Merge branch 'public-single-node' into pmm-6401-read-prometheus-data-files

2025-01-10 15:14:09 +00:00 · 2023-02-01 13:02:21 -08:00 · 2023-02-01 13:02:21 -08:00 · 32e46ea35f
commit 32e46ea35f
parent 6faaefef7b 607b542222
210 changed files with 7813 additions and 3188 deletions
--- a/11
+++ b/11
@ -144,6 +144,7 @@ vmutils-windows-amd64: \
 	vmctl-windows-amd64

 victoria-metrics-crossbuild: \
+	victoria-metrics-linux-386 \
 	victoria-metrics-linux-amd64 \
 	victoria-metrics-linux-arm64 \
 	victoria-metrics-linux-arm \
@ -155,6 +156,7 @@ victoria-metrics-crossbuild: \
 	victoria-metrics-openbsd-amd64

 vmutils-crossbuild: \
+	vmutils-linux-386 \
 	vmutils-linux-amd64 \
 	vmutils-linux-arm64 \
 	vmutils-linux-arm \
@ -177,6 +179,7 @@ release: \
 	release-vmutils

 release-victoria-metrics: \
+	release-victoria-metrics-linux-386 \
 	release-victoria-metrics-linux-amd64 \
 	release-victoria-metrics-linux-arm \
 	release-victoria-metrics-linux-arm64 \
@ -185,6 +188,10 @@ release-victoria-metrics: \
 	release-victoria-metrics-freebsd-amd64 \
 	release-victoria-metrics-openbsd-amd64

+# adds i386 arch
+release-victoria-metrics-linux-386:
+	GOOS=linux GOARCH=386 $(MAKE) release-victoria-metrics-goos-goarch
+
 release-victoria-metrics-linux-amd64:
 	GOOS=linux GOARCH=amd64 $(MAKE) release-victoria-metrics-goos-goarch

@ -216,6 +223,7 @@ release-victoria-metrics-goos-goarch: victoria-metrics-$(GOOS)-$(GOARCH)-prod
 	cd bin && rm -rf victoria-metrics-$(GOOS)-$(GOARCH)-prod

 release-vmutils: \
+	release-vmutils-linux-386 \
 	release-vmutils-linux-amd64 \
 	release-vmutils-linux-arm64 \
 	release-vmutils-linux-arm \
@ -225,6 +233,9 @@ release-vmutils: \
 	release-vmutils-openbsd-amd64 \
 	release-vmutils-windows-amd64

+release-vmutils-linux-386:
+	GOOS=linux GOARCH=386 $(MAKE) release-vmutils-goos-goarch
+	
 release-vmutils-linux-amd64:
 	GOOS=linux GOARCH=amd64 $(MAKE) release-vmutils-goos-goarch

--- a/README.md
+++ b/README.md
@ -1616,7 +1616,9 @@ VictoriaMetrics provides the following security-related command-line flags:
 Explicitly set internal network interface for TCP and UDP ports for data ingestion with Graphite and OpenTSDB formats.
 For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=<internal_iface_ip>:2003`. This protects from unexpected requests from untrusted network interfaces.

-VictoriaMetrics has achieved security certifications for Database Software Development and Software-Based Monitoring Services. We apply strict security measures in everything we do. See our [Security page](https://victoriametrics.com/security/) for more details.
+See also [security recommendation for VictoriaMetrics cluster](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#security)
+and [the general security page at VictoriaMetrics website](https://victoriametrics.com/security/).
+

 ## Tuning

--- a/app/vmagent/main.go
+++ b/app/vmagent/main.go
@ -236,7 +236,14 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
 			httpserver.Errorf(w, r, "%s", err)
 			return true
 		}
-		w.WriteHeader(http.StatusNoContent)
+		statusCode := http.StatusNoContent
+		if strings.HasPrefix(path, "/prometheus/api/v1/import/prometheus/metrics/job/") ||
+			strings.HasPrefix(path, "/api/v1/import/prometheus/metrics/job/") {
+			// Return 200 status code for pushgateway requests.
+			// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3636
+			statusCode = http.StatusOK
+		}
+		w.WriteHeader(statusCode)
 		return true
 	}
 	if strings.HasPrefix(path, "datadog/") {
--- a/app/vmalert/README.md
+++ b/app/vmalert/README.md
@ -9,6 +9,13 @@ protocol and require `-remoteWrite.url` to be configured.
 Vmalert is heavily inspired by [Prometheus](https://prometheus.io/docs/alerting/latest/overview/)
 implementation and aims to be compatible with its syntax.

+A [single-node](https://docs.victoriametrics.com/Single-server-VictoriaMetrics.html#vmalert)
+or [cluster version](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#vmalert)
+of VictoriaMetrics are capable of proxying requests to vmalert via `-vmalert.proxyURL` command-line flag. 
+Use this feature for the following cases:
+* for proxying requests from [Grafana Alerting UI](https://grafana.com/docs/grafana/latest/alerting/);
+* for accessing vmalert's UI through VictoriaMetrics Web interface.
+
 ## Features

 * Integration with [VictoriaMetrics](https://github.com/VictoriaMetrics/VictoriaMetrics) TSDB;
--- a/app/vmauth/README.md
+++ b/app/vmauth/README.md
@ -284,8 +284,10 @@ See the docs at https://docs.victoriametrics.com/vmauth.html .
     Timezone to use for timestamps in logs. Timezone must be a valid IANA Time Zone. For example: America/New_York, Europe/Berlin, Etc/GMT+3 or Local (default "UTC")
  -loggerWarnsPerSecondLimit int
     Per-second limit on the number of WARN messages. If more than the given number of warns are emitted per second, then the remaining warns are suppressed. Zero values disable the rate limit
+  -maxConcurrentRequests int
+     The maximum number of concurrent requests vmauth can process. Other requests are rejected with '429 Too Many Requests' http status code. See also -maxIdleConnsPerBackend (default 1000)
  -maxIdleConnsPerBackend int
-     The maximum number of idle connections vmauth can open per each backend host (default 100)
+     The maximum number of idle connections vmauth can open per each backend host. See also -maxConcurrentRequests (default 100)
  -memory.allowedBytes size
     Allowed size of system memory VictoriaMetrics caches may occupy. This option overrides -memory.allowedPercent if set to a non-zero value. Too low a value may increase the cache miss rate usually resulting in higher CPU and disk IO usage. Too high a value may evict too much data from OS page cache resulting in higher disk IO usage
     Supports the following optional suffixes for size values: KB, MB, GB, TB, KiB, MiB, GiB, TiB (default 0)
@ -305,6 +307,8 @@ See the docs at https://docs.victoriametrics.com/vmauth.html .
     Supports an array of values separated by comma or specified via multiple flags.
  -reloadAuthKey string
     Auth key for /-/reload http endpoint. It must be passed as authKey=...
+  -responseTimeout duration
+     The timeout for receiving a response from backend (default 5m0s)
  -tls
     Whether to enable TLS for incoming HTTP requests at -httpListenAddr (aka https). -tlsCertFile and -tlsKeyFile must be set if -tls is set
  -tlsCertFile string
--- a/app/vmauth/main.go
+++ b/app/vmauth/main.go
@ -3,8 +3,10 @@ package main
 import (
 	"flag"
 	"fmt"
+	"io"
+	"net"
 	"net/http"
-	"net/http/httputil"
+	"net/textproto"
 	"net/url"
 	"os"
 	"strings"
@ -12,10 +14,12 @@ import (
 	"time"

 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/buildinfo"
+	"github.com/VictoriaMetrics/VictoriaMetrics/lib/bytesutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/envflag"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/flagutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
+	"github.com/VictoriaMetrics/VictoriaMetrics/lib/netutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/procutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/pushmetrics"
 	"github.com/VictoriaMetrics/metrics"
@ -25,9 +29,13 @@ var (
 	httpListenAddr   = flag.String("httpListenAddr", ":8427", "TCP address to listen for http connections. See also -httpListenAddr.useProxyProtocol")
 	useProxyProtocol = flag.Bool("httpListenAddr.useProxyProtocol", false, "Whether to use proxy protocol for connections accepted at -httpListenAddr . "+
 		"See https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt")
-	maxIdleConnsPerBackend = flag.Int("maxIdleConnsPerBackend", 100, "The maximum number of idle connections vmauth can open per each backend host")
-	reloadAuthKey          = flag.String("reloadAuthKey", "", "Auth key for /-/reload http endpoint. It must be passed as authKey=...")
-	logInvalidAuthTokens   = flag.Bool("logInvalidAuthTokens", false, "Whether to log requests with invalid auth tokens. "+
+	maxIdleConnsPerBackend = flag.Int("maxIdleConnsPerBackend", 100, "The maximum number of idle connections vmauth can open per each backend host. "+
+		"See also -maxConcurrentRequests")
+	responseTimeout       = flag.Duration("responseTimeout", 5*time.Minute, "The timeout for receiving a response from backend")
+	maxConcurrentRequests = flag.Int("maxConcurrentRequests", 1000, "The maximum number of concurrent requests vmauth can process. Other requests are rejected with "+
+		"'429 Too Many Requests' http status code. See also -maxIdleConnsPerBackend")
+	reloadAuthKey        = flag.String("reloadAuthKey", "", "Auth key for /-/reload http endpoint. It must be passed as authKey=...")
+	logInvalidAuthTokens = flag.Bool("logInvalidAuthTokens", false, "Whether to log requests with invalid auth tokens. "+
 		`Such requests are always counted at vmauth_http_request_errors_total{reason="invalid_auth_token"} metric, which is exposed at /metrics page`)
 )

@ -81,15 +89,20 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
 		// See https://docs.influxdata.com/influxdb/v2.0/api/
 		authToken = strings.Replace(authToken, "Token", "Bearer", 1)
 	}
+
 	ac := authConfig.Load().(map[string]*UserInfo)
 	ui := ac[authToken]
 	if ui == nil {
 		invalidAuthTokenRequests.Inc()
+		err := fmt.Errorf("cannot find the provided auth token %q in config", authToken)
 		if *logInvalidAuthTokens {
-			httpserver.Errorf(w, r, "cannot find the provided auth token %q in config", authToken)
+			err = &httpserver.ErrorWithStatusCode{
+				Err:        err,
+				StatusCode: http.StatusUnauthorized,
+			}
+			httpserver.Errorf(w, r, "%s", err)
 		} else {
-			errStr := fmt.Sprintf("cannot find the provided auth token %q in config", authToken)
-			http.Error(w, errStr, http.StatusBadRequest)
+			http.Error(w, err.Error(), http.StatusUnauthorized)
 		}
 		return true
 	}
@ -99,26 +112,121 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
 		httpserver.Errorf(w, r, "cannot determine targetURL: %s", err)
 		return true
 	}
-	r.Header.Set("vm-target-url", targetURL.String())
-	for _, h := range headers {
-		r.Header.Set(h.Name, h.Value)
+
+	// Limit the concurrency of requests to backends
+	concurrencyLimitOnce.Do(concurrencyLimitInit)
+	select {
+	case concurrencyLimitCh <- struct{}{}:
+	default:
+		concurrentRequestsLimitReachedTotal.Inc()
+		w.Header().Add("Retry-After", "10")
+		err := &httpserver.ErrorWithStatusCode{
+			Err:        fmt.Errorf("cannot serve more than -maxConcurrentRequests=%d concurrent requests", cap(concurrencyLimitCh)),
+			StatusCode: http.StatusTooManyRequests,
+		}
+		httpserver.Errorf(w, r, "%s", err)
+		return true
 	}
-	proxyRequest(w, r)
+	processRequest(w, r, targetURL, headers)
+	<-concurrencyLimitCh
 	return true
 }

-func proxyRequest(w http.ResponseWriter, r *http.Request) {
-	defer func() {
-		err := recover()
-		if err == nil || err == http.ErrAbortHandler {
-			// Suppress http.ErrAbortHandler panic.
-			// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/1353
-			return
+func processRequest(w http.ResponseWriter, r *http.Request, targetURL *url.URL, headers []Header) {
+	// This code has been copied from net/http/httputil/reverseproxy.go
+	req := sanitizeRequestHeaders(r)
+	req.URL = targetURL
+	for _, h := range headers {
+		req.Header.Set(h.Name, h.Value)
+	}
+	transportOnce.Do(transportInit)
+	res, err := transport.RoundTrip(req)
+	if err != nil {
+		err = &httpserver.ErrorWithStatusCode{
+			Err:        fmt.Errorf("error when proxying the request to %q: %s", targetURL, err),
+			StatusCode: http.StatusBadGateway,
 		}
-		// Forward other panics to the caller.
-		panic(err)
-	}()
-	getReverseProxy().ServeHTTP(w, r)
+		httpserver.Errorf(w, r, "%s", err)
+		return
+	}
+	removeHopHeaders(res.Header)
+	copyHeader(w.Header(), res.Header)
+	w.WriteHeader(res.StatusCode)
+
+	copyBuf := copyBufPool.Get()
+	copyBuf.B = bytesutil.ResizeNoCopyNoOverallocate(copyBuf.B, 16*1024)
+	_, err = io.CopyBuffer(w, res.Body, copyBuf.B)
+	copyBufPool.Put(copyBuf)
+	_ = res.Body.Close()
+	if err != nil && !netutil.IsTrivialNetworkError(err) {
+		remoteAddr := httpserver.GetQuotedRemoteAddr(r)
+		requestURI := httpserver.GetRequestURI(r)
+		logger.Warnf("remoteAddr: %s; requestURI: %s; error when proxying response body from %s: %s", remoteAddr, requestURI, targetURL, err)
+		return
+	}
+}
+
+var copyBufPool bytesutil.ByteBufferPool
+
+func copyHeader(dst, src http.Header) {
+	for k, vv := range src {
+		for _, v := range vv {
+			dst.Add(k, v)
+		}
+	}
+}
+
+func sanitizeRequestHeaders(r *http.Request) *http.Request {
+	// This code has been copied from net/http/httputil/reverseproxy.go
+	req := r.Clone(r.Context())
+	removeHopHeaders(req.Header)
+	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+		// If we aren't the first proxy retain prior
+		// X-Forwarded-For information as a comma+space
+		// separated list and fold multiple headers into one.
+		prior := req.Header["X-Forwarded-For"]
+		if len(prior) > 0 {
+			clientIP = strings.Join(prior, ", ") + ", " + clientIP
+		}
+		req.Header.Set("X-Forwarded-For", clientIP)
+	}
+	return req
+}
+
+func removeHopHeaders(h http.Header) {
+	// remove hop-by-hop headers listed in the "Connection" header of h.
+	// See RFC 7230, section 6.1
+	for _, f := range h["Connection"] {
+		for _, sf := range strings.Split(f, ",") {
+			if sf = textproto.TrimString(sf); sf != "" {
+				h.Del(sf)
+			}
+		}
+	}
+
+	// Remove hop-by-hop headers to the backend. Especially
+	// important is "Connection" because we want a persistent
+	// connection, regardless of what the client sent to us.
+	for _, key := range hopHeaders {
+		h.Del(key)
+	}
+}
+
+// Hop-by-hop headers. These are removed when sent to the backend.
+// As of RFC 7230, hop-by-hop headers are required to appear in the
+// Connection header field. These are the headers defined by the
+// obsoleted RFC 2616 (section 13.5.1) and are used for backward
+// compatibility.
+var hopHeaders = []string{
+	"Connection",
+	"Proxy-Connection", // non-standard but still sent by libcurl and rejected by e.g. google
+	"Keep-Alive",
+	"Proxy-Authenticate",
+	"Proxy-Authorization",
+	"Te",      // canonicalized version of "TE"
+	"Trailer", // not Trailers per URL above; https://www.rfc-editor.org/errata_search.php?eid=4522
+	"Transfer-Encoding",
+	"Upgrade",
 }

 var (
@ -128,43 +236,41 @@ var (
 )

 var (
-	reverseProxy     *httputil.ReverseProxy
-	reverseProxyOnce sync.Once
+	transport     *http.Transport
+	transportOnce sync.Once
 )

-func getReverseProxy() *httputil.ReverseProxy {
-	reverseProxyOnce.Do(initReverseProxy)
-	return reverseProxy
+func transportInit() {
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.ResponseHeaderTimeout = *responseTimeout
+	// Automatic compression must be disabled in order to fix https://github.com/VictoriaMetrics/VictoriaMetrics/issues/535
+	tr.DisableCompression = true
+	// Disable HTTP/2.0, since VictoriaMetrics components don't support HTTP/2.0 (because there is no sense in this).
+	tr.ForceAttemptHTTP2 = false
+	tr.MaxIdleConnsPerHost = *maxIdleConnsPerBackend
+	if tr.MaxIdleConns != 0 && tr.MaxIdleConns < tr.MaxIdleConnsPerHost {
+		tr.MaxIdleConns = tr.MaxIdleConnsPerHost
+	}
+	transport = tr
 }

-// initReverseProxy must be called after flag.Parse(), since it uses command-line flags.
-func initReverseProxy() {
-	reverseProxy = &httputil.ReverseProxy{
-		Director: func(r *http.Request) {
-			targetURL := r.Header.Get("vm-target-url")
-			target, err := url.Parse(targetURL)
-			if err != nil {
-				logger.Panicf("BUG: unexpected error when parsing targetURL=%q: %s", targetURL, err)
-			}
-			r.URL = target
-		},
-		Transport: func() *http.Transport {
-			tr := http.DefaultTransport.(*http.Transport).Clone()
-			// Automatic compression must be disabled in order to fix https://github.com/VictoriaMetrics/VictoriaMetrics/issues/535
-			tr.DisableCompression = true
-			// Disable HTTP/2.0, since VictoriaMetrics components don't support HTTP/2.0 (because there is no sense in this).
-			tr.ForceAttemptHTTP2 = false
-			tr.MaxIdleConnsPerHost = *maxIdleConnsPerBackend
-			if tr.MaxIdleConns != 0 && tr.MaxIdleConns < tr.MaxIdleConnsPerHost {
-				tr.MaxIdleConns = tr.MaxIdleConnsPerHost
-			}
-			return tr
-		}(),
-		FlushInterval: time.Second,
-		ErrorLog:      logger.StdErrorLogger(),
-	}
+var (
+	concurrencyLimitCh   chan struct{}
+	concurrencyLimitOnce sync.Once
+)
+
+func concurrencyLimitInit() {
+	concurrencyLimitCh = make(chan struct{}, *maxConcurrentRequests)
+	_ = metrics.NewGauge("vmauth_concurrent_requests_capacity", func() float64 {
+		return float64(*maxConcurrentRequests)
+	})
+	_ = metrics.NewGauge("vmauth_concurrent_requests_current", func() float64 {
+		return float64(len(concurrencyLimitCh))
+	})
 }

