rebase: to upstream v2.3

Signed-off-by: Anton Arapov <anton@descope.org>