1 + sozAttributes(uint64(k)) + 1 + sozAttributes(uint64(v))
 			i = encodeVarintAttributes(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0x8
@@ -874,10 +869,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Int64S) > 0 {
+		keysForInt64S := make([]int32, 0, len(m.Int64S))
 		for k, _ := range m.Int64S {
+			keysForInt64S = append(keysForInt64S, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForInt64S)
+		for _, k := range keysForInt64S {
 			dAtA[i] = 0x1a
 			i++
-			v := m.Int64S[k]
+			v := m.Int64S[int32(k)]
 			mapSize := 1 + sozAttributes(uint64(k)) + 1 + sovAttributes(uint64(v))
 			i = encodeVarintAttributes(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0x8
@@ -889,10 +889,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Doubles) > 0 {
+		keysForDoubles := make([]int32, 0, len(m.Doubles))
 		for k, _ := range m.Doubles {
+			keysForDoubles = append(keysForDoubles, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForDoubles)
+		for _, k := range keysForDoubles {
 			dAtA[i] = 0x22
 			i++
-			v := m.Doubles[k]
+			v := m.Doubles[int32(k)]
 			mapSize := 1 + sozAttributes(uint64(k)) + 1 + 8
 			i = encodeVarintAttributes(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0x8
@@ -905,10 +910,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Bools) > 0 {
+		keysForBools := make([]int32, 0, len(m.Bools))
 		for k, _ := range m.Bools {
+			keysForBools = append(keysForBools, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForBools)
+		for _, k := range keysForBools {
 			dAtA[i] = 0x2a
 			i++
-			v := m.Bools[k]
+			v := m.Bools[int32(k)]
 			mapSize := 1 + sozAttributes(uint64(k)) + 1 + 1
 			i = encodeVarintAttributes(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0x8
@@ -925,10 +935,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Timestamps) > 0 {
+		keysForTimestamps := make([]int32, 0, len(m.Timestamps))
 		for k, _ := range m.Timestamps {
+			keysForTimestamps = append(keysForTimestamps, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForTimestamps)
+		for _, k := range keysForTimestamps {
 			dAtA[i] = 0x32
 			i++
-			v := m.Timestamps[k]
+			v := m.Timestamps[int32(k)]
 			msgSize := 0
 			if (&v) != nil {
 				msgSize = github_com_gogo_protobuf_types.SizeOfStdTime(*(&v))
@@ -950,10 +965,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Durations) > 0 {
+		keysForDurations := make([]int32, 0, len(m.Durations))
 		for k, _ := range m.Durations {
+			keysForDurations = append(keysForDurations, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForDurations)
+		for _, k := range keysForDurations {
 			dAtA[i] = 0x3a
 			i++
-			v := m.Durations[k]
+			v := m.Durations[int32(k)]
 			msgSize := 0
 			if (&v) != nil {
 				msgSize = github_com_gogo_protobuf_types.SizeOfStdDuration(*(&v))
@@ -975,10 +995,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.Bytes) > 0 {
+		keysForBytes := make([]int32, 0, len(m.Bytes))
 		for k, _ := range m.Bytes {
+			keysForBytes = append(keysForBytes, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForBytes)
+		for _, k := range keysForBytes {
 			dAtA[i] = 0x42
 			i++
-			v := m.Bytes[k]
+			v := m.Bytes[int32(k)]
 			byteSize := 0
 			if len(v) > 0 {
 				byteSize = 1 + len(v) + sovAttributes(uint64(len(v)))
@@ -997,10 +1022,15 @@ func (m *CompressedAttributes) MarshalTo(dAtA []byte) (int, error) {
 		}
 	}
 	if len(m.StringMaps) > 0 {
+		keysForStringMaps := make([]int32, 0, len(m.StringMaps))
 		for k, _ := range m.StringMaps {
+			keysForStringMaps = append(keysForStringMaps, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForStringMaps)
+		for _, k := range keysForStringMaps {
 			dAtA[i] = 0x4a
 			i++
-			v := m.StringMaps[k]
+			v := m.StringMaps[int32(k)]
 			msgSize := 0
 			if (&v) != nil {
 				msgSize = (&v).Size()
@@ -1040,10 +1070,15 @@ func (m *StringMap) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if len(m.Entries) > 0 {
+		keysForEntries := make([]int32, 0, len(m.Entries))
 		for k, _ := range m.Entries {
+			keysForEntries = append(keysForEntries, int32(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Int32s(keysForEntries)
+		for _, k := range keysForEntries {
 			dAtA[i] = 0xa
 			i++
-			v := m.Entries[k]
+			v := m.Entries[int32(k)]
 			mapSize := 1 + sozAttributes(uint64(k)) + 1 + sozAttributes(uint64(v))
 			i = encodeVarintAttributes(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0x8
diff --git a/mixer/v1/attributes.proto b/mixer/v1/attributes.proto
index f04a583089..b2eb970280 100644
--- a/mixer/v1/attributes.proto
+++ b/mixer/v1/attributes.proto
@@ -25,6 +25,7 @@ import "google/protobuf/timestamp.proto";
 option (gogoproto.goproto_getters_all) = false;
 option (gogoproto.equal_all) = false;
 option (gogoproto.gostring_all) = false;
+option (gogoproto.stable_marshaler_all) = true;
 option cc_enable_arenas = true;
 
 // Attributes represents a set of typed name/value pairs. Many of Mixer's
diff --git a/mixer/v1/config/client/api_spec.pb.go b/mixer/v1/config/client/api_spec.pb.go
index ad6be4e759..479e8e3c52 100644
--- a/mixer/v1/config/client/api_spec.pb.go
+++ b/mixer/v1/config/client/api_spec.pb.go
@@ -108,16 +108,12 @@ func (m *HTTPAPISpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *HTTPAPISpec) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_HTTPAPISpec.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *HTTPAPISpec) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_HTTPAPISpec.Merge(m, src)
@@ -168,16 +164,12 @@ func (m *HTTPAPISpecPattern) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *HTTPAPISpecPattern) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_HTTPAPISpecPattern.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *HTTPAPISpecPattern) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_HTTPAPISpecPattern.Merge(m, src)
@@ -316,16 +308,12 @@ func (m *APIKey) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *APIKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_APIKey.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *APIKey) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_APIKey.Merge(m, src)
@@ -495,16 +483,12 @@ func (m *HTTPAPISpecReference) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *HTTPAPISpecReference) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_HTTPAPISpecReference.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *HTTPAPISpecReference) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_HTTPAPISpecReference.Merge(m, src)
@@ -554,16 +538,12 @@ func (m *HTTPAPISpecBinding) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *HTTPAPISpecBinding) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_HTTPAPISpecBinding.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *HTTPAPISpecBinding) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_HTTPAPISpecBinding.Merge(m, src)
@@ -590,40 +570,40 @@ func init() {
 }
 
 var fileDescriptor_fb6b15fd2f44b459 = []byte{
-	// 524 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x53, 0xcf, 0x6e, 0xda, 0x4e,
-	0x10, 0x5e, 0x87, 0x84, 0xc0, 0xf0, 0x3b, 0xad, 0xa2, 0x9f, 0x5c, 0x14, 0x6d, 0x11, 0x49, 0x25,
-	0xd4, 0x83, 0xdd, 0xd0, 0x5b, 0x2f, 0x15, 0x1c, 0x2a, 0x50, 0x5a, 0x15, 0x39, 0x9c, 0x5a, 0x55,
-	0xc8, 0x31, 0x13, 0x58, 0x11, 0xbc, 0xee, 0x7a, 0x41, 0xe1, 0xd6, 0x47, 0xe8, 0x63, 0xf4, 0xd2,
-	0x07, 0xe8, 0x1b, 0xe4, 0xc8, 0x91, 0x63, 0x31, 0x97, 0x1e, 0xf3, 0x08, 0xd5, 0x7a, 0x1d, 0xa0,
-	0xff, 0x50, 0xa5, 0x9e, 0xec, 0x99, 0xf9, 0x66, 0xbe, 0xf9, 0x66, 0x67, 0xe0, 0xd1, 0x98, 0xdf,
-	0xa0, 0x74, 0xa7, 0x67, 0x6e, 0x20, 0xc2, 0x2b, 0x3e, 0x70, 0x83, 0x6b, 0x8e, 0xa1, 0x72, 0xfd,
-	0x88, 0xf7, 0xe2, 0x08, 0x03, 0x27, 0x92, 0x42, 0x09, 0x7a, 0xcc, 0x63, 0xc5, 0x85, 0x93, 0x82,
-	0x9d, 0xe9, 0x99, 0x63, 0xc0, 0x8e, 0x01, 0x97, 0x8f, 0x06, 0x62, 0x20, 0x52, 0xa0, 0xab, 0xff,
-	0x4c, 0x4e, 0xf9, 0xc1, 0xba, 0xb4, 0xaf, 0x94, 0xe4, 0x97, 0x13, 0x85, 0x71, 0x16, 0x3a, 0xfd,
-	0x03, 0x6b, 0x8c, 0x72, 0xca, 0x03, 0x34, 0xa8, 0xea, 0xc2, 0x82, 0x52, 0xab, 0xdb, 0xed, 0x34,
-	0x3a, 0xed, 0x8b, 0x08, 0x03, 0xfa, 0x0c, 0x60, 0x53, 0xc9, 0xb6, 0x2a, 0x56, 0xad, 0x54, 0x2f,
-	0x3b, 0x3f, 0x75, 0xd6, 0x58, 0x23, 0xbc, 0x2d, 0x34, 0x7d, 0x09, 0x85, 0xc8, 0x57, 0x0a, 0x65,
-	0x18, 0xdb, 0x7b, 0x95, 0x5c, 0xad, 0x54, 0x7f, 0xe2, 0xec, 0xd2, 0xe4, 0x6c, 0x11, 0x77, 0x4c,
-	0xa2, 0xb7, 0xae, 0x40, 0x9f, 0x43, 0x41, 0x0f, 0x68, 0x84, 0xb3, 0xd8, 0xce, 0xa5, 0xd5, 0x4e,
-	0x77, 0x57, 0x6b, 0x74, 0xda, 0xe7, 0x38, 0xf3, 0x0e, 0xfd, 0x88, 0x9f, 0xe3, 0x2c, 0xae, 0x7e,
-	0xb1, 0x80, 0xfe, 0xca, 0xf0, 0x4f, 0x0a, 0x1f, 0x42, 0x69, 0xa8, 0x54, 0xd4, 0x1b, 0xa3, 0x1a,
-	0x8a, 0xbe, 0xbd, 0x57, 0xb1, 0x6a, 0x45, 0x0f, 0xb4, 0xeb, 0x55, 0xea, 0xa1, 0x27, 0xf0, 0xdf,
-	0x44, 0xf2, 0x9e, 0xc2, 0x71, 0x74, 0xed, 0x2b, 0xb4, 0x73, 0x1a, 0xd1, 0x22, 0x5e, 0x69, 0x22,
-	0x79, 0x37, 0x73, 0xd2, 0xff, 0xe1, 0x40, 0xe2, 0x00, 0x6f, 0xec, 0xfd, 0x2c, 0x6a, 0xcc, 0x66,
-	0x11, 0x0e, 0x33, 0xf5, 0xd5, 0xb7, 0x90, 0x37, 0x72, 0x34, 0xf8, 0xfd, 0x04, 0xe5, 0x2c, 0xed,
-	0x34, 0x05, 0xa7, 0x26, 0xb5, 0x21, 0x3f, 0x44, 0xbf, 0x8f, 0xd2, 0x74, 0xd1, 0x22, 0x5e, 0x66,
-	0xeb, 0x48, 0x20, 0xc4, 0x88, 0x6f, 0xd8, 0x33, 0xbb, 0x79, 0x00, 0xb9, 0x11, 0xce, 0xaa, 0x2d,
-	0x38, 0xda, 0x9a, 0x8b, 0x87, 0x57, 0x28, 0x31, 0x0c, 0x90, 0x52, 0xd8, 0x0f, 0xfd, 0x31, 0x1a,
-	0x26, 0x2f, 0xfd, 0xa7, 0xc7, 0x50, 0xd4, 0xdf, 0x38, 0xf2, 0x03, 0xcc, 0xf4, 0x6e, 0x1c, 0xd5,
-	0xcf, 0x3f, 0x8e, 0xb8, 0xc9, 0xc3, 0x3e, 0x0f, 0x07, 0xf4, 0x05, 0x14, 0xb2, 0x2d, 0xd3, 0x03,
-	0xd6, 0x4f, 0xf7, 0x78, 0xf7, 0xd3, 0xb5, 0x75, 0xf0, 0xc2, 0xa4, 0x78, 0xeb, 0x5c, 0xfa, 0x1a,
-	0x8a, 0xf7, 0x37, 0x72, 0xbf, 0x51, 0xf5, 0xbf, 0xde, 0xa8, 0xb5, 0x2e, 0x4f, 0xef, 0x91, 0xf6,
-	0xc4, 0xcd, 0x77, 0xb7, 0x4b, 0x46, 0xe6, 0x4b, 0x46, 0x16, 0x4b, 0x46, 0xee, 0x96, 0x8c, 0x7c,
-	0x48, 0x98, 0xf5, 0x29, 0x61, 0xe4, 0x36, 0x61, 0xd6, 0x3c, 0x61, 0xd6, 0xd7, 0x84, 0x59, 0xdf,
-	0x12, 0x46, 0xee, 0x12, 0x66, 0x7d, 0x5c, 0x31, 0x32, 0x5f, 0x31, 0xb2, 0x58, 0x31, 0xf2, 0xe6,
-	0xc4, 0xd0, 0x72, 0xa1, 0xaf, 0xd6, 0xfd, 0xfd, 0x69, 0x5d, 0xe6, 0xd3, 0x9b, 0x7a, 0xfa, 0x3d,
-	0x00, 0x00, 0xff, 0xff, 0x74, 0x4a, 0xd4, 0x0b, 0xf1, 0x03, 0x00, 0x00,
+	// 525 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x53, 0xbd, 0x6e, 0x1a, 0x41,
+	0x10, 0xde, 0x35, 0x36, 0x86, 0x21, 0xd5, 0xca, 0x8a, 0x2e, 0xc8, 0xda, 0x20, 0xec, 0x48, 0x28,
+	0xc5, 0x5d, 0x4c, 0xba, 0x34, 0x11, 0x14, 0x11, 0xc8, 0x89, 0x82, 0xce, 0x54, 0x49, 0x81, 0xce,
+	0xc7, 0x18, 0x56, 0x98, 0xbb, 0xcb, 0xde, 0x82, 0x4c, 0x97, 0x47, 0xc8, 0x63, 0xa4, 0xc9, 0x03,
+	0xe4, 0x0d, 0x5c, 0x52, 0x52, 0x86, 0xa3, 0x49, 0xe9, 0x47, 0x88, 0xf6, 0xf6, 0x0c, 0xe4, 0x0f,
+	0x45, 0x4a, 0x75, 0x37, 0x33, 0xdf, 0xcc, 0x37, 0xdf, 0xec, 0x0c, 0x3c, 0x19, 0x8b, 0x1b, 0x94,
+	0xce, 0xf4, 0xcc, 0xf1, 0xc3, 0xe0, 0x4a, 0x0c, 0x1c, 0xff, 0x5a, 0x60, 0xa0, 0x1c, 0x2f, 0x12,
+	0xbd, 0x38, 0x42, 0xdf, 0x8e, 0x64, 0xa8, 0x42, 0x76, 0x2c, 0x62, 0x25, 0x42, 0x3b, 0x05, 0xdb,
+	0xd3, 0x33, 0xdb, 0x80, 0x6d, 0x03, 0x2e, 0x1f, 0x0d, 0xc2, 0x41, 0x98, 0x02, 0x1d, 0xfd, 0x67,
+	0x72, 0xca, 0x8f, 0xd6, 0xa5, 0x3d, 0xa5, 0xa4, 0xb8, 0x9c, 0x28, 0x8c, 0xb3, 0xd0, 0xe9, 0x5f,
+	0x58, 0x63, 0x94, 0x53, 0xe1, 0xa3, 0x41, 0x55, 0x17, 0x14, 0x4a, 0xad, 0x6e, 0xb7, 0xd3, 0xe8,
+	0xb4, 0x2f, 0x22, 0xf4, 0xd9, 0x0b, 0x80, 0x4d, 0x25, 0x8b, 0x56, 0x68, 0xad, 0x54, 0x2f, 0xdb,
+	0xbf, 0x74, 0xd6, 0x58, 0x23, 0xdc, 0x2d, 0x34, 0x7b, 0x0d, 0x85, 0xc8, 0x53, 0x0a, 0x65, 0x10,
+	0x5b, 0x7b, 0x95, 0x5c, 0xad, 0x54, 0x7f, 0x66, 0xef, 0xd2, 0x64, 0x6f, 0x11, 0x77, 0x4c, 0xa2,
+	0xbb, 0xae, 0xc0, 0x5e, 0x42, 0x41, 0x0f, 0x68, 0x84, 0xb3, 0xd8, 0xca, 0xa5, 0xd5, 0x4e, 0x77,
+	0x57, 0x6b, 0x74, 0xda, 0xe7, 0x38, 0x73, 0x0f, 0xbd, 0x48, 0x9c, 0xe3, 0x2c, 0xae, 0x7e, 0xa5,
+	0xc0, 0x7e, 0x67, 0xf8, 0x2f, 0x85, 0x8f, 0xa1, 0x34, 0x54, 0x2a, 0xea, 0x8d, 0x51, 0x0d, 0xc3,
+	0xbe, 0xb5, 0x57, 0xa1, 0xb5, 0xa2, 0x0b, 0xda, 0xf5, 0x26, 0xf5, 0xb0, 0x13, 0x78, 0x30, 0x91,
+	0xa2, 0xa7, 0x70, 0x1c, 0x5d, 0x7b, 0x0a, 0xad, 0x9c, 0x46, 0xb4, 0x88, 0x5b, 0x9a, 0x48, 0xd1,
+	0xcd, 0x9c, 0xec, 0x21, 0x1c, 0x48, 0x1c, 0xe0, 0x8d, 0xb5, 0x9f, 0x45, 0x8d, 0xd9, 0x2c, 0xc2,
+	0x61, 0xa6, 0xbe, 0xfa, 0x1e, 0xf2, 0x46, 0x8e, 0x06, 0x7f, 0x98, 0xa0, 0x9c, 0xa5, 0x9d, 0xa6,
+	0xe0, 0xd4, 0x64, 0x16, 0xe4, 0x87, 0xe8, 0xf5, 0x51, 0x9a, 0x2e, 0x5a, 0xc4, 0xcd, 0x6c, 0x1d,
+	0xf1, 0xc3, 0x70, 0x24, 0x36, 0xec, 0x99, 0xdd, 0x3c, 0x80, 0xdc, 0x08, 0x67, 0xd5, 0x16, 0x1c,
+	0x6d, 0xcd, 0xc5, 0xc5, 0x2b, 0x94, 0x18, 0xf8, 0xc8, 0x18, 0xec, 0x07, 0xde, 0x18, 0x0d, 0x93,
+	0x9b, 0xfe, 0xb3, 0x63, 0x28, 0xea, 0x6f, 0x1c, 0x79, 0x3e, 0x66, 0x7a, 0x37, 0x8e, 0xea, 0x97,
+	0x9f, 0x47, 0xdc, 0x14, 0x41, 0x5f, 0x04, 0x03, 0xf6, 0x0a, 0x0a, 0xd9, 0x96, 0xe9, 0x01, 0xeb,
+	0xa7, 0x7b, 0xba, 0xfb, 0xe9, 0xda, 0x3a, 0x78, 0x61, 0x52, 0xdc, 0x75, 0x2e, 0x7b, 0x0b, 0xc5,
+	0xfb, 0x1b, 0xb9, 0xdf, 0xa8, 0xfa, 0x3f, 0x6f, 0xd4, 0x5a, 0x97, 0xab, 0xf7, 0x48, 0x7b, 0xe2,
+	0xa6, 0x77, 0xbb, 0xe4, 0x64, 0xbe, 0xe4, 0x64, 0xb1, 0xe4, 0xe4, 0x6e, 0xc9, 0xc9, 0xc7, 0x84,
+	0xd3, 0xcf, 0x09, 0x27, 0xb7, 0x09, 0xa7, 0xf3, 0x84, 0xd3, 0x45, 0xc2, 0xe9, 0xb7, 0x84, 0xd3,
+	0xef, 0x09, 0x27, 0x77, 0x09, 0xa7, 0x9f, 0x56, 0x9c, 0xcc, 0x57, 0x9c, 0x2c, 0x56, 0x9c, 0xbc,
+	0x3b, 0x31, 0xd4, 0x22, 0xd4, 0x97, 0xeb, 0xfc, 0xf9, 0xbc, 0x2e, 0xf3, 0xe9, 0x5d, 0x3d, 0xff,
+	0x11, 0x00, 0x00, 0xff, 0xff, 0x9e, 0x0d, 0x86, 0xcc, 0xf5, 0x03, 0x00, 0x00,
 }
 
 func (m *HTTPAPISpec) Marshal() (dAtA []byte, err error) {
diff --git a/mixer/v1/config/client/api_spec.proto b/mixer/v1/config/client/api_spec.proto
index 27fafee827..92dfefc067 100644
--- a/mixer/v1/config/client/api_spec.proto
+++ b/mixer/v1/config/client/api_spec.proto
@@ -26,6 +26,7 @@ import "mixer/v1/config/client/service.proto";
 option (gogoproto.goproto_getters_all) = false;
 option (gogoproto.equal_all) = false;
 option (gogoproto.gostring_all) = false;
+option (gogoproto.stable_marshaler_all) = true;
 
 // HTTPAPISpec defines the canonical configuration for generating
 // API-related attributes from HTTP requests based on the method and
diff --git a/mixer/v1/config/client/client_config.pb.go b/mixer/v1/config/client/client_config.pb.go
index 85f5b24cd4..7984e9a4fd 100644
--- a/mixer/v1/config/client/client_config.pb.go
+++ b/mixer/v1/config/client/client_config.pb.go
@@ -75,16 +75,12 @@ func (m *NetworkFailPolicy) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *NetworkFailPolicy) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_NetworkFailPolicy.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *NetworkFailPolicy) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_NetworkFailPolicy.Merge(m, src)
@@ -142,16 +138,12 @@ func (m *ServiceConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *ServiceConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_ServiceConfig.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *ServiceConfig) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_ServiceConfig.Merge(m, src)
@@ -212,16 +204,12 @@ func (m *TransportConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *TransportConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_TransportConfig.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *TransportConfig) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_TransportConfig.Merge(m, src)
@@ -264,16 +252,12 @@ func (m *HttpClientConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *HttpClientConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_HttpClientConfig.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *HttpClientConfig) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_HttpClientConfig.Merge(m, src)
@@ -317,16 +301,12 @@ func (m *TcpClientConfig) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *TcpClientConfig) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_TcpClientConfig.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *TcpClientConfig) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_TcpClientConfig.Merge(m, src)
@@ -355,67 +335,67 @@ func init() {
 }
 