+var concurrentRequestsLimitReachedTotal = metrics.NewCounter("vmauth_concurrent_requests_limit_reached_total")
+
 func usage() {
 	const s = `
 vmauth authenticates and authorizes incoming requests and proxies them to VictoriaMetrics.
--- a/app/vmbackup/main.go
+++ b/app/vmbackup/main.go
@ -65,7 +65,7 @@ func main() {
 				logger.Fatalf("Failed to set snapshot.deleteURL flag: %v", err)
 			}
 		}
-		deleteUrl, err := url.Parse(*snapshotCreateURL)
+		deleteUrl, err := url.Parse(*snapshotDeleteURL)
 		if err != nil {
 			logger.Fatalf("cannot parse snapshotDeleteURL: %s", err)
 		}
--- a/app/vmctl/prometheus.go
+++ b/app/vmctl/prometheus.go
@ -102,6 +102,7 @@ func (pp *prometheusProcessor) do(b tsdb.BlockReader) error {
 	if err != nil {
 		return fmt.Errorf("failed to read block: %s", err)
 	}
+	var it chunkenc.Iterator
 	for ss.Next() {
 		var name string
 		var labels []vm.LabelPair
@ -123,7 +124,7 @@ func (pp *prometheusProcessor) do(b tsdb.BlockReader) error {

 		var timestamps []int64
 		var values []float64
-		it := series.Iterator()
+		it = series.Iterator(it)
 		for {
 			typ := it.Next()
 			if typ == chunkenc.ValNone {
--- a/app/vmctl/testdata/servers_integration_test/remote_read_server.go
+++ b/app/vmctl/testdata/servers_integration_test/remote_read_server.go
@ -15,6 +15,7 @@ import (
 	"github.com/prometheus/prometheus/model/labels"
 	"github.com/prometheus/prometheus/prompb"
 	"github.com/prometheus/prometheus/storage/remote"
+	"github.com/prometheus/prometheus/tsdb/chunks"
 )

 const (
@ -154,7 +155,7 @@ func (rrs *RemoteReadServer) getStreamReadHandler(t *testing.T) http.Handler {
 			t.Fatalf("error unmarshal read request: %s", err)
 		}

-		var chunks []prompb.Chunk
+		var chks []prompb.Chunk
 		ctx := context.Background()
 		for idx, r := range req.Queries {
 			startTs := r.StartTimestampMs
@ -171,9 +172,10 @@ func (rrs *RemoteReadServer) getStreamReadHandler(t *testing.T) http.Handler {
 			}

 			ss := q.Select(false, nil, matchers...)
+			var iter chunks.Iterator
 			for ss.Next() {
 				series := ss.At()
-				iter := series.Iterator()
+				iter = series.Iterator(iter)
 				labels := remote.MergeLabels(labelsToLabelsProto(series.Labels()), nil)

 				frameBytesLeft := maxBytesInFrame
@ -190,14 +192,14 @@ func (rrs *RemoteReadServer) getStreamReadHandler(t *testing.T) http.Handler {
 						t.Fatalf("error found not populated chunk returned by SeriesSet at ref: %v", chunk.Ref)
 					}

-					chunks = append(chunks, prompb.Chunk{
+					chks = append(chks, prompb.Chunk{
 						MinTimeMs: chunk.MinTime,
 						MaxTimeMs: chunk.MaxTime,
 						Type:      prompb.Chunk_Encoding(chunk.Chunk.Encoding()),
 						Data:      chunk.Chunk.Bytes(),
 					})

-					frameBytesLeft -= chunks[len(chunks)-1].Size()
+					frameBytesLeft -= chks[len(chks)-1].Size()

 					// We are fine with minor inaccuracy of max bytes per frame. The inaccuracy will be max of full chunk size.
 					isNext = iter.Next()
@ -207,7 +209,7 @@ func (rrs *RemoteReadServer) getStreamReadHandler(t *testing.T) http.Handler {

 					resp := &prompb.ChunkedReadResponse{
 						ChunkedSeries: []*prompb.ChunkedSeries{
-							{Labels: labels, Chunks: chunks},
+							{Labels: labels, Chunks: chks},
 						},
 						QueryIndex: int64(idx),
 					}
@ -220,7 +222,7 @@ func (rrs *RemoteReadServer) getStreamReadHandler(t *testing.T) http.Handler {
 					if _, err := stream.Write(b); err != nil {
 						t.Fatalf("error write to stream: %s", err)
 					}
-					chunks = chunks[:0]
+					chks = chks[:0]
 					rrs.storage.Reset()
 				}
 				if err := iter.Err(); err != nil {
--- a/app/vmselect/bufferedwriter/bufferedwriter.go
+++ b/app/vmselect/bufferedwriter/bufferedwriter.go
@ -4,8 +4,9 @@ import (
 	"bufio"
 	"fmt"
 	"io"
-	"strings"
 	"sync"
+
+	"github.com/VictoriaMetrics/VictoriaMetrics/lib/netutil"
 )

 // Get returns buffered writer for the given w.
@ -63,7 +64,7 @@ func (bw *Writer) Write(p []byte) (int, error) {
 		return 0, bw.err
 	}
 	n, err := bw.bw.Write(p)
-	if err != nil && !isTrivialNetworkError(err) {
+	if err != nil && !netutil.IsTrivialNetworkError(err) {
 		bw.err = fmt.Errorf("cannot send %d bytes to client: %w", len(p), err)
 	}
 	return n, bw.err
@ -76,7 +77,7 @@ func (bw *Writer) Flush() error {
 	if bw.err != nil {
 		return bw.err
 	}
-	if err := bw.bw.Flush(); err != nil && !isTrivialNetworkError(err) {
+	if err := bw.bw.Flush(); err != nil && !netutil.IsTrivialNetworkError(err) {
 		bw.err = fmt.Errorf("cannot flush data to client: %w", err)
 	}
 	return bw.err
@ -88,12 +89,3 @@ func (bw *Writer) Error() error {
 	defer bw.lock.Unlock()
 	return bw.err
 }
-
-func isTrivialNetworkError(err error) bool {
-	// Suppress trivial network errors, which could occur at remote side.
-	s := err.Error()
-	if strings.Contains(s, "broken pipe") || strings.Contains(s, "reset by peer") {
-		return true
-	}
-	return false
-}
--- a/app/vmselect/vmui/asset-manifest.json
+++ b/app/vmselect/vmui/asset-manifest.json
@ -1,14 +1,14 @@
 {
  "files": {
-    "main.css": "./static/css/main.9ca6b743.css",
-    "main.js": "./static/js/main.8969be5f.js",
+    "main.css": "./static/css/main.3f9cb68f.css",
+    "main.js": "./static/js/main.b1572032.js",
    "static/js/27.c1ccfd29.chunk.js": "./static/js/27.c1ccfd29.chunk.js",
    "static/media/Lato-Regular.ttf": "./static/media/Lato-Regular.d714fec1633b69a9c2e9.ttf",
    "static/media/Lato-Bold.ttf": "./static/media/Lato-Bold.32360ba4b57802daa4d6.ttf",
    "index.html": "./index.html"
  },
  "entrypoints": [
-    "static/css/main.9ca6b743.css",
-    "static/js/main.8969be5f.js"
+    "static/css/main.3f9cb68f.css",
+    "static/js/main.b1572032.js"
  ]
 }
--- a/app/vmselect/vmui/index.html
+++ b/app/vmselect/vmui/index.html
@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="./favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><meta name="description" content="UI for VictoriaMetrics"/><link rel="apple-touch-icon" href="./apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="./favicon-32x32.png"><link rel="manifest" href="./manifest.json"/><title>VM UI</title><script src="./dashboards/index.js" type="module"></script><meta name="twitter:card" content="summary_large_image"><meta name="twitter:image" content="./preview.jpg"><meta name="twitter:title" content="UI for VictoriaMetrics"><meta name="twitter:description" content="Explore and troubleshoot your VictoriaMetrics data"><meta name="twitter:site" content="@VictoriaMetrics"><meta property="og:title" content="Metric explorer for VictoriaMetrics"><meta property="og:description" content="Explore and troubleshoot your VictoriaMetrics data"><meta property="og:image" content="./preview.jpg"><meta property="og:type" content="website"><script defer="defer" src="./static/js/main.8969be5f.js"></script><link href="./static/css/main.9ca6b743.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="./favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><meta name="description" content="UI for VictoriaMetrics"/><link rel="apple-touch-icon" href="./apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="./favicon-32x32.png"><link rel="manifest" href="./manifest.json"/><title>VM UI</title><script src="./dashboards/index.js" type="module"></script><meta name="twitter:card" content="summary_large_image"><meta name="twitter:image" content="./preview.jpg"><meta name="twitter:title" content="UI for VictoriaMetrics"><meta name="twitter:description" content="Explore and troubleshoot your VictoriaMetrics data"><meta name="twitter:site" content="@VictoriaMetrics"><meta property="og:title" content="Metric explorer for VictoriaMetrics"><meta property="og:description" content="Explore and troubleshoot your VictoriaMetrics data"><meta property="og:image" content="./preview.jpg"><meta property="og:type" content="website"><script defer="defer" src="./static/js/main.b1572032.js"></script><link href="./static/css/main.3f9cb68f.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>
--- a/app/vmselect/vmui/static/css/main.3f9cb68f.css
+++ b/app/vmselect/vmui/static/css/main.3f9cb68f.css
--- a/app/vmselect/vmui/static/css/main.9ca6b743.css
+++ b/app/vmselect/vmui/static/css/main.9ca6b743.css
--- a/app/vmselect/vmui/static/js/main.8969be5f.js
+++ b/app/vmselect/vmui/static/js/main.8969be5f.js
--- a/app/vmselect/vmui/static/js/main.b1572032.js
+++ b/app/vmselect/vmui/static/js/main.b1572032.js
--- a/app/vmselect/vmui/static/js/main.b1572032.js.LICENSE.txt
+++ b/app/vmselect/vmui/static/js/main.b1572032.js.LICENSE.txt
--- a/app/vmstorage/promdb/promdb.go
+++ b/app/vmstorage/promdb/promdb.go
@ -173,13 +173,14 @@ func VisitSeries(sq *storage.SearchQuery, deadline searchutils.Deadline, f Serie
 		values     []float64
 		timestamps []int64
 	)
+	var it chunkenc.Iterator
 	for ss.Next() {
 		s := ss.At()
 		convertPromLabelsToMetricName(&mn, s.Labels())
 		metricName = mn.SortAndMarshal(metricName[:0])
 		values = values[:0]
 		timestamps = timestamps[:0]
-		it := s.Iterator()
+		it = s.Iterator(it)
 		for {
 			typ := it.Next()
 			if typ == chunkenc.ValNone {
--- a/app/vmui/packages/vmui/src/App.tsx
+++ b/app/vmui/packages/vmui/src/App.tsx
@ -8,56 +8,57 @@ import DashboardsLayout from "./pages/PredefinedPanels";
 import CardinalityPanel from "./pages/CardinalityPanel";
 import TopQueries from "./pages/TopQueries";
 import ThemeProvider from "./components/Main/ThemeProvider/ThemeProvider";
-import Spinner from "./components/Main/Spinner/Spinner";
 import TracePage from "./pages/TracePage";
 import ExploreMetrics from "./pages/ExploreMetrics";
 import PreviewIcons from "./components/Main/Icons/PreviewIcons";

 const App: FC = () => {

-  const [loadingTheme, setLoadingTheme] = useState(true);
+  const [loadedTheme, setLoadedTheme] = useState(false);

  return <>
-    {loadingTheme && <Spinner/>}
-    <ThemeProvider setLoadingTheme={setLoadingTheme}/>
-
-    <HashRouter key={`${loadingTheme}`}>
+    <HashRouter>
      <AppContextProvider>
-        <Routes>
-          <Route
-            path={"/"}
-            element={<Layout/>}
-          >
-            <Route
-              path={router.home}
-              element={<CustomPanel/>}
-            />
-            <Route
-              path={router.metrics}
-              element={<ExploreMetrics/>}
-            />
-            <Route
-              path={router.cardinality}
-              element={<CardinalityPanel/>}
-            />
-            <Route
-              path={router.topQueries}
-              element={<TopQueries/>}
-            />
-            <Route
-              path={router.trace}
-              element={<TracePage/>}
-            />
-            <Route
-              path={router.dashboards}
-              element={<DashboardsLayout/>}
-            />
-            <Route
-              path={router.icons}
-              element={<PreviewIcons/>}
-            />
-          </Route>
-        </Routes>
+        <>
+          <ThemeProvider onLoaded={setLoadedTheme}/>
+          {loadedTheme && (
+            <Routes>
+              <Route
+                path={"/"}
+                element={<Layout/>}
+              >
+                <Route
+                  path={router.home}
+                  element={<CustomPanel/>}
+                />
+                <Route
+                  path={router.metrics}
+                  element={<ExploreMetrics/>}
+                />
+                <Route
+                  path={router.cardinality}
+                  element={<CardinalityPanel/>}
+                />
+                <Route
+                  path={router.topQueries}
+                  element={<TopQueries/>}
+                />
+                <Route
+                  path={router.trace}
+                  element={<TracePage/>}
+                />
+                <Route
+                  path={router.dashboards}
+                  element={<DashboardsLayout/>}
+                />
+                <Route
+                  path={router.icons}
+                  element={<PreviewIcons/>}
+                />
+              </Route>
+            </Routes>
+          )}
+        </>
      </AppContextProvider>
    </HashRouter>
  </>;
--- a/app/vmui/packages/vmui/src/api/accountId.ts
+++ b/app/vmui/packages/vmui/src/api/accountId.ts
@ -0,0 +1,2 @@
+export const getAccountIds = (server: string) =>
+  `${server.replace(/^(.+)(\/select.+)/, "$1")}/admin/tenants`;
--- a/app/vmui/packages/vmui/src/components/Chart/BarChart/BarChart.tsx
+++ b/app/vmui/packages/vmui/src/components/Chart/BarChart/BarChart.tsx
@ -9,7 +9,7 @@ const BarChart: FC<BarChartProps> = ({
  data,
  container,
  configs }) => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();

  const uPlotRef = useRef<HTMLDivElement>(null);
  const [uPlotInst, setUPlotInst] = useState<uPlot>();
@ -30,7 +30,7 @@ const BarChart: FC<BarChartProps> = ({
    const u = new uPlot(options, data, uPlotRef.current);
    setUPlotInst(u);
    return u.destroy;
-  }, [uPlotRef.current, layoutSize, darkTheme]);
+  }, [uPlotRef.current, layoutSize, isDarkTheme]);

  useEffect(() => updateChart(), [data]);

--- a/app/vmui/packages/vmui/src/components/Chart/LineChart/LineChart.tsx
+++ b/app/vmui/packages/vmui/src/components/Chart/LineChart/LineChart.tsx
@ -48,7 +48,7 @@ const LineChart: FC<LineChartProps> = ({
  container,
  height
 }) => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();

  const uPlotRef = useRef<HTMLDivElement>(null);
  const [isPanning, setPanning] = useState(false);
@ -225,7 +225,7 @@ const LineChart: FC<LineChartProps> = ({
    setUPlotInst(u);
    setXRange({ min: period.start, max: period.end });
    return u.destroy;
-  }, [uPlotRef.current, series, layoutSize, height, darkTheme]);
+  }, [uPlotRef.current, series, layoutSize, height, isDarkTheme]);

  useEffect(() => {
    window.addEventListener("keydown", handleKeyDown);
--- a/app/vmui/packages/vmui/src/components/Configurators/AdditionalSettings/AdditionalSettings.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/AdditionalSettings/AdditionalSettings.tsx
@ -1,6 +1,4 @@
 import React, { FC } from "preact/compat";
-import { getAppModeParams } from "../../../utils/app-mode";
-import TenantsConfiguration from "../TenantsConfiguration/TenantsConfiguration";
 import { useCustomPanelDispatch, useCustomPanelState } from "../../../state/customPanel/CustomPanelStateContext";
 import { useQueryDispatch, useQueryState } from "../../../state/query/QueryStateContext";
 import "./style.scss";
@ -8,8 +6,6 @@ import Switch from "../../Main/Switch/Switch";

 const AdditionalSettings: FC = () => {

-  const { inputTenantID } = getAppModeParams();
-
  const { autocomplete } = useQueryState();
  const queryDispatch = useQueryDispatch();

@ -44,11 +40,6 @@ const AdditionalSettings: FC = () => {
      value={isTracingEnabled}
      onChange={onChangeQueryTracing}
    />
-    {!!inputTenantID && (
-      <div className="vm-additional-settings__input">
-        <TenantsConfiguration/>
-      </div>
-    )}
  </div>;
 };

--- a/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/GlobalSettings.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/GlobalSettings.tsx
@ -1,4 +1,4 @@
-import React, { FC, useState } from "preact/compat";
+import React, { FC, useEffect, useState } from "preact/compat";
 import ServerConfigurator from "./ServerConfigurator/ServerConfigurator";
 import { useAppDispatch, useAppState } from "../../../state/common/StateContext";
 import { SettingsIcon } from "../../Main/Icons";
@ -43,6 +43,11 @@ const GlobalSettings: FC = () => {
    handleClose();
  };

+  useEffect(() => {
+    if (stateServerUrl === serverUrl) return;
+    setServerUrl(stateServerUrl);
+  }, [stateServerUrl]);
+
  return <>
    <Tooltip title={title}>
      <Button
@ -92,13 +97,13 @@ const GlobalSettings: FC = () => {
              color="error"
              onClick={handleClose}
            >
-                Cancel
+              Cancel
            </Button>
            <Button
              variant="contained"
              onClick={handlerApply}
            >
-                apply
+              apply
            </Button>
          </div>
        </div>
--- a/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/ServerConfigurator/ServerConfigurator.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/ServerConfigurator/ServerConfigurator.tsx
@ -22,18 +22,14 @@ const ServerConfigurator: FC<ServerConfiguratorProps> = ({ serverUrl, onChange ,
  };

  return (
-    <div>
-      <div className="vm-server-configurator__title">
-        Server URL
-      </div>
-      <TextField
-        autofocus
-        value={serverUrl}
-        error={error}
-        onChange={onChangeServer}
-        onEnter={onEnter}
-      />
-    </div>
+    <TextField
+      autofocus
+      label="Server URL"
+      value={serverUrl}
+      error={error}
+      onChange={onChangeServer}
+      onEnter={onEnter}
+    />
  );
 };

