diff --git a/client/ctclient/cmd/bisect.go b/client/ctclient/cmd/bisect.go
index 9c9ee2a082..0c33d1aaa7 100644
--- a/client/ctclient/cmd/bisect.go
+++ b/client/ctclient/cmd/bisect.go
@@ -19,9 +19,9 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/spf13/cobra"
+	"k8s.io/klog/v2"
 )
 
 func init() {
@@ -45,7 +45,7 @@ func init() {
 func runBisect(ctx context.Context) {
 	logClient := connect(ctx)
 	if timestamp == 0 {
-		glog.Exit("No -timestamp option supplied")
+		klog.Exit("No -timestamp option supplied")
 	}
 	target := timestamp
 	sth, err := logClient.GetSTH(ctx)
@@ -58,18 +58,18 @@ func runBisect(ctx context.Context) {
 			exitWithDetails(err)
 		}
 		if l := len(entries.Entries); l != 1 {
-			glog.Exitf("Unexpected number (%d) of entries received requesting index %d", l, idx)
+			klog.Exitf("Unexpected number (%d) of entries received requesting index %d", l, idx)
 		}
 		logEntry, err := ct.RawLogEntryFromLeaf(idx, &entries.Entries[0])
 		if err != nil {
-			glog.Exitf("Failed to parse leaf %d: %v", idx, err)
+			klog.Exitf("Failed to parse leaf %d: %v", idx, err)
 		}
 		return logEntry
 	}
 	// Performing a binary search assumes that the timestamps are monotonically
 	// increasing.
 	idx := sort.Search(int(sth.TreeSize), func(idx int) bool {
-		glog.V(1).Infof("check timestamp at index %d", idx)
+		klog.V(1).Infof("check timestamp at index %d", idx)
 		entry := getEntry(int64(idx))
 		return entry.Leaf.TimestampedEntry.Timestamp >= uint64(target)
 	})
diff --git a/client/ctclient/cmd/get_consistency_proof.go b/client/ctclient/cmd/get_consistency_proof.go
index f37dde086f..1a753432a9 100644
--- a/client/ctclient/cmd/get_consistency_proof.go
+++ b/client/ctclient/cmd/get_consistency_proof.go
@@ -21,11 +21,11 @@ import (
 	"encoding/hex"
 	"fmt"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/spf13/cobra"
 	"github.com/transparency-dev/merkle/proof"
 	"github.com/transparency-dev/merkle/rfc6962"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -56,28 +56,28 @@ func init() {
 func runGetConsistencyProof(ctx context.Context) {
 	logClient := connect(ctx)
 	if treeSize <= 0 {
-		glog.Exit("No valid --size supplied")
+		klog.Exit("No valid --size supplied")
 	}
 	if prevSize <= 0 {
-		glog.Exit("No valid --prev_size supplied")
+		klog.Exit("No valid --prev_size supplied")
 	}
 	var hash1, hash2 []byte
 	if prevHash != "" {
 		var err error
 		hash1, err = hashFromString(prevHash)
 		if err != nil {
-			glog.Exitf("Invalid --prev_hash: %v", err)
+			klog.Exitf("Invalid --prev_hash: %v", err)
 		}
 	}
 	if treeHash != "" {
 		var err error
 		hash2, err = hashFromString(treeHash)
 		if err != nil {
-			glog.Exitf("Invalid --tree_hash: %v", err)
+			klog.Exitf("Invalid --tree_hash: %v", err)
 		}
 	}
 	if (hash1 != nil) != (hash2 != nil) {
-		glog.Exitf("Need both --prev_hash and --tree_hash or neither")
+		klog.Exitf("Need both --prev_hash and --tree_hash or neither")
 	}
 	getConsistencyProofBetween(ctx, logClient, prevSize, treeSize, hash1, hash2)
 }
@@ -96,7 +96,7 @@ func getConsistencyProofBetween(ctx context.Context, logClient client.CheckLogCl
 	}
 	// We have tree hashes so we can verify the proof.
 	if err := proof.VerifyConsistency(rfc6962.DefaultHasher, first, second, pf, prevHash, treeHash); err != nil {
-		glog.Exitf("Failed to VerifyConsistency(%x @size=%d, %x @size=%d): %v", prevHash, first, treeHash, second, err)
+		klog.Exitf("Failed to VerifyConsistency(%x @size=%d, %x @size=%d): %v", prevHash, first, treeHash, second, err)
 	}
 	fmt.Printf("Verified that hash %x @%d + proof = hash %x @%d\n", prevHash, first, treeHash, second)
 }
diff --git a/client/ctclient/cmd/get_entries.go b/client/ctclient/cmd/get_entries.go
index 7da7ef8fe1..33e583473b 100644
--- a/client/ctclient/cmd/get_entries.go
+++ b/client/ctclient/cmd/get_entries.go
@@ -20,11 +20,11 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
 	"github.com/spf13/cobra"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -55,7 +55,7 @@ func init() {
 func runGetEntries(ctx context.Context) {
 	logClient := connect(ctx)
 	if getFirst == -1 {
-		glog.Exit("No -first option supplied")
+		klog.Exit("No -first option supplied")
 	}
 	if getLast == -1 {
 		getLast = getFirst
@@ -102,7 +102,7 @@ func showRawCert(cert ct.ASN1Cert) {
 	if textOut {
 		c, err := x509.ParseCertificate(cert.Data)
 		if err != nil {
-			glog.Errorf("Error parsing certificate: %q", err.Error())
+			klog.Errorf("Error parsing certificate: %q", err.Error())
 		}
 		if c == nil {
 			return
@@ -123,6 +123,6 @@ func showParsedCert(cert *x509.Certificate) {
 