 var fileDescriptor_27bf0dec365e2f6f = []byte{
-	// 954 bytes of a gzipped FileDescriptorProto
+	// 956 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x56, 0x4d, 0x6f, 0x1a, 0x47,
-	0x18, 0xde, 0x05, 0xec, 0x98, 0x71, 0xf8, 0xf0, 0x90, 0xa8, 0x98, 0x54, 0x2b, 0x44, 0x14, 0x95,
-	0x36, 0xea, 0xd2, 0xd0, 0x4b, 0x95, 0x43, 0x2b, 0x4c, 0x6c, 0xc5, 0x6a, 0x9c, 0xd0, 0xb5, 0xab,
-	0x48, 0xad, 0xaa, 0xd1, 0xb0, 0x0c, 0x30, 0xf2, 0x7a, 0x67, 0x33, 0x3b, 0x60, 0xfb, 0xd6, 0x5f,
-	0x50, 0xf5, 0x67, 0xe4, 0x0f, 0xf4, 0x3f, 0xe4, 0xe8, 0x63, 0x8e, 0x35, 0xbe, 0xf4, 0x98, 0x63,
-	0xa5, 0x5e, 0xaa, 0x9d, 0x19, 0x58, 0x63, 0xf3, 0x51, 0xaa, 0xf6, 0xc4, 0xec, 0xfb, 0x3e, 0xcf,
-	0xcb, 0xec, 0xf3, 0x3e, 0xf3, 0xce, 0x82, 0xcf, 0x4e, 0xe8, 0x19, 0xe1, 0xb5, 0xe1, 0x93, 0x9a,
-	0xcb, 0xfc, 0x2e, 0xed, 0xd5, 0x5c, 0x8f, 0x12, 0x5f, 0xe8, 0x1f, 0xa4, 0x82, 0x76, 0xc0, 0x99,
-	0x60, 0xf0, 0x63, 0x1a, 0x0a, 0xca, 0x6c, 0xc9, 0xb0, 0x87, 0x4f, 0x6c, 0x9d, 0x54, 0xd0, 0xd2,
-	0xbd, 0x1e, 0xeb, 0x31, 0x09, 0xac, 0x45, 0x2b, 0xc5, 0x29, 0x59, 0x3d, 0xc6, 0x7a, 0x1e, 0xa9,
-	0xc9, 0xa7, 0xf6, 0xa0, 0x5b, 0xeb, 0x0c, 0x38, 0x16, 0x94, 0xf9, 0x3a, 0xbf, 0x3d, 0xf9, 0x7f,
-	0x2c, 0x04, 0xa7, 0xed, 0x81, 0x20, 0xa1, 0x4e, 0x3d, 0x9a, 0xb3, 0x35, 0x1c, 0x50, 0x14, 0x06,
-	0xc4, 0xd5, 0xb0, 0xca, 0x1c, 0xd8, 0x9b, 0x01, 0x13, 0x58, 0x61, 0x2a, 0xbf, 0x25, 0xc0, 0xd6,
-	0x4b, 0x22, 0x4e, 0x19, 0x3f, 0xde, 0xc3, 0xd4, 0x6b, 0x31, 0x8f, 0xba, 0xe7, 0xd0, 0x01, 0xeb,
-	0x81, 0x5c, 0x15, 0xcd, 0xb2, 0x59, 0xcd, 0xd6, 0x9f, 0xda, 0x8b, 0x5e, 0xd0, 0xbe, 0x55, 0xc0,
-	0x8e, 0x97, 0x8e, 0xae, 0x04, 0x1f, 0x80, 0xf4, 0x09, 0x3e, 0x43, 0x9c, 0x08, 0x7e, 0x5e, 0x4c,
-	0x94, 0xcd, 0x6a, 0xc6, 0xd9, 0x38, 0xc1, 0x67, 0x4e, 0xf4, 0x0c, 0x1b, 0x20, 0xd7, 0xc6, 0x21,
-	0x51, 0x59, 0x74, 0x8a, 0xa9, 0x28, 0x26, 0xcb, 0x66, 0x75, 0xb3, 0xbe, 0x6d, 0x2b, 0x99, 0xec,
-	0xb1, 0x4c, 0xf6, 0x33, 0x2d, 0x93, 0x93, 0x89, 0x18, 0x92, 0xfe, 0x1a, 0x53, 0x01, 0xbf, 0x01,
-	0xd9, 0x49, 0x7d, 0x55, 0x21, 0xb5, 0xac, 0xc2, 0xdd, 0xf1, 0xff, 0x47, 0x05, 0x2a, 0x8f, 0x01,
-	0xb8, 0x26, 0x41, 0x06, 0xa4, 0xf7, 0x1a, 0xfb, 0x2f, 0xd0, 0xab, 0xd6, 0xee, 0xcb, 0xbc, 0x01,
-	0xb3, 0x00, 0xc8, 0xc7, 0xe6, 0x8b, 0x57, 0x87, 0xbb, 0x79, 0xb3, 0xf2, 0x57, 0x12, 0x64, 0x0e,
-	0x09, 0x1f, 0x52, 0x97, 0x34, 0xa5, 0x16, 0xd0, 0x06, 0x85, 0x0e, 0x0d, 0x71, 0xdb, 0x23, 0xc8,
-	0xed, 0x13, 0xf7, 0x18, 0xb9, 0xd8, 0xf3, 0x42, 0x29, 0xe0, 0x86, 0xb3, 0xa5, 0x53, 0xcd, 0x28,
-	0xd3, 0x8c, 0x12, 0xf0, 0x0b, 0x70, 0x6f, 0x8c, 0xe7, 0x24, 0x60, 0x5c, 0x68, 0x42, 0x42, 0x12,
-	0xa0, 0xce, 0x39, 0x32, 0xa5, 0x18, 0xbb, 0x20, 0x2f, 0x1b, 0x80, 0x62, 0x43, 0x68, 0x95, 0x4a,
-	0x37, 0xfb, 0xd3, 0x98, 0x20, 0x9c, 0x9c, 0x0c, 0xc6, 0x01, 0x78, 0x00, 0x32, 0x7d, 0x21, 0x02,
-	0x34, 0x76, 0x4b, 0x31, 0x55, 0x4e, 0x56, 0x37, 0xeb, 0x9f, 0x2e, 0xee, 0xf1, 0xf3, 0xa3, 0xa3,
-	0x56, 0xa3, 0xb5, 0x7f, 0x18, 0x10, 0xd7, 0xd9, 0x8c, 0xf8, 0x8d, 0x80, 0x46, 0x0f, 0x70, 0x0f,
-	0x00, 0x69, 0x28, 0x55, 0x6b, 0x4d, 0xd6, 0xfa, 0x64, 0x71, 0xad, 0xef, 0x22, 0xbc, 0xac, 0x94,
-	0x7e, 0x33, 0x5e, 0x42, 0x04, 0x0a, 0xbe, 0xf2, 0x11, 0xea, 0x62, 0xea, 0x21, 0x6d, 0xc0, 0x3b,
-	0xf2, 0x05, 0x6b, 0x2b, 0x1a, 0xd0, 0xd9, 0xf2, 0x6f, 0x99, 0x7a, 0x1f, 0xc0, 0x2e, 0xe3, 0xa7,
-	0x98, 0x77, 0xae, 0x0b, 0xb8, 0xb1, 0x54, 0xc0, 0x2d, 0xcd, 0x8a, 0x43, 0x95, 0x3f, 0x93, 0x20,
-	0x77, 0xc4, 0xb1, 0x1f, 0xca, 0xe6, 0xcc, 0xed, 0xbf, 0xdb, 0x27, 0xb3, 0xfb, 0xef, 0xf6, 0xc9,
-	0x75, 0xbc, 0xd2, 0x4f, 0xe1, 0x13, 0x53, 0x78, 0xa9, 0x94, 0xc2, 0xdf, 0xf6, 0x4b, 0x1b, 0x0b,
-	0xb7, 0x2f, 0x1d, 0x70, 0xd3, 0x2f, 0x3b, 0x51, 0x66, 0x9e, 0xa2, 0xa9, 0xff, 0x4c, 0xd1, 0x03,
-	0x70, 0x3f, 0x14, 0x58, 0x84, 0x68, 0x10, 0x74, 0xb0, 0x20, 0x88, 0xfa, 0x82, 0xf0, 0x21, 0xf6,
-	0x8a, 0x6b, 0xcb, 0x4e, 0x5e, 0x41, 0xf2, 0xbe, 0x97, 0xb4, 0x7d, 0xcd, 0x82, 0x0f, 0x41, 0x46,
-	0x2b, 0xe7, 0x0d, 0x42, 0x41, 0x78, 0x71, 0xbd, 0x6c, 0x56, 0xd3, 0xce, 0x5d, 0x19, 0x6c, 0xaa,
-	0x18, 0x7c, 0x04, 0xb2, 0xe3, 0xe3, 0xa2, 0x51, 0x77, 0x24, 0x2a, 0xa3, 0xa2, 0x63, 0xd8, 0x6b,
-	0x50, 0x8a, 0x9b, 0x8c, 0xba, 0x8c, 0x23, 0x75, 0x74, 0x02, 0xce, 0xce, 0xce, 0xff, 0x41, 0xd3,
-	0x3f, 0x8a, 0xd9, 0x7b, 0x8c, 0x1f, 0x44, 0x88, 0x56, 0x44, 0xad, 0xfc, 0x92, 0x02, 0xf9, 0xe7,
-	0x42, 0x04, 0x4d, 0xa9, 0x93, 0xee, 0xfd, 0xb7, 0x20, 0x2d, 0xc6, 0x76, 0x90, 0x1d, 0xdf, 0xac,
-	0x7f, 0xbe, 0x58, 0xdf, 0x1b, 0xee, 0x71, 0x62, 0x3e, 0x3c, 0x06, 0xb9, 0x50, 0x4d, 0x16, 0x7d,
-	0xc9, 0x44, 0x33, 0x21, 0x3a, 0x55, 0x3b, 0x4b, 0x4e, 0xe8, 0x8d, 0x5d, 0xd9, 0x53, 0xf3, 0x29,
-	0xdc, 0xf5, 0x05, 0x3f, 0x77, 0xb2, 0xe1, 0x54, 0x10, 0x7e, 0x0d, 0x1e, 0x74, 0x48, 0x17, 0x0f,
-	0x3c, 0x81, 0x3a, 0x24, 0x14, 0xd4, 0x97, 0xfd, 0x41, 0x1a, 0x25, 0xcd, 0x95, 0x76, 0xb6, 0x35,
-	0xe4, 0x59, 0x8c, 0xd0, 0xb5, 0x67, 0xce, 0xa4, 0xd4, 0xea, 0x33, 0x69, 0xf6, 0xd9, 0x5c, 0xfb,
-	0x17, 0x67, 0xb3, 0xe4, 0x83, 0xc2, 0x8c, 0x17, 0x87, 0x79, 0x90, 0x3c, 0x26, 0xea, 0x3e, 0x4b,
-	0x3b, 0xd1, 0x12, 0x36, 0xc0, 0xda, 0x10, 0x7b, 0x03, 0x75, 0xe4, 0x36, 0xeb, 0x8f, 0x17, 0xab,
-	0x3b, 0x55, 0xd3, 0x51, 0xcc, 0xa7, 0x89, 0xaf, 0xcc, 0xca, 0xdb, 0x68, 0x16, 0xb8, 0xff, 0xa3,
-	0x1f, 0x66, 0x49, 0x9c, 0x58, 0x5d, 0xe2, 0x39, 0xf7, 0x53, 0x72, 0xd5, 0xfb, 0x29, 0x35, 0xf7,
-	0x7e, 0xfa, 0x11, 0xdc, 0x77, 0x99, 0xef, 0x13, 0x57, 0x5a, 0x68, 0xea, 0x52, 0x30, 0x57, 0xb9,
-	0x14, 0x0a, 0x71, 0x95, 0x49, 0x10, 0xee, 0x80, 0x9c, 0xde, 0xc6, 0x64, 0xca, 0xac, 0x2f, 0x9b,
-	0x32, 0x7a, 0x52, 0x8c, 0x07, 0xcc, 0xce, 0x4f, 0xef, 0x2e, 0x2d, 0xe3, 0xe2, 0xd2, 0x32, 0xde,
-	0x5f, 0x5a, 0xc6, 0x87, 0x4b, 0xcb, 0xf8, 0x79, 0x64, 0x99, 0x6f, 0x47, 0x96, 0xf1, 0x6e, 0x64,
-	0x99, 0x17, 0x23, 0xcb, 0xfc, 0x7d, 0x64, 0x99, 0x7f, 0x8c, 0x2c, 0xe3, 0xc3, 0xc8, 0x32, 0x7f,
-	0xbd, 0xb2, 0x8c, 0x8b, 0x2b, 0xcb, 0x78, 0x7f, 0x65, 0x19, 0x3f, 0x3c, 0x54, 0x5b, 0xa7, 0x2c,
-	0xfa, 0xc6, 0xaa, 0xcd, 0xfe, 0xae, 0x6a, 0xaf, 0xcb, 0x1d, 0x7c, 0xf9, 0x77, 0x00, 0x00, 0x00,
-	0xff, 0xff, 0x1b, 0xe3, 0x81, 0xd2, 0x3a, 0x0a, 0x00, 0x00,
+	0x18, 0xde, 0x05, 0xec, 0x98, 0x21, 0x7c, 0x78, 0x48, 0x54, 0x4c, 0xaa, 0x15, 0x22, 0x8a, 0x4a,
+	0x1b, 0x75, 0x69, 0xe8, 0xa5, 0xca, 0xa1, 0x15, 0x26, 0xb6, 0x62, 0x35, 0x4e, 0xe8, 0xda, 0x55,
+	0xa4, 0xf6, 0x30, 0x1a, 0x96, 0x01, 0x46, 0x5e, 0xef, 0x6c, 0x66, 0x07, 0x6c, 0xdf, 0xfa, 0x0b,
+	0xaa, 0xfe, 0x8c, 0xfc, 0x81, 0xfe, 0x87, 0x1c, 0x7d, 0xf4, 0xb1, 0xc6, 0x97, 0x1e, 0x7d, 0xac,
+	0xd4, 0x4b, 0xb5, 0x33, 0x03, 0x18, 0x9b, 0x8f, 0x52, 0x35, 0x27, 0x66, 0xdf, 0xf7, 0x79, 0x5e,
+	0x66, 0x9f, 0xf7, 0x99, 0x77, 0x16, 0x7c, 0x71, 0x4c, 0x4f, 0x09, 0xaf, 0x0e, 0x9e, 0x55, 0x5d,
+	0xe6, 0x77, 0x68, 0xb7, 0xea, 0x7a, 0x94, 0xf8, 0x42, 0xff, 0x20, 0x15, 0xb4, 0x03, 0xce, 0x04,
+	0x83, 0x9f, 0xd2, 0x50, 0x50, 0x66, 0x4b, 0x86, 0x3d, 0x78, 0x66, 0xeb, 0xa4, 0x82, 0x16, 0x1f,
+	0x74, 0x59, 0x97, 0x49, 0x60, 0x35, 0x5a, 0x29, 0x4e, 0xd1, 0xea, 0x32, 0xd6, 0xf5, 0x48, 0x55,
+	0x3e, 0xb5, 0xfa, 0x9d, 0x6a, 0xbb, 0xcf, 0xb1, 0xa0, 0xcc, 0xd7, 0xf9, 0xad, 0xf1, 0xff, 0x63,
+	0x21, 0x38, 0x6d, 0xf5, 0x05, 0x09, 0x75, 0xea, 0xc9, 0x9c, 0xad, 0xe1, 0x80, 0xa2, 0x30, 0x20,
+	0xae, 0x86, 0x95, 0xe7, 0xc0, 0xde, 0xf5, 0x99, 0xc0, 0x0a, 0x53, 0xfe, 0x3d, 0x06, 0x36, 0x5f,
+	0x13, 0x71, 0xc2, 0xf8, 0xd1, 0x2e, 0xa6, 0x5e, 0x93, 0x79, 0xd4, 0x3d, 0x83, 0x0e, 0x58, 0x0f,
+	0xe4, 0xaa, 0x60, 0x96, 0xcc, 0x4a, 0xa6, 0xf6, 0xdc, 0x5e, 0xf4, 0x82, 0xf6, 0x9d, 0x02, 0xf6,
+	0x64, 0xe9, 0xe8, 0x4a, 0xf0, 0x11, 0x48, 0x1e, 0xe3, 0x53, 0xc4, 0x89, 0xe0, 0x67, 0x85, 0x58,
+	0xc9, 0xac, 0xa4, 0x9d, 0x8d, 0x63, 0x7c, 0xea, 0x44, 0xcf, 0xb0, 0x0e, 0xb2, 0x2d, 0x1c, 0x12,
+	0x95, 0x45, 0x27, 0x98, 0x8a, 0x42, 0xbc, 0x64, 0x56, 0x52, 0xb5, 0x2d, 0x5b, 0xc9, 0x64, 0x8f,
+	0x64, 0xb2, 0x5f, 0x68, 0x99, 0x9c, 0x74, 0xc4, 0x90, 0xf4, 0xb7, 0x98, 0x0a, 0xf8, 0x1d, 0xc8,
+	0x8c, 0xeb, 0xab, 0x0a, 0x89, 0x65, 0x15, 0xee, 0x8f, 0xfe, 0x3f, 0x2a, 0x50, 0x7e, 0x0a, 0xc0,
+	0x0d, 0x09, 0xd2, 0x20, 0xb9, 0x5b, 0xdf, 0x7b, 0x85, 0xde, 0x34, 0x77, 0x5e, 0xe7, 0x0c, 0x98,
+	0x01, 0x40, 0x3e, 0x36, 0x5e, 0xbd, 0x39, 0xd8, 0xc9, 0x99, 0xe5, 0xbf, 0xe3, 0x20, 0x7d, 0x40,
+	0xf8, 0x80, 0xba, 0xa4, 0x21, 0xb5, 0x80, 0x36, 0xc8, 0xb7, 0x69, 0x88, 0x5b, 0x1e, 0x41, 0x6e,
+	0x8f, 0xb8, 0x47, 0xc8, 0xc5, 0x9e, 0x17, 0x4a, 0x01, 0x37, 0x9c, 0x4d, 0x9d, 0x6a, 0x44, 0x99,
+	0x46, 0x94, 0x80, 0x5f, 0x81, 0x07, 0x23, 0x3c, 0x27, 0x01, 0xe3, 0x42, 0x13, 0x62, 0x92, 0x00,
+	0x75, 0xce, 0x91, 0x29, 0xc5, 0xd8, 0x01, 0x39, 0xd9, 0x00, 0x34, 0x31, 0x84, 0x56, 0xa9, 0x78,
+	0xbb, 0x3f, 0xf5, 0x31, 0xc2, 0xc9, 0xca, 0xe0, 0x24, 0x00, 0xf7, 0x41, 0xba, 0x27, 0x44, 0x80,
+	0x46, 0x6e, 0x29, 0x24, 0x4a, 0xf1, 0x4a, 0xaa, 0xf6, 0xf9, 0xe2, 0x1e, 0xbf, 0x3c, 0x3c, 0x6c,
+	0xd6, 0x9b, 0x7b, 0x07, 0x01, 0x71, 0x9d, 0x54, 0xc4, 0xaf, 0x07, 0x34, 0x7a, 0x80, 0xbb, 0x00,
+	0x48, 0x43, 0xa9, 0x5a, 0x6b, 0xb2, 0xd6, 0x67, 0x8b, 0x6b, 0xfd, 0x10, 0xe1, 0x65, 0xa5, 0xe4,
+	0xbb, 0xd1, 0x12, 0x22, 0x90, 0xf7, 0x95, 0x8f, 0x50, 0x07, 0x53, 0x0f, 0x69, 0x03, 0xde, 0x93,
+	0x2f, 0x58, 0x5d, 0xd1, 0x80, 0xce, 0xa6, 0x7f, 0xc7, 0xd4, 0x7b, 0x00, 0x76, 0x18, 0x3f, 0xc1,
+	0xbc, 0x7d, 0x53, 0xc0, 0x8d, 0xa5, 0x02, 0x6e, 0x6a, 0xd6, 0x24, 0x54, 0xfe, 0x2b, 0x0e, 0xb2,
+	0x87, 0x1c, 0xfb, 0xa1, 0x6c, 0xce, 0xdc, 0xfe, 0xbb, 0x3d, 0x32, 0xbb, 0xff, 0x6e, 0x8f, 0xdc,
+	0xc4, 0x2b, 0xfd, 0x14, 0x3e, 0x36, 0x85, 0x97, 0x4a, 0x29, 0xfc, 0x5d, 0xbf, 0xb4, 0xb0, 0x70,
+	0x7b, 0xd2, 0x01, 0xb7, 0xfd, 0xb2, 0x1d, 0x65, 0xe6, 0x29, 0x9a, 0xf8, 0xdf, 0x14, 0xdd, 0x07,
+	0x0f, 0x43, 0x81, 0x45, 0x88, 0xfa, 0x41, 0x1b, 0x0b, 0x82, 0xa8, 0x2f, 0x08, 0x1f, 0x60, 0xaf,
+	0xb0, 0xb6, 0xec, 0xe4, 0xe5, 0x25, 0xef, 0x47, 0x49, 0xdb, 0xd3, 0x2c, 0xf8, 0x18, 0xa4, 0xb5,
+	0x72, 0x5e, 0x3f, 0x14, 0x84, 0x17, 0xd6, 0x4b, 0x66, 0x25, 0xe9, 0xdc, 0x97, 0xc1, 0x86, 0x8a,
+	0xc1, 0x27, 0x20, 0x33, 0x3a, 0x2e, 0x1a, 0x75, 0x4f, 0xa2, 0xd2, 0x2a, 0x3a, 0x82, 0xbd, 0x05,
+	0xc5, 0x49, 0x93, 0x51, 0x87, 0x71, 0xa4, 0x8e, 0x4e, 0xc0, 0xd9, 0xe9, 0xd9, 0xbf, 0x68, 0xfa,
+	0x27, 0x13, 0xf6, 0x2e, 0xe3, 0xfb, 0x11, 0xa2, 0x19, 0x51, 0xcb, 0xbf, 0x26, 0x40, 0xee, 0xa5,
+	0x10, 0x41, 0x43, 0xea, 0xa4, 0x7b, 0xff, 0x3d, 0x48, 0x8a, 0x91, 0x1d, 0x64, 0xc7, 0x53, 0xb5,
+	0x2f, 0x17, 0xeb, 0x7b, 0xcb, 0x3d, 0xce, 0x84, 0x0f, 0x8f, 0x40, 0x36, 0x54, 0x93, 0x45, 0x5f,
+	0x32, 0xd1, 0x4c, 0x88, 0x4e, 0xd5, 0xf6, 0x92, 0x13, 0x7a, 0x6b, 0x57, 0xf6, 0xd4, 0x7c, 0x0a,
+	0x77, 0x7c, 0xc1, 0xcf, 0x9c, 0x4c, 0x38, 0x15, 0x84, 0xdf, 0x82, 0x47, 0x6d, 0xd2, 0xc1, 0x7d,
+	0x4f, 0xa0, 0x36, 0x09, 0x05, 0xf5, 0x65, 0x7f, 0x90, 0x46, 0x49, 0x73, 0x25, 0x9d, 0x2d, 0x0d,
+	0x79, 0x31, 0x41, 0xe8, 0xda, 0x33, 0x67, 0x52, 0x62, 0xf5, 0x99, 0x34, 0xfb, 0x6c, 0xae, 0xfd,
+	0x87, 0xb3, 0x59, 0xf4, 0x41, 0x7e, 0xc6, 0x8b, 0xc3, 0x1c, 0x88, 0x1f, 0x11, 0x75, 0x9f, 0x25,
+	0x9d, 0x68, 0x09, 0xeb, 0x60, 0x6d, 0x80, 0xbd, 0xbe, 0x3a, 0x72, 0xa9, 0xda, 0xd3, 0xc5, 0xea,
+	0x4e, 0xd5, 0x74, 0x14, 0xf3, 0x79, 0xec, 0x1b, 0xb3, 0xfc, 0x3e, 0x9a, 0x05, 0xee, 0x47, 0xf4,
+	0xc3, 0x2c, 0x89, 0x63, 0xab, 0x4b, 0x3c, 0xe7, 0x7e, 0x8a, 0xaf, 0x7a, 0x3f, 0x25, 0xe6, 0xde,
+	0x4f, 0x3f, 0x83, 0x87, 0x2e, 0xf3, 0x7d, 0xe2, 0x4a, 0x0b, 0x4d, 0x5d, 0x0a, 0xe6, 0x2a, 0x97,
+	0x42, 0x7e, 0x52, 0x65, 0x1c, 0x84, 0xdb, 0x20, 0xab, 0xb7, 0x31, 0x9e, 0x32, 0xeb, 0xcb, 0xa6,
+	0x8c, 0x9e, 0x14, 0xa3, 0x01, 0xb3, 0x8d, 0x3f, 0x5c, 0x5a, 0xc6, 0xf9, 0xa5, 0x65, 0x5c, 0x5c,
+	0x5a, 0xc6, 0xf5, 0xa5, 0x65, 0xfc, 0x32, 0xb4, 0xcc, 0xf7, 0x43, 0xcb, 0xf8, 0x30, 0xb4, 0xcc,
+	0xf3, 0xa1, 0x65, 0x5e, 0x0c, 0x2d, 0xf3, 0x8f, 0xa1, 0x65, 0xfe, 0x39, 0xb4, 0x8c, 0xeb, 0xa1,
+	0x65, 0xfe, 0x76, 0x65, 0x19, 0xe7, 0x57, 0x96, 0x71, 0x71, 0x65, 0x19, 0x3f, 0x3d, 0x56, 0xdb,
+	0xa7, 0x2c, 0xfa, 0xce, 0xaa, 0xce, 0xfe, 0xb6, 0x6a, 0xad, 0xcb, 0x5d, 0x7c, 0xfd, 0x4f, 0x00,
+	0x00, 0x00, 0xff, 0xff, 0x45, 0x4f, 0xa9, 0x41, 0x3e, 0x0a, 0x00, 0x00,
 }
 
 func (x NetworkFailPolicy_FailPolicy) String() string {
@@ -681,10 +661,15 @@ func (m *HttpClientConfig) MarshalTo(dAtA []byte) (int, error) {
 		i += n9
 	}
 	if len(m.ServiceConfigs) > 0 {
+		keysForServiceConfigs := make([]string, 0, len(m.ServiceConfigs))
 		for k, _ := range m.ServiceConfigs {
+			keysForServiceConfigs = append(keysForServiceConfigs, string(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Strings(keysForServiceConfigs)
+		for _, k := range keysForServiceConfigs {
 			dAtA[i] = 0x12
 			i++
-			v := m.ServiceConfigs[k]
+			v := m.ServiceConfigs[string(k)]
 			msgSize := 0
 			if v != nil {
 				msgSize = v.Size()
diff --git a/mixer/v1/config/client/client_config.proto b/mixer/v1/config/client/client_config.proto
index 27568888f2..8dd8853341 100644
--- a/mixer/v1/config/client/client_config.proto
+++ b/mixer/v1/config/client/client_config.proto
@@ -31,6 +31,7 @@ option go_package = "istio.io/api/mixer/v1/config/client";
 option (gogoproto.goproto_getters_all) = false;
 option (gogoproto.equal_all) = false;
 option (gogoproto.gostring_all) = false;
+option (gogoproto.stable_marshaler_all) = true;
 