--- a/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/TenantsConfiguration/TenantsConfiguration.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/TenantsConfiguration/TenantsConfiguration.tsx
@ -0,0 +1,117 @@
+import React, { FC, useState, useRef, useEffect, useMemo } from "preact/compat";
+import { useAppDispatch, useAppState } from "../../../../state/common/StateContext";
+import { useTimeDispatch } from "../../../../state/time/TimeStateContext";
+import { ArrowDownIcon, StorageIcons } from "../../../Main/Icons";
+import Button from "../../../Main/Button/Button";
+import "./style.scss";
+import { replaceTenantId } from "../../../../utils/default-server-url";
+import classNames from "classnames";
+import Popper from "../../../Main/Popper/Popper";
+import { getAppModeEnable } from "../../../../utils/app-mode";
+import Tooltip from "../../../Main/Tooltip/Tooltip";
+
+const TenantsConfiguration: FC<{accountIds: string[]}> = ({ accountIds }) => {
+  const appModeEnable = getAppModeEnable();
+
+  const { tenantId: tenantIdState, serverUrl } = useAppState();
+  const dispatch = useAppDispatch();
+  const timeDispatch = useTimeDispatch();
+
+  const [openOptions, setOpenOptions] = useState(false);
+  const optionsButtonRef = useRef<HTMLDivElement>(null);
+
+  const getTenantIdFromUrl = (url: string) => {
+    const regexp = /(\/select\/)(\d+|\d.+)(\/)(.+)/;
+    return (url.match(regexp) || [])[2];
+  };
+
+  const showTenantSelector = useMemo(() => {
+    const id = getTenantIdFromUrl(serverUrl);
+    return accountIds.length > 1 && id;
+  }, [accountIds, serverUrl]);
+
+  const toggleOpenOptions = () => {
+    setOpenOptions(prev => !prev);
+  };
+
+  const handleCloseOptions = () => {
+    setOpenOptions(false);
+  };
+
+  const createHandlerChange = (value: string) => () => {
+    const tenant = value;
+    dispatch({ type: "SET_TENANT_ID", payload: tenant });
+    if (serverUrl) {
+      const updateServerUrl = replaceTenantId(serverUrl, tenant);
+      if (updateServerUrl === serverUrl) return;
+      dispatch({ type: "SET_SERVER", payload: updateServerUrl });
+      timeDispatch({ type: "RUN_QUERY" });
+    }
+    handleCloseOptions();
+  };
+
+  useEffect(() => {
+    const id = getTenantIdFromUrl(serverUrl);
+
+    if (tenantIdState && tenantIdState !== id) {
+      createHandlerChange(tenantIdState)();
+    } else {
+      createHandlerChange(id)();
+    }
+  }, [serverUrl]);
+
+  if (!showTenantSelector) return null;
+
+  return (
+    <div className="vm-tenant-input">
+      <Tooltip title="Define Tenant ID if you need request to another storage">
+        <div ref={optionsButtonRef}>
+          <Button
+            className={appModeEnable ? "" : "vm-header-button"}
+            variant="contained"
+            color="primary"
+            fullWidth
+            startIcon={<StorageIcons/>}
+            endIcon={(
+              <div
+                className={classNames({
+                  "vm-execution-controls-buttons__arrow": true,
+                  "vm-execution-controls-buttons__arrow_open": openOptions,
+                })}
+              >
+                <ArrowDownIcon/>
+              </div>
+            )}
+            onClick={toggleOpenOptions}
+          >
+            {tenantIdState}
+          </Button>
+        </div>
+      </Tooltip>
+      <Popper
+        open={openOptions}
+        placement="bottom-left"
+        onClose={handleCloseOptions}
+        buttonRef={optionsButtonRef}
+        fullWidth
+      >
+        <div className="vm-list">
+          {accountIds.map(id => (
+            <div
+              className={classNames({
+                "vm-list-item": true,
+                "vm-list-item_active": id === tenantIdState
+              })}
+              key={id}
+              onClick={createHandlerChange(id)}
+            >
+              {id}
+            </div>
+          ))}
+        </div>
+      </Popper>
+    </div>
+  );
+};
+
+export default TenantsConfiguration;
--- a/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/TenantsConfiguration/hooks/useFetchAccountIds.ts
+++ b/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/TenantsConfiguration/hooks/useFetchAccountIds.ts
@ -0,0 +1,41 @@
+import { useAppState } from "../../../../../state/common/StateContext";
+import { useEffect, useMemo, useState } from "preact/compat";
+import { ErrorTypes } from "../../../../../types";
+import { getAccountIds } from "../../../../../api/accountId";
+
+export const useFetchAccountIds = () => {
+  const { serverUrl } = useAppState();
+
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState<ErrorTypes | string>();
+  const [accountIds, setAccountIds] = useState<string[]>([]);
+
+  const fetchUrl = useMemo(() => getAccountIds(serverUrl), [serverUrl]);
+
+  useEffect(() => {
+    const fetchData = async () => {
+      setIsLoading(true);
+      try {
+        const response = await fetch(fetchUrl);
+        const resp = await response.json();
+        const data = (resp.data || []) as string[];
+        setAccountIds(data);
+
+        if (response.ok) {
+          setError(undefined);
+        } else {
+          setError(`${resp.errorType}\r\n${resp?.error}`);
+        }
+      } catch (e) {
+        if (e instanceof Error) {
+          setError(`${e.name}: ${e.message}`);
+        }
+      }
+      setIsLoading(false);
+    };
+
+    fetchData().catch(console.error);
+  }, [fetchUrl]);
+
+  return { accountIds, isLoading, error };
+};
--- a/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/TenantsConfiguration/style.scss
+++ b/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/TenantsConfiguration/style.scss
@ -0,0 +1,5 @@
+@use "../../../../styles/variables" as *;
+
+.vm-tenant-input {
+  position: relative;
+}
--- a/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/style.scss
+++ b/app/vmui/packages/vmui/src/components/Configurators/GlobalSettings/style.scss
@ -8,9 +8,15 @@

  &__input {

+    &_server {
+      display: grid;
+      grid-template-columns: 1fr auto;
+      gap: 0 $padding-small;
+    }
  }

  &__title {
+    grid-column: auto / span 2;
    display: flex;
    align-items: center;
    justify-content: flex-start;
--- a/app/vmui/packages/vmui/src/components/Configurators/TenantsConfiguration/TenantsConfiguration.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/TenantsConfiguration/TenantsConfiguration.tsx
@ -1,58 +0,0 @@
-import React, { FC, useState, useEffect, useCallback } from "preact/compat";
-import { useAppDispatch, useAppState } from "../../../state/common/StateContext";
-import debounce from "lodash.debounce";
-import { getAppModeParams } from "../../../utils/app-mode";
-import { useTimeDispatch } from "../../../state/time/TimeStateContext";
-import { InfoIcon } from "../../Main/Icons";
-import TextField from "../../Main/TextField/TextField";
-import Button from "../../Main/Button/Button";
-import Tooltip from "../../Main/Tooltip/Tooltip";
-
-const TenantsConfiguration: FC = () => {
-  const { serverURL } = getAppModeParams();
-  const { tenantId: tenantIdState } = useAppState();
-  const dispatch = useAppDispatch();
-  const timeDispatch = useTimeDispatch();
-
-  const [tenantId, setTenantId] = useState<string | number>(tenantIdState || 0);
-
-  const handleApply = (value: string | number) => {
-    const tenantId = Number(value);
-    dispatch({ type: "SET_TENANT_ID", payload: tenantId });
-    if (serverURL) {
-      const updateServerUrl = serverURL.replace(/(\/select\/)([\d]+)(\/prometheus)/, `$1${tenantId}$3`);
-      dispatch({ type: "SET_SERVER", payload: updateServerUrl });
-      timeDispatch({ type: "RUN_QUERY" });
-    }
-  };
-
-  const debouncedHandleApply = useCallback(debounce(handleApply, 700), []);
-
-  const handleChange = (value: string) => {
-    setTenantId(value);
-    debouncedHandleApply(value);
-  };
-
-  useEffect(() => {
-    if (tenantId === tenantIdState) return;
-    setTenantId(tenantIdState);
-  }, [tenantIdState]);
-
-  return <TextField
-    label="Tenant ID"
-    type="number"
-    value={tenantId}
-    onChange={handleChange}
-    endIcon={(
-      <Tooltip title={"Define tenant id if you need request to another storage"}>
-        <Button
-          variant={"text"}
-          size={"small"}
-          startIcon={<InfoIcon/>}
-        />
-      </Tooltip>
-    )}
-  />;
-};
-
-export default TenantsConfiguration;
--- a/app/vmui/packages/vmui/src/components/Configurators/ThemeControl/ThemeControl.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/ThemeControl/ThemeControl.tsx
@ -1,19 +1,16 @@
 import React from "react";
 import "./style.scss";
-import classNames from "classnames";
 import { useAppDispatch, useAppState } from "../../../state/common/StateContext";
+import { Theme } from "../../../types";
+import Toggle from "../../Main/Toggle/Toggle";

-const options = [
-  { title: "Light", value: false },
-  { title: "Dark", value: true }
-];
-
+const options = Object.values(Theme).map(value => ({ title: value, value }));
 const ThemeControl = () => {
-  const { darkTheme } = useAppState();
+  const { theme } = useAppState();
  const dispatch = useAppDispatch();

-  const createHandlerClickItem = (value: boolean) => () => {
-    dispatch({ type: "SET_DARK_THEME", payload: value });
+  const handleClickItem = (value: string) => {
+    dispatch({ type: "SET_THEME", payload: value as Theme });
  };

  return (
@ -21,21 +18,12 @@ const ThemeControl = () => {
      <div className="vm-server-configurator__title">
        Theme preferences
      </div>
-      <div className="vm-theme-control-options">
-        <div
-          className="vm-theme-control-options__highlight"
-          style={{ left: darkTheme ? "50%" : 0 }}
+      <div className="vm-theme-control__toggle">
+        <Toggle
+          options={options}
+          value={theme}
+          onChange={handleClickItem}
        />
-        {options.map(item => (
-          <div
-            className={classNames({
-              "vm-theme-control-options__item": true,
-              "vm-theme-control-options__item_active": item.value === darkTheme
-            })}
-            onClick={createHandlerClickItem(item.value)}
-            key={item.title}
-          >{item.title}</div>
-        ))}
      </div>
    </div>
  );
--- a/app/vmui/packages/vmui/src/components/Configurators/ThemeControl/style.scss
+++ b/app/vmui/packages/vmui/src/components/Configurators/ThemeControl/style.scss
@ -1,44 +1,10 @@
@use "src/styles/variables" as *;

 .vm-theme-control {
-  &-options {
-    position: relative;
+
+  &__toggle {
    display: inline-flex;
-    border: $border-divider;
-    border-radius: $border-radius-medium;
-    overflow: hidden;
-
-    &__item {
-      position: relative;
-      padding: $padding-small $padding-global;
-      border-right: $border-divider;
-      color: $color-text;
-      cursor: pointer;
-      z-index: 2;
-      transition: color 200ms ease-out;
-      user-select: none;
-
-      &:last-child {
-        border: none;
-      }
-
-      &_active {
-        color: $color-primary-text;
-      }
-
-      &:hover {
-        box-shadow: $box-shadow-popper;
-      }
-    }
-
-    &__highlight {
-      position: absolute;
-      top: 0;
-      left: 0;
-      background-color: $color-primary;
-      height: 100%;
-      width: 50%;
-      transition: left 150ms ease-in;
-    }
+    min-width: 300px;
+    text-transform: capitalize;
  }
 }
--- a/app/vmui/packages/vmui/src/components/Configurators/TimeRangeSettings/TimeSelector/TimeSelector.tsx
+++ b/app/vmui/packages/vmui/src/components/Configurators/TimeRangeSettings/TimeSelector/TimeSelector.tsx
@ -17,7 +17,7 @@ import classNames from "classnames";
 import { useAppState } from "../../../../state/common/StateContext";

 export const TimeSelector: FC = () => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();
  const wrapperRef = useRef<HTMLDivElement>(null);
  const documentSize = useResize(document.body);
  const displayFullDate = useMemo(() => documentSize.width > 1280, [documentSize]);
@ -150,7 +150,7 @@ export const TimeSelector: FC = () => {
          <div
            className={classNames({
              "vm-time-selector-left-inputs": true,
-              "vm-time-selector-left-inputs_dark": darkTheme
+              "vm-time-selector-left-inputs_dark": isDarkTheme
            })}
          >
            <div
--- a/app/vmui/packages/vmui/src/components/Layout/Header/Header.tsx
+++ b/app/vmui/packages/vmui/src/components/Layout/Header/Header.tsx
@ -15,15 +15,18 @@ import classNames from "classnames";
 import StepConfigurator from "../../Configurators/StepConfigurator/StepConfigurator";
 import { useAppState } from "../../../state/common/StateContext";
 import HeaderNav from "./HeaderNav/HeaderNav";
+import TenantsConfiguration from "../../Configurators/GlobalSettings/TenantsConfiguration/TenantsConfiguration";
+import { useFetchAccountIds } from "../../Configurators/GlobalSettings/TenantsConfiguration/hooks/useFetchAccountIds";

 const Header: FC = () => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();
  const appModeEnable = getAppModeEnable();
+  const { accountIds } = useFetchAccountIds();

  const primaryColor = useMemo(() => {
-    const variable = darkTheme ? "color-background-block" : "color-primary";
+    const variable = isDarkTheme ? "color-background-block" : "color-primary";
    return getCssVariable(variable);
-  }, [darkTheme]);
+  }, [isDarkTheme]);

  const { background, color } = useMemo(() => {
    const { headerStyles: {
@ -37,7 +40,6 @@ const Header: FC = () => {
  const navigate = useNavigate();
  const { search, pathname } = useLocation();

-
  const headerSetup = useMemo(() => {
    return ((routerOptions[pathname] || {}) as RouterOptions).header || {};
  }, [pathname]);
@ -52,7 +54,7 @@ const Header: FC = () => {
    className={classNames({
      "vm-header": true,
      "vm-header_app": appModeEnable,
-      "vm-header_dark": darkTheme
+      "vm-header_dark": isDarkTheme
    })}
    style={{ background, color }}
  >
@ -70,6 +72,7 @@ const Header: FC = () => {
      background={background}
    />
    <div className="vm-header__settings">
+      {headerSetup?.tenant && <TenantsConfiguration accountIds={accountIds}/>}
      {headerSetup?.stepControl && <StepConfigurator/>}
      {headerSetup?.timeSelector && <TimeSelector/>}
      {headerSetup?.cardinalityDatePicker && <CardinalityDatePicker/>}
--- a/app/vmui/packages/vmui/src/components/Main/Alert/Alert.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/Alert/Alert.tsx
@ -20,14 +20,14 @@ const icons = {
 const Alert: FC<AlertProps> = ({
  variant,
  children }) => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();

  return (
    <div
      className={classNames({
        "vm-alert": true,
        [`vm-alert_${variant}`]: variant,
-        "vm-alert_dark": darkTheme
+        "vm-alert_dark": isDarkTheme
      })}
    >
      <div className="vm-alert__icon">{icons[variant || "info"]}</div>
--- a/app/vmui/packages/vmui/src/components/Main/DatePicker/TImePicker/TimePicker.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/DatePicker/TImePicker/TimePicker.tsx
@ -14,7 +14,7 @@ enum TimeUnits { hour, minutes, seconds }


 const TimePicker: FC<CalendarTimepickerProps>= ({ selectDate, onChangeTime, onClose }) => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();

  const [activeField, setActiveField] = useState<TimeUnits>(TimeUnits.hour);
  const [hours, setHours] = useState(selectDate.format("HH"));
@ -159,7 +159,7 @@ const TimePicker: FC<CalendarTimepickerProps>= ({ selectDate, onChangeTime, onCl
      <div
        className={classNames({
          "vm-calendar-time-picker-fields": true,
-          "vm-calendar-time-picker-fields_dark": darkTheme
+          "vm-calendar-time-picker-fields_dark": isDarkTheme
        })}
      >
        <input
--- a/app/vmui/packages/vmui/src/components/Main/Icons/index.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/Icons/index.tsx
@ -389,3 +389,14 @@ export const QuestionIcon = () => (
  </svg>

 );
+
+export const StorageIcons = () => (
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+  >
+    <path
+      d="M4 20h16c1.1 0 2-.9 2-2s-.9-2-2-2H4c-1.1 0-2 .9-2 2s.9 2 2 2zm0-3h2v2H4v-2zM2 6c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2s-.9-2-2-2H4c-1.1 0-2 .9-2 2zm4 1H4V5h2v2zm-2 7h16c1.1 0 2-.9 2-2s-.9-2-2-2H4c-1.1 0-2 .9-2 2s.9 2 2 2zm0-3h2v2H4v-2z"
+    ></path>
+  </svg>
+);
--- a/app/vmui/packages/vmui/src/components/Main/Modal/style.scss
+++ b/app/vmui/packages/vmui/src/components/Main/Modal/style.scss
@ -8,7 +8,7 @@ $padding-modal: 22px;
  left: 0;
  right: 0;
  bottom: 0;
-  z-index: 999;
+  z-index: 100;
  display: flex;
  align-items: center;
  justify-content: center;
--- a/app/vmui/packages/vmui/src/components/Main/Select/Select.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/Select/Select.tsx
@ -27,7 +27,7 @@ const Select: FC<SelectProps> = ({
  autofocus,
  onChange
 }) => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();

  const [search, setSearch] = useState("");
  const autocompleteAnchorEl = useRef<HTMLDivElement>(null);
@ -111,7 +111,7 @@ const Select: FC<SelectProps> = ({
    <div
      className={classNames({
        "vm-select": true,
-        "vm-select_dark": darkTheme
+        "vm-select_dark": isDarkTheme
      })}
    >
      <div
--- a/app/vmui/packages/vmui/src/components/Main/Spinner/Spinner.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/Spinner/Spinner.tsx
@ -1,27 +1,31 @@
 import React, { CSSProperties, FC } from "preact/compat";
 import "./style.scss";
 import classNames from "classnames";
-import { getFromStorage } from "../../../utils/storage";
+import { useAppState } from "../../../state/common/StateContext";

 interface SpinnerProps {
  containerStyles?: CSSProperties;
  message?: string
 }