 func showPEMData(data []byte) {
 	if err := pem.Encode(os.Stdout, &pem.Block{Type: "CERTIFICATE", Bytes: data}); err != nil {
-		glog.Errorf("Failed to PEM encode cert: %q", err.Error())
+		klog.Errorf("Failed to PEM encode cert: %q", err.Error())
 	}
 }
diff --git a/client/ctclient/cmd/get_inclusion_proof.go b/client/ctclient/cmd/get_inclusion_proof.go
index af21bd79c1..1d2881e6bc 100644
--- a/client/ctclient/cmd/get_inclusion_proof.go
+++ b/client/ctclient/cmd/get_inclusion_proof.go
@@ -25,13 +25,13 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/spf13/cobra"
 	"github.com/transparency-dev/merkle/proof"
 	"github.com/transparency-dev/merkle/rfc6962"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -66,7 +66,7 @@ func runGetInclusionProof(ctx context.Context) {
 		var err error
 		hash, err = hashFromString(leafHash)
 		if err != nil {
-			glog.Exitf("Invalid --leaf_hash supplied: %v", err)
+			klog.Exitf("Invalid --leaf_hash supplied: %v", err)
 		}
 	} else if len(certChain) > 0 {
 		// Build a leaf hash from the chain and a timestamp.
@@ -75,18 +75,18 @@ func runGetInclusionProof(ctx context.Context) {
 			entryTimestamp = timestamp // Use user-specified timestamp.
 		}
 		if entryTimestamp == 0 {
-			glog.Exit("No timestamp available to accompany certificate")
+			klog.Exit("No timestamp available to accompany certificate")
 		}
 