 // Specifies the behavior when the client is unable to connect to Mixer.
 message NetworkFailPolicy {
diff --git a/mixer/v1/config/client/quota.pb.go b/mixer/v1/config/client/quota.pb.go
index 02e71e22b1..39fe9ff311 100644
--- a/mixer/v1/config/client/quota.pb.go
+++ b/mixer/v1/config/client/quota.pb.go
@@ -40,16 +40,12 @@ func (m *QuotaSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *QuotaSpec) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_QuotaSpec.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *QuotaSpec) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_QuotaSpec.Merge(m, src)
@@ -82,16 +78,12 @@ func (m *QuotaRule) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *QuotaRule) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_QuotaRule.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *QuotaRule) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_QuotaRule.Merge(m, src)
@@ -124,16 +116,12 @@ func (m *StringMatch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *StringMatch) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_StringMatch.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *StringMatch) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_StringMatch.Merge(m, src)
@@ -300,16 +288,12 @@ func (m *AttributeMatch) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *AttributeMatch) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_AttributeMatch.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *AttributeMatch) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_AttributeMatch.Merge(m, src)
@@ -340,16 +324,12 @@ func (m *Quota) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *Quota) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Quota.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *Quota) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_Quota.Merge(m, src)
@@ -383,16 +363,12 @@ func (m *QuotaSpecBinding) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *QuotaSpecBinding) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_QuotaSpecBinding.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *QuotaSpecBinding) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_QuotaSpecBinding.Merge(m, src)
@@ -426,16 +402,12 @@ func (m *QuotaSpecBinding_QuotaSpecReference) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *QuotaSpecBinding_QuotaSpecReference) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_QuotaSpecBinding_QuotaSpecReference.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *QuotaSpecBinding_QuotaSpecReference) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_QuotaSpecBinding_QuotaSpecReference.Merge(m, src)
@@ -464,40 +436,40 @@ func init() { proto.RegisterFile("mixer/v1/config/client/quota.proto", fileDescr
 
 var fileDescriptor_81777b5d047af315 = []byte{
 	// 540 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x93, 0xcf, 0x6a, 0x13, 0x5f,
-	0x14, 0xc7, 0x67, 0x92, 0xdf, 0x84, 0x5f, 0x4e, 0x44, 0xca, 0xa5, 0x94, 0x21, 0x94, 0x4b, 0x99,
-	0x0a, 0x56, 0x91, 0x19, 0x5a, 0x11, 0x8a, 0x22, 0xd2, 0x88, 0x45, 0x05, 0x41, 0x6f, 0x76, 0x82,
-	0x94, 0xc9, 0xf4, 0x64, 0x7a, 0x31, 0x99, 0x99, 0xde, 0xb9, 0x13, 0x92, 0x9d, 0x2b, 0x57, 0x2e,
-	0x7c, 0x0c, 0x1f, 0x25, 0xcb, 0x2c, 0xbb, 0x34, 0x93, 0x8d, 0xcb, 0x3e, 0x82, 0xcc, 0xbd, 0x37,
-	0x6d, 0x44, 0x0d, 0x75, 0x35, 0xe7, 0x9c, 0x39, 0x9f, 0xef, 0xf9, 0xc3, 0xb9, 0xe0, 0x0d, 0xf9,
-	0x18, 0x45, 0x30, 0xda, 0x0f, 0xa2, 0x34, 0xe9, 0xf3, 0x38, 0x88, 0x06, 0x1c, 0x13, 0x19, 0x9c,
-	0x17, 0xa9, 0x0c, 0xfd, 0x4c, 0xa4, 0x32, 0x25, 0xdb, 0x3c, 0x97, 0x3c, 0xf5, 0x55, 0xa6, 0x3f,
-	0xda, 0xf7, 0x75, 0xa6, 0xaf, 0x33, 0xdb, 0x9b, 0x71, 0x1a, 0xa7, 0x2a, 0x31, 0xa8, 0x2c, 0xcd,
-	0xb4, 0xef, 0xfc, 0x45, 0x37, 0x47, 0x31, 0xe2, 0x11, 0xea, 0x2c, 0xef, 0x35, 0x34, 0xdf, 0x55,
-	0x85, 0xba, 0x19, 0x46, 0xe4, 0x29, 0x38, 0xa2, 0x18, 0x60, 0xee, 0xda, 0x3b, 0xf5, 0xbd, 0xd6,
-	0xc1, 0x5d, 0x7f, 0x5d, 0x59, 0x5f, 0x71, 0xac, 0x18, 0x20, 0xd3, 0x94, 0xf7, 0xc5, 0x36, 0x62,
-	0x55, 0x90, 0x74, 0xc0, 0x19, 0x86, 0x32, 0x3a, 0x33, 0x62, 0x0f, 0xd6, 0x8b, 0x1d, 0x49, 0x29,
-	0x78, 0xaf, 0x90, 0xf8, 0xa6, 0x62, 0x98, 0x46, 0xc9, 0x13, 0x68, 0xa8, 0x35, 0xe4, 0x6e, 0x4d,
-	0x89, 0xec, 0xde, 0xa4, 0x23, 0x83, 0x78, 0x08, 0xad, 0xae, 0x14, 0x3c, 0x89, 0x95, 0x24, 0xd9,
-	0x02, 0x07, 0xc7, 0x61, 0x24, 0x5d, 0x7b, 0xc7, 0xde, 0x6b, 0xbe, 0xb4, 0x98, 0x76, 0x89, 0x0b,
-	0x8d, 0x4c, 0x60, 0x9f, 0x8f, 0xdd, 0x9a, 0xf9, 0x61, 0xfc, 0x8a, 0x10, 0x18, 0xe3, 0xd8, 0xad,
-	0x2f, 0x09, 0xe5, 0x76, 0x6e, 0x01, 0xa8, 0xf6, 0x4e, 0xe4, 0x24, 0x43, 0x6f, 0x6a, 0xc3, 0xed,
-	0x5f, 0xbb, 0x27, 0x6f, 0xa1, 0x11, 0x0d, 0xc2, 0x22, 0x47, 0x33, 0xfb, 0xe1, 0xbf, 0xcc, 0xee,
-	0x3f, 0x57, 0xe8, 0x8b, 0x44, 0x8a, 0x09, 0x33, 0x3a, 0xed, 0x53, 0x68, 0xad, 0x84, 0xc9, 0x06,
-	0xd4, 0x3f, 0xe2, 0x44, 0x4f, 0xc2, 0x2a, 0x93, 0x3c, 0x03, 0x67, 0x14, 0x0e, 0x0a, 0x54, 0x43,
-	0xb4, 0x0e, 0xee, 0xad, 0xaf, 0xb8, 0xb2, 0x17, 0xa6, 0xb9, 0xc7, 0xb5, 0x43, 0xdb, 0x7b, 0x04,
-	0x8e, 0x5a, 0x21, 0xd9, 0x04, 0x47, 0x2d, 0xd1, 0x54, 0xd0, 0x0e, 0xd9, 0x82, 0x46, 0x74, 0x16,
-	0x8a, 0x58, 0x17, 0xa9, 0x33, 0xe3, 0x79, 0x9f, 0x6b, 0xb0, 0x71, 0x75, 0x44, 0x1d, 0x9e, 0x9c,
-	0xf2, 0x24, 0x26, 0xc7, 0xf0, 0xbf, 0xb9, 0xb4, 0xe5, 0x39, 0xdd, 0x5f, 0xdf, 0xd3, 0xab, 0xea,
-	0x67, 0x57, 0x23, 0xec, 0x8a, 0x25, 0x3d, 0x68, 0xa9, 0xea, 0x27, 0x79, 0x86, 0xd1, 0xf2, 0x0e,
-	0x8e, 0x6e, 0x70, 0x07, 0x2b, 0xcd, 0x5c, 0x07, 0x18, 0xf6, 0x51, 0x60, 0x12, 0x21, 0x83, 0xf3,
-	0x65, 0x2c, 0x6f, 0x1f, 0x03, 0xf9, 0x3d, 0x83, 0x10, 0xf8, 0x2f, 0x09, 0x87, 0x68, 0x76, 0xa0,
-	0x6c, 0xb2, 0x0d, 0xcd, 0xea, 0x9b, 0x67, 0x61, 0xa4, 0xb7, 0xd0, 0x64, 0xd7, 0x81, 0xce, 0x87,
-	0xe9, 0x9c, 0x5a, 0xb3, 0x39, 0xb5, 0x2e, 0xe6, 0xd4, 0xba, 0x9c, 0x53, 0xeb, 0x53, 0x49, 0xed,
-	0x6f, 0x25, 0xb5, 0xa6, 0x25, 0xb5, 0x67, 0x25, 0xb5, 0xbf, 0x97, 0xd4, 0xfe, 0x51, 0x52, 0xeb,
-	0xb2, 0xa4, 0xf6, 0xd7, 0x05, 0xb5, 0x66, 0x0b, 0x6a, 0x5d, 0x2c, 0xa8, 0xf5, 0x7e, 0x57, 0xcf,
-	0xc3, 0xd3, 0x20, 0xcc, 0x78, 0xf0, 0xe7, 0x97, 0xdb, 0x6b, 0xa8, 0x27, 0xfb, 0xf0, 0x67, 0x00,
-	0x00, 0x00, 0xff, 0xff, 0x07, 0x28, 0x43, 0xd1, 0x32, 0x04, 0x00, 0x00,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x93, 0xcf, 0x6b, 0x13, 0x41,
+	0x14, 0xc7, 0x77, 0x12, 0x37, 0x98, 0x17, 0x91, 0x32, 0x94, 0xb2, 0x84, 0x32, 0x94, 0xad, 0x60,
+	0x15, 0xd9, 0xa5, 0x15, 0xa1, 0x28, 0x22, 0x8d, 0x58, 0x54, 0x10, 0x74, 0x7a, 0xf3, 0x52, 0x36,
+	0xdb, 0x97, 0xed, 0x60, 0xb2, 0xbb, 0xdd, 0x9d, 0x0d, 0xc9, 0xcd, 0x93, 0x27, 0x0f, 0xfe, 0x19,
+	0xfe, 0x29, 0x39, 0xe6, 0x98, 0xa3, 0xd9, 0x5c, 0x3c, 0xf6, 0x4f, 0x90, 0x9d, 0x99, 0xb4, 0x11,
+	0x35, 0xd4, 0xd3, 0xbe, 0xf7, 0xf6, 0x7d, 0xbe, 0xef, 0x07, 0x6f, 0xc0, 0x1d, 0x88, 0x11, 0x66,
+	0xfe, 0x70, 0xdf, 0x0f, 0x93, 0xb8, 0x27, 0x22, 0x3f, 0xec, 0x0b, 0x8c, 0xa5, 0x7f, 0x51, 0x24,
+	0x32, 0xf0, 0xd2, 0x2c, 0x91, 0x09, 0xdd, 0x16, 0xb9, 0x14, 0x89, 0xa7, 0x32, 0xbd, 0xe1, 0xbe,
+	0xa7, 0x33, 0x3d, 0x9d, 0xd9, 0xde, 0x8c, 0x92, 0x28, 0x51, 0x89, 0x7e, 0x65, 0x69, 0xa6, 0x7d,
+	0xef, 0x1f, 0xba, 0x39, 0x66, 0x43, 0x11, 0xa2, 0xce, 0x72, 0xdf, 0x42, 0xf3, 0x43, 0x55, 0xe8,
+	0x24, 0xc5, 0x90, 0x3e, 0x07, 0x3b, 0x2b, 0xfa, 0x98, 0x3b, 0x64, 0xa7, 0xbe, 0xd7, 0x3a, 0xb8,
+	0xef, 0xad, 0x2b, 0xeb, 0x29, 0x8e, 0x17, 0x7d, 0xe4, 0x9a, 0x72, 0xbf, 0x12, 0x23, 0x56, 0x05,
+	0x69, 0x07, 0xec, 0x41, 0x20, 0xc3, 0x73, 0x23, 0xf6, 0x68, 0xbd, 0xd8, 0x91, 0x94, 0x99, 0xe8,
+	0x16, 0x12, 0xdf, 0x55, 0x0c, 0xd7, 0x28, 0x7d, 0x06, 0x0d, 0xb5, 0x86, 0xdc, 0xa9, 0x29, 0x91,
+	0xdd, 0x9b, 0x74, 0x64, 0x10, 0x17, 0xa1, 0x75, 0x22, 0x33, 0x11, 0x47, 0x4a, 0x92, 0x6e, 0x81,
+	0x8d, 0xa3, 0x20, 0x94, 0x0e, 0xd9, 0x21, 0x7b, 0xcd, 0xd7, 0x16, 0xd7, 0x2e, 0x75, 0xa0, 0x91,
+	0x66, 0xd8, 0x13, 0x23, 0xa7, 0x66, 0x7e, 0x18, 0xbf, 0x22, 0x32, 0x8c, 0x70, 0xe4, 0xd4, 0x97,
+	0x84, 0x72, 0x3b, 0x77, 0x00, 0x54, 0x7b, 0xa7, 0x72, 0x9c, 0xa2, 0x3b, 0x21, 0x70, 0xf7, 0xf7,
+	0xee, 0xe9, 0x7b, 0x68, 0x84, 0xfd, 0xa0, 0xc8, 0xd1, 0xcc, 0x7e, 0xf8, 0x3f, 0xb3, 0x7b, 0x2f,
+	0x15, 0xfa, 0x2a, 0x96, 0xd9, 0x98, 0x1b, 0x9d, 0xf6, 0x19, 0xb4, 0x56, 0xc2, 0x74, 0x03, 0xea,
+	0x9f, 0x70, 0xac, 0x27, 0xe1, 0x95, 0x49, 0x5f, 0x80, 0x3d, 0x0c, 0xfa, 0x05, 0xaa, 0x21, 0x5a,
+	0x07, 0x0f, 0xd6, 0x57, 0x5c, 0xd9, 0x0b, 0xd7, 0xdc, 0xd3, 0xda, 0x21, 0x71, 0x9f, 0x80, 0xad,
+	0x56, 0x48, 0x37, 0xc1, 0x56, 0x4b, 0x34, 0x15, 0xb4, 0x43, 0xb7, 0xa0, 0x11, 0x9e, 0x07, 0x59,
+	0xa4, 0x8b, 0xd4, 0xb9, 0xf1, 0xdc, 0x2f, 0x35, 0xd8, 0xb8, 0x3a, 0xa2, 0x8e, 0x88, 0xcf, 0x44,
+	0x1c, 0xd1, 0x63, 0xb8, 0x6d, 0x2e, 0x6d, 0x79, 0x4e, 0x0f, 0xd7, 0xf7, 0xf4, 0xa6, 0xfa, 0x79,
+	0xa2, 0x11, 0x7e, 0xc5, 0xd2, 0x2e, 0xb4, 0x54, 0xf5, 0xd3, 0x3c, 0xc5, 0x70, 0x79, 0x07, 0x47,
+	0x37, 0xb8, 0x83, 0x95, 0x66, 0xae, 0x03, 0x1c, 0x7b, 0x98, 0x61, 0x1c, 0x22, 0x87, 0x8b, 0x65,
+	0x2c, 0x6f, 0x1f, 0x03, 0xfd, 0x33, 0x83, 0x52, 0xb8, 0x15, 0x07, 0x03, 0x34, 0x3b, 0x50, 0x36,
+	0xdd, 0x86, 0x66, 0xf5, 0xcd, 0xd3, 0x20, 0xd4, 0x5b, 0x68, 0xf2, 0xeb, 0x40, 0x27, 0x98, 0xcc,
+	0x99, 0x35, 0x9d, 0x33, 0x6b, 0x36, 0x67, 0xd6, 0xe5, 0x9c, 0x59, 0x9f, 0x4b, 0x46, 0xbe, 0x97,
+	0xcc, 0x9a, 0x94, 0x8c, 0x4c, 0x4b, 0x46, 0x66, 0x25, 0x23, 0x3f, 0x4a, 0x46, 0x7e, 0x96, 0xcc,
+	0xba, 0x2c, 0x19, 0xf9, 0xb6, 0x60, 0xd6, 0x74, 0xc1, 0xac, 0xd9, 0x82, 0x59, 0x1f, 0x77, 0xf5,
+	0x4c, 0x22, 0xf1, 0x83, 0x54, 0xf8, 0x7f, 0x7f, 0xbd, 0xdd, 0x86, 0x7a, 0xb6, 0x8f, 0x7f, 0x05,
+	0x00, 0x00, 0xff, 0xff, 0xb5, 0x3a, 0x59, 0xa6, 0x36, 0x04, 0x00, 0x00,
 }
 
 func (m *QuotaSpec) Marshal() (dAtA []byte, err error) {
@@ -637,10 +609,15 @@ func (m *AttributeMatch) MarshalTo(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	if len(m.Clause) > 0 {
+		keysForClause := make([]string, 0, len(m.Clause))
 		for k, _ := range m.Clause {
+			keysForClause = append(keysForClause, string(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Strings(keysForClause)
+		for _, k := range keysForClause {
 			dAtA[i] = 0xa
 			i++
-			v := m.Clause[k]
+			v := m.Clause[string(k)]
 			msgSize := 0
 			if v != nil {
 				msgSize = v.Size()
diff --git a/mixer/v1/config/client/quota.proto b/mixer/v1/config/client/quota.proto
index 3894fcd18d..5ea594c838 100644
--- a/mixer/v1/config/client/quota.proto
+++ b/mixer/v1/config/client/quota.proto
@@ -24,6 +24,7 @@ import "mixer/v1/config/client/service.proto";
 option (gogoproto.goproto_getters_all) = false;
 option (gogoproto.equal_all) = false;
 option (gogoproto.gostring_all) = false;
+option (gogoproto.stable_marshaler_all) = true;
 
 // Specifies runtime quota rules.
 //  * Uses Istio attributes to match individual requests
diff --git a/mixer/v1/config/client/service.pb.go b/mixer/v1/config/client/service.pb.go
index 11e541be68..34e237910f 100644
--- a/mixer/v1/config/client/service.pb.go
+++ b/mixer/v1/config/client/service.pb.go
@@ -53,16 +53,12 @@ func (m *IstioService) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
 func (m *IstioService) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_IstioService.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalTo(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
+	b = b[:cap(b)]
+	n, err := m.MarshalTo(b)
+	if err != nil {
+		return nil, err
 	}
+	return b[:n], nil
 }
 func (m *IstioService) XXX_Merge(src proto.Message) {
 	xxx_messageInfo_IstioService.Merge(m, src)
@@ -86,27 +82,27 @@ func init() {
 }
 
 var fileDescriptor_3358a28a51c817d5 = []byte{
-	// 315 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x51, 0x3f, 0x4b, 0x03, 0x31,
-	0x1c, 0x4d, 0xfa, 0x4f, 0x9a, 0x3a, 0x48, 0x28, 0x12, 0x4a, 0xf9, 0x51, 0xd4, 0xa1, 0x53, 0x42,
-	0x15, 0x44, 0x1d, 0x05, 0x07, 0x41, 0x1c, 0xea, 0x26, 0x38, 0xa4, 0x67, 0x2c, 0xc1, 0xeb, 0xa5,
-	0xdc, 0x9d, 0x87, 0xdd, 0xfc, 0x08, 0x7e, 0x0c, 0x3f, 0x4a, 0xc7, 0x8e, 0x1d, 0xbd, 0x74, 0x71,
-	0xec, 0x17, 0x10, 0xe4, 0x92, 0x2b, 0x76, 0x10, 0xa7, 0xbc, 0xf7, 0x7b, 0xef, 0xfd, 0x78, 0x49,
-	0xc8, 0xd1, 0x44, 0xbf, 0xaa, 0x58, 0x64, 0x03, 0x11, 0x98, 0xe8, 0x49, 0x8f, 0x45, 0x10, 0x6a,
-	0x15, 0xa5, 0x22, 0x51, 0x71, 0xa6, 0x03, 0xc5, 0xa7, 0xb1, 0x49, 0x0d, 0xed, 0xea, 0x24, 0xd5,
-	0x86, 0x3b, 0x2f, 0xcf, 0x06, 0xdc, 0x7b, 0xb9, 0xf7, 0x76, 0xda, 0x63, 0x33, 0x36, 0xce, 0x28,
-	0x0a, 0xe4, 0x33, 0x07, 0xdf, 0x98, 0xec, 0x5e, 0x17, 0xb1, 0x3b, 0xbf, 0x8a, 0x52, 0x52, 0x8b,
-	0xe4, 0x44, 0x31, 0xdc, 0xc3, 0xfd, 0xe6, 0xd0, 0x61, 0xda, 0x25, 0xcd, 0xe2, 0x4c, 0xa6, 0x32,
-	0x50, 0xac, 0xe2, 0x84, 0xdf, 0x01, 0xdd, 0x27, 0x8d, 0x47, 0x33, 0x91, 0x3a, 0x62, 0x55, 0x27,
-	0x95, 0x8c, 0x32, 0xb2, 0x53, 0xf6, 0x63, 0x35, 0x27, 0x6c, 0x28, 0xbd, 0x25, 0x8d, 0x50, 0x8e,
-	0x54, 0x98, 0xb0, 0x7a, 0xaf, 0xda, 0x6f, 0x1d, 0x9f, 0xf2, 0xff, 0x9a, 0xf3, 0xed, 0x7e, 0xfc,
-	0xc6, 0x05, 0xaf, 0xa2, 0x34, 0x9e, 0x0d, 0xcb, 0x2d, 0x9d, 0x73, 0xd2, 0xda, 0x1a, 0xd3, 0x3d,
-	0x52, 0x7d, 0x56, 0xb3, 0xf2, 0x06, 0x05, 0xa4, 0x6d, 0x52, 0xcf, 0x64, 0xf8, 0xb2, 0x29, 0xef,
-	0xc9, 0x45, 0xe5, 0x0c, 0x5f, 0x3e, 0xcc, 0x73, 0x40, 0x8b, 0x1c, 0xd0, 0x32, 0x07, 0xb4, 0xce,
-	0x01, 0xbd, 0x59, 0xc0, 0x1f, 0x16, 0xd0, 0xdc, 0x02, 0x5e, 0x58, 0xc0, 0x9f, 0x16, 0xf0, 0x97,
-	0x05, 0xb4, 0xb6, 0x80, 0xdf, 0x57, 0x80, 0x16, 0x2b, 0x40, 0xcb, 0x15, 0xa0, 0xfb, 0x43, 0xdf,
-	0x59, 0x1b, 0x21, 0xa7, 0x5a, 0xfc, 0xfd, 0x41, 0xa3, 0x86, 0x7b, 0xe5, 0x93, 0x9f, 0x00, 0x00,
-	0x00, 0xff, 0xff, 0xc4, 0x69, 0x6e, 0x30, 0xc1, 0x01, 0x00, 0x00,
+	// 318 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x51, 0x3f, 0x4b, 0x3b, 0x31,
+	0x18, 0x4e, 0xfa, 0xef, 0x47, 0xd3, 0xdf, 0x20, 0xa1, 0x48, 0x28, 0xe5, 0xa5, 0xa8, 0x43, 0xa7,
+	0x84, 0x2a, 0x88, 0x3a, 0x0a, 0x0e, 0x82, 0x38, 0xd4, 0xcd, 0x2d, 0x3d, 0x63, 0x09, 0x5e, 0x2f,
+	0xe5, 0xee, 0x3c, 0xec, 0xe6, 0x47, 0xf0, 0x63, 0xf8, 0x51, 0x3a, 0x76, 0xec, 0xe8, 0xe5, 0x16,
+	0xc7, 0x7e, 0x01, 0x41, 0x2e, 0xb9, 0x62, 0x07, 0x71, 0xca, 0xf3, 0xbc, 0xcf, 0xf3, 0xbc, 0x3c,
+	0x49, 0xc8, 0xd1, 0x4c, 0xbf, 0xa8, 0x58, 0x64, 0x23, 0x11, 0x98, 0xe8, 0x51, 0x4f, 0x45, 0x10,
+	0x6a, 0x15, 0xa5, 0x22, 0x51, 0x71, 0xa6, 0x03, 0xc5, 0xe7, 0xb1, 0x49, 0x0d, 0xed, 0xeb, 0x24,
+	0xd5, 0x86, 0x3b, 0x2f, 0xcf, 0x46, 0xdc, 0x7b, 0xb9, 0xf7, 0xf6, 0xba, 0x53, 0x33, 0x35, 0xce,
+	0x28, 0x4a, 0xe4, 0x33, 0x07, 0x5f, 0x98, 0xfc, 0xbf, 0x2e, 0x63, 0x77, 0x7e, 0x15, 0xa5, 0xa4,
+	0x11, 0xc9, 0x99, 0x62, 0x78, 0x80, 0x87, 0xed, 0xb1, 0xc3, 0xb4, 0x4f, 0xda, 0xe5, 0x99, 0xcc,
+	0x65, 0xa0, 0x58, 0xcd, 0x09, 0x3f, 0x03, 0xba, 0x4f, 0x5a, 0x0f, 0x66, 0x26, 0x75, 0xc4, 0xea,
+	0x4e, 0xaa, 0x18, 0x65, 0xe4, 0x5f, 0xd5, 0x8f, 0x35, 0x9c, 0xb0, 0xa5, 0xf4, 0x96, 0xb4, 0x42,
+	0x39, 0x51, 0x61, 0xc2, 0x9a, 0x83, 0xfa, 0xb0, 0x73, 0x7c, 0xca, 0xff, 0x6a, 0xce, 0x77, 0xfb,
+	0xf1, 0x1b, 0x17, 0xbc, 0x8a, 0xd2, 0x78, 0x31, 0xae, 0xb6, 0xf4, 0xce, 0x49, 0x67, 0x67, 0x4c,
+	0xf7, 0x48, 0xfd, 0x49, 0x2d, 0xaa, 0x1b, 0x94, 0x90, 0x76, 0x49, 0x33, 0x93, 0xe1, 0xf3, 0xb6,
+	0xbc, 0x27, 0x17, 0xb5, 0x33, 0x7c, 0x29, 0x97, 0x39, 0xa0, 0x55, 0x0e, 0x68, 0x9d, 0x03, 0xda,
+	0xe4, 0x80, 0x5e, 0x2d, 0xe0, 0x77, 0x0b, 0x68, 0x69, 0x01, 0xaf, 0x2c, 0xe0, 0xb5, 0x05, 0xfc,
+	0x61, 0x01, 0x7f, 0x5a, 0x40, 0x1b, 0x0b, 0xf8, 0xad, 0x00, 0xb4, 0x2a, 0x00, 0xad, 0x0b, 0x40,
+	0xf7, 0x87, 0xbe, 0xb7, 0x36, 0x42, 0xce, 0xb5, 0xf8, 0xfd, 0x93, 0x26, 0x2d, 0xf7, 0xd2, 0x27,
+	0xdf, 0x01, 0x00, 0x00, 0xff, 0xff, 0xab, 0x14, 0xde, 0x44, 0xc5, 0x01, 0x00, 0x00,
 }
 
 func (m *IstioService) Marshal() (dAtA []byte, err error) {
@@ -149,10 +145,15 @@ func (m *IstioService) MarshalTo(dAtA []byte) (int, error) {
 		i += copy(dAtA[i:], m.Service)
 	}
 	if len(m.Labels) > 0 {
+		keysForLabels := make([]string, 0, len(m.Labels))
 		for k, _ := range m.Labels {
+			keysForLabels = append(keysForLabels, string(k))
+		}
+		github_com_gogo_protobuf_sortkeys.Strings(keysForLabels)
+		for _, k := range keysForLabels {
 			dAtA[i] = 0x2a
 			i++
-			v := m.Labels[k]
+			v := m.Labels[string(k)]
 			mapSize := 1 + len(k) + sovService(uint64(len(k))) + 1 + len(v) + sovService(uint64(len(v)))
 			i = encodeVarintService(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0xa
diff --git a/mixer/v1/config/client/service.proto b/mixer/v1/config/client/service.proto
index 958a4cb2c9..d00937a84a 100644
--- a/mixer/v1/config/client/service.proto
+++ b/mixer/v1/config/client/service.proto
@@ -23,6 +23,7 @@ import "gogoproto/gogo.proto";
 option (gogoproto.goproto_getters_all) = false;
 option (gogoproto.equal_all) = false;
 option (gogoproto.gostring_all) = false;
+option (gogoproto.stable_marshaler_all) = true;
 