-const Spinner: FC<SpinnerProps> = ({ containerStyles = {}, message }) => (
-  <div
-    className={classNames({
-      "vm-spinner": true,
-      "vm-spinner_dark": getFromStorage("DARK_THEME")
-    })}
-    style={containerStyles && {}}
-  >
-    <div className="half-circle-spinner">
-      <div className="circle circle-1"></div>
-      <div className="circle circle-2"></div>
+const Spinner: FC<SpinnerProps> = ({ containerStyles = {}, message }) => {
+  const { isDarkTheme } = useAppState();
+
+  return (
+    <div
+      className={classNames({
+        "vm-spinner": true,
+        "vm-spinner_dark": isDarkTheme,
+      })}
+      style={containerStyles && {}}
+    >
+      <div className="half-circle-spinner">
+        <div className="circle circle-1"></div>
+        <div className="circle circle-2"></div>
+      </div>
+      {message && <div className="vm-spinner__message">{message}</div>}
    </div>
-    {message && <div className="vm-spinner__message">{message}</div>}
-  </div>
-);
+  );
+};

 export default Spinner;
--- a/app/vmui/packages/vmui/src/components/Main/TextField/TextField.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/TextField/TextField.tsx
@ -39,7 +39,7 @@ const TextField: FC<TextFieldProps> = ({
  onFocus,
  onBlur
 }) => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();

  const inputRef = useRef<HTMLInputElement>(null);
  const textareaRef = useRef<HTMLTextAreaElement>(null);
@ -83,7 +83,7 @@ const TextField: FC<TextFieldProps> = ({
    className={classNames({
      "vm-text-field": true,
      "vm-text-field_textarea": type === "textarea",
-      "vm-text-field_dark": darkTheme
+      "vm-text-field_dark": isDarkTheme
    })}
    data-replicated-value={value}
  >
--- a/app/vmui/packages/vmui/src/components/Main/ThemeProvider/ThemeProvider.ts
+++ b/app/vmui/packages/vmui/src/components/Main/ThemeProvider/ThemeProvider.ts
@ -1,12 +1,15 @@
-import { FC, useEffect } from "preact/compat";
+import { FC, useEffect, useState } from "preact/compat";
 import { getContrastColor } from "../../../utils/color";
-import { getCssVariable, setCssVariable } from "../../../utils/theme";
+import { getCssVariable, isSystemDark, setCssVariable } from "../../../utils/theme";
 import { AppParams, getAppModeParams } from "../../../utils/app-mode";
 import { getFromStorage } from "../../../utils/storage";
 import { darkPalette, lightPalette } from "../../../constants/palette";
+import { Theme } from "../../../types";
+import { useAppDispatch, useAppState } from "../../../state/common/StateContext";
+import useSystemTheme from "../../../hooks/useSystemTheme";

-interface StyleVariablesProps {
-  setLoadingTheme: (val: boolean) => void
+interface ThemeProviderProps {
+  onLoaded: (val: boolean) => void
 }

 const colorVariables = [
@ -18,9 +21,18 @@ const colorVariables = [
  "success",
 ];

-export const ThemeProvider: FC<StyleVariablesProps> = ({ setLoadingTheme }) => {
+export const ThemeProvider: FC<ThemeProviderProps> = ({ onLoaded }) => {

-  const { palette = {} } = getAppModeParams();
+  const { palette: paletteAppMode = {} } = getAppModeParams();
+  const { theme } = useAppState();
+  const isDarkTheme = useSystemTheme();
+  const dispatch = useAppDispatch();
+
+  const [palette, setPalette] = useState({
+    [Theme.dark]: darkPalette,
+    [Theme.light]: lightPalette,
+    [Theme.system]: isSystemDark() ? darkPalette : lightPalette
+  });

  const setScrollbarSize = () => {
    const { innerWidth, innerHeight } = window;
@ -30,16 +42,21 @@ export const ThemeProvider: FC<StyleVariablesProps> = ({ setLoadingTheme }) => {
  };

  const setContrastText = () => {
-    colorVariables.forEach(variable => {
+    colorVariables.forEach((variable, i) => {
      const color = getCssVariable(`color-${variable}`);
      const text = getContrastColor(color);
      setCssVariable(`${variable}-text`, text);
+
+      if (i === colorVariables.length - 1) {
+        dispatch({ type: "SET_DARK_THEME" });
+        onLoaded(true);
+      }
    });
  };

  const setAppModePalette = () => {
    colorVariables.forEach(variable => {
-      const colorFromAppMode = palette[variable as keyof AppParams["palette"]];
+      const colorFromAppMode = paletteAppMode[variable as keyof AppParams["palette"]];
      if (colorFromAppMode) setCssVariable(`color-${variable}`, colorFromAppMode);
    });

@ -47,25 +64,33 @@ export const ThemeProvider: FC<StyleVariablesProps> = ({ setLoadingTheme }) => {
  };

  const setTheme = () => {
-    const darkTheme = getFromStorage("DARK_THEME");
-    const palette = darkTheme ? darkPalette : lightPalette;
-    Object.entries(palette).forEach(([variable, value]) => {
+    const theme = (getFromStorage("THEME") || Theme.system) as Theme;
+    const result = palette[theme];
+    Object.entries(result).forEach(([variable, value]) => {
      setCssVariable(variable, value);
    });
    setContrastText();
  };

+  const updatePalette = () => {
+    const newSystemPalette = isSystemDark() ? darkPalette : lightPalette;
+    if (palette[Theme.system] === newSystemPalette) {
+      setTheme();
+      return;
+    }
+    setPalette(prev => ({
+      ...prev,
+      [Theme.system]: newSystemPalette
+    }));
+  };
+
  useEffect(() => {
    setAppModePalette();
    setScrollbarSize();
    setTheme();
-    setLoadingTheme(false);
+  }, [palette]);

-    window.addEventListener("storage", setTheme);
-    return () => {
-      window.removeEventListener("storage", setTheme);
-    };
-  }, []);
+  useEffect(updatePalette, [theme, isDarkTheme]);

  return null;
 };
--- a/app/vmui/packages/vmui/src/components/Main/Toggle/Toggle.tsx
+++ b/app/vmui/packages/vmui/src/components/Main/Toggle/Toggle.tsx
@ -0,0 +1,94 @@
+import React, { FC, useEffect, useRef, useState } from "preact/compat";
+import classNames from "classnames";
+import { ReactNode } from "react";
+import "./style.scss";
+
+interface ToggleProps {
+  options: {value: string, title?: string, icon?: ReactNode}[]
+  value: string
+  onChange: (val: string) => void
+  label?: string
+}
+
+const Toggle: FC<ToggleProps> = ({ options, value, label, onChange }) => {
+
+  const activeRef = useRef<HTMLDivElement>(null);
+  const [position, setPosition] = useState({
+    width: "0px",
+    left: "0px",
+    borderRadius: "0px"
+  });
+
+  const createHandlerChange = (value: string) => () => {
+    onChange(value);
+  };
+
+  useEffect(() => {
+    if (!activeRef.current) {
+      setPosition({
+        width: "0px",
+        left: "0px",
+        borderRadius: "0px"
+      });
+      return;
+    }
+    const index = options.findIndex(o => o.value === value);
+    const { width: widthRect } = activeRef.current.getBoundingClientRect();
+
+    let width = widthRect;
+    let left = index * width;
+    let borderRadius = "0";
+    if (index === 0) borderRadius = "16px 0 0 16px";
+
+    if (index === options.length - 1) {
+      borderRadius = "10px";
+      left -= 1;
+      borderRadius = "0 16px 16px 0";
+    }
+
+    if (index !== 0 && (index !== options.length - 1)) {
+      width += 1;
+      left -= 1;
+    }
+
+
+    setPosition({ width: `${width}px`, left: `${left}px`, borderRadius });
+  }, [activeRef, value, options]);
+
+  return (
+    <div className="vm-toggles">
+      {label && (
+        <label className="vm-toggles__label">
+          {label}
+        </label>
+      )}
+      <div
+        className="vm-toggles-group"
+        style={{ gridTemplateColumns: `repeat(${options.length}, 1fr)` }}
+      >
+        {position.borderRadius && <div
+          className="vm-toggles-group__highlight"
+          style={position}
+        />}
+        {options.map((option, i) => (
+          <div
+            className={classNames({
+              "vm-toggles-group-item": true,
+              "vm-toggles-group-item_first": i === 0,
+              "vm-toggles-group-item_active": option.value === value,
+              "vm-toggles-group-item_icon": option.icon && option.title
+            })}
+            onClick={createHandlerChange(option.value)}
+            key={option.value}
+            ref={option.value === value ? activeRef : null}
+          >
+            {option.icon}
+            {option.title}
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+};
+
+export default Toggle;
--- a/app/vmui/packages/vmui/src/components/Main/Toggle/style.scss
+++ b/app/vmui/packages/vmui/src/components/Main/Toggle/style.scss
@ -0,0 +1,81 @@
+@use "src/styles/variables" as *;
+
+.vm-toggles {
+  position: relative;
+  display: grid;
+  gap: 3px;
+  width: 100%;
+
+  &__label {
+    padding: 0 $padding-global;
+    color: $color-text-secondary;
+    font-size: $font-size-small;
+    line-height: 1;
+  }
+
+  &-group {
+    position: relative;
+    display: grid;
+    width: 100%;
+    align-items: center;
+    justify-content: center;
+    overflow: hidden;
+
+    &-item {
+      position: relative;
+      display: grid;
+      align-items: center;
+      justify-content: center;
+      padding: $padding-small;
+      border-right: $border-divider;
+      border-top: $border-divider;
+      border-bottom: $border-divider;
+      font-size: $font-size-small;
+      color: $color-text-secondary;
+      font-weight: bold;
+      cursor: pointer;
+      text-align: center;
+      transition: color 150ms ease-in;
+      z-index: 2;
+      user-select: none;
+
+      &_first {
+        border-radius: 16px 0 0 16px;
+        border-left: $border-divider
+      }
+
+      &:last-child {
+        border-radius: 0 16px 16px 0;
+        border-left: none;
+      }
+
+      &_icon {
+        grid-template-columns: 14px auto;
+        gap: 4px;
+      }
+
+      &:hover {
+        color: $color-primary;
+      }
+
+      &_active {
+        color: $color-primary;
+        border-color: transparent;
+
+        &:hover {
+          background-color: transparent;
+        }
+      }
+    }
+
+    &__highlight {
+      position: absolute;
+      top: 0;
+      height: 100%;
+      background-color: rgba($color-primary, 0.08);
+      border: 1px solid $color-primary;
+      transition: left 200ms cubic-bezier(0.280, 0.840, 0.420, 1), border-radius 200ms linear;
+      z-index: 1;
+    }
+  }
+}
--- a/app/vmui/packages/vmui/src/components/TraceQuery/NestedNav/NestedNav.tsx
+++ b/app/vmui/packages/vmui/src/components/TraceQuery/NestedNav/NestedNav.tsx
@ -16,7 +16,7 @@ interface OpenLevels {
 }

 const NestedNav: FC<RecursiveProps> = ({ trace, totalMsec })  => {
-  const { darkTheme } = useAppState();
+  const { isDarkTheme } = useAppState();
  const [openLevels, setOpenLevels] = useState({} as OpenLevels);

  const handleListClick = (level: number) => () => {
@ -31,7 +31,7 @@ const NestedNav: FC<RecursiveProps> = ({ trace, totalMsec })  => {
    <div
      className={classNames({
        "vm-nested-nav": true,
-        "vm-nested-nav_dark": darkTheme,
+        "vm-nested-nav_dark": isDarkTheme,
      })}
    >
      <div
--- a/app/vmui/packages/vmui/src/constants/palette.ts
+++ b/app/vmui/packages/vmui/src/constants/palette.ts
@ -7,7 +7,7 @@ export const darkPalette = {
  "color-success": "#57ab5a",
  "color-background-body": "#22272e",
  "color-background-block": "#2d333b",
-  "color-background-tooltip": "rgba(22, 22, 22, 0.6)",
+  "color-background-tooltip": "rgba(22, 22, 22, 0.8)",
  "color-text": "#cdd9e5",
  "color-text-secondary": "#768390",
  "color-text-disabled": "#636e7b",
--- a/app/vmui/packages/vmui/src/hooks/useSystemTheme.ts
+++ b/app/vmui/packages/vmui/src/hooks/useSystemTheme.ts
@ -0,0 +1,20 @@
+import { useEffect, useState } from "preact/compat";
+import { isSystemDark } from "../utils/theme";
+
+const useThemeDetector = () => {
+  const [isDarkTheme, setIsDarkTheme] = useState(isSystemDark());
+
+  const mqListener = ((e: MediaQueryListEvent) => {
+    setIsDarkTheme(e.matches);
+  });
+
+  useEffect(() => {
+    const darkThemeMq = window.matchMedia("(prefers-color-scheme: dark)");
+    darkThemeMq.addEventListener("change", mqListener);
+    return () => darkThemeMq.removeEventListener("change", mqListener);
+  }, []);
+
+  return isDarkTheme;
+};
+
+export default useThemeDetector;
--- a/app/vmui/packages/vmui/src/pages/CardinalityPanel/CardinalityConfigurator/CardinalityConfigurator.tsx
+++ b/app/vmui/packages/vmui/src/pages/CardinalityPanel/CardinalityConfigurator/CardinalityConfigurator.tsx
@ -1,14 +1,13 @@
-import React, { FC } from "react";
+import React, { FC, useMemo } from "react";
 import QueryEditor from "../../../components/Configurators/QueryEditor/QueryEditor";
 import { useFetchQueryOptions } from "../../../hooks/useFetchQueryOptions";
 import { ErrorTypes } from "../../../types";
 import { useQueryDispatch, useQueryState } from "../../../state/query/QueryStateContext";
 import Switch from "../../../components/Main/Switch/Switch";
-import { PlayIcon, QuestionIcon } from "../../../components/Main/Icons";
+import { InfoIcon, PlayIcon, QuestionIcon, WikiIcon } from "../../../components/Main/Icons";
 import Button from "../../../components/Main/Button/Button";
 import TextField from "../../../components/Main/TextField/TextField";
 import "./style.scss";
-import { useMemo } from "preact/compat";
 import Tooltip from "../../../components/Main/Tooltip/Tooltip";

 export interface CardinalityConfiguratorProps {
@ -65,7 +64,7 @@ const CardinalityConfigurator: FC<CardinalityConfiguratorProps> = ({
    <div className="vm-cardinality-configurator-controls">
      <div className="vm-cardinality-configurator-controls__query">
        <QueryEditor
-          value={query || match || ""}
+          value={query}
          autocomplete={autocomplete}
          options={queryOptions}
          error={error}
@ -91,10 +90,22 @@ const CardinalityConfigurator: FC<CardinalityConfiguratorProps> = ({
          type="text"
          value={focusLabel || ""}
          onChange={onFocusLabelChange}
+          endIcon={(
+            <Tooltip
+              title={(
+                <div>
+                  <p>To identify values with the highest number of series for the selected label.</p>
+                  <p>Adds a table showing the series with the highest number of series.</p>
+                </div>
+              )}
+            >
+              <InfoIcon/>
+            </Tooltip>
+          )}
        />
      </div>
    </div>
-    <div className="vm-cardinality-configurator-bottom__autocomplete">
+    <div className="vm-cardinality-configurator-additional">
      <Switch
        label={"Autocomplete"}
        value={autocomplete}
@ -108,17 +119,22 @@ const CardinalityConfigurator: FC<CardinalityConfiguratorProps> = ({
        Show top {topN} entries per table.
      </div>
      <a
-        className="vm-cardinality-configurator-bottom__docs"
-        href="https://victoriametrics.com/blog/cardinality-explorer/"
+        className="vm-link vm-link_with-icon"
        target="_blank"
+        href="https://docs.victoriametrics.com/#cardinality-explorer"
        rel="help noreferrer"
      >
-        <Tooltip title="Example of using">
-          <Button
-            variant="text"
-            startIcon={<QuestionIcon/>}
-          />
-        </Tooltip>
+        <WikiIcon/>
+        Documentation
+      </a>
+      <a
+        className="vm-link vm-link_with-icon"
+        target="_blank"
+        href="https://victoriametrics.com/blog/cardinality-explorer/"
+        rel="help noreferrer"
+      >
+        <QuestionIcon/>
+        Example of using
      </a>
      <Button
        startIcon={<PlayIcon/>}
--- a/app/vmui/packages/vmui/src/pages/CardinalityPanel/CardinalityConfigurator/style.scss
+++ b/app/vmui/packages/vmui/src/pages/CardinalityPanel/CardinalityConfigurator/style.scss
@ -16,20 +16,23 @@
    }
  }

+  &-additional {
+    display: flex;
+    align-items: center;
+  }
+
  &-bottom {
-    display: grid;
-    grid-template-columns: 1fr auto auto;
-    align-items: flex-end;
-    gap: $padding-small;
+    display: flex;
+    align-items: center;
+    gap: $padding-global;

    &__info {
+      flex-grow: 1;
      font-size: $font-size;
    }

-    &__docs {
-      display: flex;
-      align-items: center;
-      justify-content: center;
+    a {
+      color: $color-text-secondary;
    }
  }
 }
--- a/app/vmui/packages/vmui/src/pages/CardinalityPanel/index.tsx
+++ b/app/vmui/packages/vmui/src/pages/CardinalityPanel/index.tsx
@ -31,10 +31,6 @@ const Index: FC = () => {
    cardinalityDispatch({ type: "RUN_QUERY" });
  };

-  const onSetQuery = (query: string) => {
-    setQuery(query);
-  };
-
  const onSetHistory = (step: number) => {
    const newIndexHistory = queryHistoryIndex + step;
    if (newIndexHistory < 0 || newIndexHistory >= queryHistory.length) return;
@ -86,7 +82,7 @@ const Index: FC = () => {
        totalLabelValuePairs={tsdbStatusData.totalLabelValuePairs}
        focusLabel={focusLabel}
        onRunQuery={onRunQuery}
-        onSetQuery={onSetQuery}
+        onSetQuery={setQuery}
        onSetHistory={onSetHistory}
        onTopNChange={onTopNChange}
        onFocusLabelChange={onFocusLabelChange}
--- a/app/vmui/packages/vmui/src/router/index.ts
+++ b/app/vmui/packages/vmui/src/router/index.ts
@ -8,19 +8,23 @@ const router = {
  icons: "/icons"
 };