 		var leafEntry *ct.MerkleTreeLeaf
 		cert, err := x509.ParseCertificate(chain[0].Data)
 		if x509.IsFatal(err) {
-			glog.Warningf("Failed to parse leaf certificate: %v", err)
+			klog.Warningf("Failed to parse leaf certificate: %v", err)
 			leafEntry = ct.CreateX509MerkleTreeLeaf(chain[0], uint64(entryTimestamp))
 		} else if cert.IsPrecertificate() {
 			leafEntry, err = ct.MerkleTreeLeafFromRawChain(chain, ct.PrecertLogEntryType, uint64(entryTimestamp))
 			if err != nil {
-				glog.Exitf("Failed to build pre-certificate leaf entry: %v", err)
+				klog.Exitf("Failed to build pre-certificate leaf entry: %v", err)
 			}
 		} else {
 			leafEntry = ct.CreateX509MerkleTreeLeaf(chain[0], uint64(entryTimestamp))
@@ -94,18 +94,18 @@ func runGetInclusionProof(ctx context.Context) {
 
 		leafHash, err := ct.LeafHashForLeaf(leafEntry)
 		if err != nil {
-			glog.Exitf("Failed to create hash of leaf: %v", err)
+			klog.Exitf("Failed to create hash of leaf: %v", err)
 		}
 		hash = leafHash[:]
 
 		// Print a warning if this timestamp is still within the MMD window.
 		when := ct.TimestampToTime(uint64(entryTimestamp))
 		if age := time.Since(when); age < logMMD {
-			glog.Warningf("WARNING: Timestamp (%v) is with MMD window (%v), log may not have incorporated this entry yet.", when, logMMD)
+			klog.Warningf("WARNING: Timestamp (%v) is with MMD window (%v), log may not have incorporated this entry yet.", when, logMMD)
 		}
 	}
 	if len(hash) != sha256.Size {
-		glog.Exit("No leaf hash available")
+		klog.Exit("No leaf hash available")
 	}
 	getInclusionProofForHash(ctx, logClient, hash)
 }
@@ -133,7 +133,7 @@ func getInclusionProofForHash(ctx context.Context, logClient client.CheckLogClie
 	if sth != nil {
 		// If we retrieved an STH we can verify the proof.
 		if err := proof.VerifyInclusion(rfc6962.DefaultHasher, uint64(rsp.LeafIndex), sth.TreeSize, hash, rsp.AuditPath, sth.SHA256RootHash[:]); err != nil {
-			glog.Exitf("Failed to VerifyInclusion(%d, %d)=%v", rsp.LeafIndex, sth.TreeSize, err)
+			klog.Exitf("Failed to VerifyInclusion(%d, %d)=%v", rsp.LeafIndex, sth.TreeSize, err)
 		}
 		fmt.Printf("Verified that hash %x + proof = root hash %x\n", hash, sth.SHA256RootHash)
 	}
@@ -142,7 +142,7 @@ func getInclusionProofForHash(ctx context.Context, logClient client.CheckLogClie
 func chainFromFile(filename string) ([]ct.ASN1Cert, int64) {
 	contents, err := os.ReadFile(filename)
 	if err != nil {
-		glog.Exitf("Failed to read certificate file: %v", err)
+		klog.Exitf("Failed to read certificate file: %v", err)
 	}
 	rest := contents
 	var chain []ct.ASN1Cert
@@ -157,7 +157,7 @@ func chainFromFile(filename string) ([]ct.ASN1Cert, int64) {
 		}
 	}
 	if len(chain) == 0 {
-		glog.Exitf("No certificates found in %s", certChain)
+		klog.Exitf("No certificates found in %s", certChain)
 	}
 
 	// Also look for something like a text timestamp for convenience.
diff --git a/client/ctclient/cmd/root.go b/client/ctclient/cmd/root.go
index 991c3d6460..76d73e8962 100644
--- a/client/ctclient/cmd/root.go
+++ b/client/ctclient/cmd/root.go
@@ -26,7 +26,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/jsonclient"
@@ -34,6 +33,7 @@ import (
 	"github.com/google/certificate-transparency-go/x509util"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+	"k8s.io/klog/v2"
 )
 
 const connectionFlags = "{--log_uri uri | --log_name name [--log_list {file|uri}]} [--pub_key file]"
@@ -47,7 +47,7 @@ var (
 )
 
 func init() {
-	// Add flags added with "flag" package, including glog, to Cobra flag set.
+	// Add flags added with "flag" package, including klog, to Cobra flag set.
 	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
 
 	flags := rootCmd.PersistentFlags()
@@ -72,7 +72,7 @@ var rootCmd = &cobra.Command{
 // appropriately. It needs to be called exactly once by main().
 func Execute() {
 	if err := rootCmd.Execute(); err != nil {
-		glog.Fatal(err)
+		klog.Fatal(err)
 	}
 }
 