 // NOTE: this is a duplicate of proxy.v1.config.IstioService from
 // proxy/v1alpha1/config/route_rules.proto.
diff --git a/python/istio_api/mixer/v1/attributes_pb2.py b/python/istio_api/mixer/v1/attributes_pb2.py
index 9d37998e42..5f94c4c883 100644
--- a/python/istio_api/mixer/v1/attributes_pb2.py
+++ b/python/istio_api/mixer/v1/attributes_pb2.py
@@ -22,7 +22,7 @@
   name='mixer/v1/attributes.proto',
   package='istio.mixer.v1',
   syntax='proto3',
-  serialized_pb=_b('\n\x19mixer/v1/attributes.proto\x12\x0eistio.mixer.v1\x1a\x14gogoproto/gogo.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xe9\x04\n\nAttributes\x12>\n\nattributes\x18\x01 \x03(\x0b\x32*.istio.mixer.v1.Attributes.AttributesEntry\x1a\\\n\x0f\x41ttributesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x38\n\x05value\x18\x02 \x01(\x0b\x32).istio.mixer.v1.Attributes.AttributeValue:\x02\x38\x01\x1a\xbb\x02\n\x0e\x41ttributeValue\x12\x16\n\x0cstring_value\x18\x02 \x01(\tH\x00\x12\x15\n\x0bint64_value\x18\x03 \x01(\x03H\x00\x12\x16\n\x0c\x64ouble_value\x18\x04 \x01(\x01H\x00\x12\x14\n\nbool_value\x18\x05 \x01(\x08H\x00\x12\x15\n\x0b\x62ytes_value\x18\x06 \x01(\x0cH\x00\x12\x35\n\x0ftimestamp_value\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x00\x12\x33\n\x0e\x64uration_value\x18\x08 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12@\n\x10string_map_value\x18\t \x01(\x0b\x32$.istio.mixer.v1.Attributes.StringMapH\x00\x42\x07\n\x05value\x1a\x7f\n\tStringMap\x12\x42\n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x31.istio.mixer.v1.Attributes.StringMap.EntriesEntry\x1a.\n\x0c\x45ntriesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbb\x08\n\x14\x43ompressedAttributes\x12\r\n\x05words\x18\x01 \x03(\t\x12\x42\n\x07strings\x18\x02 \x03(\x0b\x32\x31.istio.mixer.v1.CompressedAttributes.StringsEntry\x12@\n\x06int64s\x18\x03 \x03(\x0b\x32\x30.istio.mixer.v1.CompressedAttributes.Int64sEntry\x12\x42\n\x07\x64oubles\x18\x04 \x03(\x0b\x32\x31.istio.mixer.v1.CompressedAttributes.DoublesEntry\x12>\n\x05\x62ools\x18\x05 \x03(\x0b\x32/.istio.mixer.v1.CompressedAttributes.BoolsEntry\x12R\n\ntimestamps\x18\x06 \x03(\x0b\x32\x34.istio.mixer.v1.CompressedAttributes.TimestampsEntryB\x08\xc8\xde\x1f\x00\x90\xdf\x1f\x01\x12P\n\tdurations\x18\x07 \x03(\x0b\x32\x33.istio.mixer.v1.CompressedAttributes.DurationsEntryB\x08\xc8\xde\x1f\x00\x98\xdf\x1f\x01\x12>\n\x05\x62ytes\x18\x08 \x03(\x0b\x32/.istio.mixer.v1.CompressedAttributes.BytesEntry\x12O\n\x0bstring_maps\x18\t \x03(\x0b\x32\x34.istio.mixer.v1.CompressedAttributes.StringMapsEntryB\x04\xc8\xde\x1f\x00\x1a.\n\x0cStringsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x11:\x02\x38\x01\x1a-\n\x0bInt64sEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x03:\x02\x38\x01\x1a.\n\x0c\x44oublesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x01:\x02\x38\x01\x1a,\n\nBoolsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x08:\x02\x38\x01\x1aM\n\x0fTimestampsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp:\x02\x38\x01\x1aK\n\x0e\x44urationsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12(\n\x05value\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration:\x02\x38\x01\x1a,\n\nBytesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\x1aL\n\x0fStringMapsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12(\n\x05value\x18\x02 \x01(\x0b\x32\x19.istio.mixer.v1.StringMap:\x02\x38\x01\"t\n\tStringMap\x12\x37\n\x07\x65ntries\x18\x01 \x03(\x0b\x32&.istio.mixer.v1.StringMap.EntriesEntry\x1a.\n\x0c\x45ntriesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x11:\x02\x38\x01\x42&Z\x15istio.io/api/mixer/v1\xf8\x01\x01\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\x62\x06proto3')
+  serialized_pb=_b('\n\x19mixer/v1/attributes.proto\x12\x0eistio.mixer.v1\x1a\x14gogoproto/gogo.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xe9\x04\n\nAttributes\x12>\n\nattributes\x18\x01 \x03(\x0b\x32*.istio.mixer.v1.Attributes.AttributesEntry\x1a\\\n\x0f\x41ttributesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x38\n\x05value\x18\x02 \x01(\x0b\x32).istio.mixer.v1.Attributes.AttributeValue:\x02\x38\x01\x1a\xbb\x02\n\x0e\x41ttributeValue\x12\x16\n\x0cstring_value\x18\x02 \x01(\tH\x00\x12\x15\n\x0bint64_value\x18\x03 \x01(\x03H\x00\x12\x16\n\x0c\x64ouble_value\x18\x04 \x01(\x01H\x00\x12\x14\n\nbool_value\x18\x05 \x01(\x08H\x00\x12\x15\n\x0b\x62ytes_value\x18\x06 \x01(\x0cH\x00\x12\x35\n\x0ftimestamp_value\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x00\x12\x33\n\x0e\x64uration_value\x18\x08 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12@\n\x10string_map_value\x18\t \x01(\x0b\x32$.istio.mixer.v1.Attributes.StringMapH\x00\x42\x07\n\x05value\x1a\x7f\n\tStringMap\x12\x42\n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x31.istio.mixer.v1.Attributes.StringMap.EntriesEntry\x1a.\n\x0c\x45ntriesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbb\x08\n\x14\x43ompressedAttributes\x12\r\n\x05words\x18\x01 \x03(\t\x12\x42\n\x07strings\x18\x02 \x03(\x0b\x32\x31.istio.mixer.v1.CompressedAttributes.StringsEntry\x12@\n\x06int64s\x18\x03 \x03(\x0b\x32\x30.istio.mixer.v1.CompressedAttributes.Int64sEntry\x12\x42\n\x07\x64oubles\x18\x04 \x03(\x0b\x32\x31.istio.mixer.v1.CompressedAttributes.DoublesEntry\x12>\n\x05\x62ools\x18\x05 \x03(\x0b\x32/.istio.mixer.v1.CompressedAttributes.BoolsEntry\x12R\n\ntimestamps\x18\x06 \x03(\x0b\x32\x34.istio.mixer.v1.CompressedAttributes.TimestampsEntryB\x08\xc8\xde\x1f\x00\x90\xdf\x1f\x01\x12P\n\tdurations\x18\x07 \x03(\x0b\x32\x33.istio.mixer.v1.CompressedAttributes.DurationsEntryB\x08\xc8\xde\x1f\x00\x98\xdf\x1f\x01\x12>\n\x05\x62ytes\x18\x08 \x03(\x0b\x32/.istio.mixer.v1.CompressedAttributes.BytesEntry\x12O\n\x0bstring_maps\x18\t \x03(\x0b\x32\x34.istio.mixer.v1.CompressedAttributes.StringMapsEntryB\x04\xc8\xde\x1f\x00\x1a.\n\x0cStringsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x11:\x02\x38\x01\x1a-\n\x0bInt64sEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x03:\x02\x38\x01\x1a.\n\x0c\x44oublesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x01:\x02\x38\x01\x1a,\n\nBoolsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x08:\x02\x38\x01\x1aM\n\x0fTimestampsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp:\x02\x38\x01\x1aK\n\x0e\x44urationsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12(\n\x05value\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration:\x02\x38\x01\x1a,\n\nBytesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\x1aL\n\x0fStringMapsEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12(\n\x05value\x18\x02 \x01(\x0b\x32\x19.istio.mixer.v1.StringMap:\x02\x38\x01\"t\n\tStringMap\x12\x37\n\x07\x65ntries\x18\x01 \x03(\x0b\x32&.istio.mixer.v1.StringMap.EntriesEntry\x1a.\n\x0c\x45ntriesEntry\x12\x0b\n\x03key\x18\x01 \x01(\x11\x12\r\n\x05value\x18\x02 \x01(\x11:\x02\x38\x01\x42*Z\x15istio.io/api/mixer/v1\xf8\x01\x01\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\xd8\xe2\x1e\x01\x62\x06proto3')
   ,
   dependencies=[gogoproto_dot_gogo__pb2.DESCRIPTOR,google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_timestamp__pb2.DESCRIPTOR,])
 
@@ -883,7 +883,7 @@
 
 
 DESCRIPTOR.has_options = True
-DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z\025istio.io/api/mixer/v1\370\001\001\310\341\036\000\250\342\036\000\360\341\036\000'))
+DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z\025istio.io/api/mixer/v1\370\001\001\310\341\036\000\250\342\036\000\360\341\036\000\330\342\036\001'))
 _ATTRIBUTES_ATTRIBUTESENTRY.has_options = True
 _ATTRIBUTES_ATTRIBUTESENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 _ATTRIBUTES_STRINGMAP_ENTRIESENTRY.has_options = True
diff --git a/python/istio_api/mixer/v1/config/client/api_spec_pb2.py b/python/istio_api/mixer/v1/config/client/api_spec_pb2.py
index f71baa78a7..09acbb2404 100644
--- a/python/istio_api/mixer/v1/config/client/api_spec_pb2.py
+++ b/python/istio_api/mixer/v1/config/client/api_spec_pb2.py
@@ -22,7 +22,7 @@
   name='mixer/v1/config/client/api_spec.proto',
   package='istio.mixer.v1.config.client',
   syntax='proto3',
-  serialized_pb=_b('\n%mixer/v1/config/client/api_spec.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\x1a\x19mixer/v1/attributes.proto\x1a$mixer/v1/config/client/service.proto\"\xb9\x01\n\x0bHTTPAPISpec\x12.\n\nattributes\x18\x01 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x42\n\x08patterns\x18\x02 \x03(\x0b\x32\x30.istio.mixer.v1.config.client.HTTPAPISpecPattern\x12\x36\n\x08\x61pi_keys\x18\x03 \x03(\x0b\x32$.istio.mixer.v1.config.client.APIKey\"\x8d\x01\n\x12HTTPAPISpecPattern\x12.\n\nattributes\x18\x01 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x13\n\x0bhttp_method\x18\x02 \x01(\t\x12\x16\n\x0curi_template\x18\x03 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x04 \x01(\tH\x00\x42\t\n\x07pattern\"D\n\x06\x41PIKey\x12\x0f\n\x05query\x18\x01 \x01(\tH\x00\x12\x10\n\x06header\x18\x02 \x01(\tH\x00\x12\x10\n\x06\x63ookie\x18\x03 \x01(\tH\x00\x42\x05\n\x03key\"7\n\x14HTTPAPISpecReference\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tnamespace\x18\x02 \x01(\t\"\x99\x01\n\x12HTTPAPISpecBinding\x12<\n\x08services\x18\x01 \x03(\x0b\x32*.istio.mixer.v1.config.client.IstioService\x12\x45\n\tapi_specs\x18\x02 \x03(\x0b\x32\x32.istio.mixer.v1.config.client.HTTPAPISpecReferenceB1Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\x62\x06proto3')
+  serialized_pb=_b('\n%mixer/v1/config/client/api_spec.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\x1a\x19mixer/v1/attributes.proto\x1a$mixer/v1/config/client/service.proto\"\xb9\x01\n\x0bHTTPAPISpec\x12.\n\nattributes\x18\x01 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x42\n\x08patterns\x18\x02 \x03(\x0b\x32\x30.istio.mixer.v1.config.client.HTTPAPISpecPattern\x12\x36\n\x08\x61pi_keys\x18\x03 \x03(\x0b\x32$.istio.mixer.v1.config.client.APIKey\"\x8d\x01\n\x12HTTPAPISpecPattern\x12.\n\nattributes\x18\x01 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x13\n\x0bhttp_method\x18\x02 \x01(\t\x12\x16\n\x0curi_template\x18\x03 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x04 \x01(\tH\x00\x42\t\n\x07pattern\"D\n\x06\x41PIKey\x12\x0f\n\x05query\x18\x01 \x01(\tH\x00\x12\x10\n\x06header\x18\x02 \x01(\tH\x00\x12\x10\n\x06\x63ookie\x18\x03 \x01(\tH\x00\x42\x05\n\x03key\"7\n\x14HTTPAPISpecReference\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tnamespace\x18\x02 \x01(\t\"\x99\x01\n\x12HTTPAPISpecBinding\x12<\n\x08services\x18\x01 \x03(\x0b\x32*.istio.mixer.v1.config.client.IstioService\x12\x45\n\tapi_specs\x18\x02 \x03(\x0b\x32\x32.istio.mixer.v1.config.client.HTTPAPISpecReferenceB5Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\xd8\xe2\x1e\x01\x62\x06proto3')
   ,
   dependencies=[gogoproto_dot_gogo__pb2.DESCRIPTOR,mixer_dot_v1_dot_attributes__pb2.DESCRIPTOR,mixer_dot_v1_dot_config_dot_client_dot_service__pb2.DESCRIPTOR,])
 
@@ -317,5 +317,5 @@
 
 
 DESCRIPTOR.has_options = True
-DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000'))
+DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000\330\342\036\001'))
 # @@protoc_insertion_point(module_scope)
diff --git a/python/istio_api/mixer/v1/config/client/client_config_pb2.py b/python/istio_api/mixer/v1/config/client/client_config_pb2.py
index d384b645e1..f9646b5cb9 100644
--- a/python/istio_api/mixer/v1/config/client/client_config_pb2.py
+++ b/python/istio_api/mixer/v1/config/client/client_config_pb2.py
@@ -24,7 +24,7 @@
   name='mixer/v1/config/client/client_config.proto',
   package='istio.mixer.v1.config.client',
   syntax='proto3',
-  serialized_pb=_b('\n*mixer/v1/config/client/client_config.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mixer/v1/attributes.proto\x1a%mixer/v1/config/client/api_spec.proto\x1a\"mixer/v1/config/client/quota.proto\"\x86\x02\n\x11NetworkFailPolicy\x12J\n\x06policy\x18\x01 \x01(\x0e\x32:.istio.mixer.v1.config.client.NetworkFailPolicy.FailPolicy\x12\x11\n\tmax_retry\x18\x02 \x01(\r\x12\x32\n\x0f\x62\x61se_retry_wait\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x31\n\x0emax_retry_wait\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"+\n\nFailPolicy\x12\r\n\tFAIL_OPEN\x10\x00\x12\x0e\n\nFAIL_CLOSE\x10\x01\"\x85\x03\n\rServiceConfig\x12\x1b\n\x13\x64isable_check_calls\x18\x01 \x01(\x08\x12\x1c\n\x14\x64isable_report_calls\x18\x02 \x01(\x08\x12\x34\n\x10mixer_attributes\x18\x03 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12@\n\rhttp_api_spec\x18\x04 \x03(\x0b\x32).istio.mixer.v1.config.client.HTTPAPISpec\x12;\n\nquota_spec\x18\x05 \x03(\x0b\x32\'.istio.mixer.v1.config.client.QuotaSpec\x12L\n\x13network_fail_policy\x18\x07 \x01(\x0b\x32/.istio.mixer.v1.config.client.NetworkFailPolicy\x12\x36\n\x12\x66orward_attributes\x18\x08 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\"\xe0\x02\n\x0fTransportConfig\x12\x1b\n\x13\x64isable_check_cache\x18\x01 \x01(\x08\x12\x1b\n\x13\x64isable_quota_cache\x18\x02 \x01(\x08\x12\x1c\n\x14\x64isable_report_batch\x18\x03 \x01(\x08\x12L\n\x13network_fail_policy\x18\x04 \x01(\x0b\x32/.istio.mixer.v1.config.client.NetworkFailPolicy\x12\x38\n\x15stats_update_interval\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\rcheck_cluster\x18\x06 \x01(\t\x12\x16\n\x0ereport_cluster\x18\x07 \x01(\t\x12>\n\x1a\x61ttributes_for_mixer_proxy\x18\x08 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\"\xa8\x03\n\x10HttpClientConfig\x12@\n\ttransport\x18\x01 \x01(\x0b\x32-.istio.mixer.v1.config.client.TransportConfig\x12[\n\x0fservice_configs\x18\x02 \x03(\x0b\x32\x42.istio.mixer.v1.config.client.HttpClientConfig.ServiceConfigsEntry\x12#\n\x1b\x64\x65\x66\x61ult_destination_service\x18\x03 \x01(\t\x12\x34\n\x10mixer_attributes\x18\x04 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x36\n\x12\x66orward_attributes\x18\x05 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x1a\x62\n\x13ServiceConfigsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12:\n\x05value\x18\x02 \x01(\x0b\x32+.istio.mixer.v1.config.client.ServiceConfig:\x02\x38\x01\"\xc0\x02\n\x0fTcpClientConfig\x12@\n\ttransport\x18\x01 \x01(\x0b\x32-.istio.mixer.v1.config.client.TransportConfig\x12\x34\n\x10mixer_attributes\x18\x02 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x1b\n\x13\x64isable_check_calls\x18\x03 \x01(\x08\x12\x1c\n\x14\x64isable_report_calls\x18\x04 \x01(\x08\x12\x46\n\x15\x63onnection_quota_spec\x18\x05 \x01(\x0b\x32\'.istio.mixer.v1.config.client.QuotaSpec\x12\x32\n\x0freport_interval\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationB1Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\x62\x06proto3')
+  serialized_pb=_b('\n*mixer/v1/config/client/client_config.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mixer/v1/attributes.proto\x1a%mixer/v1/config/client/api_spec.proto\x1a\"mixer/v1/config/client/quota.proto\"\x86\x02\n\x11NetworkFailPolicy\x12J\n\x06policy\x18\x01 \x01(\x0e\x32:.istio.mixer.v1.config.client.NetworkFailPolicy.FailPolicy\x12\x11\n\tmax_retry\x18\x02 \x01(\r\x12\x32\n\x0f\x62\x61se_retry_wait\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x31\n\x0emax_retry_wait\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"+\n\nFailPolicy\x12\r\n\tFAIL_OPEN\x10\x00\x12\x0e\n\nFAIL_CLOSE\x10\x01\"\x85\x03\n\rServiceConfig\x12\x1b\n\x13\x64isable_check_calls\x18\x01 \x01(\x08\x12\x1c\n\x14\x64isable_report_calls\x18\x02 \x01(\x08\x12\x34\n\x10mixer_attributes\x18\x03 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12@\n\rhttp_api_spec\x18\x04 \x03(\x0b\x32).istio.mixer.v1.config.client.HTTPAPISpec\x12;\n\nquota_spec\x18\x05 \x03(\x0b\x32\'.istio.mixer.v1.config.client.QuotaSpec\x12L\n\x13network_fail_policy\x18\x07 \x01(\x0b\x32/.istio.mixer.v1.config.client.NetworkFailPolicy\x12\x36\n\x12\x66orward_attributes\x18\x08 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\"\xe0\x02\n\x0fTransportConfig\x12\x1b\n\x13\x64isable_check_cache\x18\x01 \x01(\x08\x12\x1b\n\x13\x64isable_quota_cache\x18\x02 \x01(\x08\x12\x1c\n\x14\x64isable_report_batch\x18\x03 \x01(\x08\x12L\n\x13network_fail_policy\x18\x04 \x01(\x0b\x32/.istio.mixer.v1.config.client.NetworkFailPolicy\x12\x38\n\x15stats_update_interval\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\rcheck_cluster\x18\x06 \x01(\t\x12\x16\n\x0ereport_cluster\x18\x07 \x01(\t\x12>\n\x1a\x61ttributes_for_mixer_proxy\x18\x08 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\"\xa8\x03\n\x10HttpClientConfig\x12@\n\ttransport\x18\x01 \x01(\x0b\x32-.istio.mixer.v1.config.client.TransportConfig\x12[\n\x0fservice_configs\x18\x02 \x03(\x0b\x32\x42.istio.mixer.v1.config.client.HttpClientConfig.ServiceConfigsEntry\x12#\n\x1b\x64\x65\x66\x61ult_destination_service\x18\x03 \x01(\t\x12\x34\n\x10mixer_attributes\x18\x04 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x36\n\x12\x66orward_attributes\x18\x05 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x1a\x62\n\x13ServiceConfigsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12:\n\x05value\x18\x02 \x01(\x0b\x32+.istio.mixer.v1.config.client.ServiceConfig:\x02\x38\x01\"\xc0\x02\n\x0fTcpClientConfig\x12@\n\ttransport\x18\x01 \x01(\x0b\x32-.istio.mixer.v1.config.client.TransportConfig\x12\x34\n\x10mixer_attributes\x18\x02 \x01(\x0b\x32\x1a.istio.mixer.v1.Attributes\x12\x1b\n\x13\x64isable_check_calls\x18\x03 \x01(\x08\x12\x1c\n\x14\x64isable_report_calls\x18\x04 \x01(\x08\x12\x46\n\x15\x63onnection_quota_spec\x18\x05 \x01(\x0b\x32\'.istio.mixer.v1.config.client.QuotaSpec\x12\x32\n\x0freport_interval\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationB5Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\xd8\xe2\x1e\x01\x62\x06proto3')
   ,
   dependencies=[gogoproto_dot_gogo__pb2.DESCRIPTOR,google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mixer_dot_v1_dot_attributes__pb2.DESCRIPTOR,mixer_dot_v1_dot_config_dot_client_dot_api__spec__pb2.DESCRIPTOR,mixer_dot_v1_dot_config_dot_client_dot_quota__pb2.DESCRIPTOR,])
 
@@ -494,7 +494,7 @@
 
 
 DESCRIPTOR.has_options = True
-DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000'))
+DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000\330\342\036\001'))
 _HTTPCLIENTCONFIG_SERVICECONFIGSENTRY.has_options = True
 _HTTPCLIENTCONFIG_SERVICECONFIGSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 # @@protoc_insertion_point(module_scope)
diff --git a/python/istio_api/mixer/v1/config/client/quota_pb2.py b/python/istio_api/mixer/v1/config/client/quota_pb2.py
index 074868bb1a..d3e74703c3 100644
--- a/python/istio_api/mixer/v1/config/client/quota_pb2.py
+++ b/python/istio_api/mixer/v1/config/client/quota_pb2.py
@@ -21,7 +21,7 @@
   name='mixer/v1/config/client/quota.proto',
   package='istio.mixer.v1.config.client',
   syntax='proto3',
-  serialized_pb=_b('\n\"mixer/v1/config/client/quota.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\x1a$mixer/v1/config/client/service.proto\"C\n\tQuotaSpec\x12\x36\n\x05rules\x18\x01 \x03(\x0b\x32\'.istio.mixer.v1.config.client.QuotaRule\"}\n\tQuotaRule\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.mixer.v1.config.client.AttributeMatch\x12\x33\n\x06quotas\x18\x02 \x03(\x0b\x32#.istio.mixer.v1.config.client.Quota\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"\xb4\x01\n\x0e\x41ttributeMatch\x12H\n\x06\x63lause\x18\x01 \x03(\x0b\x32\x38.istio.mixer.v1.config.client.AttributeMatch.ClauseEntry\x1aX\n\x0b\x43lauseEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x38\n\x05value\x18\x02 \x01(\x0b\x32).istio.mixer.v1.config.client.StringMatch:\x02\x38\x01\"&\n\x05Quota\x12\r\n\x05quota\x18\x01 \x01(\t\x12\x0e\n\x06\x63harge\x18\x02 \x01(\x03\"\xdf\x01\n\x10QuotaSpecBinding\x12<\n\x08services\x18\x01 \x03(\x0b\x32*.istio.mixer.v1.config.client.IstioService\x12V\n\x0bquota_specs\x18\x02 \x03(\x0b\x32\x41.istio.mixer.v1.config.client.QuotaSpecBinding.QuotaSpecReference\x1a\x35\n\x12QuotaSpecReference\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tnamespace\x18\x02 \x01(\tB1Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\x62\x06proto3')
+  serialized_pb=_b('\n\"mixer/v1/config/client/quota.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\x1a$mixer/v1/config/client/service.proto\"C\n\tQuotaSpec\x12\x36\n\x05rules\x18\x01 \x03(\x0b\x32\'.istio.mixer.v1.config.client.QuotaRule\"}\n\tQuotaRule\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.mixer.v1.config.client.AttributeMatch\x12\x33\n\x06quotas\x18\x02 \x03(\x0b\x32#.istio.mixer.v1.config.client.Quota\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"\xb4\x01\n\x0e\x41ttributeMatch\x12H\n\x06\x63lause\x18\x01 \x03(\x0b\x32\x38.istio.mixer.v1.config.client.AttributeMatch.ClauseEntry\x1aX\n\x0b\x43lauseEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x38\n\x05value\x18\x02 \x01(\x0b\x32).istio.mixer.v1.config.client.StringMatch:\x02\x38\x01\"&\n\x05Quota\x12\r\n\x05quota\x18\x01 \x01(\t\x12\x0e\n\x06\x63harge\x18\x02 \x01(\x03\"\xdf\x01\n\x10QuotaSpecBinding\x12<\n\x08services\x18\x01 \x03(\x0b\x32*.istio.mixer.v1.config.client.IstioService\x12V\n\x0bquota_specs\x18\x02 \x03(\x0b\x32\x41.istio.mixer.v1.config.client.QuotaSpecBinding.QuotaSpecReference\x1a\x35\n\x12QuotaSpecReference\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tnamespace\x18\x02 \x01(\tB5Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\xd8\xe2\x1e\x01\x62\x06proto3')
   ,
   dependencies=[gogoproto_dot_gogo__pb2.DESCRIPTOR,mixer_dot_v1_dot_config_dot_client_dot_service__pb2.DESCRIPTOR,])
 