+export interface RouterOptionsHeader {
+  tenant?: boolean,
+  stepControl?: boolean,
+  timeSelector?: boolean,
+  executionControls?: boolean,
+  globalSettings?: boolean,
+  cardinalityDatePicker?: boolean
+}
+
 export interface RouterOptions {
  title?: string,
-  header: {
-    stepControl?: boolean,
-    timeSelector?: boolean,
-    executionControls?: boolean,
-    globalSettings?: boolean,
-    cardinalityDatePicker?: boolean
-  }
+  header: RouterOptionsHeader
 }

 const routerOptionsDefault = {
  header: {
+    tenant: true,
    stepControl: true,
    timeSelector: true,
    executionControls: true,
@ -35,6 +39,7 @@ export const routerOptions: {[key: string]: RouterOptions} = {
  [router.metrics]: {
    title: "Explore metrics",
    header: {
+      tenant: true,
      stepControl: true,
      timeSelector: true,
    }
@ -42,12 +47,15 @@ export const routerOptions: {[key: string]: RouterOptions} = {
  [router.cardinality]: {
    title: "Explore cardinality",
    header: {
+      tenant: true,
      cardinalityDatePicker: true,
    }
  },
  [router.topQueries]: {
    title: "Top queries",
-    header: {}
+    header: {
+      tenant: true,
+    }
  },
  [router.trace]: {
    title: "Trace analyzer",
--- a/app/vmui/packages/vmui/src/state/common/reducer.ts
+++ b/app/vmui/packages/vmui/src/state/common/reducer.ts
@ -1,22 +1,29 @@
 import { getDefaultServer } from "../../utils/default-server-url";
 import { getQueryStringValue } from "../../utils/query-string";
 import { getFromStorage, saveToStorage } from "../../utils/storage";
+import { Theme } from "../../types";
+import { isDarkTheme } from "../../utils/theme";

 export interface AppState {
  serverUrl: string;
-  tenantId: number;
-  darkTheme: boolean
+  tenantId: string;
+  theme: Theme;
+  isDarkTheme: boolean | null;
 }

 export type Action =
  | { type: "SET_SERVER", payload: string }
-  | { type: "SET_TENANT_ID", payload: number }
-  | { type: "SET_DARK_THEME", payload: boolean }
+  | { type: "SET_THEME", payload: Theme }
+  | { type: "SET_TENANT_ID", payload: string }
+  | { type: "SET_DARK_THEME" }
+
+const tenantId = getQueryStringValue("g0.tenantID", "") as string;

 export const initialState: AppState = {
-  serverUrl: getDefaultServer(),
-  tenantId: Number(getQueryStringValue("g0.tenantID", 0)),
-  darkTheme: !!getFromStorage("DARK_THEME")
+  serverUrl: getDefaultServer(tenantId),
+  tenantId,
+  theme: (getFromStorage("THEME") || Theme.system) as Theme,
+  isDarkTheme: null
 };

 export function reducer(state: AppState, action: Action): AppState {
@ -31,11 +38,16 @@ export function reducer(state: AppState, action: Action): AppState {
        ...state,
        tenantId: action.payload
      };
-    case "SET_DARK_THEME":
-      saveToStorage("DARK_THEME", action.payload);
+    case "SET_THEME":
+      saveToStorage("THEME", action.payload);
      return {
        ...state,
-        darkTheme: action.payload
+        theme: action.payload,
+      };
+    case "SET_DARK_THEME":
+      return {
+        ...state,
+        isDarkTheme: isDarkTheme(state.theme)
      };
    default:
      throw new Error();
--- a/app/vmui/packages/vmui/src/styles/components/link.scss
+++ b/app/vmui/packages/vmui/src/styles/components/link.scss
@ -8,6 +8,14 @@
    color: $color-primary;
  }

+  &_with-icon {
+    display: grid;
+    align-items: center;
+    justify-content: center;
+    gap: 6px;
+    grid-template-columns: 14px auto;
+  }
+
  &:hover {
    color: $color-primary;
    text-decoration: underline;
--- a/app/vmui/packages/vmui/src/types/index.ts
+++ b/app/vmui/packages/vmui/src/types/index.ts
@ -119,3 +119,9 @@ export interface GraphSize {
  isDefault?: boolean,
  height: () => number
 }
+
+export enum Theme {
+  system = "system",
+  light = "light",
+  dark = "dark",
+}
--- a/app/vmui/packages/vmui/src/utils/default-server-url.ts
+++ b/app/vmui/packages/vmui/src/utils/default-server-url.ts
@ -1,6 +1,13 @@
 import { getAppModeParams } from "./app-mode";

-export const getDefaultServer = (): string => {
+export const getDefaultServer = (tenantId?: string): string => {
  const { serverURL } = getAppModeParams();
-  return serverURL || window.location.href.replace(/\/(?:prometheus\/)?(?:graph|vmui)\/.*/, "/prometheus");
+  const url = serverURL || window.location.href.replace(/\/(?:prometheus\/)?(?:graph|vmui)\/.*/, "/prometheus");
+  if (tenantId) return replaceTenantId(url, tenantId);
+  return url;
+};
+
+export const replaceTenantId = (serverUrl: string, tenantId: string) => {
+  const regexp = /(\/select\/)(\d+|\d.+)(\/)(.+)/;
+  return serverUrl.replace(regexp, `$1${tenantId}/$4`);
 };
--- a/app/vmui/packages/vmui/src/utils/storage.ts
+++ b/app/vmui/packages/vmui/src/utils/storage.ts
@ -7,7 +7,7 @@ export type StorageKeys = "BASIC_AUTH_DATA"
    | "SERIES_LIMITS"
    | "TABLE_COMPACT"
    | "TIMEZONE"
-    | "DARK_THEME"
+    | "THEME"

 export const saveToStorage = (key: StorageKeys, value: string | boolean | Record<string, unknown>): void => {
  if (value) {
--- a/app/vmui/packages/vmui/src/utils/theme.ts
+++ b/app/vmui/packages/vmui/src/utils/theme.ts
@ -1,3 +1,5 @@
+import { Theme } from "../types";
+
 export const getCssVariable = (variable: string) => {
  return getComputedStyle(document.documentElement).getPropertyValue(`--${variable}`);
 };
@ -5,3 +7,8 @@ export const getCssVariable = (variable: string) => {
 export const setCssVariable = (variable: string, value: string) => {
  document.documentElement.style.setProperty(`--${variable}`, value);
 };
+
+export const isSystemDark = () => window.matchMedia("(prefers-color-scheme: dark)").matches;
+
+export const isDarkTheme = (theme: Theme) => (theme === Theme.system && isSystemDark()) || theme === Theme.dark;
+
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@ -19,14 +19,26 @@ The following tip changes can be tested by building VictoriaMetrics components f
 * FEATURE: [vmui](https://docs.victoriametrics.com/#vmui): add dark mode - it can be seleted via `settings` menu in the top right corner. See [this pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3704).
 * FEATURE: [vmui](https://docs.victoriametrics.com/#vmui): improve visual appearance of the top menu. See [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3678).
 * FEATURE: [vmui](https://docs.victoriametrics.com/#vmui): embed fonts into binary instead of loading them from external sources. This allows using `vmui` in full from isolated networks without access to Internet. Thanks to @ScottKevill for [the pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3696).
+* FEATURE: [vmui](https://docs.victoriametrics.com/#vmui): add ability to switch between tenants by selecting the needed tenant in the drop-down list at the top right corner of the UI. See [this pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3673).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/vmagent.html): reduce memory usage when sending stale markers for targets, which expose big number of metrics. See [this](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3668) and [this](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3675) issues.
+* FEATURE: [vmagent](https://docs.victoriametrics.com/vmagent.html): add `__meta_kubernetes_pod_container_id` meta-label to the targets discovered via [kubernetes_sd_configs](https://docs.victoriametrics.com/sd_configs.html#kubernetes_sd_configs). This label has been added in Prometheus starting from `v2.42.0`. See [this feature request](https://github.com/prometheus/prometheus/issues/11843).
+* FEATURE: [vmagent](https://docs.victoriametrics.com/vmagent.html): add `__meta_azure_machine_size` meta-label to the targets discovered via [azure_sd_configs](https://docs.victoriametrics.com/sd_configs.html#azure_sd_configs). This label has been added in Prometheus starting from `v2.42.0`. See [this pull request](https://github.com/prometheus/prometheus/pull/11650).
+* FEATURE: [vmauth](https://docs.victoriametrics.com/vmauth.html): allow limiting the number of concurrent requests sent to `vmauth` via `-maxConcurrentRequests` command-line flag. This allows controlling memory usage of `vmauth` and the resource usage of backends behind `vmauth`. See [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3346). Thanks to @dmitryk-dk for [the initial implementation](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3486).
 * FEATURE: allow using VictoriaMetrics components behind proxies, which communicate with the backend via [proxy protocol](https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt). See [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3335). For example, [vmauth](https://docs.victoriametrics.com/vmauth.html) accepts proxy protocol connections when it starts with `-httpListenAddr.useProxyProtocol` command-line flag.
 * FEATURE: add `-internStringMaxLen` command-line flag, which can be used for fine-tuning RAM vs CPU usage in certain workloads. For example, if the stored time series contain long labels, then it may be useful reducing the `-internStringMaxLen` in order to reduce memory usage at the cost of increased CPU usage. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3692).
+* FEATURE: provide GOARCH=386 binaries for single-node VictoriaMetrics, vmagent, vmalert, vmauth, vmbackup and vmrestore components at [releases page](https://github.com/VictoriaMetrics/VictoriaMetrics/releases). See [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3661). Thanks to @denisgolius for [the pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3725).

 * BUGFIX: fix a bug, which could prevent background merges for the previous partitions until restart if the storage didn't have enough disk space for final deduplication and down-sampling.
+* BUGFIX: fix a bug, which could lead to increased CPU usage and disk IO usage when adding data to previous months and when the [deduplication](https://docs.victoriametrics.com/#deduplication) or [downsampling](https://docs.victoriametrics.com/#downsampling) is enabled. See [this pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3737).
 * BUGFIX: [VictoriaMetrics cluster](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html): propagate all the timeout-related errors from `vmstorage` to `vmselect` when `vmstorage`. Previously some timeout errors weren't returned from `vmselect` to `vmstorage`. Instead, `vmstorage` could log the error and close the connection to `vmselect`, so `vmselect` was logging cryptic errors such as `cannot execute funcName="..." on vmstorage "...": EOF`.
 * BUGFIX: [vmui](https://docs.victoriametrics.com/#vmui): add support for time zone selection for older versions of browsers. See [this pull request](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/3680).
 * BUGFIX: [vmagent](https://docs.victoriametrics.com/vmagent.html): update API version for [ec2_sd_configs](https://docs.victoriametrics.com/sd_configs.html#ec2_sd_configs) to fix [the issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3700) with missing `__meta_ec2_availability_zone_id` attribute.
+* BUGFIX: [vmagent](https://docs.victoriametrics.com/vmagent.html): properly return `200 OK` HTTP status code when importing data via [Pushgateway protocol](https://docs.victoriametrics.com/#how-to-import-data-in-prometheus-exposition-format). See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3636).
+* BUGFIX: [vmagent](https://docs.victoriametrics.com/vmagent.html): do not add `exported_` prefix to scraped metric names, which clash with the [automatically generated metric names](https://docs.victoriametrics.com/vmagent.html#automatically-generated-metrics) if `honor_labels: true` option is set in the [scrape_config](https://docs.victoriametrics.com/sd_configs.html#scrape_configs). See the [this](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3557) and [this](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3406) issues.
+* BUGFIX: [vmauth](https://docs.victoriametrics.com/vmauth.html): allow re-entering authorization info in the web browser if the entered info was incorrect. Previously it was non-trivial to do via the web browser, since `vmauth` was returning `400 Bad Request` instead of `401 Unauthorized` http response code.
+* BUGFIX: [vmauth](https://docs.victoriametrics.com/vmauth.html): always log the client address and the requested URL on proxying errors. Previously some errors could miss this information.
+* BUGFIX: [vmbackup](https://docs.victoriametrics.com/vmbackup.html): fix snapshot not being deleted after backup completion. This issue could result in unnecessary snapshots being stored, it is required to delete unnecessary snapshots manually. See the [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3735).
+* BUGFIX: [VictoriaMetrics cluster](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html): fix panic on top-level vmselect nodes of [multi-level setup](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#multi-level-cluster-setup) when the `-replicationFactor` flag is set and request contains `trace` query parameter. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3734).

 ## [v1.86.2](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.86.2)

--- a/docs/Cluster-VictoriaMetrics.md
+++ b/docs/Cluster-VictoriaMetrics.md
@ -37,7 +37,9 @@ Each service may scale independently and may run on the most suitable hardware.
 This is a [shared nothing architecture](https://en.wikipedia.org/wiki/Shared-nothing_architecture).
 It increases cluster availability, and simplifies cluster maintenance as well as cluster scaling.

-![Naive cluster scheme](Cluster-VictoriaMetrics_cluster-scheme.png)
+<p align="center">
+  <img src="Cluster-VictoriaMetrics_cluster-scheme.png" width="800">
+</p>

 ## Multitenancy

@ -237,9 +239,25 @@ for sending data from `vminsert` to `vmstorage` node according to `-vminsertAddr

 The currently discovered `vmstorage` nodes can be [monitored](#monitoring) with `vm_rpc_vmstorage_is_reachable` and `vm_rpc_vmstorage_is_read_only` metrics.

+## Security
+
+General security recommendations:
+
+- All the VictoriaMetrics cluster components must run in protected private network without direct access from untrusted networks such as Internet.
+- External clients must access `vminsert` and `vmselect` via auth proxy such as [vmauth](https://docs.victoriametrics.com/vmauth.html)
+  or [vmgateway](https://docs.victoriametrics.com/vmgateway.html).
+- The auth proxy must accept auth tokens from untrusted networks only via https in order to protect the auth tokens from eavesdropping.
+- It is recommended using distinct auth tokens for distinct [tenants](#multitenancy) in order to reduce potential damage in case of compromised auth token for some tenants.
+- Prefer using lists of allowed [API endpoints](#url-format), while disallowing access to other endpoints when configuring auth proxy in front of `vminsert` and `vmselect`.
+  This minimizes attack surface.
+
+See also [security recommendation for single-node VictoriaMetrics](https://docs.victoriametrics.com/#security)
+and [the general security page at VictoriaMetrics website](https://victoriametrics.com/security/).
+
+
 ## mTLS protection

-By default `vminsert` and `vmselect` nodes use unencrypted connections to `vmstorage` nodes, since it is assumed that all the cluster components run in a protected environment. [Enterprise version of VictoriaMetrics](https://docs.victoriametrics.com/enterprise.html) provides optional support for [mTLS connections](https://en.wikipedia.org/wiki/Mutual_authentication#mTLS) between cluster components. Pass `-cluster.tls=true` command-line flag to `vminsert`, `vmselect` and `vmstorage` nodes in order to enable mTLS protection. Additionally, `vminsert`, `vmselect` and `vmstorage` must be configured with mTLS certificates via `-cluster.tlsCertFile`, `-cluster.tlsKeyFile` command-line options. These certificates are mutually verified when `vminsert` and `vmselect` dial `vmstorage`.
+By default `vminsert` and `vmselect` nodes use unencrypted connections to `vmstorage` nodes, since it is assumed that all the cluster components [run in a protected environment](#security). [Enterprise version of VictoriaMetrics](https://docs.victoriametrics.com/enterprise.html) provides optional support for [mTLS connections](https://en.wikipedia.org/wiki/Mutual_authentication#mTLS) between cluster components. Pass `-cluster.tls=true` command-line flag to `vminsert`, `vmselect` and `vmstorage` nodes in order to enable mTLS protection. Additionally, `vminsert`, `vmselect` and `vmstorage` must be configured with mTLS certificates via `-cluster.tlsCertFile`, `-cluster.tlsKeyFile` command-line options. These certificates are mutually verified when `vminsert` and `vmselect` dial `vmstorage`.

 The following optional command-line flags related to mTLS are supported:

--- a/docs/Quick-Start.md
+++ b/docs/Quick-Start.md
@ -174,3 +174,8 @@ and [backups](https://docs.victoriametrics.com/Single-server-VictoriaMetrics.htm
 To avoid excessive resource usage or performance degradation limits must be in place:
 * [Resource usage limits](https://docs.victoriametrics.com/FAQ.html#how-to-set-a-memory-limit-for-victoriametrics-components);
 * [Cardinality limiter](https://docs.victoriametrics.com/Single-server-VictoriaMetrics.html#cardinality-limiter).
+
+### Security recommendations
+
+* [Security recommendations for single-node VictoriaMetrics](https://docs.victoriametrics.com/#security)
+* [Security recommendations for cluster version of VictoriaMetrics](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#security)
--- a/docs/README.md
+++ b/docs/README.md
@ -1617,7 +1617,9 @@ VictoriaMetrics provides the following security-related command-line flags:
 Explicitly set internal network interface for TCP and UDP ports for data ingestion with Graphite and OpenTSDB formats.
 For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=<internal_iface_ip>:2003`. This protects from unexpected requests from untrusted network interfaces.

-VictoriaMetrics has achieved security certifications for Database Software Development and Software-Based Monitoring Services. We apply strict security measures in everything we do. See our [Security page](https://victoriametrics.com/security/) for more details.
+See also [security recommendation for VictoriaMetrics cluster](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#security)
+and [the general security page at VictoriaMetrics website](https://victoriametrics.com/security/).
+

 ## Tuning

--- a/docs/Single-server-VictoriaMetrics.md
+++ b/docs/Single-server-VictoriaMetrics.md
@ -1620,7 +1620,9 @@ VictoriaMetrics provides the following security-related command-line flags:
 Explicitly set internal network interface for TCP and UDP ports for data ingestion with Graphite and OpenTSDB formats.
 For example, substitute `-graphiteListenAddr=:2003` with `-graphiteListenAddr=<internal_iface_ip>:2003`. This protects from unexpected requests from untrusted network interfaces.

-VictoriaMetrics has achieved security certifications for Database Software Development and Software-Based Monitoring Services. We apply strict security measures in everything we do. See our [Security page](https://victoriametrics.com/security/) for more details.
+See also [security recommendation for VictoriaMetrics cluster](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#security)
+and [the general security page at VictoriaMetrics website](https://victoriametrics.com/security/).
+

 ## Tuning

--- a/docs/sd_configs.md
+++ b/docs/sd_configs.md
@ -82,8 +82,9 @@ The following meta labels are available on discovered targets during [relabeling
 * `__meta_azure_machine_private_ip`: the machine's private IP
 * `__meta_azure_machine_public_ip`: the machine's public IP if it exists
 * `__meta_azure_machine_resource_group`: the machine's resource group
-* `__meta_azure_machine_tag_<tagname>`: each tag value of the machine
 * `__meta_azure_machine_scale_set`: the name of the scale set which the vm is part of (this value is only set if you are using a scale set)
+* `__meta_azure_machine_size`: the machine size
+* `__meta_azure_machine_tag_<tagname>`: each tag value of the machine
 * `__meta_azure_subscription_id`: the subscription ID
 * `__meta_azure_tenant_id`: the tenant ID

@ -788,8 +789,9 @@ One of the following `role` types can be configured to discover targets:
  * `__meta_kubernetes_pod_labelpresent_<labelname>`: "true" for each label from the pod object.
  * `__meta_kubernetes_pod_annotation_<annotationname>`: Each annotation from the pod object.
  * `__meta_kubernetes_pod_annotationpresent_<annotationname>`: "true" for each annotation from the pod object.
-  * `__meta_kubernetes_pod_container_init`: "true" if the container is an InitContainer
+  * `__meta_kubernetes_pod_container_id`: ID of the container in the form `<type>://<container_id>`.
  * `__meta_kubernetes_pod_container_image`: Container image the target address points to.
+  * `__meta_kubernetes_pod_container_init`: "true" if the container is an InitContainer.
  * `__meta_kubernetes_pod_container_name`: Name of the container the target address points to.
  * `__meta_kubernetes_pod_container_port_name`: Name of the container port.
  * `__meta_kubernetes_pod_container_port_number`: Number of the container port.
--- a/docs/vmalert.md
+++ b/docs/vmalert.md
@ -13,6 +13,13 @@ protocol and require `-remoteWrite.url` to be configured.
 Vmalert is heavily inspired by [Prometheus](https://prometheus.io/docs/alerting/latest/overview/)
 implementation and aims to be compatible with its syntax.