@@ -82,15 +82,15 @@ func signatureToString(signed *ct.DigitallySigned) string {
 
 func exitWithDetails(err error) {
 	if err, ok := err.(client.RspError); ok {
-		glog.Infof("HTTP details: status=%d, body:\n%s", err.StatusCode, err.Body)
+		klog.Infof("HTTP details: status=%d, body:\n%s", err.StatusCode, err.Body)
 	}
-	glog.Exit(err.Error())
+	klog.Exit(err.Error())
 }
 
 func connect(ctx context.Context) *client.LogClient {
 	var tlsCfg *tls.Config
 	if skipHTTPSVerify {
-		glog.Warning("Skipping HTTPS connection verification")
+		klog.Warning("Skipping HTTPS connection verification")
 		tlsCfg = &tls.Config{InsecureSkipVerify: skipHTTPSVerify}
 	}
 	httpClient := &http.Client{
@@ -110,7 +110,7 @@ func connect(ctx context.Context) *client.LogClient {
 	if pubKey != "" {
 		pubkey, err := os.ReadFile(pubKey)
 		if err != nil {
-			glog.Exit(err)
+			klog.Exit(err)
 		}
 		opts.PublicKey = string(pubkey)
 	}
@@ -119,23 +119,23 @@ func connect(ctx context.Context) *client.LogClient {
 	if logName != "" {
 		llData, err := x509util.ReadFileOrURL(logList, httpClient)
 		if err != nil {
-			glog.Exitf("Failed to read log list: %v", err)
+			klog.Exitf("Failed to read log list: %v", err)
 		}
 		ll, err := loglist.NewFromJSON(llData)
 		if err != nil {
-			glog.Exitf("Failed to build log list: %v", err)
+			klog.Exitf("Failed to build log list: %v", err)
 		}
 
 		logs := ll.FindLogByName(logName)
 		if len(logs) == 0 {
-			glog.Exitf("No log with name like %q found in loglist %q", logName, logList)
+			klog.Exitf("No log with name like %q found in loglist %q", logName, logList)
 		}
 		if len(logs) > 1 {
 			logNames := make([]string, len(logs))
 			for i, log := range logs {
 				logNames[i] = fmt.Sprintf("%q", log.Description)
 			}
-			glog.Exitf("Multiple logs with name like %q found in loglist: %s", logName, strings.Join(logNames, ","))
+			klog.Exitf("Multiple logs with name like %q found in loglist: %s", logName, strings.Join(logNames, ","))
 		}
 		uri = "https://" + logs[0].URL
 		if opts.PublicKey == "" {
@@ -143,10 +143,10 @@ func connect(ctx context.Context) *client.LogClient {
 		}
 	}
 
-	glog.V(1).Infof("Use CT log at %s", uri)
+	klog.V(1).Infof("Use CT log at %s", uri)
 	logClient, err := client.New(uri, httpClient, opts)
 	if err != nil {
-		glog.Exit(err)
+		klog.Exit(err)
 	}
 
 	return logClient
diff --git a/client/ctclient/cmd/upload.go b/client/ctclient/cmd/upload.go
index be17b7451f..7fe88485a8 100644
--- a/client/ctclient/cmd/upload.go
+++ b/client/ctclient/cmd/upload.go
@@ -19,11 +19,11 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
 	"github.com/spf13/cobra"
+	"k8s.io/klog/v2"
 )
 
 var logMMD time.Duration
@@ -48,7 +48,7 @@ func init() {
 func runUpload(ctx context.Context) {
 	logClient := connect(ctx)
 	if certChain == "" {
-		glog.Exitf("No certificate chain file specified with -cert_chain")
+		klog.Exitf("No certificate chain file specified with -cert_chain")
 	}
 	chain, _ := chainFromFile(certChain)
 