@@ -411,7 +411,7 @@
 
 
 DESCRIPTOR.has_options = True
-DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000'))
+DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000\330\342\036\001'))
 _ATTRIBUTEMATCH_CLAUSEENTRY.has_options = True
 _ATTRIBUTEMATCH_CLAUSEENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 # @@protoc_insertion_point(module_scope)
diff --git a/python/istio_api/mixer/v1/config/client/service_pb2.py b/python/istio_api/mixer/v1/config/client/service_pb2.py
index 59fd4f4216..f1e5dfed54 100644
--- a/python/istio_api/mixer/v1/config/client/service_pb2.py
+++ b/python/istio_api/mixer/v1/config/client/service_pb2.py
@@ -20,7 +20,7 @@
   name='mixer/v1/config/client/service.proto',
   package='istio.mixer.v1.config.client',
   syntax='proto3',
-  serialized_pb=_b('\n$mixer/v1/config/client/service.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\"\xc7\x01\n\x0cIstioService\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tnamespace\x18\x02 \x01(\t\x12\x0e\n\x06\x64omain\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\x12\x46\n\x06labels\x18\x05 \x03(\x0b\x32\x36.istio.mixer.v1.config.client.IstioService.LabelsEntry\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x31Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\x62\x06proto3')
+  serialized_pb=_b('\n$mixer/v1/config/client/service.proto\x12\x1cistio.mixer.v1.config.client\x1a\x14gogoproto/gogo.proto\"\xc7\x01\n\x0cIstioService\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tnamespace\x18\x02 \x01(\t\x12\x0e\n\x06\x64omain\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\x12\x46\n\x06labels\x18\x05 \x03(\x0b\x32\x36.istio.mixer.v1.config.client.IstioService.LabelsEntry\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x42\x35Z#istio.io/api/mixer/v1/config/client\xc8\xe1\x1e\x00\xa8\xe2\x1e\x00\xf0\xe1\x1e\x00\xd8\xe2\x1e\x01\x62\x06proto3')
   ,
   dependencies=[gogoproto_dot_gogo__pb2.DESCRIPTOR,])
 
@@ -144,7 +144,7 @@
 
 
 DESCRIPTOR.has_options = True
-DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000'))
+DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z#istio.io/api/mixer/v1/config/client\310\341\036\000\250\342\036\000\360\341\036\000\330\342\036\001'))
 _ISTIOSERVICE_LABELSENTRY.has_options = True
 _ISTIOSERVICE_LABELSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 # @@protoc_insertion_point(module_scope)

From 7e7d6afc2632344224bf8a164d2b3aad4b9adbd8 Mon Sep 17 00:00:00 2001
From: Martin Taillefer <geeknoid@users.noreply.github.com>
Date: Tue, 12 Mar 2019 05:37:41 -0700
Subject: [PATCH 04/10] Fix some doc errors. (#854)

This started out to just fix a bad link to unblock work on
istio.io, but I ended up fixing a bunch of typos/incorrect format
throughout.
---
 .../istio.authentication.v1alpha1.pb.html     |  2 +-
 authentication/v1alpha1/policy.pb.go          |  2 +-
 authentication/v1alpha1/policy.proto          |  2 +-
 dictionaries/custom.txt                       |  4 ++++
 .../http/jwt_auth/v2alpha1/config.pb.go       | 12 +++++------
 .../http/jwt_auth/v2alpha1/config.proto       | 12 +++++------
 mesh/v1alpha1/config.pb.go                    | 12 +++++------
 mesh/v1alpha1/config.proto                    | 12 +++++------
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html     | 12 +++++------
 mesh/v1alpha1/network.pb.go                   |  2 +-
 mesh/v1alpha1/network.proto                   |  4 ++--
 mesh/v1alpha1/proxy.pb.go                     |  2 +-
 mesh/v1alpha1/proxy.proto                     |  4 ++--
 mixer/v1/config/client/service.proto          |  2 +-
 networking/v1alpha3/gateway.pb.go             | 18 ++++++++--------
 networking/v1alpha3/gateway.pb.html           | 16 +++++++-------
 networking/v1alpha3/gateway.proto             | 18 ++++++++--------
 networking/v1alpha3/service_entry.pb.go       | 21 +++++++++----------
 networking/v1alpha3/service_entry.pb.html     | 21 +++++++++----------
 networking/v1alpha3/service_entry.proto       | 21 +++++++++----------
 networking/v1alpha3/sidecar.pb.go             |  8 +++----
 networking/v1alpha3/sidecar.pb.html           |  8 +++----
 networking/v1alpha3/sidecar.proto             |  8 +++----
 networking/v1alpha3/virtual_service.pb.go     |  8 +++----
 networking/v1alpha3/virtual_service.pb.html   |  8 +++----
 networking/v1alpha3/virtual_service.proto     |  8 +++----
 policy/v1beta1/cfg.pb.go                      |  8 +++----
 policy/v1beta1/cfg.proto                      |  8 +++----
 policy/v1beta1/istio.policy.v1beta1.pb.html   |  8 +++----
 rbac/v1alpha1/istio.rbac.v1alpha1.pb.html     |  6 +++---
 rbac/v1alpha1/rbac.pb.go                      |  6 +++---
 rbac/v1alpha1/rbac.proto                      |  8 +++----
 32 files changed, 141 insertions(+), 150 deletions(-)

diff --git a/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html b/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
index 65acfb5a37..4d144436f4 100644
--- a/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
+++ b/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
@@ -118,7 +118,7 @@ <h2 id="Jwt">Jwt</h2>
 the issuer or (b) inferred from the email domain of the issuer (e.g. a
 Google service account).</p>
 
-<p>Example: https://www.googleapis.com/oauth2/v1/certs</p>
+<p>Example: <code>https://www.googleapis.com/oauth2/v1/certs</code></p>
 
 </td>
 </tr>
diff --git a/authentication/v1alpha1/policy.pb.go b/authentication/v1alpha1/policy.pb.go
index 0954be05da..9dd5783f15 100644
--- a/authentication/v1alpha1/policy.pb.go
+++ b/authentication/v1alpha1/policy.pb.go
@@ -431,7 +431,7 @@ type Jwt struct {
 	// the issuer or (b) inferred from the email domain of the issuer (e.g. a
 	// Google service account).
 	//
-	// Example: https://www.googleapis.com/oauth2/v1/certs
+	// Example: `https://www.googleapis.com/oauth2/v1/certs`
 	JwksUri string `protobuf:"bytes,3,opt,name=jwks_uri,json=jwksUri,proto3" json:"jwks_uri,omitempty"`
 	// JWT is sent in a request header. `header` represents the
 	// header name.
diff --git a/authentication/v1alpha1/policy.proto b/authentication/v1alpha1/policy.proto
index 916270f965..f9156eb75b 100644
--- a/authentication/v1alpha1/policy.proto
+++ b/authentication/v1alpha1/policy.proto
@@ -155,7 +155,7 @@ message Jwt {
   // the issuer or (b) inferred from the email domain of the issuer (e.g. a
   // Google service account).
   //
-  // Example: https://www.googleapis.com/oauth2/v1/certs
+  // Example: `https://www.googleapis.com/oauth2/v1/certs`
   string jwks_uri = 3;
 
   // Two fields below define where to extract the JWT from an HTTP request.
diff --git a/dictionaries/custom.txt b/dictionaries/custom.txt
index 14c8b03d73..f056b95fd0 100644
--- a/dictionaries/custom.txt
+++ b/dictionaries/custom.txt
@@ -13,6 +13,7 @@ jitter
 JSON
 JWT
 Kubernetes
+LightStep
 MCP
 multicluster
 NACK
@@ -27,6 +28,7 @@ scalability
 SDS
 SNI
 SPIFFE
+subnet
 TCP
 TLS
 UDP
@@ -35,3 +37,5 @@ unmanaged
 unterminated
 URI
 URL
+VM
+Zipkin
diff --git a/envoy/config/filter/http/jwt_auth/v2alpha1/config.pb.go b/envoy/config/filter/http/jwt_auth/v2alpha1/config.pb.go
index 87ce22a8f3..d05358fc7e 100644
--- a/envoy/config/filter/http/jwt_auth/v2alpha1/config.pb.go
+++ b/envoy/config/filter/http/jwt_auth/v2alpha1/config.pb.go
@@ -348,15 +348,14 @@ func _DataSource_OneofSizer(msg proto.Message) (n int) {
 	return n
 }
 
-// This message specifies how a JSON Web Token (JWT) can be verified. JWT format is defined
-// `here <https://tools.ietf.org/html/rfc7519>`_. Please see `OAuth2.0
-//  <https://tools.ietf.org/html/rfc6749>`_ and `OIDC1.0  <http://openid.net/connect>`_ for
+// This message specifies how a JSON Web Token (JWT) can be verified. See the [JWT format definition](https://tools.ietf.org/html/rfc7519)
+// for details. Please see [OAuth2.0](https://tools.ietf.org/html/rfc6749) and
+// [OIDC1.0](http://openid.net/connect) for
 // the authentication flow.
 //
 // Example:
 //
-// .. code-block:: yaml
-//
+// ```yaml
 //     issuer: https://example.com
 //     audiences:
 //     - bookstore_android.apps.googleusercontent.com
@@ -367,8 +366,7 @@ func _DataSource_OneofSizer(msg proto.Message) (n int) {
 //         cluster: example_jwks_cluster
 //       cache_duration:
 //       - seconds: 300
-//
-// [#not-implemented-hide:]
+// ```
 type JwtRule struct {
 	// Identifies the principal that issued the JWT. See `here
 	//  <https://tools.ietf.org/html/rfc7519#section-4.1.1>`_. Usually a URL or an email address.
diff --git a/envoy/config/filter/http/jwt_auth/v2alpha1/config.proto b/envoy/config/filter/http/jwt_auth/v2alpha1/config.proto
index 477be41f75..ec4cb9200b 100644
--- a/envoy/config/filter/http/jwt_auth/v2alpha1/config.proto
+++ b/envoy/config/filter/http/jwt_auth/v2alpha1/config.proto
@@ -69,15 +69,14 @@ message DataSource {
   }
 }
 
-// This message specifies how a JSON Web Token (JWT) can be verified. JWT format is defined
-// `here <https://tools.ietf.org/html/rfc7519>`_. Please see `OAuth2.0
-//  <https://tools.ietf.org/html/rfc6749>`_ and `OIDC1.0  <http://openid.net/connect>`_ for
+// This message specifies how a JSON Web Token (JWT) can be verified. See the [JWT format definition](https://tools.ietf.org/html/rfc7519)
+// for details. Please see [OAuth2.0](https://tools.ietf.org/html/rfc6749) and
+// [OIDC1.0](http://openid.net/connect) for
 // the authentication flow.
 //
 // Example:
 //
-// .. code-block:: yaml
-//
+// ```yaml
 //     issuer: https://example.com
 //     audiences:
 //     - bookstore_android.apps.googleusercontent.com
@@ -88,8 +87,7 @@ message DataSource {
 //         cluster: example_jwks_cluster
 //       cache_duration:
 //       - seconds: 300
-//
-// [#not-implemented-hide:]
+// ```
 message JwtRule {
   // Identifies the principal that issued the JWT. See `here
   //  <https://tools.ietf.org/html/rfc7519#section-4.1.1>`_. Usually a URL or an email address.
diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 2adfe66184..9fdc0a9033 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -239,7 +239,7 @@ type MeshConfig struct {
 	ConfigSources []*ConfigSource `protobuf:"bytes,22,rep,name=config_sources,json=configSources,proto3" json:"config_sources,omitempty"`
 	// $hide_from_docs
 	// This flag is used by secret discovery service(SDS).
-	// If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
+	// If set to true ([prerequisite](https://kubernetes.io/docs/concepts/storage/volumes/#projected)), Istio will inject volumes mount
 	// for Kubernetes service account trustworthy JWT(which is available with Kubernetes 1.12 or higher), so that the Kubernetes API server
 	// mounts Kubernetes service account trustworthy JWT to the Envoy container, which will be used to request key/cert eventually.
 	// This isn't supported for non-Kubernetes cases.
@@ -298,7 +298,7 @@ type MeshConfig struct {
 	DefaultDestinationRuleExportTo []string `protobuf:"bytes,33,rep,name=default_destination_rule_export_to,json=defaultDestinationRuleExportTo,proto3" json:"default_destination_rule_export_to,omitempty"`
 	// $hide_from_docs
 	// The namespace to treat as the administrative root namespace for
-	// istio configuration. When processing a leaf namespace Istio will search for
+	// Istio configuration. When processing a leaf namespace Istio will search for
 	// declarations in that namespace first and if none are found it will
 	// search in the root namespace. Any matching declaration found in the root
 	// namespace is processed as if it were declared in the leaf namespace.
@@ -307,8 +307,8 @@ type MeshConfig struct {
 	// type.
 	//
 	// There is no default value for this flag in 1.1 but in later releases it
-	// is expected to default to a new namespace, "istio-config", which is
-	// maintained separately from the "istio-system" namespace where an instance
+	// is expected to default to a new namespace, `istio-config`, which is
+	// maintained separately from the `istio-system` namespace where an instance
 	// of the control plane runtime is deployed. This separates the concerns of
 	// configuring the control-plane runtime from configuration of the mesh.
 	RootNamespace string `protobuf:"bytes,34,opt,name=root_namespace,json=rootNamespace,proto3" json:"root_namespace,omitempty"`
@@ -653,7 +653,7 @@ type ConfigSource struct {
 	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
 	// Use the tls_settings to specify the tls mode to use. If the MCP server
 	// uses Istio mutual TLS and shares the root CA with Pilot, specify the TLS
-	// mode as ISTIO_MUTUAL.
+	// mode as `ISTIO_MUTUAL`.
 	TlsSettings          *v1alpha3.TLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings,proto3" json:"tls_settings,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}              `json:"-"`
 	XXX_unrecognized     []byte                `json:"-"`
@@ -757,7 +757,7 @@ func (m *ConfigSource) GetTlsSettings() *v1alpha3.TLSSettings {
 type LocalityLoadBalancerSetting struct {
 	// Optional: only one of distribute or failover can be set.
 	// Explicitly specify loadbalancing weight across different zones and geographical locations.
-	// Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing)
+	// Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight)
 	// If empty, the locality weight is set according to the endpoints number within it.
 	Distribute []*LocalityLoadBalancerSetting_Distribute `protobuf:"bytes,1,rep,name=distribute,proto3" json:"distribute,omitempty"`
 	// Optional: only failover or distribute can be set.
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index 062e1e60e8..c35e2b2434 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -196,7 +196,7 @@ message MeshConfig {
 
   // $hide_from_docs
   // This flag is used by secret discovery service(SDS).
-  // If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
+  // If set to true ([prerequisite](https://kubernetes.io/docs/concepts/storage/volumes/#projected)), Istio will inject volumes mount
   // for Kubernetes service account trustworthy JWT(which is available with Kubernetes 1.12 or higher), so that the Kubernetes API server
   // mounts Kubernetes service account trustworthy JWT to the Envoy container, which will be used to request key/cert eventually.
   // This isn't supported for non-Kubernetes cases.
@@ -261,7 +261,7 @@ message MeshConfig {
 
   // $hide_from_docs
   // The namespace to treat as the administrative root namespace for
-  // istio configuration. When processing a leaf namespace Istio will search for
+  // Istio configuration. When processing a leaf namespace Istio will search for
   // declarations in that namespace first and if none are found it will
   // search in the root namespace. Any matching declaration found in the root
   // namespace is processed as if it were declared in the leaf namespace.
@@ -270,8 +270,8 @@ message MeshConfig {
   // type.
   //
   // There is no default value for this flag in 1.1 but in later releases it
-  // is expected to default to a new namespace, "istio-config", which is
-  // maintained separately from the "istio-system" namespace where an instance
+  // is expected to default to a new namespace, `istio-config`, which is
+  // maintained separately from the `istio-system` namespace where an instance
   // of the control plane runtime is deployed. This separates the concerns of
   // configuring the control-plane runtime from configuration of the mesh.
   string root_namespace = 34;
@@ -297,7 +297,7 @@ message ConfigSource {
 
   // Use the tls_settings to specify the tls mode to use. If the MCP server
   // uses Istio mutual TLS and shares the root CA with Pilot, specify the TLS
-  // mode as ISTIO_MUTUAL.
+  // mode as `ISTIO_MUTUAL`.
   istio.networking.v1alpha3.TLSSettings tls_settings = 2;
 }
 
@@ -385,7 +385,7 @@ message LocalityLoadBalancerSetting{
 
   // Optional: only one of distribute or failover can be set.
   // Explicitly specify loadbalancing weight across different zones and geographical locations.
-  // Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing)
+  // Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight)
   // If empty, the locality weight is set according to the endpoints number within it.
   repeated Distribute distribute = 1;
 
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index d4d0be852a..0a654fad29 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -77,9 +77,9 @@ <h2 id="ConfigSource">ConfigSource</h2>
 <td><code>tlsSettings</code></td>
 <td><code><a href="https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule.html#TLSSettings">istio.networking.v1alpha3.TLSSettings</a></code></td>
 <td>
-<p>Use the tls<em>settings to specify the tls mode to use. If the MCP server
+<p>Use the tls_settings to specify the tls mode to use. If the MCP server
 uses Istio mutual TLS and shares the root CA with Pilot, specify the TLS
-mode as ISTIO</em>MUTUAL.</p>
+mode as <code>ISTIO_MUTUAL</code>.</p>
 
 </td>
 </tr>
@@ -150,7 +150,7 @@ <h2 id="LocalityLoadBalancerSetting">LocalityLoadBalancerSetting</h2>
 <td>
 <p>Optional: only one of distribute or failover can be set.
 Explicitly specify loadbalancing weight across different zones and geographical locations.
-Refer to <a href="https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing">Locality weighted load balancing</a>
+Refer to <a href="https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight">Locality weighted load balancing</a>
 If empty, the locality weight is set according to the endpoints number within it.</p>
 
 </td>
@@ -755,7 +755,7 @@ <h2 id="Network-NetworkEndpoints">Network.NetworkEndpoints</h2>
 <li><p>Implicitly: If the registry explicitly provides information about
 the network to which the endpoint belongs to. In some cases, its
 possible to indicate the network associated with the endpoint by
-adding ISTIO<em>META</em>NETWORK environment variable to the sidecar.</p></li>
+adding the <code>ISTIO_META_NETWORK</code> environment variable to the sidecar.</p></li>
 
 <li><p>Explicitly:</p></li>
 </ol>
@@ -794,7 +794,7 @@ <h2 id="Network-NetworkEndpoints">Network.NetworkEndpoints</h2>
 <td>
 <p>Add all endpoints from the specified registry into this network.
 The names of the registries should correspond to the secret name
-that was used to configure the registry (kubernetes multicluster) or
+that was used to configure the registry (Kubernetes multicluster) or
 supplied by MCP server.</p>
 
 </td>
@@ -909,7 +909,7 @@ <h2 id="ProxyConfig">ProxyConfig</h2>
 <td><code>string</code></td>
 <td>
 <p>Address of the Envoy Metrics Service implementation (e.g. metrics-service:15000).
-See https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/metrics/v2/metrics_service.proto
+See <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/metrics/v2/metrics_service.proto">Metric Service</a>
 for details about Envoy&rsquo;s Metrics Service API.</p>
 
 </td>
diff --git a/mesh/v1alpha1/network.pb.go b/mesh/v1alpha1/network.pb.go
index 078d6a2610..ccd7f8e0b7 100644
--- a/mesh/v1alpha1/network.pb.go
+++ b/mesh/v1alpha1/network.pb.go
@@ -92,7 +92,7 @@ func (m *Network) GetGateways() []*Network_IstioNetworkGateway {
 // 1. Implicitly: If the registry explicitly provides information about
 // the network to which the endpoint belongs to. In some cases, its
 // possible to indicate the network associated with the endpoint by
-// adding ISTIO_META_NETWORK environment variable to the sidecar.
+// adding the `ISTIO_META_NETWORK` environment variable to the sidecar.
 //
 // 2. Explicitly:
 //
diff --git a/mesh/v1alpha1/network.proto b/mesh/v1alpha1/network.proto
index a55c416cfe..8260072a34 100644
--- a/mesh/v1alpha1/network.proto
+++ b/mesh/v1alpha1/network.proto
@@ -31,7 +31,7 @@ message Network {
   // 1. Implicitly: If the registry explicitly provides information about
   // the network to which the endpoint belongs to. In some cases, its
   // possible to indicate the network associated with the endpoint by
-  // adding ISTIO_META_NETWORK environment variable to the sidecar.
+  // adding the `ISTIO_META_NETWORK` environment variable to the sidecar.
   //
   // 2. Explicitly:
   //
@@ -52,7 +52,7 @@ message Network {
 
     // Add all endpoints from the specified registry into this network.
     // The names of the registries should correspond to the secret name
-    // that was used to configure the registry (kubernetes multicluster) or
+    // that was used to configure the registry (Kubernetes multicluster) or
     // supplied by MCP server.
     string from_registry = 2;
     }
diff --git a/mesh/v1alpha1/proxy.pb.go b/mesh/v1alpha1/proxy.pb.go
index 0056c3caf6..10950ac4c8 100644
--- a/mesh/v1alpha1/proxy.pb.go
+++ b/mesh/v1alpha1/proxy.pb.go
@@ -414,7 +414,7 @@ type ProxyConfig struct {
 	// IP Address and Port of a statsd UDP listener (e.g. _10.75.241.127:9125_).
 	StatsdUdpAddress string `protobuf:"bytes,10,opt,name=statsd_udp_address,json=statsdUdpAddress,proto3" json:"statsd_udp_address,omitempty"`
 	// Address of the Envoy Metrics Service implementation (e.g. metrics-service:15000).
-	// See https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/metrics/v2/metrics_service.proto
+	// See [Metric Service](https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/metrics/v2/metrics_service.proto)
 	// for details about Envoy's Metrics Service API.
 	EnvoyMetricsServiceAddress string `protobuf:"bytes,20,opt,name=envoy_metrics_service_address,json=envoyMetricsServiceAddress,proto3" json:"envoy_metrics_service_address,omitempty"`
 	// Port on which Envoy should listen for administrative commands.
diff --git a/mesh/v1alpha1/proxy.proto b/mesh/v1alpha1/proxy.proto
index 576289c8ad..a08d122c59 100644
--- a/mesh/v1alpha1/proxy.proto
+++ b/mesh/v1alpha1/proxy.proto
@@ -120,13 +120,13 @@ message ProxyConfig {
   string statsd_udp_address = 10;
 
   // Address of the Envoy Metrics Service implementation (e.g. metrics-service:15000).
-  // See https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/metrics/v2/metrics_service.proto
+  // See [Metric Service](https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/metrics/v2/metrics_service.proto)
   // for details about Envoy's Metrics Service API.
   string envoy_metrics_service_address = 20;
 
   // Port on which Envoy should listen for administrative commands.
   int32 proxy_admin_port = 11;
-  
+
   // $hide_from_docs
   string availability_zone = 12 [deprecated=true];
 
diff --git a/mixer/v1/config/client/service.proto b/mixer/v1/config/client/service.proto
index d00937a84a..01de2e9737 100644
--- a/mixer/v1/config/client/service.proto
+++ b/mixer/v1/config/client/service.proto
@@ -30,7 +30,7 @@ option (gogoproto.stable_marshaler_all) = true;
 //
 // Mixer protobufs have gogoproto specific options which are not
 // compatiable with the proxy's vanilla protobufs. Ideally, these
-// protobuf options be reconciled so fundamental istio concepts and
+// protobuf options be reconciled so fundamental Istio concepts and
 // types can be shared by components. Until then, make a copy of
 // IstioService for mixerclient to use.
 
diff --git a/networking/v1alpha3/gateway.pb.go b/networking/v1alpha3/gateway.pb.go
index 53ff90247b..5764c93c26 100644
--- a/networking/v1alpha3/gateway.pb.go
+++ b/networking/v1alpha3/gateway.pb.go
@@ -52,7 +52,7 @@
 //     - "bookinfo-namespace/*.bookinfo.com"
 //     tls:
 //       mode: SIMPLE # enables HTTPS on this port
-//       credentialName: bookinfo-secret # fetches certs from kubernetes secret
+//       credentialName: bookinfo-secret # fetches certs from Kubernetes secret
 //   - port:
 //       number: 9080
 //       name: http-wildcard
@@ -72,15 +72,15 @@
 // the forwarding of traffic arriving at a particular host or gateway port.
 //
 // For example, the following VirtualService splits traffic for
-// "https://uk.bookinfo.com/reviews", "https://eu.bookinfo.com/reviews",
-// "http://uk.bookinfo.com:9080/reviews",
-// "http://eu.bookinfo.com:9080/reviews" into two versions (prod and qa) of
+// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
+// `http://uk.bookinfo.com:9080/reviews`,
+// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
 // an internal reviews service on port 9080. In addition, requests
 // containing the cookie "user: dev-123" will be sent to special port 7777
 // in the qa version. The same rule is also applicable inside the mesh for
 // requests to the "reviews.prod.svc.cluster.local" service. This rule is
-// applicable across ports 443, 9080. Note that "http://uk.bookinfo.com"
-// gets redirected to "https://uk.bookinfo.com" (i.e. 80 redirects to 443).
+// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
+// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -410,14 +410,14 @@ type Server struct {
 	// $hide_from_docs
 	// The ip or the Unix domain socket to which the listener should be bound
 	// to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
-	// (Linux abstract namespace). When using unix domain sockets, the port
+	// (Linux abstract namespace). When using Unix domain sockets, the port
 	// number should be 0.
 	Bind string `protobuf:"bytes,4,opt,name=bind,proto3" json:"bind,omitempty"`
 	// REQUIRED. One or more hosts exposed by this gateway.
 	// While typically applicable to
 	// HTTP services, it can also be used for TCP services using TLS with SNI.
 	// A host is specified as a `dnsName` with an optional `namespace/` prefix.
-	// The `dnsName` should be specified using FQDN format, opionally including
+	// The `dnsName` should be specified using FQDN format, optionally including
 	// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
 	// Set the `dnsName` to `*` to select all `VirtualService` hosts from the
 	// specified namespace (e.g.,`prod/*`). If no `namespace/` is specified,
@@ -542,7 +542,7 @@ type Server_TLSOptions struct {
 	// credentialName appended with suffix "-cacert" is used to identify
 	// the CaCertificates associated with this server. Gateway workloads
 	// capable of fetching credentials from a remote credential store such
-	// as kubernetes secrets, will be configured to retrieve the
+	// as Kubernetes secrets, will be configured to retrieve the
 	// serverCertificate and the privateKey using credentialName, instead
 	// of using the file system paths specified above. If using mutual TLS,
 	// gateway workloads will retrieve the CaCertificates using
diff --git a/networking/v1alpha3/gateway.pb.html b/networking/v1alpha3/gateway.pb.html
index 2e8bd131e7..670df0918e 100644
--- a/networking/v1alpha3/gateway.pb.html
+++ b/networking/v1alpha3/gateway.pb.html
@@ -56,7 +56,7 @@
     - &quot;bookinfo-namespace/*.bookinfo.com&quot;
     tls:
       mode: SIMPLE # enables HTTPS on this port
-      credentialName: bookinfo-secret # fetches certs from kubernetes secret
+      credentialName: bookinfo-secret # fetches certs from Kubernetes secret
   - port:
       number: 9080
       name: http-wildcard
@@ -76,15 +76,15 @@
 the forwarding of traffic arriving at a particular host or gateway port.</p>
 