+A [single-node](https://docs.victoriametrics.com/Single-server-VictoriaMetrics.html#vmalert)
+or [cluster version](https://docs.victoriametrics.com/Cluster-VictoriaMetrics.html#vmalert)
+of VictoriaMetrics are capable of proxying requests to vmalert via `-vmalert.proxyURL` command-line flag. 
+Use this feature for the following cases:
+* for proxying requests from [Grafana Alerting UI](https://grafana.com/docs/grafana/latest/alerting/);
+* for accessing vmalert's UI through VictoriaMetrics Web interface.
+
 ## Features

 * Integration with [VictoriaMetrics](https://github.com/VictoriaMetrics/VictoriaMetrics) TSDB;
--- a/docs/vmauth.md
+++ b/docs/vmauth.md
@ -288,8 +288,10 @@ See the docs at https://docs.victoriametrics.com/vmauth.html .
     Timezone to use for timestamps in logs. Timezone must be a valid IANA Time Zone. For example: America/New_York, Europe/Berlin, Etc/GMT+3 or Local (default "UTC")
  -loggerWarnsPerSecondLimit int
     Per-second limit on the number of WARN messages. If more than the given number of warns are emitted per second, then the remaining warns are suppressed. Zero values disable the rate limit
+  -maxConcurrentRequests int
+     The maximum number of concurrent requests vmauth can process. Other requests are rejected with '429 Too Many Requests' http status code. See also -maxIdleConnsPerBackend (default 1000)
  -maxIdleConnsPerBackend int
-     The maximum number of idle connections vmauth can open per each backend host (default 100)
+     The maximum number of idle connections vmauth can open per each backend host. See also -maxConcurrentRequests (default 100)
  -memory.allowedBytes size
     Allowed size of system memory VictoriaMetrics caches may occupy. This option overrides -memory.allowedPercent if set to a non-zero value. Too low a value may increase the cache miss rate usually resulting in higher CPU and disk IO usage. Too high a value may evict too much data from OS page cache resulting in higher disk IO usage
     Supports the following optional suffixes for size values: KB, MB, GB, TB, KiB, MiB, GiB, TiB (default 0)
@ -309,6 +311,8 @@ See the docs at https://docs.victoriametrics.com/vmauth.html .
     Supports an array of values separated by comma or specified via multiple flags.
  -reloadAuthKey string
     Auth key for /-/reload http endpoint. It must be passed as authKey=...
+  -responseTimeout duration
+     The timeout for receiving a response from backend (default 5m0s)
  -tls
     Whether to enable TLS for incoming HTTP requests at -httpListenAddr (aka https). -tlsCertFile and -tlsKeyFile must be set if -tls is set
  -tlsCertFile string
--- a/go.mod
+++ b/go.mod
@ -14,13 +14,13 @@ require (
 	github.com/VictoriaMetrics/metrics v1.23.1
 	github.com/VictoriaMetrics/metricsql v0.51.2
 	github.com/aws/aws-sdk-go-v2 v1.17.3
-	github.com/aws/aws-sdk-go-v2/config v1.18.8
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.47
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.30.0
+	github.com/aws/aws-sdk-go-v2/config v1.18.11
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.50
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.30.1
 	github.com/cespare/xxhash/v2 v2.2.0
 	github.com/cheggaaa/pb/v3 v3.1.0
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.14.1 // indirect
 	github.com/go-kit/kit v0.12.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/snappy v0.0.4
@ -31,8 +31,8 @@ require (
 	github.com/mattn/go-runewidth v0.0.14 // indirect
 	github.com/oklog/ulid v1.3.1
 	github.com/prometheus/common v0.39.0 // indirect
-	github.com/prometheus/prometheus v0.41.0
-	github.com/urfave/cli/v2 v2.24.1
+	github.com/prometheus/prometheus v0.42.0
+	github.com/urfave/cli/v2 v2.24.2
 	github.com/valyala/fastjson v1.6.4
 	github.com/valyala/fastrand v1.1.0
 	github.com/valyala/fasttemplate v1.2.2
@ -42,21 +42,21 @@ require (
 	golang.org/x/net v0.5.0
 	golang.org/x/oauth2 v0.4.0
 	golang.org/x/sys v0.4.0
-	google.golang.org/api v0.108.0
+	google.golang.org/api v0.109.0
 	gopkg.in/yaml.v2 v2.4.0
 )

 require (
 	cloud.google.com/go v0.109.0 // indirect
-	cloud.google.com/go/compute v1.15.1 // indirect
+	cloud.google.com/go/compute v1.18.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	cloud.google.com/go/iam v0.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
-	github.com/aws/aws-sdk-go v1.44.184 // indirect
+	github.com/aws/aws-sdk-go v1.44.192 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.8 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.11 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21 // indirect
@ -68,14 +68,14 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.12.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.18.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.18.2 // indirect
 	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dennwc/varint v1.0.0 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
-	github.com/go-logfmt/logfmt v0.5.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
@ -101,20 +101,20 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0 // indirect
-	go.opentelemetry.io/otel v1.11.2 // indirect
-	go.opentelemetry.io/otel/metric v0.34.0 // indirect
-	go.opentelemetry.io/otel/trace v1.11.2 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.38.0 // indirect
+	go.opentelemetry.io/otel v1.12.0 // indirect
+	go.opentelemetry.io/otel/metric v0.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.12.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/goleak v1.2.0 // indirect
-	golang.org/x/exp v0.0.0-20230118134722-a68e582fa157 // indirect
+	golang.org/x/exp v0.0.0-20230131160201-f062dba9d201 // indirect
 	golang.org/x/sync v0.1.0 // indirect
 	golang.org/x/text v0.6.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230119192704-9d59e20e5cd1 // indirect
-	google.golang.org/grpc v1.52.0 // indirect
+	google.golang.org/genproto v0.0.0-20230131230820-1c016267d619 // indirect
+	google.golang.org/grpc v1.52.3 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@ -21,8 +21,8 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.15.1 h1:7UGq3QknM33pw5xATlpzeoomNxsacIVvTqTTvbfajmE=
-cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63rR+SXhcpA=
+cloud.google.com/go/compute v1.18.0 h1:FEigFqoDbys2cvFkZ9Fjq4gnHBP55anJ0yQyau2f9oY=
+cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
@ -52,7 +52,7 @@ github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.6.1 h1:YvQv9Mz6T8oR5ypQO
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.6.1/go.mod h1:c6WvOhtmjNUWbLfOG1qxM/q0SPvQNSVJvolm+C52dIU=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest/autorest v0.11.28 h1:ndAExarwr5Y+GaHE6VCaY1kyS/HwwGGyuimVhWsHOEM=
-github.com/Azure/go-autorest/autorest/adal v0.9.21 h1:jjQnVFXPfekaqb8vIsv2G1lxshoW+oGv4MDlhRtnYZk=
+github.com/Azure/go-autorest/autorest/adal v0.9.22 h1:/GblQdIudfEM3AWWZ0mrYJQSd7JS4S/Mbzh6F0ov0Xc=
 github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
 github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
 github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac=
@ -87,20 +87,20 @@ github.com/andybalholm/brotli v1.0.2/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu
 github.com/andybalholm/brotli v1.0.3/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/armon/go-metrics v0.3.10 h1:FR+drcQStOe+32sYyJYyZ7FIdgoGGBnwLl+flodp8Uo=
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.44.184 h1:/MggyE66rOImXJKl1HqhLQITvWvqIV7w1Q4MaG6FHUo=
-github.com/aws/aws-sdk-go v1.44.184/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.44.192 h1:KL54vCxRd5v5XBGjnF3FelzXXwl+aWHDmDTihFmRNgM=
+github.com/aws/aws-sdk-go v1.44.192/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go-v2 v1.17.3 h1:shN7NlnVzvDUgPQ+1rLMSxY8OWRNDRYtiqe0p/PgrhY=
 github.com/aws/aws-sdk-go-v2 v1.17.3/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
-github.com/aws/aws-sdk-go-v2/config v1.18.8 h1:lDpy0WM8AHsywOnVrOHaSMfpaiV2igOw8D7svkFkXVA=
-github.com/aws/aws-sdk-go-v2/config v1.18.8/go.mod h1:5XCmmyutmzzgkpk/6NYTjeWb6lgo9N170m1j6pQkIBs=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.8 h1:vTrwTvv5qAwjWIGhZDSBH/oQHuIQjGmD232k01FUh6A=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.8/go.mod h1:lVa4OHbvgjVot4gmh1uouF1ubgexSCN92P6CJQpT0t8=
+github.com/aws/aws-sdk-go-v2/config v1.18.11 h1:7dJD4p90OyKYIihuwe/LbHfP7uw4yVm5P1hel+b8UZ8=
+github.com/aws/aws-sdk-go-v2/config v1.18.11/go.mod h1:FTGKr2F7QL7IAg22dUmEB5NWpLPAOuhrONzXe7TVhAI=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.11 h1:QnvlTut1XXKkX4aaM1Ydo5X0CHriv0jmLu8PTVQQJJo=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.11/go.mod h1:tqAm4JmQaShel+Qi38hmd1QglSnnxaYt50k/9yGQzzc=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21 h1:j9wi1kQ8b+e0FBVHxCqCGo4kxDU175hoDHcWAi0sauU=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.21/go.mod h1:ugwW57Z5Z48bpvUyZuaPy4Kv+vEfJWnIrky7RmkBvJg=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.47 h1:E884ndKWVGt8IhtUuGhXbEsmaCvdAAkTTUDu7uAok1g=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.47/go.mod h1:KybsEsmXLO0u75FyS3F0sY4OQ97syDe8z+ISq8oEczA=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.50 h1:ATgzvd5DaU0Evx7yvaUw2ftwiWDGnDN59zowPF3jDk0=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.50/go.mod h1:naA7bah2/dpvwlyWysZ7yaAYI1Ti73HPaDyGryfJuiU=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27 h1:I3cakv2Uy1vNmmhRQmFptYDxOvBnwCdNwyw63N0RaRU=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.27/go.mod h1:a1/UpzeyBBerajpnP5nGZa9mGzsBn5cOKxm6NWQsvoI=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.21 h1:5NbbMrIzmUn/TXFqAle6mgrH5m9cOvMLRGL7pnG8tRE=
@ -117,14 +117,14 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.21 h1:5C6XgTViS
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.21/go.mod h1:lRToEJsn+DRA9lW4O9L9+/3hjTkUzlzyzHqn8MTds5k=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21 h1:vY5siRXvW5TrOKm2qKEf9tliBfdLxdfy0i02LOcmqUo=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.21/go.mod h1:WZvNXT1XuH8dnJM0HvOlvk+RNn7NbAPvA/ACO0QarSc=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.30.0 h1:wddsyuESfviaiXk3w9N6/4iRwTg/a3gktjODY6jYQBo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.30.0/go.mod h1:L2l2/q76teehcW7YEsgsDjqdsDTERJeX3nOMIFlgGUE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.30.1 h1:kIgvVY7PHx4gIb0na/Q9gTWJWauTwhKdaqJjX8PkIY8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.30.1/go.mod h1:L2l2/q76teehcW7YEsgsDjqdsDTERJeX3nOMIFlgGUE=
 github.com/aws/aws-sdk-go-v2/service/sso v1.12.0 h1:/2gzjhQowRLarkkBOGPXSRnb8sQ2RVsjdG1C/UliK/c=
 github.com/aws/aws-sdk-go-v2/service/sso v1.12.0/go.mod h1:wo/B7uUm/7zw/dWhBJ4FXuw1sySU5lyIhVg1Bu2yL9A=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.0 h1:Jfly6mRxk2ZOSlbCvZfKNS7TukSx1mIzhSsqZ/IGSZI=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.0/go.mod h1:TZSH7xLO7+phDtViY/KUp9WGCJMQkLJ/VpgkTFd5gh8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.0 h1:kOO++CYo50RcTFISESluhWEi5Prhg+gaSs4whWabiZU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.0/go.mod h1:+lGbb3+1ugwKrNTWcf2RT05Xmp543B06zDFTwiTLp7I=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.2 h1:J/4wIaGInCEYCGhTSruxCxeoA5cy91a+JT7cHFKFSHQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.2/go.mod h1:+lGbb3+1ugwKrNTWcf2RT05Xmp543B06zDFTwiTLp7I=
 github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
 github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@ -151,10 +151,10 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dennwc/varint v1.0.0 h1:kGNFFSSw8ToIy3obO/kKr8U9GZYUAxQEVuix4zfDWzE=
 github.com/dennwc/varint v1.0.0/go.mod h1:hnItb35rvZvJrbTALZtY/iQfDs48JKRG1RPpgziApxA=
-github.com/digitalocean/godo v1.91.1 h1:1o30VOCu1aC6488qBd0SkQiBeAZ35RSTvLwCA1pQMhc=
+github.com/digitalocean/godo v1.95.0 h1:S48/byPKui7RHZc1wYEPfRvkcEvToADNb5I3guu95xg=
 github.com/dnaeon/go-vcr v1.1.0 h1:ReYa/UBrRyQdant9B4fNHGoCNKw6qh6P0fsdGmZpR7c=
 github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
-github.com/docker/docker v20.10.21+incompatible h1:UTLdBmHk3bEY+w8qeO5KttOhy6OmXWsl/FEet9Uswog=
+github.com/docker/docker v20.10.23+incompatible h1:1ZQUUYAdh+oylOT85aA2ZcfRp22jmLhoaEcVEfK8dyA=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/edsrzf/mmap-go v1.1.0 h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ=
@ -166,8 +166,8 @@ github.com/envoyproxy/go-control-plane v0.10.3 h1:xdCVXxEe0Y3FQith+0cj2irwZudqGY
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.9.1 h1:PS7VIOgmSVhWUEeZwTe7z7zouA22Cr590PzXKbZHOVY=
 github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
-github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
+github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
@ -184,8 +184,8 @@ github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBj
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@ -193,7 +193,7 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
-github.com/go-openapi/swag v0.21.1 h1:wm0rhTb5z7qpJRHBdPOMuY4QjVUMbF6/kwoYeRAOrKU=
+github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
 github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48 h1:JVrqSeQfdhYRFk24TvhTZWU0q8lfCojxZQFi3Ou7+uY=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-zookeeper/zk v1.0.3 h1:7M2kwOsc//9VeeFiPtf+uSJlVpU66x9Ba5+8XK7/TDg=
@ -281,17 +281,19 @@ github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd h1:PpuIBO5P3e9hpqBD
 github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A=
 github.com/hashicorp/consul/api v1.18.0 h1:R7PPNzTCeN6VuQNDwwhZWJvzCtGSrNpJqfb22h3yH9g=
 github.com/hashicorp/cronexpr v1.1.1 h1:NJZDd87hGXjoZBdvyCF9mX4DCq5Wy7+A/w+A7q0wn6c=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-retryablehttp v0.7.1 h1:sUiuQAnLlbvmExtFQs72iFW/HXeUn8Z1aJLQ4LJJbTQ=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/nomad/api v0.0.0-20221214074818-7dbbf6bc584d h1:kEWrUx7mld3c6HRcO2KhfD1MYBkofuZfEfDwCRQ9aMU=
+github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
+github.com/hashicorp/nomad/api v0.0.0-20230124213148-69fd1a0e4bf7 h1:XOdd3JHyeQnBRxotBo9ibxBFiYGuYhQU25s/YeV2cTU=
 github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY=
-github.com/hetznercloud/hcloud-go v1.38.0 h1:K6Pd/mMdcLfBhvwG39qyAaacp4pCS3dKa8gChmLKxLg=
+github.com/hetznercloud/hcloud-go v1.39.0 h1:RUlzI458nGnPR6dlcZlrsGXYC1hQlFbKdm8tVtEQQB0=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/influxdata/influxdb v1.11.0 h1:0X+ZsbcOWc6AEi5MHee9BYqXCKmz8IZsljrRYjmV8Qg=
@ -328,14 +330,12 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/linode/linodego v1.9.3 h1:+lxNZw4avRxhCqGjwfPgQ2PvMT+vOL0OMsTdzixR7hQ=
+github.com/linode/linodego v1.12.0 h1:33mOIrZ+gVva14gyJMKPZ85mQGovAvZCEP1ftgmFBjA=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@ -396,8 +396,8 @@ github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
 github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
-github.com/prometheus/prometheus v0.41.0 h1:+QR4QpzwE54zsKk2K7EUkof3tHxa3b/fyw7xJ4jR1Ns=
-github.com/prometheus/prometheus v0.41.0/go.mod h1:Uu5817xm7ibU/VaDZ9pu1ssGzcpO9Bd+LyoZ76RpHyo=
+github.com/prometheus/prometheus v0.42.0 h1:G769v8covTkOiNckXFIwLx01XE04OE6Fr0JPA0oR2nI=
+github.com/prometheus/prometheus v0.42.0/go.mod h1:Pfqb/MLnnR2KK+0vchiaH39jXxvLMBk+3lnIGP4N7Vk=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw=
@ -405,7 +405,7 @@ github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/scaleway/scaleway-sdk-go v1.0.0-beta.10 h1:wsfMs0iv+MJiViM37qh5VEKISi3/ZUq2nNKNdqmumAs=
+github.com/scaleway/scaleway-sdk-go v1.0.0-beta.12 h1:Aaz4T7dZp7cB2cv7D/tGtRdSMh48sRaDYr7Jh0HV4qQ=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
@ -423,8 +423,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/urfave/cli/v2 v2.24.1 h1:/QYYr7g0EhwXEML8jO+8OYt5trPnLHS0p3mrgExJ5NU=
-github.com/urfave/cli/v2 v2.24.1/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
+github.com/urfave/cli/v2 v2.24.2 h1:q1VA+ofZ8SWfEKB9xXHUD4QZaeI9e+ItEqSbfH2JBXk=
+github.com/urfave/cli/v2 v2.24.2/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasthttp v1.30.0/go.mod h1:2rsYD01CKFrjjsvFxx75KlEUNpWNBY9JWD3K/7o2Cus=
@ -456,14 +456,14 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0 h1:yt2NKzK7Vyo6h0+X8BA4FpreZQTlVEIarnsBP/H5mzs=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0/go.mod h1:+ARmXlUlc51J7sZeCBkBJNdHGySrdOzgzxp6VWRWM1U=
-go.opentelemetry.io/otel v1.11.2 h1:YBZcQlsVekzFsFbjygXMOXSs6pialIZxcjfO/mBDmR0=
-go.opentelemetry.io/otel v1.11.2/go.mod h1:7p4EUV+AqgdlNV9gL97IgUZiVR3yrFXYo53f9BM3tRI=
-go.opentelemetry.io/otel/metric v0.34.0 h1:MCPoQxcg/26EuuJwpYN1mZTeCYAUGx8ABxfW07YkjP8=
-go.opentelemetry.io/otel/metric v0.34.0/go.mod h1:ZFuI4yQGNCupurTXCwkeD/zHBt+C2bR7bw5JqUm/AP8=
-go.opentelemetry.io/otel/trace v1.11.2 h1:Xf7hWSF2Glv0DE3MH7fBHvtpSBsjcBUe5MYAmZM/+y0=
-go.opentelemetry.io/otel/trace v1.11.2/go.mod h1:4N+yC7QEz7TTsG9BSRLNAa63eg5E06ObSbKPmxQ/pKA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.38.0 h1:rTxmym+VN9f6ajzNtITVgyvZrNbpLt3NHr3suLLHLEQ=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.38.0/go.mod h1:w6xNm+kC506KNs5cknSHal6dtdRnc4uema0uN9GSQc0=
+go.opentelemetry.io/otel v1.12.0 h1:IgfC7kqQrRccIKuB7Cl+SRUmsKbEwSGPr0Eu+/ht1SQ=
+go.opentelemetry.io/otel v1.12.0/go.mod h1:geaoz0L0r1BEOR81k7/n9W4TCXYCJ7bPO7K374jQHG0=
+go.opentelemetry.io/otel/metric v0.35.0 h1:aPT5jk/w7F9zW51L7WgRqNKDElBdyRLGuBtI5MX34e8=
+go.opentelemetry.io/otel/metric v0.35.0/go.mod h1:qAcbhaTRFU6uG8QM7dDo7XvFsWcugziq/5YI065TokQ=
+go.opentelemetry.io/otel/trace v1.12.0 h1:p28in++7Kd0r2d8gSt931O57fdjUyWxkVbESuILAeUc=
+go.opentelemetry.io/otel/trace v1.12.0/go.mod h1:pHlgBynn6s25qJ2szD+Bv+iwKJttjHSI3lUAyf0GNuQ=
 go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
 go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
@ -487,8 +487,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230118134722-a68e582fa157 h1:fiNkyhJPUvxbRPbCqY/D9qdjmPzfHcpK3P4bM4gioSY=
-golang.org/x/exp v0.0.0-20230118134722-a68e582fa157/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/exp v0.0.0-20230131160201-f062dba9d201 h1:BEABXpNXLEz0WxtA+6CQIz2xkg80e+1zrhWyMcq8VzE=
+golang.org/x/exp v0.0.0-20230131160201-f062dba9d201/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@ -609,7 +609,6 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220405052023-b1e9470b6e64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@ -680,7 +679,7 @@ golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.4.0 h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4=
+golang.org/x/tools v0.5.0 h1:+bSpV5HIeWkuvgaMfI3UmKRThoTA5ODJTUd8T17NO+4=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@ -703,8 +702,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.108.0 h1:WVBc/faN0DkKtR43Q/7+tPny9ZoLZdIiAyG5Q9vFClg=
-google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
+google.golang.org/api v0.109.0 h1:sW9hgHyX497PP5//NUM7nqfV8D0iDfBApqq7sOh1XR8=
+google.golang.org/api v0.109.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@ -742,8 +741,8 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20230119192704-9d59e20e5cd1 h1:wSjSSQW7LuPdv3m1IrSN33nVxH/kID6OIKy+FMwGB2k=
-google.golang.org/genproto v0.0.0-20230119192704-9d59e20e5cd1/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
+google.golang.org/genproto v0.0.0-20230131230820-1c016267d619 h1:p0kMzw6AG0JEzd7Z+kXqOiLhC6gjUQTbtS2zR0Q3DbI=
+google.golang.org/genproto v0.0.0-20230131230820-1c016267d619/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@ -757,8 +756,8 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.52.0 h1:kd48UiU7EHsV4rnLyOJRuP/Il/UHE7gdDAQ+SZI7nZk=
-google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
+google.golang.org/grpc v1.52.3 h1:pf7sOysg4LdgBqduXveGKrcEwbStiK2rtfghdzlUYDQ=
+google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@ -799,9 +798,9 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.26.0 h1:IpPlZnxBpV1xl7TGk/X6lFtpgjgntCg8PJ+qrPHAC7I=
-k8s.io/apimachinery v0.26.0 h1:1feANjElT7MvPqp0JT6F3Ss6TWDwmcjLypwoPpEf7zg=
-k8s.io/client-go v0.26.0 h1:lT1D3OfO+wIi9UFolCrifbjUUgu7CpLca0AD8ghRLI8=
+k8s.io/api v0.26.1 h1:f+SWYiPd/GsiWwVRz+NbFyCgvv75Pk9NK6dlkZgpCRQ=
+k8s.io/apimachinery v0.26.1 h1:8EZ/eGJL+hY/MYCNwhmDzVqq2lPl3N3Bo8rvweJwXUQ=
+k8s.io/client-go v0.26.1 h1:87CXzYJnAMGaa/IDDfRdhTzxk/wzGZ+/HUQpqgVSZXU=
 k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
 k8s.io/kube-openapi v0.0.0-20221207184640-f3cff1453715 h1:tBEbstoM+K0FiBV5KGAKQ0kuvf54v/hwpldiJt69w1s=
--- a/lib/bytesutil/internstring.go
+++ b/lib/bytesutil/internstring.go
@ -9,7 +9,7 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/fasttime"
 )