 <p>For example, the following VirtualService splits traffic for
-&ldquo;https://uk.bookinfo.com/reviews&rdquo;, &ldquo;https://eu.bookinfo.com/reviews&rdquo;,
-&ldquo;http://uk.bookinfo.com:9080/reviews&rdquo;,
-&ldquo;http://eu.bookinfo.com:9080/reviews&rdquo; into two versions (prod and qa) of
+<code>https://uk.bookinfo.com/reviews</code>, <code>https://eu.bookinfo.com/reviews</code>,
+<code>http://uk.bookinfo.com:9080/reviews</code>,
+<code>http://eu.bookinfo.com:9080/reviews</code> into two versions (prod and qa) of
 an internal reviews service on port 9080. In addition, requests
 containing the cookie &ldquo;user: dev-123&rdquo; will be sent to special port 7777
 in the qa version. The same rule is also applicable inside the mesh for
 requests to the &ldquo;reviews.prod.svc.cluster.local&rdquo; service. This rule is
-applicable across ports 443, 9080. Note that &ldquo;http://uk.bookinfo.com&rdquo;
-gets redirected to &ldquo;https://uk.bookinfo.com&rdquo; (i.e. 80 redirects to 443).</p>
+applicable across ports 443, 9080. Note that <code>http://uk.bookinfo.com</code>
+gets redirected to <code>https://uk.bookinfo.com</code> (i.e. 80 redirects to 443).</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
@@ -337,7 +337,7 @@ <h2 id="Server">Server</h2>
 While typically applicable to
 HTTP services, it can also be used for TCP services using TLS with SNI.
 A host is specified as a <code>dnsName</code> with an optional <code>namespace/</code> prefix.
-The <code>dnsName</code> should be specified using FQDN format, opionally including
+The <code>dnsName</code> should be specified using FQDN format, optionally including
 a wildcard character in the left-most component (e.g., <code>prod/*.example.com</code>).
 Set the <code>dnsName</code> to <code>*</code> to select all <code>VirtualService</code> hosts from the
 specified namespace (e.g.,<code>prod/*</code>). If no <code>namespace/</code> is specified,
@@ -450,7 +450,7 @@ <h2 id="Server-TLSOptions">Server.TLSOptions</h2>
 credentialName appended with suffix &ldquo;-cacert&rdquo; is used to identify
 the CaCertificates associated with this server. Gateway workloads
 capable of fetching credentials from a remote credential store such
-as kubernetes secrets, will be configured to retrieve the
+as Kubernetes secrets, will be configured to retrieve the
 serverCertificate and the privateKey using credentialName, instead
 of using the file system paths specified above. If using mutual TLS,
 gateway workloads will retrieve the CaCertificates using
diff --git a/networking/v1alpha3/gateway.proto b/networking/v1alpha3/gateway.proto
index ea314aa192..4ae5e7983c 100644
--- a/networking/v1alpha3/gateway.proto
+++ b/networking/v1alpha3/gateway.proto
@@ -69,7 +69,7 @@ syntax = "proto3";
 //     - "bookinfo-namespace/*.bookinfo.com"
 //     tls:
 //       mode: SIMPLE # enables HTTPS on this port
-//       credentialName: bookinfo-secret # fetches certs from kubernetes secret
+//       credentialName: bookinfo-secret # fetches certs from Kubernetes secret
 //   - port:
 //       number: 9080
 //       name: http-wildcard
@@ -89,15 +89,15 @@ syntax = "proto3";
 // the forwarding of traffic arriving at a particular host or gateway port.
 //
 // For example, the following VirtualService splits traffic for
-// "https://uk.bookinfo.com/reviews", "https://eu.bookinfo.com/reviews",
-// "http://uk.bookinfo.com:9080/reviews",
-// "http://eu.bookinfo.com:9080/reviews" into two versions (prod and qa) of
+// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
+// `http://uk.bookinfo.com:9080/reviews`,
+// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
 // an internal reviews service on port 9080. In addition, requests
 // containing the cookie "user: dev-123" will be sent to special port 7777
 // in the qa version. The same rule is also applicable inside the mesh for
 // requests to the "reviews.prod.svc.cluster.local" service. This rule is
-// applicable across ports 443, 9080. Note that "http://uk.bookinfo.com"
-// gets redirected to "https://uk.bookinfo.com" (i.e. 80 redirects to 443).
+// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
+// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -274,7 +274,7 @@ message Server {
   // $hide_from_docs
   // The ip or the Unix domain socket to which the listener should be bound
   // to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
-  // (Linux abstract namespace). When using unix domain sockets, the port
+  // (Linux abstract namespace). When using Unix domain sockets, the port
   // number should be 0.
   string bind = 4;
 
@@ -282,7 +282,7 @@ message Server {
   // While typically applicable to
   // HTTP services, it can also be used for TCP services using TLS with SNI.
   // A host is specified as a `dnsName` with an optional `namespace/` prefix.
-  // The `dnsName` should be specified using FQDN format, opionally including
+  // The `dnsName` should be specified using FQDN format, optionally including
   // a wildcard character in the left-most component (e.g., `prod/*.example.com`).
   // Set the `dnsName` to `*` to select all `VirtualService` hosts from the
   // specified namespace (e.g.,`prod/*`). If no `namespace/` is specified,
@@ -359,7 +359,7 @@ message Server {
     // credentialName appended with suffix "-cacert" is used to identify
     // the CaCertificates associated with this server. Gateway workloads
     // capable of fetching credentials from a remote credential store such
-    // as kubernetes secrets, will be configured to retrieve the
+    // as Kubernetes secrets, will be configured to retrieve the
     // serverCertificate and the privateKey using credentialName, instead
     // of using the file system paths specified above. If using mutual TLS,
     // gateway workloads will retrieve the CaCertificates using
diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index 6168b16ee6..4e6de8be9d 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -167,8 +167,8 @@
 //    - "*"
 // ```
 //
-// And the associated VirtualService to route from the sidecar to the
-// gateway service (istio-egressgateway.istio-system.svc.cluster.local), as
+// And the associated `VirtualService` to route from the sidecar to the
+// gateway service (`istio-egressgateway.istio-system.svc.cluster.local`), as
 // well as route from the gateway to the external service. Note that the
 // virtual service is exported to all namespaces enabling them to route traffic
 // through the gateway to the external service. Forcing traffic to go through
@@ -228,7 +228,7 @@
 //
 // The following example demonstrates a service that is available via a
 // Unix Domain Socket on the host of the client. The resolution must be
-// set to STATIC to use unix address endpoints.
+// set to STATIC to use Unix address endpoints.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -248,10 +248,10 @@
 //   - address: unix:///var/run/example/socket
 // ```
 //
-// For HTTP-based services, it is possible to create a VirtualService
+// For HTTP-based services, it is possible to create a `VirtualService`
 // backed by multiple DNS addressable endpoints. In such a scenario, the
-// application can use the HTTP_PROXY environment variable to transparently
-// reroute API calls for the VirtualService to a chosen backend. For
+// application can use the `HTTP_PROXY` environment variable to transparently
+// reroute API calls for the `VirtualService` to a chosen backend. For
 // example, the following configuration creates a non-existent external
 // service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
 // uk.foo.bar.com:9080, and in.foo.bar.com:7080
@@ -287,10 +287,9 @@
 // specified above. In other words, a call to `http://foo.bar.com/baz` would
 // be translated to `http://uk.foo.bar.com/baz`.
 //
-// The following example illustrates the usage of a ServiceEntry
+// The following example illustrates the usage of a `ServiceEntry`
 // containing a subject alternate name
-// whose format conforms to the SPIFEE standard
-// <https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md>:
+// whose format conforms to the [SPIFEE standard](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md):
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -399,7 +398,7 @@ const (
 	// will resolve the DNS address specified in the hosts field, if
 	// wildcards are not used. If endpoints are specified, the DNS
 	// addresses specified in the endpoints will be resolved to determine
-	// the destination IP address.  DNS resolution cannot be used with unix
+	// the destination IP address.  DNS resolution cannot be used with Unix
 	// domain socket endpoints.
 	ServiceEntry_DNS ServiceEntry_Resolution = 2
 )
@@ -593,7 +592,7 @@ type ServiceEntry_Endpoint struct {
 	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
 	// Set of ports associated with the endpoint. The ports must be
 	// associated with a port name that was declared as part of the
-	// service. Do not use for unix:// addresses.
+	// service. Do not use for `unix://` addresses.
 	Ports map[string]uint32 `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
 	// One or more labels associated with the endpoint.
 	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
diff --git a/networking/v1alpha3/service_entry.pb.html b/networking/v1alpha3/service_entry.pb.html
index 419590bd63..a0b6499949 100644
--- a/networking/v1alpha3/service_entry.pb.html
+++ b/networking/v1alpha3/service_entry.pb.html
@@ -165,8 +165,8 @@
    - &quot;*&quot;
 </code></pre>
 
-<p>And the associated VirtualService to route from the sidecar to the
-gateway service (istio-egressgateway.istio-system.svc.cluster.local), as
+<p>And the associated <code>VirtualService</code> to route from the sidecar to the
+gateway service (<code>istio-egressgateway.istio-system.svc.cluster.local</code>), as
 well as route from the gateway to the external service. Note that the
 virtual service is exported to all namespaces enabling them to route traffic
 through the gateway to the external service. Forcing traffic to go through
@@ -224,7 +224,7 @@
 
 <p>The following example demonstrates a service that is available via a
 Unix Domain Socket on the host of the client. The resolution must be
-set to STATIC to use unix address endpoints.</p>
+set to STATIC to use Unix address endpoints.</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
 kind: ServiceEntry
@@ -243,10 +243,10 @@
   - address: unix:///var/run/example/socket
 </code></pre>
 
-<p>For HTTP-based services, it is possible to create a VirtualService
+<p>For HTTP-based services, it is possible to create a <code>VirtualService</code>
 backed by multiple DNS addressable endpoints. In such a scenario, the
-application can use the HTTP_PROXY environment variable to transparently
-reroute API calls for the VirtualService to a chosen backend. For
+application can use the <code>HTTP_PROXY</code> environment variable to transparently
+reroute API calls for the <code>VirtualService</code> to a chosen backend. For
 example, the following configuration creates a non-existent external
 service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
 uk.foo.bar.com:9080, and in.foo.bar.com:7080</p>
@@ -281,10 +281,9 @@
 specified above. In other words, a call to <code>http://foo.bar.com/baz</code> would
 be translated to <code>http://uk.foo.bar.com/baz</code>.</p>
 
-<p>The following example illustrates the usage of a ServiceEntry
+<p>The following example illustrates the usage of a <code>ServiceEntry</code>
 containing a subject alternate name
-whose format conforms to the SPIFEE standard
-<a href="https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md">https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md</a>:</p>
+whose format conforms to the <a href="https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md">SPIFEE standard</a>:</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
 kind: ServiceEntry
@@ -464,7 +463,7 @@ <h2 id="ServiceEntry-Endpoint">ServiceEntry.Endpoint</h2>
 <td>
 <p>Set of ports associated with the endpoint. The ports must be
 associated with a port name that was declared as part of the
-service. Do not use for unix:// addresses.</p>
+service. Do not use for <code>unix://</code> addresses.</p>
 
 </td>
 </tr>
@@ -613,7 +612,7 @@ <h2 id="ServiceEntry-Resolution">ServiceEntry.Resolution</h2>
 will resolve the DNS address specified in the hosts field, if
 wildcards are not used. If endpoints are specified, the DNS
 addresses specified in the endpoints will be resolved to determine
-the destination IP address.  DNS resolution cannot be used with unix
+the destination IP address.  DNS resolution cannot be used with Unix
 domain socket endpoints.</p>
 
 </td>
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index 7a61b47aae..9fa0578625 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -186,8 +186,8 @@ import "networking/v1alpha3/gateway.proto";
 //    - "*"
 // ```
 //
-// And the associated VirtualService to route from the sidecar to the
-// gateway service (istio-egressgateway.istio-system.svc.cluster.local), as
+// And the associated `VirtualService` to route from the sidecar to the
+// gateway service (`istio-egressgateway.istio-system.svc.cluster.local`), as
 // well as route from the gateway to the external service. Note that the
 // virtual service is exported to all namespaces enabling them to route traffic
 // through the gateway to the external service. Forcing traffic to go through
@@ -247,7 +247,7 @@ import "networking/v1alpha3/gateway.proto";
 //
 // The following example demonstrates a service that is available via a
 // Unix Domain Socket on the host of the client. The resolution must be
-// set to STATIC to use unix address endpoints.
+// set to STATIC to use Unix address endpoints.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -267,10 +267,10 @@ import "networking/v1alpha3/gateway.proto";
 //   - address: unix:///var/run/example/socket
 // ```
 //
-// For HTTP-based services, it is possible to create a VirtualService
+// For HTTP-based services, it is possible to create a `VirtualService`
 // backed by multiple DNS addressable endpoints. In such a scenario, the
-// application can use the HTTP_PROXY environment variable to transparently
-// reroute API calls for the VirtualService to a chosen backend. For
+// application can use the `HTTP_PROXY` environment variable to transparently
+// reroute API calls for the `VirtualService` to a chosen backend. For
 // example, the following configuration creates a non-existent external
 // service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
 // uk.foo.bar.com:9080, and in.foo.bar.com:7080
@@ -306,10 +306,9 @@ import "networking/v1alpha3/gateway.proto";
 // specified above. In other words, a call to `http://foo.bar.com/baz` would
 // be translated to `http://uk.foo.bar.com/baz`.
 //
-// The following example illustrates the usage of a ServiceEntry
+// The following example illustrates the usage of a `ServiceEntry`
 // containing a subject alternate name
-// whose format conforms to the SPIFEE standard
-// <https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md>:
+// whose format conforms to the [SPIFEE standard](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md):
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -418,7 +417,7 @@ message ServiceEntry {
     // will resolve the DNS address specified in the hosts field, if
     // wildcards are not used. If endpoints are specified, the DNS
     // addresses specified in the endpoints will be resolved to determine
-    // the destination IP address.  DNS resolution cannot be used with unix
+    // the destination IP address.  DNS resolution cannot be used with Unix
     // domain socket endpoints.
     DNS = 2;
   };
@@ -440,7 +439,7 @@ message ServiceEntry {
 
     // Set of ports associated with the endpoint. The ports must be
     // associated with a port name that was declared as part of the
-    // service. Do not use for unix:// addresses.
+    // service. Do not use for `unix://` addresses.
     map<string, uint32> ports = 2;
 
     // One or more labels associated with the endpoint.
diff --git a/networking/v1alpha3/sidecar.pb.go b/networking/v1alpha3/sidecar.pb.go
index 9224c76070..dfc84815f8 100644
--- a/networking/v1alpha3/sidecar.pb.go
+++ b/networking/v1alpha3/sidecar.pb.go
@@ -84,7 +84,7 @@
 // resource in the prod-us1 namespace for all pods with labels "app:
 // productpage" belonging to the productpage.prod-us1 service. Assuming
 // that these pods are deployed without IPtable rules (i.e. the Istio init
-// container) and the proxy metadata ISTIO_META_INTERCEPTION_MODE is set to
+// container) and the proxy metadata `ISTIO_META_INTERCEPTION_MODE` is set to
 // NONE, the specification below allows such pods to receive HTTP traffic
 // on port 9080 and forward it to the application listening on
 // 127.0.0.1:8080. It also allows the application to communicate with a
@@ -146,7 +146,7 @@
 // traffic. The following Sidecar configuration allows the VM to expose a
 // listener on 172.16.1.32:80 (the VM's IP) for traffic arriving from the
 // 172.16.0.0/16 subnet. Note that in this scenario, the
-// ISTIO_META_INTERCEPTION_MODE metadata on the proxy in the VM should
+// `ISTIO_META_INTERCEPTION_MODE` metadata on the proxy in the VM should
 // contain "REDIRECT" or "TPROXY" as its value, implying that IP tables
 // based traffic capture is active.
 //
@@ -334,7 +334,7 @@ type IstioIngressListener struct {
 	// traffic should be forwarded to. This configuration can be used to
 	// redirect traffic arriving at the bind point on the sidecar to a port
 	// or Unix domain socket where the application workload is listening for
-	// connections. Format should be 127.0.0.1:PORT or unix:///path/to/socket
+	// connections. Format should be 127.0.0.1:PORT or `unix:///path/to/socket`
 	DefaultEndpoint      string   `protobuf:"bytes,4,opt,name=default_endpoint,json=defaultEndpoint,proto3" json:"default_endpoint,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -435,7 +435,7 @@ type IstioEgressListener struct {
 	// using a `ServiceEntry` or `VirtualService` configuration. Any
 	// associated `DestinationRule` in the same namespace will also be used.
 	//
-	// The `dnsName` should be specified using FQDN format, opionally including
+	// The `dnsName` should be specified using FQDN format, optionally including
 	// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
 	// Set the `dnsName` to `*` to select all services from the specified namespace
 	// (e.g.,`prod/*`). The `namespace` can also be set to `*` to select a particular
diff --git a/networking/v1alpha3/sidecar.pb.html b/networking/v1alpha3/sidecar.pb.html
index c7cbb3970f..a4a209a5bf 100644
--- a/networking/v1alpha3/sidecar.pb.html
+++ b/networking/v1alpha3/sidecar.pb.html
@@ -87,7 +87,7 @@
 resource in the prod-us1 namespace for all pods with labels &ldquo;app:
 productpage&rdquo; belonging to the productpage.prod-us1 service. Assuming
 that these pods are deployed without IPtable rules (i.e. the Istio init
-container) and the proxy metadata ISTIO<em>META</em>INTERCEPTION_MODE is set to
+container) and the proxy metadata <code>ISTIO_META_INTERCEPTION_MODE</code> is set to
 NONE, the specification below allows such pods to receive HTTP traffic
 on port 9080 and forward it to the application listening on
 127.0.0.1:8080. It also allows the application to communicate with a
@@ -147,7 +147,7 @@
 traffic. The following Sidecar configuration allows the VM to expose a
 listener on 172.16.1.32:80 (the VM&rsquo;s IP) for traffic arriving from the
 172.16.0.0/16 subnet. Note that in this scenario, the
-ISTIO<em>META</em>INTERCEPTION_MODE metadata on the proxy in the VM should
+<code>ISTIO_META_INTERCEPTION_MODE</code> metadata on the proxy in the VM should
 contain &ldquo;REDIRECT&rdquo; or &ldquo;TPROXY&rdquo; as its value, implying that IP tables
 based traffic capture is active.</p>
 
@@ -285,7 +285,7 @@ <h2 id="IstioEgressListener">IstioEgressListener</h2>
 using a <code>ServiceEntry</code> or <code>VirtualService</code> configuration. Any
 associated <code>DestinationRule</code> in the same namespace will also be used.</p>
 
-<p>The <code>dnsName</code> should be specified using FQDN format, opionally including
+<p>The <code>dnsName</code> should be specified using FQDN format, optionally including
 a wildcard character in the left-most component (e.g., <code>prod/*.example.com</code>).
 Set the <code>dnsName</code> to <code>*</code> to select all services from the specified namespace
 (e.g.,<code>prod/*</code>). The <code>namespace</code> can also be set to <code>*</code> to select a particular
@@ -356,7 +356,7 @@ <h2 id="IstioIngressListener">IstioIngressListener</h2>
 traffic should be forwarded to. This configuration can be used to
 redirect traffic arriving at the bind point on the sidecar to a port
 or Unix domain socket where the application workload is listening for
-connections. Format should be 127.0.0.1:PORT or unix:///path/to/socket</p>
+connections. Format should be 127.0.0.1:PORT or <code>unix:///path/to/socket</code></p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/sidecar.proto b/networking/v1alpha3/sidecar.proto
index e3a5be2545..3e05e714a2 100644
--- a/networking/v1alpha3/sidecar.proto
+++ b/networking/v1alpha3/sidecar.proto
@@ -103,7 +103,7 @@ import "networking/v1alpha3/gateway.proto";
 // resource in the prod-us1 namespace for all pods with labels "app:
 // productpage" belonging to the productpage.prod-us1 service. Assuming
 // that these pods are deployed without IPtable rules (i.e. the Istio init
-// container) and the proxy metadata ISTIO_META_INTERCEPTION_MODE is set to
+// container) and the proxy metadata `ISTIO_META_INTERCEPTION_MODE` is set to
 // NONE, the specification below allows such pods to receive HTTP traffic
 // on port 9080 and forward it to the application listening on
 // 127.0.0.1:8080. It also allows the application to communicate with a
@@ -165,7 +165,7 @@ import "networking/v1alpha3/gateway.proto";
 // traffic. The following Sidecar configuration allows the VM to expose a
 // listener on 172.16.1.32:80 (the VM's IP) for traffic arriving from the
 // 172.16.0.0/16 subnet. Note that in this scenario, the
-// ISTIO_META_INTERCEPTION_MODE metadata on the proxy in the VM should
+// `ISTIO_META_INTERCEPTION_MODE` metadata on the proxy in the VM should
 // contain "REDIRECT" or "TPROXY" as its value, implying that IP tables
 // based traffic capture is active.
 //
@@ -247,7 +247,7 @@ message IstioIngressListener {
   // traffic should be forwarded to. This configuration can be used to
   // redirect traffic arriving at the bind point on the sidecar to a port
   // or Unix domain socket where the application workload is listening for
-  // connections. Format should be 127.0.0.1:PORT or unix:///path/to/socket
+  // connections. Format should be 127.0.0.1:PORT or `unix:///path/to/socket`
   string default_endpoint = 4;
 }
 
@@ -287,7 +287,7 @@ message IstioEgressListener {
   // using a `ServiceEntry` or `VirtualService` configuration. Any
   // associated `DestinationRule` in the same namespace will also be used.
   //
-  // The `dnsName` should be specified using FQDN format, opionally including
+  // The `dnsName` should be specified using FQDN format, optionally including
   // a wildcard character in the left-most component (e.g., `prod/*.example.com`).
   // Set the `dnsName` to `*` to select all services from the specified namespace
   // (e.g.,`prod/*`). The `namespace` can also be set to `*` to select a particular
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index dc79fdf24e..e6f416e349 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -1998,9 +1998,8 @@ type HTTPRetry struct {
 	PerTryTimeout *types.Duration `protobuf:"bytes,2,opt,name=per_try_timeout,json=perTryTimeout,proto3" json:"per_try_timeout,omitempty"`
 	// Specifies the conditions under which retry takes place.
 	// One or more policies can be specified using a ‘,’ delimited list.
-	// The supported policies can be found in
-	// <https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on>
-	// and <https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on>
+	// See the [supported policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on)
+	// and [here](https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on) for more details.
 	RetryOn              string   `protobuf:"bytes,3,opt,name=retry_on,json=retryOn,proto3" json:"retry_on,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -2062,8 +2061,7 @@ func (m *HTTPRetry) GetRetryOn() string {
 }
 
 // Describes the Cross-Origin Resource Sharing (CORS) policy, for a given
-// service. Refer to
-// <https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS>
+// service. Refer to [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)
 // for further details about cross origin resource sharing. For example,
 // the following rule restricts cross origin requests to those originating
 // from example.com domain using HTTP POST/GET, and sets the
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index c55e804f1f..553bd484ee 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -95,8 +95,7 @@
 <h2 id="CorsPolicy">CorsPolicy</h2>
 <section>
 <p>Describes the Cross-Origin Resource Sharing (CORS) policy, for a given
-service. Refer to
-<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS">https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS</a>
+service. Refer to <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS">CORS</a>
 for further details about cross origin resource sharing. For example,
 the following rule restricts cross origin requests to those originating
 from example.com domain using HTTP POST/GET, and sets the
@@ -829,9 +828,8 @@ <h2 id="HTTPRetry">HTTPRetry</h2>
 <td>
 <p>Specifies the conditions under which retry takes place.
 One or more policies can be specified using a ‘,’ delimited list.
-The supported policies can be found in
-<a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on">https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on</a>
-and <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on">https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on</a></p>
+See the <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on">supported policies</a>
+and <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on">here</a> for more details.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index dadf6fe195..f69937399e 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -916,15 +916,13 @@ message HTTPRetry {
 
   // Specifies the conditions under which retry takes place.
   // One or more policies can be specified using a ‘,’ delimited list.
-  // The supported policies can be found in
-  // <https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on>
-  // and <https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on>
+  // See the [supported policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-on)
+  // and [here](https://www.envoyproxy.io/docs/envoy/latest/configuration/http_filters/router_filter#x-envoy-retry-grpc-on) for more details.
   string retry_on = 3;
 }
 