-var internStringMaxLen = flag.Int("internStringMaxLen", 300, "The maximum length for strings to intern. Lower limit may save memory at the cost of higher CPU usage. "+
+var internStringMaxLen = flag.Int("internStringMaxLen", 500, "The maximum length for strings to intern. Lower limit may save memory at the cost of higher CPU usage. "+
 	"See https://en.wikipedia.org/wiki/String_interning")

 // InternBytes interns b as a string
--- a/lib/httpserver/httpserver.go
+++ b/lib/httpserver/httpserver.go
@ -199,7 +199,7 @@ func gzipHandler(s *server, rh RequestHandler) http.HandlerFunc {
 		w = maybeGzipResponseWriter(w, r)
 		handlerWrapper(s, w, r, rh)
 		if zrw, ok := w.(*gzipResponseWriter); ok {
-			if err := zrw.Close(); err != nil && !isTrivialNetworkError(err) {
+			if err := zrw.Close(); err != nil && !netutil.IsTrivialNetworkError(err) {
 				logger.Warnf("gzipResponseWriter.Close: %s", err)
 			}
 		}
@ -503,10 +503,10 @@ func (zrw *gzipResponseWriter) Flush() {
 		_, _ = zrw.Write(nil)
 	}
 	if !zrw.disableCompression {
-		if err := zrw.bw.Flush(); err != nil && !isTrivialNetworkError(err) {
+		if err := zrw.bw.Flush(); err != nil && !netutil.IsTrivialNetworkError(err) {
 			logger.Warnf("gzipResponseWriter.Flush (buffer): %s", err)
 		}
-		if err := zrw.zw.Flush(); err != nil && !isTrivialNetworkError(err) {
+		if err := zrw.zw.Flush(); err != nil && !netutil.IsTrivialNetworkError(err) {
 			logger.Warnf("gzipResponseWriter.Flush (gzip): %s", err)
 		}
 	}
@ -643,14 +643,6 @@ func (e *ErrorWithStatusCode) Error() string {
 	return e.Err.Error()
 }

-func isTrivialNetworkError(err error) bool {
-	s := err.Error()
-	if strings.Contains(s, "broken pipe") || strings.Contains(s, "reset by peer") {
-		return true
-	}
-	return false
-}
-
 // IsTLS indicates is tls enabled or not
 func IsTLS() bool {
 	return *tlsEnable
--- a/lib/netutil/netutil.go
+++ b/lib/netutil/netutil.go
@ -0,0 +1,15 @@
+package netutil
+
+import (
+	"strings"
+)
+
+// IsTrivialNetworkError returns true if the err can be ignored during logging.
+func IsTrivialNetworkError(err error) bool {
+	// Suppress trivial network errors, which could occur at remote side.
+	s := err.Error()
+	if strings.Contains(s, "broken pipe") || strings.Contains(s, "reset by peer") {
+		return true
+	}
+	return false
+}
--- a/lib/promscrape/discovery/azure/azure.go
+++ b/lib/promscrape/discovery/azure/azure.go
@ -97,6 +97,9 @@ func appendMachineLabels(vms []virtualMachine, port int, sdc *SDConfig) []*promu
 			if vm.scaleSet != "" {
 				m.Add("__meta_azure_machine_scale_set", vm.scaleSet)
 			}
+			if vm.Properties.HardwareProfile.VMSize != "" {
+				m.Add("__meta_azure_machine_size", vm.Properties.HardwareProfile.VMSize)
+			}
 			for k, v := range vm.Tags {
 				m.Add(discoveryutils.SanitizeLabelName("__meta_azure_machine_tag_"+k), v)
 			}
--- a/lib/promscrape/discovery/azure/azure_test.go
+++ b/lib/promscrape/discovery/azure/azure_test.go
@ -16,12 +16,16 @@ func TestAppendMachineLabels(t *testing.T) {
 	}
 	f("single vm", []virtualMachine{
 		{
-			Name:       "vm-1",
-			ID:         "id-2",
-			Type:       "Azure",
-			Location:   "eu-west-1",
-			Properties: virtualMachineProperties{OsProfile: osProfile{ComputerName: "test-1"}, StorageProfile: storageProfile{OsDisk: osDisk{OsType: "Linux"}}},
-			Tags:       map[string]string{"key-1": "value-1"},
+			Name:     "vm-1",
+			ID:       "id-2",
+			Type:     "Azure",
+			Location: "eu-west-1",
+			Properties: virtualMachineProperties{
+				OsProfile:       osProfile{ComputerName: "test-1"},
+				StorageProfile:  storageProfile{OsDisk: osDisk{OsType: "Linux"}},
+				HardwareProfile: hardwareProfile{VMSize: "big"},
+			},
+			Tags: map[string]string{"key-1": "value-1"},
 			ipAddresses: []vmIPAddress{
 				{privateIP: "10.10.10.1"},
 			},
@ -36,6 +40,7 @@ func TestAppendMachineLabels(t *testing.T) {
 			"__meta_azure_machine_computer_name": "test-1",
 			"__meta_azure_machine_location":      "eu-west-1",
 			"__meta_azure_machine_private_ip":    "10.10.10.1",
+			"__meta_azure_machine_size":          "big",
 			"__meta_azure_machine_tag_key_1":     "value-1",
 		}),
 	})
--- a/lib/promscrape/discovery/azure/machine.go
+++ b/lib/promscrape/discovery/azure/machine.go
@ -29,9 +29,14 @@ type vmIPAddress struct {
 }

 type virtualMachineProperties struct {
-	NetworkProfile networkProfile `json:"networkProfile,omitempty"`
-	OsProfile      osProfile      `json:"osProfile,omitempty"`
-	StorageProfile storageProfile `json:"storageProfile,omitempty"`
+	NetworkProfile  networkProfile  `json:"networkProfile,omitempty"`
+	OsProfile       osProfile       `json:"osProfile,omitempty"`
+	StorageProfile  storageProfile  `json:"storageProfile,omitempty"`
+	HardwareProfile hardwareProfile `json:"hardwareProfile,omitempty"`
+}
+
+type hardwareProfile struct {
+	VMSize string `json:"vmSize,omitempty"`
 }

 type storageProfile struct {
@ -45,6 +50,7 @@ type osDisk struct {
 type osProfile struct {
 	ComputerName string `json:"computerName,omitempty"`
 }
+
 type networkProfile struct {
 	// NetworkInterfaces - Specifies the list of resource Ids for the network interfaces associated with the virtual machine.
 	NetworkInterfaces []networkInterfaceReference `json:"networkInterfaces,omitempty"`
--- a/lib/promscrape/discovery/kubernetes/pod.go
+++ b/lib/promscrape/discovery/kubernetes/pod.go
@ -82,10 +82,12 @@ type ContainerPort struct {
 //
 // See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#podstatus-v1-core
 type PodStatus struct {
-	Phase      string
-	PodIP      string
-	HostIP     string
-	Conditions []PodCondition
+	Phase                 string
+	PodIP                 string
+	HostIP                string
+	Conditions            []PodCondition
+	ContainerStatuses     []ContainerStatus
+	InitContainerStatuses []ContainerStatus
 }

 // PodCondition implements k8s pod condition.
@ -96,6 +98,27 @@ type PodCondition struct {
 	Status string
 }

+// ContainerStatus implements k8s container status.
+//
+// See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#containerstatus-v1-core
+type ContainerStatus struct {
+	Name        string
+	ContainerID string
+}
+
+func getContainerID(p *Pod, containerName string, isInit bool) string {
+	css := p.Status.ContainerStatuses
+	if isInit {
+		css = p.Status.InitContainerStatuses
+	}
+	for _, cs := range css {
+		if cs.Name == containerName {
+			return cs.ContainerID
+		}
+	}
+	return ""
+}
+
 // getTargetLabels returns labels for each port of the given p.
 //
 // See https://prometheus.io/docs/prometheus/latest/configuration/configuration/#pod
@ -105,12 +128,12 @@ func (p *Pod) getTargetLabels(gw *groupWatcher) []*promutils.Labels {
 		return nil
 	}
 	var ms []*promutils.Labels
-	ms = appendPodLabels(ms, gw, p, p.Spec.Containers, "false")
-	ms = appendPodLabels(ms, gw, p, p.Spec.InitContainers, "true")
+	ms = appendPodLabels(ms, gw, p, p.Spec.Containers, false)
+	ms = appendPodLabels(ms, gw, p, p.Spec.InitContainers, true)
 	return ms
 }

-func appendPodLabels(ms []*promutils.Labels, gw *groupWatcher, p *Pod, cs []Container, isInit string) []*promutils.Labels {
+func appendPodLabels(ms []*promutils.Labels, gw *groupWatcher, p *Pod, cs []Container, isInit bool) []*promutils.Labels {
 	for _, c := range cs {
 		for _, cp := range c.Ports {
 			ms = appendPodLabelsInternal(ms, gw, p, c, &cp, isInit)
@ -122,14 +145,24 @@ func appendPodLabels(ms []*promutils.Labels, gw *groupWatcher, p *Pod, cs []Cont
 	return ms
 }

-func appendPodLabelsInternal(ms []*promutils.Labels, gw *groupWatcher, p *Pod, c Container, cp *ContainerPort, isInit string) []*promutils.Labels {
+func appendPodLabelsInternal(ms []*promutils.Labels, gw *groupWatcher, p *Pod, c Container, cp *ContainerPort, isInit bool) []*promutils.Labels {
 	addr := p.Status.PodIP
 	if cp != nil {
 		addr = discoveryutils.JoinHostPort(addr, cp.ContainerPort)
 	}
 	m := promutils.GetLabels()
 	m.Add("__address__", addr)
-	m.Add("__meta_kubernetes_pod_container_init", isInit)
+	isInitStr := "false"
+	if isInit {
+		isInitStr = "true"
+	}
+	m.Add("__meta_kubernetes_pod_container_init", isInitStr)
+
+	containerID := getContainerID(p, c.Name, isInit)
+	if containerID != "" {
+		m.Add("__meta_kubernetes_pod_container_id", containerID)
+	}
+
 	p.appendCommonLabels(m, gw)
 	p.appendContainerLabels(m, c, cp)
 	return append(ms, m)
--- a/lib/promscrape/discovery/kubernetes/pod_test.go
+++ b/lib/promscrape/discovery/kubernetes/pod_test.go
@ -262,6 +262,7 @@ func TestParsePodListSuccess(t *testing.T) {
 			"__meta_kubernetes_pod_controller_kind":          "Node",
 			"__meta_kubernetes_pod_controller_name":          "m01",
 			"__meta_kubernetes_pod_container_init":           "false",
+			"__meta_kubernetes_pod_container_id":             "docker://a28f0800855008485376c1eece1cf61de97cb7026b9188d138b0d55d92fc2f5c",

 			"__meta_kubernetes_pod_label_component": "etcd",
 			"__meta_kubernetes_pod_label_tier":      "control-plane",
--- a/lib/promscrape/scrapework.go
+++ b/lib/promscrape/scrapework.go
@ -133,7 +133,7 @@ type ScrapeWork struct {
 	// See https://docs.victoriametrics.com/vmagent.html#prometheus-staleness-markers
 	NoStaleMarkers bool

-	//The Tenant Info
+	// The Tenant Info
 	AuthToken *auth.Token

 	// The original 'job_name'
@ -904,7 +904,19 @@ func (sw *scrapeWork) addAutoTimeseries(wc *writeRequestCtx, name string, value

 func (sw *scrapeWork) addRowToTimeseries(wc *writeRequestCtx, r *parser.Row, timestamp int64, needRelabel bool) {
 	metric := r.Metric
-	if needRelabel && isAutoMetric(metric) {
+
+	// Add `exported_` prefix to metrics, which clash with the automatically generated
+	// metric names only if the following conditions are met:
+	//
+	// - The `honor_labels` option isn't set to true in the scrape_config.
+	//   If `honor_labels: true`, then the scraped metric name must remain unchanged
+	//   because the user explicitly asked about it in the config.
+	// - The metric has no labels (tags). If it has labels, then the metric value
+	//   will be written into a separate time series comparing to automatically generated time series.
+	//
+	// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3557
+	// and https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3406
+	if needRelabel && !sw.Config.HonorLabels && len(r.Tags) == 0 && isAutoMetric(metric) {
 		bb := bbPool.Get()
 		bb.B = append(bb.B, "exported_"...)
 		bb.B = append(bb.B, metric...)
--- a/lib/promscrape/scrapework_test.go
+++ b/lib/promscrape/scrapework_test.go
@ -361,9 +361,27 @@ func TestScrapeWorkScrapeInternalSuccess(t *testing.T) {
 	`, &ScrapeWork{
 		ScrapeTimeout: time.Second * 42,
 	}, `
-		exported_up{bar="baz"} 34.44 123
-		exported_scrape_series_added 3.435 123
+		up{bar="baz"} 34.44 123
 		bar{a="b",c="d"} -3e4 123
+		exported_scrape_series_added 3.435 123
+		up 1 123
+		scrape_duration_seconds 0 123
+		scrape_samples_scraped 3 123
+		scrape_samples_post_metric_relabeling 3 123
+		scrape_timeout_seconds 42 123
+		scrape_series_added 3 123
+	`)
+	f(`
+		up{bar="baz"} 34.44
+		bar{a="b",c="d"} -3e4
+		scrape_series_added 3.435
+	`, &ScrapeWork{
+		ScrapeTimeout: time.Second * 42,
+		HonorLabels:   true,
+	}, `
+		up{bar="baz"} 34.44 123
+		bar{a="b",c="d"} -3e4 123
+		scrape_series_added 3.435 123
 		up 1 123
 		scrape_samples_scraped 3 123
 		scrape_duration_seconds 0 123
--- a/lib/storage/partition.go
+++ b/lib/storage/partition.go
@ -736,12 +736,15 @@ func (pt *partition) HasTimestamp(timestamp int64) bool {
 // GetParts appends parts snapshot to dst and returns it.
 //
 // The appended parts must be released with PutParts.
-func (pt *partition) GetParts(dst []*partWrapper) []*partWrapper {
+func (pt *partition) GetParts(dst []*partWrapper, addInMemory bool) []*partWrapper {
 	pt.partsLock.Lock()
-	for _, pw := range pt.inmemoryParts {
-		pw.incRef()
+	if addInMemory {
+		for _, pw := range pt.inmemoryParts {
+			pw.incRef()
+		}
+		dst = append(dst, pt.inmemoryParts...)
 	}
-	dst = append(dst, pt.inmemoryParts...)
+
 	for _, pw := range pt.smallParts {
 		pw.incRef()
 	}
@ -1227,7 +1230,7 @@ func (pt *partition) runFinalDedup() error {
 }

 func (pt *partition) getRequiredDedupInterval() (int64, int64) {
-	pws := pt.GetParts(nil)
+	pws := pt.GetParts(nil, false)
 	defer pt.PutParts(pws)
 	dedupInterval := GetDedupInterval(pt.tr.MaxTimestamp)
 	minDedupInterval := getMinDedupInterval(pws)
@ -1275,12 +1278,13 @@ func (pt *partition) mergeParts(pws []*partWrapper, stopCh <-chan struct{}, isFi
 		}()
 	}