 // Describes the Cross-Origin Resource Sharing (CORS) policy, for a given
-// service. Refer to
-// <https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS>
+// service. Refer to [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)
 // for further details about cross origin resource sharing. For example,
 // the following rule restricts cross origin requests to those originating
 // from example.com domain using HTTP POST/GET, and sets the
diff --git a/policy/v1beta1/cfg.pb.go b/policy/v1beta1/cfg.pb.go
index 1feea86699..5ddb5b7582 100644
--- a/policy/v1beta1/cfg.pb.go
+++ b/policy/v1beta1/cfg.pb.go
@@ -118,7 +118,7 @@ type AttributeManifest struct {
 	// Optional. The revision of this document. Assigned by server.
 	Revision string `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"`
 	// Required. Name of the component producing these attributes. This can be
-	// the proxy (with the canonical name "istio-proxy") or the name of an
+	// the proxy (with the canonical name `istio-proxy`) or the name of an
 	// `attributes` kind adapter in Mixer.
 	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// The set of attributes this Istio component will be responsible for producing at runtime.
@@ -131,9 +131,9 @@ type AttributeManifest struct {
 	// match the regular expression `[\.-]`.
 	//
 	// Attribute names must be unique within a single Istio deployment. The set of canonical
-	// attributes are described at https://istio.io/docs/reference/attribute-vocabulary.html.
+	// attributes are described at [here](https://istio.io/docs/reference/attribute-vocabulary.html).
 	// Attributes not in that list should be named with a component-specific suffix such as
-	// request.count-my.component.
+	// `request.count-my.component`.
 	Attributes map[string]*AttributeManifest_AttributeInfo `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 }
 
@@ -287,7 +287,7 @@ func (m *AttributeManifest_AttributeInfo) GetValueType() ValueType {
 // A Rule is a selector and a set of intentions to be executed when the
 // selector is `true`
 //
-// The following example instructs Mixer to invoke 'prometheus-handler' handler for all services and pass it the
+// The following example instructs Mixer to invoke `prometheus-handler` handler for all services and pass it the
 // instance constructed using the 'RequestCountByService' instance.
 //
 // ```yaml
diff --git a/policy/v1beta1/cfg.proto b/policy/v1beta1/cfg.proto
index a32277c9ee..5175e4acc9 100644
--- a/policy/v1beta1/cfg.proto
+++ b/policy/v1beta1/cfg.proto
@@ -29,7 +29,7 @@ message AttributeManifest {
   // Optional. The revision of this document. Assigned by server.
   string revision = 1;
   // Required. Name of the component producing these attributes. This can be
-  // the proxy (with the canonical name "istio-proxy") or the name of an
+  // the proxy (with the canonical name `istio-proxy`) or the name of an
   // `attributes` kind adapter in Mixer.
   string name = 2;
 
@@ -91,16 +91,16 @@ message AttributeManifest {
   // match the regular expression `[\.-]`.
   //
   // Attribute names must be unique within a single Istio deployment. The set of canonical
-  // attributes are described at https://istio.io/docs/reference/attribute-vocabulary.html.
+  // attributes are described at [here](https://istio.io/docs/reference/attribute-vocabulary.html).
   // Attributes not in that list should be named with a component-specific suffix such as
-  // request.count-my.component.
+  // `request.count-my.component`.
   map<string, AttributeInfo> attributes = 3;
 }
 
 // A Rule is a selector and a set of intentions to be executed when the
 // selector is `true`
 //
-// The following example instructs Mixer to invoke 'prometheus-handler' handler for all services and pass it the
+// The following example instructs Mixer to invoke `prometheus-handler` handler for all services and pass it the
 // instance constructed using the 'RequestCountByService' instance.
 //
 // ```yaml
diff --git a/policy/v1beta1/istio.policy.v1beta1.pb.html b/policy/v1beta1/istio.policy.v1beta1.pb.html
index b5ad9f807d..147eda3f17 100644
--- a/policy/v1beta1/istio.policy.v1beta1.pb.html
+++ b/policy/v1beta1/istio.policy.v1beta1.pb.html
@@ -87,7 +87,7 @@ <h2 id="AttributeManifest">AttributeManifest</h2>
 <td><code>string</code></td>
 <td>
 <p>Required. Name of the component producing these attributes. This can be
-the proxy (with the canonical name &ldquo;istio-proxy&rdquo;) or the name of an
+the proxy (with the canonical name <code>istio-proxy</code>) or the name of an
 <code>attributes</code> kind adapter in Mixer.</p>
 
 </td>
@@ -107,9 +107,9 @@ <h2 id="AttributeManifest">AttributeManifest</h2>
 match the regular expression <code>[\.-]</code>.</p>
 
 <p>Attribute names must be unique within a single Istio deployment. The set of canonical
-attributes are described at https://istio.io/docs/reference/attribute-vocabulary.html.
+attributes are described at <a href="https://istio.io/docs/reference/attribute-vocabulary.html">here</a>.
 Attributes not in that list should be named with a component-specific suffix such as
-request.count-my.component.</p>
+<code>request.count-my.component</code>.</p>
 
 </td>
 </tr>
@@ -1082,7 +1082,7 @@ <h2 id="Rule">Rule</h2>
 <p>A Rule is a selector and a set of intentions to be executed when the
 selector is <code>true</code></p>
 
-<p>The following example instructs Mixer to invoke &lsquo;prometheus-handler&rsquo; handler for all services and pass it the
+<p>The following example instructs Mixer to invoke <code>prometheus-handler</code> handler for all services and pass it the
 instance constructed using the &lsquo;RequestCountByService&rsquo; instance.</p>
 
 <pre><code class="language-yaml">- match: match(destination.service.host, &quot;*&quot;)
diff --git a/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html b/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
index edc324f0e8..ed19826593 100644
--- a/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
+++ b/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
@@ -173,11 +173,11 @@ <h2 id="RbacConfig">RbacConfig</h2>
 <section>
 <p>RbacConfig defines the global config to control Istio RBAC behavior.
 This Custom Resource is a singleton where only one Custom Resource should be created globally in
-the mesh and the namespace should be the same to other Istio components, which usually is istio-system.
-Note: This is enforced in both istioctl and server side, new Custom Resource will be rejected if found any
+the mesh and the namespace should be the same to other Istio components, which usually is <code>istio-system</code>.
+Note: This is enforced in both <code>istioctl</code> and server side, new Custom Resource will be rejected if found any
 existing one, the user should either delete the existing one or change the existing one directly.</p>
 
-<p>Below is an example of RbacConfig object &ldquo;istio-rbac-config&rdquo; which enables Istio RBAC for all
+<p>Below is an example of an <code>RbacConfig</code> resource called <code>istio-rbac-config</code> which enables Istio RBAC for all
 services in the default namespace.</p>
 
 <pre><code class="language-yaml">apiVersion: &quot;rbac.istio.io/v1alpha1&quot;
diff --git a/rbac/v1alpha1/rbac.pb.go b/rbac/v1alpha1/rbac.pb.go
index 297f24ca19..dc346f1214 100644
--- a/rbac/v1alpha1/rbac.pb.go
+++ b/rbac/v1alpha1/rbac.pb.go
@@ -836,11 +836,11 @@ func (m *RoleRef) GetName() string {
 
 // RbacConfig defines the global config to control Istio RBAC behavior.
 // This Custom Resource is a singleton where only one Custom Resource should be created globally in
-// the mesh and the namespace should be the same to other Istio components, which usually is istio-system.
-// Note: This is enforced in both istioctl and server side, new Custom Resource will be rejected if found any
+// the mesh and the namespace should be the same to other Istio components, which usually is `istio-system`.
+// Note: This is enforced in both `istioctl` and server side, new Custom Resource will be rejected if found any
 // existing one, the user should either delete the existing one or change the existing one directly.
 //
-// Below is an example of RbacConfig object "istio-rbac-config" which enables Istio RBAC for all
+// Below is an example of an `RbacConfig` resource called `istio-rbac-config` which enables Istio RBAC for all
 // services in the default namespace.
 //
 // ```yaml
diff --git a/rbac/v1alpha1/rbac.proto b/rbac/v1alpha1/rbac.proto
index 85ea2a666f..a5a30608ec 100644
--- a/rbac/v1alpha1/rbac.proto
+++ b/rbac/v1alpha1/rbac.proto
@@ -296,11 +296,11 @@ message RoleRef {
 
 // RbacConfig defines the global config to control Istio RBAC behavior.
 // This Custom Resource is a singleton where only one Custom Resource should be created globally in
-// the mesh and the namespace should be the same to other Istio components, which usually is istio-system.
-// Note: This is enforced in both istioctl and server side, new Custom Resource will be rejected if found any
+// the mesh and the namespace should be the same to other Istio components, which usually is `istio-system`.
+// Note: This is enforced in both `istioctl` and server side, new Custom Resource will be rejected if found any
 // existing one, the user should either delete the existing one or change the existing one directly.
 //
-// Below is an example of RbacConfig object "istio-rbac-config" which enables Istio RBAC for all
+// Below is an example of an `RbacConfig` resource called `istio-rbac-config` which enables Istio RBAC for all
 // services in the default namespace.
 //
 // ```yaml
@@ -355,7 +355,7 @@ message RbacConfig {
 
   // $hide_from_docs
   // Indicates enforcement mode of the RbacConfig, in ENFORCED mode by default.
-  // It's used to verify new RbacConfig work as expected before rolling to production. 
+  // It's used to verify new RbacConfig work as expected before rolling to production.
   // When setting as PERMISSIVE, RBAC isn't enforced and has no impact on users.
   // RBAC engine run RbacConfig in PERMISSIVE mode and logs stats.
   // Invalid to set RbacConfig in PERMISSIVE and ServiceRoleBinding in ENFORCED mode.

From a68257e399a822e1797317563da8cc78edbde8c1 Mon Sep 17 00:00:00 2001
From: Martin Taillefer <geeknoid@users.noreply.github.com>
Date: Tue, 12 Mar 2019 07:00:59 -0700
Subject: [PATCH 05/10] Fix two more broken links. (#856)

---
 mixer/v1/attributes.pb.go                                   | 2 +-
 mixer/v1/attributes.proto                                   | 2 +-
 mixer/v1/config/client/istio.mixer.v1.config.client.pb.html | 2 +-
 mixer/v1/istio.mixer.v1.pb.html                             | 2 +-
 policy/v1beta1/cfg.pb.go                                    | 2 +-
 policy/v1beta1/cfg.proto                                    | 2 +-
 policy/v1beta1/istio.policy.v1beta1.pb.html                 | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/mixer/v1/attributes.pb.go b/mixer/v1/attributes.pb.go
index 00bad919e6..4b772b82d7 100644
--- a/mixer/v1/attributes.pb.go
+++ b/mixer/v1/attributes.pb.go
@@ -53,7 +53,7 @@ const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
 // specialized Mixer adapters and services can also generate attributes.
 //
 // The common baseline set of attributes available in most Istio deployments is defined
-// [here](https://istio.io/docs/reference/config/mixer/attribute-vocabulary.html).
+// [here](https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/).
 //
 // Attributes are strongly typed. The supported attribute types are defined by
 // [ValueType](https://github.com/istio/api/blob/master/policy/v1beta1/value_type.proto).
diff --git a/mixer/v1/attributes.proto b/mixer/v1/attributes.proto
index b2eb970280..32fa4fc8a5 100644
--- a/mixer/v1/attributes.proto
+++ b/mixer/v1/attributes.proto
@@ -51,7 +51,7 @@ option cc_enable_arenas = true;
 // specialized Mixer adapters and services can also generate attributes.
 //
 // The common baseline set of attributes available in most Istio deployments is defined
-// [here](https://istio.io/docs/reference/config/mixer/attribute-vocabulary.html).
+// [here](https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/).
 //
 // Attributes are strongly typed. The supported attribute types are defined by
 // [ValueType](https://github.com/istio/api/blob/master/policy/v1beta1/value_type.proto).
diff --git a/mixer/v1/config/client/istio.mixer.v1.config.client.pb.html b/mixer/v1/config/client/istio.mixer.v1.config.client.pb.html
index 90fdffac76..bd25751a32 100644
--- a/mixer/v1/config/client/istio.mixer.v1.config.client.pb.html
+++ b/mixer/v1/config/client/istio.mixer.v1.config.client.pb.html
@@ -1058,7 +1058,7 @@ <h2 id="istio-mixer-v1-Attributes">istio.mixer.v1.Attributes</h2>
 specialized Mixer adapters and services can also generate attributes.</p>
 
 <p>The common baseline set of attributes available in most Istio deployments is defined
-<a href="https://istio.io/docs/reference/config/mixer/attribute-vocabulary.html">here</a>.</p>
+<a href="https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/">here</a>.</p>
 
 <p>Attributes are strongly typed. The supported attribute types are defined by
 <a href="https://github.com/istio/api/blob/master/policy/v1beta1/value_type.proto">ValueType</a>.
diff --git a/mixer/v1/istio.mixer.v1.pb.html b/mixer/v1/istio.mixer.v1.pb.html
index e2d446ab96..1caee7a896 100644
--- a/mixer/v1/istio.mixer.v1.pb.html
+++ b/mixer/v1/istio.mixer.v1.pb.html
@@ -66,7 +66,7 @@ <h3 id="Attributes">Attributes</h3>
 specialized Mixer adapters and services can also generate attributes.</p>
 
 <p>The common baseline set of attributes available in most Istio deployments is defined
-<a href="https://istio.io/docs/reference/config/mixer/attribute-vocabulary.html">here</a>.</p>
+<a href="https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/">here</a>.</p>
 
 <p>Attributes are strongly typed. The supported attribute types are defined by
 <a href="https://github.com/istio/api/blob/master/policy/v1beta1/value_type.proto">ValueType</a>.
diff --git a/policy/v1beta1/cfg.pb.go b/policy/v1beta1/cfg.pb.go
index 5ddb5b7582..5481603161 100644
--- a/policy/v1beta1/cfg.pb.go
+++ b/policy/v1beta1/cfg.pb.go
@@ -131,7 +131,7 @@ type AttributeManifest struct {
 	// match the regular expression `[\.-]`.
 	//
 	// Attribute names must be unique within a single Istio deployment. The set of canonical
-	// attributes are described at [here](https://istio.io/docs/reference/attribute-vocabulary.html).
+	// attributes are described at [here](https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/).
 	// Attributes not in that list should be named with a component-specific suffix such as
 	// `request.count-my.component`.
 	Attributes map[string]*AttributeManifest_AttributeInfo `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
diff --git a/policy/v1beta1/cfg.proto b/policy/v1beta1/cfg.proto
index 5175e4acc9..1bdfbba788 100644
--- a/policy/v1beta1/cfg.proto
+++ b/policy/v1beta1/cfg.proto
@@ -91,7 +91,7 @@ message AttributeManifest {
   // match the regular expression `[\.-]`.
   //
   // Attribute names must be unique within a single Istio deployment. The set of canonical
-  // attributes are described at [here](https://istio.io/docs/reference/attribute-vocabulary.html).
+  // attributes are described at [here](https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/).
   // Attributes not in that list should be named with a component-specific suffix such as
   // `request.count-my.component`.
   map<string, AttributeInfo> attributes = 3;
diff --git a/policy/v1beta1/istio.policy.v1beta1.pb.html b/policy/v1beta1/istio.policy.v1beta1.pb.html
index 147eda3f17..f92ca16ff6 100644
--- a/policy/v1beta1/istio.policy.v1beta1.pb.html
+++ b/policy/v1beta1/istio.policy.v1beta1.pb.html
@@ -107,7 +107,7 @@ <h2 id="AttributeManifest">AttributeManifest</h2>
 match the regular expression <code>[\.-]</code>.</p>
 
 <p>Attribute names must be unique within a single Istio deployment. The set of canonical
-attributes are described at <a href="https://istio.io/docs/reference/attribute-vocabulary.html">here</a>.
+attributes are described at <a href="https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/">here</a>.
 Attributes not in that list should be named with a component-specific suffix such as
 <code>request.count-my.component</code>.</p>
 

From 9dca77f8a66a3ac67eeae2e758baa288eb396bc7 Mon Sep 17 00:00:00 2001
From: Ed Snible <esnible@acm.org>
Date: Thu, 14 Mar 2019 10:59:11 -0400
Subject: [PATCH 06/10] Fix CRD examples for release-1.1 (#859)

---
 .../istio.authentication.v1alpha1.pb.html     |  4 +-
 authentication/v1alpha1/policy.pb.go          |  4 +-
 authentication/v1alpha1/policy.proto          |  4 +-
 networking/v1alpha3/gateway.pb.go             | 10 +--
 networking/v1alpha3/gateway.pb.html           | 10 +--
 networking/v1alpha3/gateway.proto             | 10 +--
 networking/v1alpha3/virtual_service.pb.go     |  2 +-
 networking/v1alpha3/virtual_service.pb.html   |  2 +-
 networking/v1alpha3/virtual_service.proto     |  2 +-
 rbac/v1alpha1/istio.rbac.v1alpha1.pb.html     | 64 +------------------
 rbac/v1alpha1/rbac.pb.go                      |  5 +-
 rbac/v1alpha1/rbac.proto                      |  5 +-
 12 files changed, 32 insertions(+), 90 deletions(-)

diff --git a/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html b/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
index 4d144436f4..3afec5755f 100644
--- a/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
+++ b/authentication/v1alpha1/istio.authentication.v1alpha1.pb.html
@@ -353,7 +353,7 @@ <h2 id="Policy">Policy</h2>
 <pre><code class="language-yaml">apiVersion: authentication.istio.io/v1alpha1
 kind: Policy
 metadata:
-  name: productpage_mTLS_disable
+  name: productpage-mTLS-disable
   namespace: frod
 spec:
   targets:
@@ -366,7 +366,7 @@ <h2 id="Policy">Policy</h2>
 <pre><code class="language-yaml">apiVersion: authentication.istio.io/v1alpha1
 kind: Policy
 metadata:
-  name: productpage_mTLS_with_JWT
+  name: productpage-mTLS-with-JWT
   namespace: frod
 spec:
   target:
diff --git a/authentication/v1alpha1/policy.pb.go b/authentication/v1alpha1/policy.pb.go
index 9dd5783f15..d9d92c3f20 100644
--- a/authentication/v1alpha1/policy.pb.go
+++ b/authentication/v1alpha1/policy.pb.go
@@ -838,7 +838,7 @@ func (m *OriginAuthenticationMethod) GetJwt() *Jwt {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_disable
+//   name: productpage-mTLS-disable
 //   namespace: frod
 // spec:
 //   targets:
@@ -851,7 +851,7 @@ func (m *OriginAuthenticationMethod) GetJwt() *Jwt {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_with_JWT
+//   name: productpage-mTLS-with-JWT
 //   namespace: frod
 // spec:
 //   target:
diff --git a/authentication/v1alpha1/policy.proto b/authentication/v1alpha1/policy.proto
index f9156eb75b..42638a542d 100644
--- a/authentication/v1alpha1/policy.proto
+++ b/authentication/v1alpha1/policy.proto
@@ -274,7 +274,7 @@ enum PrincipalBinding {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_disable
+//   name: productpage-mTLS-disable
 //   namespace: frod
 // spec:
 //   targets:
@@ -287,7 +287,7 @@ enum PrincipalBinding {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_with_JWT
+//   name: productpage-mTLS-with-JWT
 //   namespace: frod
 // spec:
 //   target:
diff --git a/networking/v1alpha3/gateway.pb.go b/networking/v1alpha3/gateway.pb.go
index 5764c93c26..16a2c07e4b 100644
--- a/networking/v1alpha3/gateway.pb.go
+++ b/networking/v1alpha3/gateway.pb.go
@@ -35,7 +35,7 @@
 //       httpsRedirect: true # sends 301 redirect for http requests
 //   - port:
 //       number: 443
-//       name: https
+//       name: https-443
 //       protocol: HTTPS
 //     hosts:
 //     - uk.bookinfo.com
@@ -46,7 +46,7 @@
 //       privateKey: /etc/certs/privatekey.pem
 //   - port:
 //       number: 9443
-//       name: https
+//       name: https-9443
 //       protocol: HTTPS
 //     hosts:
 //     - "bookinfo-namespace/*.bookinfo.com"
@@ -100,19 +100,19 @@
 //   - match:
 //     - headers:
 //         cookie:
-//           user: dev-123
+//           exact: "user=dev-123"
 //     route:
 //     - destination:
 //         port:
 //           number: 7777
 //         host: reviews.qa.svc.cluster.local
 //   - match:
-//       uri:
+//     - uri:
 //         prefix: /reviews/
 //     route:
 //     - destination:
 //         port:
-//           number: 9080 # can be omitted if its the only port for reviews
+//           number: 9080 # can be omitted if it's the only port for reviews
 //         host: reviews.prod.svc.cluster.local
 //       weight: 80
 //     - destination:
diff --git a/networking/v1alpha3/gateway.pb.html b/networking/v1alpha3/gateway.pb.html
index 670df0918e..d47131deaf 100644
--- a/networking/v1alpha3/gateway.pb.html
+++ b/networking/v1alpha3/gateway.pb.html
@@ -39,7 +39,7 @@
       httpsRedirect: true # sends 301 redirect for http requests
   - port:
       number: 443
-      name: https
+      name: https-443
       protocol: HTTPS
     hosts:
     - uk.bookinfo.com
@@ -50,7 +50,7 @@
       privateKey: /etc/certs/privatekey.pem
   - port:
       number: 9443
-      name: https
+      name: https-9443
       protocol: HTTPS
     hosts:
     - &quot;bookinfo-namespace/*.bookinfo.com&quot;
@@ -103,19 +103,19 @@
   - match:
     - headers:
         cookie:
-          user: dev-123
+          exact: &quot;user=dev-123&quot;
     route:
     - destination:
         port:
           number: 7777
         host: reviews.qa.svc.cluster.local
   - match:
-      uri:
+    - uri:
         prefix: /reviews/
     route:
     - destination:
         port:
-          number: 9080 # can be omitted if its the only port for reviews
+          number: 9080 # can be omitted if it's the only port for reviews
         host: reviews.prod.svc.cluster.local
       weight: 80
     - destination:
diff --git a/networking/v1alpha3/gateway.proto b/networking/v1alpha3/gateway.proto
index 4ae5e7983c..838863d60d 100644
--- a/networking/v1alpha3/gateway.proto
+++ b/networking/v1alpha3/gateway.proto
@@ -52,7 +52,7 @@ syntax = "proto3";
 //       httpsRedirect: true # sends 301 redirect for http requests
 //   - port:
 //       number: 443
-//       name: https
+//       name: https-443
 //       protocol: HTTPS
 //     hosts:
 //     - uk.bookinfo.com
@@ -63,7 +63,7 @@ syntax = "proto3";
 //       privateKey: /etc/certs/privatekey.pem
 //   - port:
 //       number: 9443
-//       name: https
+//       name: https-9443
 //       protocol: HTTPS
 //     hosts:
 //     - "bookinfo-namespace/*.bookinfo.com"
@@ -117,19 +117,19 @@ syntax = "proto3";
 //   - match:
 //     - headers:
 //         cookie:
-//           user: dev-123
+//           exact: "user=dev-123"
 //     route:
 //     - destination:
 //         port:
 //           number: 7777
 //         host: reviews.qa.svc.cluster.local
 //   - match:
-//       uri:
+//     - uri:
 //         prefix: /reviews/
 //     route:
 //     - destination:
 //         port:
-//           number: 9080 # can be omitted if its the only port for reviews
+//           number: 9080 # can be omitted if it's the only port for reviews
 //         host: reviews.prod.svc.cluster.local
 //       weight: 80
 //     - destination:
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index e6f416e349..e6e308c54c 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -2090,7 +2090,7 @@ func (m *HTTPRetry) GetRetryOn() string {
 //       allowCredentials: false
 //       allowHeaders:
 //       - X-Foo-Bar
-//       maxAge: "1d"
+//       maxAge: "24h"
 // ```
 //
 type CorsPolicy struct {
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index 553bd484ee..ab9cb8215c 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -123,7 +123,7 @@ <h2 id="CorsPolicy">CorsPolicy</h2>
       allowCredentials: false
       allowHeaders:
       - X-Foo-Bar
-      maxAge: &quot;1d&quot;
+      maxAge: &quot;24h&quot;
 </code></pre>
 
 <table class="message-fields">
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index f69937399e..29562447e4 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -951,7 +951,7 @@ message HTTPRetry {
 //       allowCredentials: false
 //       allowHeaders:
 //       - X-Foo-Bar
-//       maxAge: "1d"
+//       maxAge: "24h"
 // ```
 //
 message CorsPolicy {
diff --git a/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html b/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
index ed19826593..a7ef8cbbbe 100644
--- a/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
+++ b/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html
@@ -4,7 +4,7 @@
 location: https://istio.io/docs/reference/config/authorization/istio.rbac.v1alpha1.html
 layout: protoc-gen-docs
 generator: protoc-gen-docs
-number_of_entries: 9
+number_of_entries: 8
 ---
 <p>Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding
 objects.</p>
@@ -37,7 +37,7 @@
     methods: [&quot;GET&quot;, &quot;HEAD&quot;]
     constraints:
     - key: &quot;destination.labels[version]&quot;
-      value: [&quot;v1&quot;, &quot;v2&quot;]
+      values: [&quot;v1&quot;, &quot;v2&quot;]
 </code></pre>
 
 <p>A ServiceRoleBinding specification includes two parts:</p>
@@ -164,66 +164,6 @@ <h2 id="AccessRule-Constraint">AccessRule.Constraint</h2>
 For example, the value &ldquo;v1alpha2&rdquo; matches &ldquo;v1alpha2&rdquo; (exact match),
 or &ldquo;v1<em>&rdquo; (prefix match), or &ldquo;</em>alpha2&rdquo; (suffix match).</p>
 
-</td>
-</tr>
-</tbody>
-</table>
-</section>
-<h2 id="RbacConfig">RbacConfig</h2>
-<section>
-<p>RbacConfig defines the global config to control Istio RBAC behavior.
-This Custom Resource is a singleton where only one Custom Resource should be created globally in
-the mesh and the namespace should be the same to other Istio components, which usually is <code>istio-system</code>.
-Note: This is enforced in both <code>istioctl</code> and server side, new Custom Resource will be rejected if found any
-existing one, the user should either delete the existing one or change the existing one directly.</p>
-
-<p>Below is an example of an <code>RbacConfig</code> resource called <code>istio-rbac-config</code> which enables Istio RBAC for all
-services in the default namespace.</p>
-
-<pre><code class="language-yaml">apiVersion: &quot;rbac.istio.io/v1alpha1&quot;
-kind: RbacConfig
-metadata:
-  name: default
-  namespace: istio-system
-spec:
-  mode: ON_WITH_INCLUSION
-  inclusion:
-    namespaces: [ &quot;default&quot; ]
-</code></pre>
-
-<table class="message-fields">
-<thead>
-<tr>
-<th>Field</th>
-<th>Type</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr id="RbacConfig-mode">
-<td><code>mode</code></td>
-<td><code><a href="#RbacConfig-Mode">RbacConfig.Mode</a></code></td>
-<td>
-<p>Istio RBAC mode.</p>
-
-</td>
-</tr>
-<tr id="RbacConfig-inclusion">
-<td><code>inclusion</code></td>
-<td><code><a href="#RbacConfig-Target">RbacConfig.Target</a></code></td>
-<td>
-<p>A list of services or namespaces that should be enforced by Istio RBAC policies. Note: This field have
-effect only when mode is ON<em>WITH</em>INCLUSION and will be ignored for any other modes.</p>
-
-</td>
-</tr>
-<tr id="RbacConfig-exclusion">
-<td><code>exclusion</code></td>
-<td><code><a href="#RbacConfig-Target">RbacConfig.Target</a></code></td>
-<td>
-<p>A list of services or namespaces that should not be enforced by Istio RBAC policies. Note: This field have
-effect only when mode is ON<em>WITH</em>EXCLUSION and will be ignored for any other modes.</p>
-
 </td>
 </tr>
 </tbody>
diff --git a/rbac/v1alpha1/rbac.pb.go b/rbac/v1alpha1/rbac.pb.go
index dc346f1214..cce0b6f94b 100644
--- a/rbac/v1alpha1/rbac.pb.go
+++ b/rbac/v1alpha1/rbac.pb.go
@@ -31,7 +31,7 @@
 //     methods: ["GET", "HEAD"]
 //     constraints:
 //     - key: "destination.labels[version]"
-//       value: ["v1", "v2"]
+//       values: ["v1", "v2"]
 // ```
 //
 // A ServiceRoleBinding specification includes two parts:
@@ -834,7 +834,8 @@ func (m *RoleRef) GetName() string {
 	return ""
 }
 
-// RbacConfig defines the global config to control Istio RBAC behavior.
+// $hide_from_docs
+// RbacConfig is deprecated.  RbacConfig defined the global config to control Istio RBAC behavior.
 // This Custom Resource is a singleton where only one Custom Resource should be created globally in
 // the mesh and the namespace should be the same to other Istio components, which usually is `istio-system`.
 // Note: This is enforced in both `istioctl` and server side, new Custom Resource will be rejected if found any
diff --git a/rbac/v1alpha1/rbac.proto b/rbac/v1alpha1/rbac.proto
index a5a30608ec..292e9b8a47 100644
--- a/rbac/v1alpha1/rbac.proto
+++ b/rbac/v1alpha1/rbac.proto
@@ -48,7 +48,7 @@ syntax = "proto3";
 //     methods: ["GET", "HEAD"]
 //     constraints:
 //     - key: "destination.labels[version]"
-//       value: ["v1", "v2"]
+//       values: ["v1", "v2"]
 // ```
 //
 // A ServiceRoleBinding specification includes two parts:
@@ -294,7 +294,8 @@ message RoleRef {
   string name = 2;
 }
 
-// RbacConfig defines the global config to control Istio RBAC behavior.
+// $hide_from_docs
+// RbacConfig is deprecated.  RbacConfig defined the global config to control Istio RBAC behavior.
 // This Custom Resource is a singleton where only one Custom Resource should be created globally in
 // the mesh and the namespace should be the same to other Istio components, which usually is `istio-system`.
 // Note: This is enforced in both `istioctl` and server side, new Custom Resource will be rejected if found any

From 032fe83d8cada35da33886eb4b3afd1b99aa2f30 Mon Sep 17 00:00:00 2001
From: Zhonghu Xu <xuzhonghu@huawei.com>
Date: Mon, 18 Mar 2019 07:14:53 +0800
Subject: [PATCH 07/10] fix MeshNetworks demo (#841)

* fix MeshNetworks demo

* generate

* update
---
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html | 11 +++++++----
 mesh/v1alpha1/network.pb.go               |  9 ++++++---
 mesh/v1alpha1/network.proto               | 11 +++++++----
 3 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index 0a654fad29..150a426ec9 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -620,12 +620,15 @@ <h2 id="MeshNetworks">MeshNetworks</h2>
 
 <p>MeshNetworks(file/config map):
 networks:
-- network1:
+  network1:
   - endpoints:
-    - fromRegistry: registry1 #must match secret name inKubernetes
+    - fromRegistry: registry1 #must match secret name in Kubernetes
     - fromCidr: 192.168.100.0/22 #a VM network for example
     gateways:
     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+      port: 15443
+      locality: us-east-1a
+    - address: 192.168.100.1
       port: 15443
       locality: us-east-1a</p>
 
@@ -760,8 +763,8 @@ <h2 id="Network-NetworkEndpoints">Network.NetworkEndpoints</h2>
 <li><p>Explicitly:</p></li>
 </ol>
 
-<p>a. By matching the registry name with one of the &ldquo;from<em>registries&rdquo;
-   in the mesh config. A &ldquo;from</em>registry&rdquo; can only be assigned to a
+<p>a. By matching the registry name with one of the &ldquo;fromRegistry&rdquo;
+   in the mesh config. A &ldquo;from_registry&rdquo; can only be assigned to a
    single network.</p>
 
 <p>b. By matching the IP against one of the CIDR ranges in a mesh
diff --git a/mesh/v1alpha1/network.pb.go b/mesh/v1alpha1/network.pb.go
index ccd7f8e0b7..165fc80fa1 100644
--- a/mesh/v1alpha1/network.pb.go
+++ b/mesh/v1alpha1/network.pb.go
@@ -96,7 +96,7 @@ func (m *Network) GetGateways() []*Network_IstioNetworkGateway {
 //
 // 2. Explicitly:
 //
-//    a. By matching the registry name with one of the "from_registries"
+//    a. By matching the registry name with one of the "fromRegistry"
 //    in the mesh config. A "from_registry" can only be assigned to a
 //    single network.
 //
@@ -423,14 +423,17 @@ func _Network_IstioNetworkGateway_OneofSizer(msg proto.Message) (n int) {
 //
 // MeshNetworks(file/config map):
 // networks:
-// - network1:
+//   network1:
 //   - endpoints:
-//     - fromRegistry: registry1 #must match secret name inKubernetes
+//     - fromRegistry: registry1 #must match secret name in Kubernetes
 //     - fromCidr: 192.168.100.0/22 #a VM network for example
 //     gateways:
 //     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
 //       port: 15443
 //       locality: us-east-1a
+//     - address: 192.168.100.1
+//       port: 15443
+//       locality: us-east-1a
 type MeshNetworks struct {
 	// REQUIRED: The set of networks inside this mesh. Each network should
 	// have a unique name and information about how to infer the endpoints in
diff --git a/mesh/v1alpha1/network.proto b/mesh/v1alpha1/network.proto
index 8260072a34..126d1212e6 100644
--- a/mesh/v1alpha1/network.proto
+++ b/mesh/v1alpha1/network.proto
@@ -35,7 +35,7 @@ message Network {
   //
   // 2. Explicitly:
   //
-  //    a. By matching the registry name with one of the "from_registries"
+  //    a. By matching the registry name with one of the "fromRegistry"
   //    in the mesh config. A "from_registry" can only be assigned to a
   //    single network.
   //
@@ -97,17 +97,20 @@ message Network {
 //
 // MeshNetworks(file/config map):
 // networks:
-// - network1:
+//   network1:
 //   - endpoints:
-//     - fromRegistry: registry1 #must match secret name inKubernetes
+//     - fromRegistry: registry1 #must match secret name in Kubernetes
 //     - fromCidr: 192.168.100.0/22 #a VM network for example
 //     gateways:
 //     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
 //       port: 15443
 //       locality: us-east-1a
+//     - address: 192.168.100.1
+//       port: 15443
+//       locality: us-east-1a
 message MeshNetworks {
   // REQUIRED: The set of networks inside this mesh. Each network should
   // have a unique name and information about how to infer the endpoints in
   // the network as well as the gateways associated with the network.
   map<string, Network> networks = 1;
-}
\ No newline at end of file
+}

From c1e0c866cf64488f530e2a6d59eeef25c785d1e5 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <rshriram@users.noreply.github.com>
Date: Tue, 19 Mar 2019 12:40:20 -0400
Subject: [PATCH 08/10] last minute doc fixes (#865)

Signed-off-by: Shriram Rajagopalan <rshriram@gmail.com>
---
 networking/v1alpha3/envoy_filter.pb.go      | 19 ++++++++++---------
 networking/v1alpha3/envoy_filter.pb.html    | 21 +++++++++++----------
 networking/v1alpha3/envoy_filter.proto      | 19 ++++++++++---------
 networking/v1alpha3/sidecar.pb.go           |  3 +--
 networking/v1alpha3/sidecar.pb.html         |  3 +--
 networking/v1alpha3/sidecar.proto           |  3 +--
 networking/v1alpha3/virtual_service.pb.go   |  6 +++---
 networking/v1alpha3/virtual_service.pb.html |  6 +++---
 networking/v1alpha3/virtual_service.proto   |  6 +++---
 9 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/networking/v1alpha3/envoy_filter.pb.go b/networking/v1alpha3/envoy_filter.pb.go
index bbe92a378f..f35e7da8ea 100644
--- a/networking/v1alpha3/envoy_filter.pb.go
+++ b/networking/v1alpha3/envoy_filter.pb.go
@@ -17,7 +17,7 @@
 // with each other.
 //
 // The following example for Kubernetes enables Envoy's Lua filter for all
-// inbound calls arriving at service port 8080 of the reviews service pod with
+// inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
 //
 // ```yaml
@@ -32,6 +32,7 @@
 //   - listenerMatch:
 //       portNumber: 8080
 //       listenerType: SIDECAR_INBOUND # will match with the inbound listener for reviews:8080
+//       listenerProtocol: HTTP
 //     filterName: envoy.lua
 //     filterType: HTTP
 //     filterConfig:
@@ -200,9 +201,6 @@ type EnvoyFilter struct {
 	// example, the scope includes pods running in all reachable
 	// namespaces. Omitting the selector applies the filter to all proxies in
 	// the mesh.
-	// NOTE: There can be only one EnvoyFilter bound to a specific workload.
-	// The behavior is undefined if multiple EnvoyFilter configurations are
-	// specified for the same workload.
 	WorkloadLabels map[string]string `protobuf:"bytes,1,rep,name=workload_labels,json=workloadLabels,proto3" json:"workload_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// REQUIRED: Envoy network filters/http filters to be added to matching
 	// listeners.  When adding network filters to http connections, care
@@ -278,11 +276,11 @@ type EnvoyFilter_ListenerMatch struct {
 	// Inbound vs outbound sidecar listener or gateway listener. If not specified,
 	// matches all listeners.
 	ListenerType EnvoyFilter_ListenerMatch_ListenerType `protobuf:"varint,3,opt,name=listener_type,json=listenerType,proto3,enum=istio.networking.v1alpha3.EnvoyFilter_ListenerMatch_ListenerType" json:"listener_type,omitempty"`
-	// Selects a class of listeners for the same protocol. If not
-	// specified, applies to listeners on all protocols. Use the protocol
+	// Selects a class of listeners for the same protocol. Use the protocol
 	// selection to select all HTTP listeners (includes HTTP2/gRPC/HTTPS
 	// where Envoy terminates TLS) or all TCP listeners (includes HTTPS
-	// passthrough using SNI).
+	// passthrough using SNI). When adding a HTTP filter, the listenerProtocol
+	// should be set to HTTP.
 	ListenerProtocol EnvoyFilter_ListenerMatch_ListenerProtocol `protobuf:"varint,4,opt,name=listener_protocol,json=listenerProtocol,proto3,enum=istio.networking.v1alpha3.EnvoyFilter_ListenerMatch_ListenerProtocol" json:"listener_protocol,omitempty"`
 	// One or more IP addresses to which the listener is bound. If
 	// specified, should match at least one address in the list.
@@ -421,8 +419,11 @@ func (m *EnvoyFilter_InsertPosition) GetRelativeTo() string {
 
 // Envoy filters to be added to a network or http filter chain.
 type EnvoyFilter_Filter struct {
-	// Filter will be added to the listener only if the match conditions are true.
-	// If not specified, the filters will be applied to all listeners.
+	// Filter will be added to the listener only if the match
+	// conditions are true.  If not specified, the filters will be
+	// applied to all listeners where possible, potentially resulting
+	// in invalid configurations. It is recommended to specify the
+	// listener match criteria for all filter insertions.
 	ListenerMatch *EnvoyFilter_ListenerMatch `protobuf:"bytes,1,opt,name=listener_match,json=listenerMatch,proto3" json:"listener_match,omitempty"`
 	// Insert position in the filter chain. Defaults to FIRST
 	InsertPosition *EnvoyFilter_InsertPosition `protobuf:"bytes,2,opt,name=insert_position,json=insertPosition,proto3" json:"insert_position,omitempty"`
diff --git a/networking/v1alpha3/envoy_filter.pb.html b/networking/v1alpha3/envoy_filter.pb.html
index 3144a0d15d..2b4a7e7345 100644
--- a/networking/v1alpha3/envoy_filter.pb.html
+++ b/networking/v1alpha3/envoy_filter.pb.html
@@ -22,7 +22,7 @@
 with each other.</p>
 
 <p>The following example for Kubernetes enables Envoy&rsquo;s Lua filter for all
-inbound calls arriving at service port 8080 of the reviews service pod with
+inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 labels &ldquo;app: reviews&rdquo;.</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
@@ -36,6 +36,7 @@
   - listenerMatch:
       portNumber: 8080
       listenerType: SIDECAR_INBOUND # will match with the inbound listener for reviews:8080
+      listenerProtocol: HTTP
     filterName: envoy.lua
     filterType: HTTP
     filterConfig:
@@ -63,10 +64,7 @@ <h2 id="EnvoyFilter">EnvoyFilter</h2>
 scope of label search is platform dependent. On Kubernetes, for
 example, the scope includes pods running in all reachable
 namespaces. Omitting the selector applies the filter to all proxies in
-the mesh.
-NOTE: There can be only one EnvoyFilter bound to a specific workload.
-The behavior is undefined if multiple EnvoyFilter configurations are
-specified for the same workload.</p>
+the mesh.</p>
 
 </td>
 </tr>
@@ -101,8 +99,11 @@ <h2 id="EnvoyFilter-Filter">EnvoyFilter.Filter</h2>
 <td><code>listenerMatch</code></td>
 <td><code><a href="#EnvoyFilter-ListenerMatch">EnvoyFilter.ListenerMatch</a></code></td>
 <td>
-<p>Filter will be added to the listener only if the match conditions are true.
-If not specified, the filters will be applied to all listeners.</p>
+<p>Filter will be added to the listener only if the match
+conditions are true.  If not specified, the filters will be
+applied to all listeners where possible, potentially resulting
+in invalid configurations. It is recommended to specify the
+listener match criteria for all filter insertions.</p>
 
 </td>
 </tr>
@@ -303,11 +304,11 @@ <h2 id="EnvoyFilter-ListenerMatch">EnvoyFilter.ListenerMatch</h2>
 <td><code>listenerProtocol</code></td>
 <td><code><a href="#EnvoyFilter-ListenerMatch-ListenerProtocol">EnvoyFilter.ListenerMatch.ListenerProtocol</a></code></td>
 <td>
-<p>Selects a class of listeners for the same protocol. If not
-specified, applies to listeners on all protocols. Use the protocol
+<p>Selects a class of listeners for the same protocol. Use the protocol
 selection to select all HTTP listeners (includes HTTP2/gRPC/HTTPS
 where Envoy terminates TLS) or all TCP listeners (includes HTTPS
-passthrough using SNI).</p>
+passthrough using SNI). When adding a HTTP filter, the listenerProtocol
+should be set to HTTP.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/envoy_filter.proto b/networking/v1alpha3/envoy_filter.proto
index 6f271d1f0a..acc76ce364 100644
--- a/networking/v1alpha3/envoy_filter.proto
+++ b/networking/v1alpha3/envoy_filter.proto
@@ -36,7 +36,7 @@ import "google/protobuf/struct.proto";
 // with each other.
 //
 // The following example for Kubernetes enables Envoy's Lua filter for all
-// inbound calls arriving at service port 8080 of the reviews service pod with
+// inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
 //
 // ```yaml
@@ -51,6 +51,7 @@ import "google/protobuf/struct.proto";
 //   - listenerMatch:
 //       portNumber: 8080
 //       listenerType: SIDECAR_INBOUND # will match with the inbound listener for reviews:8080
+//       listenerProtocol: HTTP
 //     filterName: envoy.lua
 //     filterType: HTTP
 //     filterConfig:
@@ -68,9 +69,6 @@ message EnvoyFilter {
   // example, the scope includes pods running in all reachable
   // namespaces. Omitting the selector applies the filter to all proxies in
   // the mesh.
-  // NOTE: There can be only one EnvoyFilter bound to a specific workload.
-  // The behavior is undefined if multiple EnvoyFilter configurations are
-  // specified for the same workload.
   map<string, string> workload_labels = 1;
 
   // Select a listener to add the filter to based on the match conditions.
@@ -116,11 +114,11 @@ message EnvoyFilter {
       TCP = 2;
     };
 
-    // Selects a class of listeners for the same protocol. If not
-    // specified, applies to listeners on all protocols. Use the protocol
+    // Selects a class of listeners for the same protocol. Use the protocol
     // selection to select all HTTP listeners (includes HTTP2/gRPC/HTTPS
     // where Envoy terminates TLS) or all TCP listeners (includes HTTPS
-    // passthrough using SNI).
+    // passthrough using SNI). When adding a HTTP filter, the listenerProtocol
+    // should be set to HTTP.
     ListenerProtocol listener_protocol = 4;
 
     // One or more IP addresses to which the listener is bound. If
@@ -155,8 +153,11 @@ message EnvoyFilter {
 
   // Envoy filters to be added to a network or http filter chain.
   message Filter {
-    // Filter will be added to the listener only if the match conditions are true.
-    // If not specified, the filters will be applied to all listeners.
+    // Filter will be added to the listener only if the match
+    // conditions are true.  If not specified, the filters will be
+    // applied to all listeners where possible, potentially resulting
+    // in invalid configurations. It is recommended to specify the
+    // listener match criteria for all filter insertions.
     ListenerMatch listener_match = 1;
 
     // Insert position in the filter chain. Defaults to FIRST
diff --git a/networking/v1alpha3/sidecar.pb.go b/networking/v1alpha3/sidecar.pb.go
index dfc84815f8..8253f56fe1 100644
--- a/networking/v1alpha3/sidecar.pb.go
+++ b/networking/v1alpha3/sidecar.pb.go
@@ -239,8 +239,7 @@ func (CaptureMode) EnumDescriptor() ([]byte, []int) {
 type Sidecar struct {
 	// Criteria used to select the specific set of pods/VMs on which this
 	// sidecar configuration should be applied. If omitted, the sidecar
-	// configuration will be applied to all workloads in the same config
-	// namespace.
+	// configuration will be applied to all workloads in the same namespace.
 	WorkloadSelector *WorkloadSelector `protobuf:"bytes,1,opt,name=workload_selector,json=workloadSelector,proto3" json:"workload_selector,omitempty"`
 	// Ingress specifies the configuration of the sidecar for processing
 	// inbound traffic to the attached workload. If omitted, Istio will
diff --git a/networking/v1alpha3/sidecar.pb.html b/networking/v1alpha3/sidecar.pb.html
index a4a209a5bf..229a3860c6 100644
--- a/networking/v1alpha3/sidecar.pb.html
+++ b/networking/v1alpha3/sidecar.pb.html
@@ -380,8 +380,7 @@ <h2 id="Sidecar">Sidecar</h2>
 <td>
 <p>Criteria used to select the specific set of pods/VMs on which this
 sidecar configuration should be applied. If omitted, the sidecar
-configuration will be applied to all workloads in the same config
-namespace.</p>
+configuration will be applied to all workloads in the same namespace.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/sidecar.proto b/networking/v1alpha3/sidecar.proto
index 3e05e714a2..85d8b26fa0 100644
--- a/networking/v1alpha3/sidecar.proto
+++ b/networking/v1alpha3/sidecar.proto
@@ -204,8 +204,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 message Sidecar {
   // Criteria used to select the specific set of pods/VMs on which this
   // sidecar configuration should be applied. If omitted, the sidecar
-  // configuration will be applied to all workloads in the same config
-  // namespace.
+  // configuration will be applied to all workloads in the same namespace.
   WorkloadSelector workload_selector = 1;
 
   // Ingress specifies the configuration of the sidecar for processing
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index e6e308c54c..e39c639251 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -1641,9 +1641,9 @@ func (m *TLSMatchAttributes) GetGateways() []string {
 //   - match:
 //     - uri:
 //         exact: /v1/getProductRatings
-//   redirect:
-//     uri: /v1/bookRatings
-//     authority: newratings.default.svc.cluster.local
+//     redirect:
+//       uri: /v1/bookRatings
+//       authority: newratings.default.svc.cluster.local
 //   ...
 // ```
 type HTTPRedirect struct {
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index ab9cb8215c..aa61515fe1 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -734,9 +734,9 @@ <h2 id="HTTPRedirect">HTTPRedirect</h2>
   - match:
     - uri:
         exact: /v1/getProductRatings
-  redirect:
-    uri: /v1/bookRatings
-    authority: newratings.default.svc.cluster.local
+    redirect:
+      uri: /v1/bookRatings
+      authority: newratings.default.svc.cluster.local
   ...
 </code></pre>
 
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index 29562447e4..bae9cce4fa 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -814,9 +814,9 @@ message TLSMatchAttributes {
 //   - match:
 //     - uri:
 //         exact: /v1/getProductRatings
-//   redirect:
-//     uri: /v1/bookRatings
-//     authority: newratings.default.svc.cluster.local
+//     redirect:
+//       uri: /v1/bookRatings
+//       authority: newratings.default.svc.cluster.local
 //   ...
 // ```
 message HTTPRedirect {

From 15246b7701a88c736f2272e6bff16821897a5ee9 Mon Sep 17 00:00:00 2001
From: Scott Ganyo <scott@ganyo.com>
Date: Thu, 7 Mar 2019 13:36:31 -0800
Subject: [PATCH 09/10] fix EnvoyFilter docs

---
 networking/v1alpha3/envoy_filter.proto | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/networking/v1alpha3/envoy_filter.proto b/networking/v1alpha3/envoy_filter.proto
index acc76ce364..a0aab1b727 100644
--- a/networking/v1alpha3/envoy_filter.proto
+++ b/networking/v1alpha3/envoy_filter.proto
@@ -35,6 +35,9 @@ import "google/protobuf/struct.proto";
 // The behavior is undefined if multiple EnvoyFilter configurations conflict
 // with each other.
 //
+// NOTE 3: For filters of `filterType: HTTP` you must include a `listenerMatch` section
+// with a `listenerProtocol: HTTP` or the filter have no effect.
+//
 // The following example for Kubernetes enables Envoy's Lua filter for all
 // inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
@@ -63,7 +66,7 @@ package istio.networking.v1alpha3;
 option go_package = "istio.io/api/networking/v1alpha3";
 
 message EnvoyFilter {
-  // One or more labels that indicate a specific set of pods/VMs whose
+  // Zero or more labels that indicate a specific set of pods/VMs whose
   // proxies should be configured to use these additional filters.  The
   // scope of label search is platform dependent. On Kubernetes, for
   // example, the scope includes pods running in all reachable

From a7fda490e755ed5d07ca379897aedd43349fd42d Mon Sep 17 00:00:00 2001
From: Scott Ganyo <scott@ganyo.com>
Date: Tue, 19 Mar 2019 10:31:31 -0700
Subject: [PATCH 10/10] make docs for proto

---
 networking/v1alpha3/envoy_filter.pb.go   | 5 ++++-
 networking/v1alpha3/envoy_filter.pb.html | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/networking/v1alpha3/envoy_filter.pb.go b/networking/v1alpha3/envoy_filter.pb.go
index f35e7da8ea..5f7a23157f 100644
--- a/networking/v1alpha3/envoy_filter.pb.go
+++ b/networking/v1alpha3/envoy_filter.pb.go
@@ -16,6 +16,9 @@
 // The behavior is undefined if multiple EnvoyFilter configurations conflict
 // with each other.
 //
+// NOTE 3: For filters of `filterType: HTTP` you must include a `listenerMatch` section
+// with a `listenerProtocol: HTTP` or the filter have no effect.
+//
 // The following example for Kubernetes enables Envoy's Lua filter for all
 // inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
@@ -195,7 +198,7 @@ func (EnvoyFilter_Filter_FilterType) EnumDescriptor() ([]byte, []int) {
 }
 
 type EnvoyFilter struct {
-	// One or more labels that indicate a specific set of pods/VMs whose
+	// Zero or more labels that indicate a specific set of pods/VMs whose
 	// proxies should be configured to use these additional filters.  The
 	// scope of label search is platform dependent. On Kubernetes, for
 	// example, the scope includes pods running in all reachable
diff --git a/networking/v1alpha3/envoy_filter.pb.html b/networking/v1alpha3/envoy_filter.pb.html
index 2b4a7e7345..d2be82dc02 100644
--- a/networking/v1alpha3/envoy_filter.pb.html
+++ b/networking/v1alpha3/envoy_filter.pb.html
@@ -21,6 +21,9 @@
 The behavior is undefined if multiple EnvoyFilter configurations conflict
 with each other.</p>
 
+<p>NOTE 3: For filters of <code>filterType: HTTP</code> you must include a <code>listenerMatch</code> section
+with a <code>listenerProtocol: HTTP</code> or the filter have no effect.</p>
+
 <p>The following example for Kubernetes enables Envoy&rsquo;s Lua filter for all
 inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 labels &ldquo;app: reviews&rdquo;.</p>
@@ -59,7 +62,7 @@ <h2 id="EnvoyFilter">EnvoyFilter</h2>
 <td><code>workloadLabels</code></td>
 <td><code>map&lt;string,&nbsp;string&gt;</code></td>
 <td>
-<p>One or more labels that indicate a specific set of pods/VMs whose
+<p>Zero or more labels that indicate a specific set of pods/VMs whose
 proxies should be configured to use these additional filters.  The
 scope of label search is platform dependent. On Kubernetes, for
 example, the scope includes pods running in all reachable