-	if isFinal && len(pws) == 1 && pws[0].mp != nil {
+	if !isDedupEnabled() && isFinal && len(pws) == 1 && pws[0].mp != nil {
 		// Fast path: flush a single in-memory part to disk.
 		mp := pws[0].mp
 		if tmpPartPath == "" {
 			logger.Panicf("BUG: tmpPartPath must be non-empty")
 		}
+
 		if err := mp.StoreToDisk(tmpPartPath); err != nil {
 			return fmt.Errorf("cannot store in-memory part to %q: %w", tmpPartPath, err)
 		}
--- a/lib/storage/partition_search.go
+++ b/lib/storage/partition_search.go
@ -80,7 +80,7 @@ func (pts *partitionSearch) Init(pt *partition, tsids []TSID, tr TimeRange) {
 		return
 	}

-	pts.pws = pt.GetParts(pts.pws[:0])
+	pts.pws = pt.GetParts(pts.pws[:0], true)

 	// Initialize psPool.
 	if n := len(pts.pws) - cap(pts.psPool); n > 0 {
--- a/lib/storage/storage_test.go
+++ b/lib/storage/storage_test.go
@ -1055,7 +1055,7 @@ func testStorageAddRows(rng *rand.Rand, s *Storage) error {
 	}
 	ptws := s1.tb.GetPartitions(nil)
 	for _, ptw := range ptws {
-		pws := ptw.pt.GetParts(nil)
+		pws := ptw.pt.GetParts(nil, true)
 		numParts := len(pws)
 		ptw.pt.PutParts(pws)
 		if numParts != 1 {
--- a/vendor/cloud.google.com/go/compute/internal/version.go
+++ b/vendor/cloud.google.com/go/compute/internal/version.go
@ -15,4 +15,4 @@
 package internal

 // Version is the current tagged release of the library.
-const Version = "1.15.1"
+const Version = "1.18.0"
--- a/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.md
@ -1,3 +1,15 @@
+# v1.18.11 (2023-02-01)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.18.10 (2023-01-25)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.18.9 (2023-01-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.18.8 (2023-01-05)

 * **Dependency Update**: Updated to the latest SDK module versions
--- a/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.go
@ -3,4 +3,4 @@
 package config

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.18.8"
+const goModuleVersion = "1.18.11"
--- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.md
@ -1,3 +1,15 @@
+# v1.13.11 (2023-02-01)
+
+* No change notes available for this release.
+
+# v1.13.10 (2023-01-25)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.13.9 (2023-01-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.13.8 (2023-01-05)

 * **Dependency Update**: Updated to the latest SDK module versions
--- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds/doc.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds/doc.go
@ -11,7 +11,7 @@
 // # Loading credentials with the SDK's AWS Config
 //
 // The EC2 Instance role credentials provider will automatically be the resolved
-// credential provider int he credential chain if no other credential provider is
+// credential provider in the credential chain if no other credential provider is
 // resolved first.
 //
 // To explicitly instruct the SDK's credentials resolving to use the EC2 Instance
--- a/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.go
@ -3,4 +3,4 @@
 package credentials

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.8"
+const goModuleVersion = "1.13.11"
--- a/vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/CHANGELOG.md
@ -1,3 +1,15 @@
+# v1.11.50 (2023-02-01)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.11.49 (2023-01-25)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.11.48 (2023-01-23)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.11.47 (2023-01-05)

 * **Dependency Update**: Updated to the latest SDK module versions
--- a/vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/go_module_metadata.go
@ -3,4 +3,4 @@
 package manager

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.11.47"
+const goModuleVersion = "1.11.50"
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/s3/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/s3/CHANGELOG.md
@ -1,3 +1,7 @@
+# v1.30.1 (2023-01-23)
+
+* No change notes available for this release.
+
 # v1.30.0 (2023-01-05)

 * **Feature**: Add `ErrorCodeOverride` field to all error structs (aws/smithy-go#401).
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/s3/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/s3/go_module_metadata.go
@ -3,4 +3,4 @@
 package s3

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.30.0"
+const goModuleVersion = "1.30.1"
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/s3/internal/endpoints/endpoints.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/s3/internal/endpoints/endpoints.go
@ -239,6 +239,15 @@ var defaultPartitions = endpoints.Partitions{
 			}: {
 				Hostname: "s3.dualstack.ap-southeast-3.amazonaws.com",
 			},
+			endpoints.EndpointKey{
+				Region: "ap-southeast-4",
+			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-southeast-4",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "s3.dualstack.ap-southeast-4.amazonaws.com",
+			},
 			endpoints.EndpointKey{
 				Region: "aws-global",
 			}: endpoints.Endpoint{
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.md
@ -1,3 +1,11 @@
+# v1.18.2 (2023-01-25)
+
+* **Documentation**: Doc only change to update wording in a key topic
+
+# v1.18.1 (2023-01-23)
+
+* No change notes available for this release.
+
 # v1.18.0 (2023-01-05)

 * **Feature**: Add `ErrorCodeOverride` field to all error structs (aws/smithy-go#401).
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.go
@ -12,12 +12,11 @@ import (
 )

 // Returns a set of temporary security credentials that you can use to access
-// Amazon Web Services resources that you might not normally have access to. These
-// temporary credentials consist of an access key ID, a secret access key, and a
-// security token. Typically, you use AssumeRole within your account or for
-// cross-account access. For a comparison of AssumeRole with other API operations
-// that produce temporary credentials, see Requesting Temporary Security
-// Credentials
+// Amazon Web Services resources. These temporary credentials consist of an access
+// key ID, a secret access key, and a security token. Typically, you use AssumeRole
+// within your account or for cross-account access. For a comparison of AssumeRole
+// with other API operations that produce temporary credentials, see Requesting
+// Temporary Security Credentials
 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
 // and Comparing the Amazon Web Services STS API operations
 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.go
@ -43,16 +43,17 @@ import (
 // Temporary credentials obtained by using the Amazon Web Services account root
 // user credentials have a maximum duration of 3,600 seconds (1 hour). Permissions
 // You can use the temporary credentials created by GetFederationToken in any
-// Amazon Web Services service except the following:
+// Amazon Web Services service with the following exceptions:
 //
-// * You cannot call any IAM
-// operations using the CLI or the Amazon Web Services API.
+// * You cannot call
+// any IAM operations using the CLI or the Amazon Web Services API. This limitation
+// does not apply to console sessions.
 //
-// * You cannot call any
-// STS operations except GetCallerIdentity.
+// * You cannot call any STS operations except
+// GetCallerIdentity.
 //
-// You must pass an inline or managed
-// session policy
+// You can use temporary credentials for single sign-on (SSO)
+// to the console. You must pass an inline or managed session policy
 // (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policy Amazon
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go
@ -3,4 +3,4 @@
 package sts

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.18.0"
+const goModuleVersion = "1.18.2"
--- a/vendor/github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints/endpoints.go
+++ b/vendor/github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints/endpoints.go
@ -165,6 +165,9 @@ var defaultPartitions = endpoints.Partitions{
 			endpoints.EndpointKey{
 				Region: "ap-southeast-3",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region: "ap-southeast-4",
+			}: endpoints.Endpoint{},
 			endpoints.EndpointKey{
 				Region: "aws-global",
 			}: endpoints.Endpoint{
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@ -27,6 +27,7 @@ const (
 	ApSoutheast1RegionID = "ap-southeast-1" // Asia Pacific (Singapore).
 	ApSoutheast2RegionID = "ap-southeast-2" // Asia Pacific (Sydney).
 	ApSoutheast3RegionID = "ap-southeast-3" // Asia Pacific (Jakarta).
+	ApSoutheast4RegionID = "ap-southeast-4" // Asia Pacific (Melbourne).
 	CaCentral1RegionID   = "ca-central-1"   // Canada (Central).
 	EuCentral1RegionID   = "eu-central-1"   // Europe (Frankfurt).
 	EuCentral2RegionID   = "eu-central-2"   // Europe (Zurich).
@ -172,6 +173,9 @@ var awsPartition = partition{
 		"ap-southeast-3": region{
 			Description: "Asia Pacific (Jakarta)",
 		},
+		"ap-southeast-4": region{
+			Description: "Asia Pacific (Melbourne)",
+		},
 		"ca-central-1": region{
 			Description: "Canada (Central)",
 		},
@ -261,6 +265,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -432,6 +439,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -935,6 +945,15 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@ -1168,6 +1187,14 @@ var awsPartition = partition{
 						Region: "ap-southeast-3",
 					},
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{
+					Hostname: "api.ecr.ap-southeast-4.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-4",
+					},
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{
@ -2096,6 +2123,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -2287,6 +2317,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -2493,6 +2526,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -3550,6 +3586,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -4018,12 +4057,32 @@ var awsPartition = partition{
 		},
 		"cases": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{},
 			},
 		},
 		"cassandra": service{
@ -4291,6 +4350,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -4479,6 +4541,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -4760,6 +4825,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -4870,6 +4938,76 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"cloudtrail-data": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"codeartifact": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@ -5240,6 +5378,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -6292,6 +6433,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -7443,6 +7587,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -7607,6 +7754,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -7683,6 +7833,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -8191,6 +8344,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -8357,6 +8513,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -8525,6 +8684,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -8712,6 +8874,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -9020,6 +9185,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -9760,6 +9928,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -9908,6 +10079,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -10463,6 +10637,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -10614,6 +10791,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -11017,6 +11197,9 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "fms-fips.ap-southeast-2.amazonaws.com",
 				},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -11245,6 +11428,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@ -11627,6 +11813,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@ -12117,6 +12306,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@ -14112,16 +14304,16 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "kendra-ranking.ap-southeast-3.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{
+					Hostname: "kendra-ranking.ap-southeast-4.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{
 					Hostname: "kendra-ranking.ca-central-1.api.aws",
 				},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{
-					Hostname: "kendra-ranking.eu-central-1.api.aws",
-				},
 				endpointKey{
 					Region: "eu-central-2",
 				}: endpoint{
@ -14147,11 +14339,6 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "kendra-ranking.eu-west-1.api.aws",
 				},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{
-					Hostname: "kendra-ranking.eu-west-2.api.aws",
-				},
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{
@ -14226,6 +14413,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -14649,6 +14839,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-4",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kms-fips.ap-southeast-4.amazonaws.com",
+				},
 				endpointKey{
 					Region: "ap-southeast-4-fips",
 				}: endpoint{
@ -15167,6 +15366,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "lambda.ap-southeast-3.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-4",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lambda.ap-southeast-4.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -15823,6 +16031,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -16931,6 +17142,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -17410,6 +17624,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -18027,6 +18244,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -18647,6 +18867,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -19644,6 +19867,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -19801,6 +20027,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -20202,6 +20431,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -20739,6 +20971,11 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "resource-explorer-2.ap-southeast-2.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-southeast-4.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{
@ -20821,6 +21058,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@ -20830,18 +21070,27 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@ -21571,6 +21820,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "s3.dualstack.ap-southeast-3.amazonaws.com",
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-4",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "s3.dualstack.ap-southeast-4.amazonaws.com",
+				},
 				endpointKey{
 					Region: "aws-global",
 				}: endpoint{
@ -22660,6 +22918,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -24433,6 +24694,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -24581,6 +24845,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -24726,6 +24993,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -25075,6 +25345,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -25235,12 +25508,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@ -25382,6 +25661,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -25474,6 +25756,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "aws-global",
 				}: endpoint{
@ -25650,6 +25935,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -25792,6 +26080,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -25934,6 +26225,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -28380,6 +28674,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@ -30650,6 +30947,9 @@ var awsusgovPartition = partition{
 				},
 			},
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
@ -31125,6 +31425,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-east-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "cloudformation.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				endpointKey{
+					Region: "us-gov-east-1-fips",
+				}: endpoint{
+					Hostname: "cloudformation.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{
@ -31133,6 +31451,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-west-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "cloudformation.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "us-gov-west-1-fips",
+				}: endpoint{
+					Hostname: "cloudformation.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 			},
 		},
 		"cloudhsm": service{
@ -33098,6 +33434,24 @@ var awsusgovPartition = partition{
 		},
 		"kinesis": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-east-1",
+				}: endpoint{
+					Hostname: "kinesis.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-gov-west-1",
+				}: endpoint{
+					Hostname: "kinesis.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{
@ -33106,6 +33460,15 @@ var awsusgovPartition = partition{
 						Region: "us-gov-east-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kinesis.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{
@ -33114,6 +33477,15 @@ var awsusgovPartition = partition{
 						Region: "us-gov-west-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kinesis.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
 			},
 		},
 		"kinesisanalytics": service{
@ -33825,6 +34197,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-east-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ram.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				endpointKey{
+					Region: "us-gov-east-1-fips",
+				}: endpoint{
+					Hostname: "ram.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{
@ -33833,6 +34223,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-west-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ram.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "us-gov-west-1-fips",
+				}: endpoint{
+					Hostname: "ram.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 			},
 		},
 		"rbin": service{
@ -35214,6 +35622,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-east-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "swf.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				endpointKey{
+					Region: "us-gov-east-1-fips",
+				}: endpoint{
+					Hostname: "swf.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{
@ -35222,6 +35648,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-west-1",
 					},
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "swf.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "us-gov-west-1-fips",
+				}: endpoint{
+					Hostname: "swf.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 			},
 		},
 		"synthetics": service{
@ -36588,6 +37032,13 @@ var awsisobPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"dlm": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-isob-east-1",
+				}: endpoint{},
+			},
+		},
 		"dms": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{},
--- a/vendor/github.com/aws/aws-sdk-go/aws/version.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/version.go
@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"

 // SDKVersion is the version of this SDK
-const SDKVersion = "1.44.184"
+const SDKVersion = "1.44.192"
--- a/vendor/github.com/aws/aws-sdk-go/private/protocol/jsonrpc/unmarshal_error.go
+++ b/vendor/github.com/aws/aws-sdk-go/private/protocol/jsonrpc/unmarshal_error.go
@ -22,7 +22,7 @@ const (
 // UnmarshalTypedError provides unmarshaling errors API response errors
 // for both typed and untyped errors.
 type UnmarshalTypedError struct {
-	exceptions map[string]func(protocol.ResponseMetadata) error
+	exceptions      map[string]func(protocol.ResponseMetadata) error
 	queryExceptions map[string]func(protocol.ResponseMetadata, string) error
 }

@ -30,11 +30,13 @@ type UnmarshalTypedError struct {
 // set of exception names to the error unmarshalers
 func NewUnmarshalTypedError(exceptions map[string]func(protocol.ResponseMetadata) error) *UnmarshalTypedError {
 	return &UnmarshalTypedError{
-		exceptions: exceptions,
+		exceptions:      exceptions,
 		queryExceptions: map[string]func(protocol.ResponseMetadata, string) error{},
 	}
 }

+// NewUnmarshalTypedErrorWithOptions works similar to NewUnmarshalTypedError applying options to the UnmarshalTypedError
+// before returning it
 func NewUnmarshalTypedErrorWithOptions(exceptions map[string]func(protocol.ResponseMetadata) error, optFns ...func(*UnmarshalTypedError)) *UnmarshalTypedError {
 	unmarshaledError := NewUnmarshalTypedError(exceptions)
 	for _, fn := range optFns {
@ -43,6 +45,11 @@ func NewUnmarshalTypedErrorWithOptions(exceptions map[string]func(protocol.Respo
 	return unmarshaledError
 }

+// WithQueryCompatibility is a helper function to construct a functional option for use with NewUnmarshalTypedErrorWithOptions.
+// The queryExceptions given act as an override for unmarshalling errors when query compatible error codes are found.
+// See also [awsQueryCompatible trait]
+//
+// [awsQueryCompatible trait]: https://smithy.io/2.0/aws/protocols/aws-query-protocol.html#aws-protocols-awsquerycompatible-trait
 func WithQueryCompatibility(queryExceptions map[string]func(protocol.ResponseMetadata, string) error) func(*UnmarshalTypedError) {
 	return func(typedError *UnmarshalTypedError) {
 		typedError.queryExceptions = queryExceptions
--- a/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/sts/api.go
@ -56,12 +56,11 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // AssumeRole API operation for AWS Security Token Service.
 //
 // Returns a set of temporary security credentials that you can use to access
-// Amazon Web Services resources that you might not normally have access to.
-// These temporary credentials consist of an access key ID, a secret access
-// key, and a security token. Typically, you use AssumeRole within your account
-// or for cross-account access. For a comparison of AssumeRole with other API
-// operations that produce temporary credentials, see Requesting Temporary Security
-// Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
+// Amazon Web Services resources. These temporary credentials consist of an
+// access key ID, a secret access key, and a security token. Typically, you
+// use AssumeRole within your account or for cross-account access. For a comparison
+// of AssumeRole with other API operations that produce temporary credentials,
+// see Requesting Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
 // and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
 // in the IAM User Guide.
 //
@ -1103,13 +1102,15 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
 // # Permissions
 //
 // You can use the temporary credentials created by GetFederationToken in any
-// Amazon Web Services service except the following:
+// Amazon Web Services service with the following exceptions:
 //
 //   - You cannot call any IAM operations using the CLI or the Amazon Web Services
-//     API.
+//     API. This limitation does not apply to console sessions.
 //
 //   - You cannot call any STS operations except GetCallerIdentity.
 //
+// You can use temporary credentials for single sign-on (SSO) to the console.
+//
 // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policy Amazon
--- a/Show more
+++ b/Show more