@@ -76,7 +76,7 @@ func runUpload(ctx context.Context) {
 	leafEntry := ct.CreateX509MerkleTreeLeaf(chain[0], sct.Timestamp)
 	leafHash, err := ct.LeafHashForLeaf(leafEntry)
 	if err != nil {
-		glog.Exitf("Failed to create hash of leaf: %v", err)
+		klog.Exitf("Failed to create hash of leaf: %v", err)
 	}
 
 	// Display the SCT.
diff --git a/client/ctclient/main.go b/client/ctclient/main.go
index 1471045abb..49d904587a 100644
--- a/client/ctclient/main.go
+++ b/client/ctclient/main.go
@@ -15,8 +15,12 @@
 // ctclient is a command-line utility for interacting with CT logs.
 package main
 
-import "github.com/google/certificate-transparency-go/client/ctclient/cmd"
+import (
+	"github.com/google/certificate-transparency-go/client/ctclient/cmd"
+	"k8s.io/klog/v2"
+)
 
 func main() {
+	klog.InitFlags(nil)
 	cmd.Execute()
 }
diff --git a/ctutil/sctcheck/sctcheck.go b/ctutil/sctcheck/sctcheck.go
index 8eb86f22a8..6d74994276 100644
--- a/ctutil/sctcheck/sctcheck.go
+++ b/ctutil/sctcheck/sctcheck.go
@@ -29,11 +29,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/ctutil"
 	"github.com/google/certificate-transparency-go/loglist"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 
 	ct "github.com/google/certificate-transparency-go"
 )
@@ -47,17 +47,18 @@ var (
 type logInfoFactory func(*loglist.Log, *http.Client) (*ctutil.LogInfo, error)
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 	ctx := context.Background()
 	hc := &http.Client{Timeout: *deadline}
 
 	llData, err := x509util.ReadFileOrURL(*logList, hc)
 	if err != nil {
-		glog.Exitf("Failed to read log list: %v", err)
+		klog.Exitf("Failed to read log list: %v", err)
 	}
 	ll, err := loglist.NewFromJSON(llData)
 	if err != nil {
-		glog.Exitf("Failed to parse log list: %v", err)
+		klog.Exitf("Failed to parse log list: %v", err)
 	}
 
 	lf := ctutil.NewLogInfo
@@ -71,31 +72,31 @@ func main() {
 			// provided alongside on the connection along the way.
 			chain, valid, invalid, err = getAndCheckSiteChain(ctx, lf, arg, ll, hc)
 			if err != nil {
-				glog.Errorf("%s: failed to get cert chain: %v", arg, err)
+				klog.Errorf("%s: failed to get cert chain: %v", arg, err)
 				continue
 			}
-			glog.Errorf("Found %d external SCTs for %q, of which %d were validated", valid+invalid, arg, valid)
+			klog.Errorf("Found %d external SCTs for %q, of which %d were validated", valid+invalid, arg, valid)
 			totalInvalid += invalid
 		} else {
 			// Treat the argument as a certificate file to load.
 			data, err := os.ReadFile(arg)
 			if err != nil {
-				glog.Errorf("%s: failed to read data: %v", arg, err)
+				klog.Errorf("%s: failed to read data: %v", arg, err)
 				continue
 			}
 			chain, err = x509util.CertificatesFromPEM(data)
 			if err != nil {
-				glog.Errorf("%s: failed to read cert data: %v", arg, err)
+				klog.Errorf("%s: failed to read cert data: %v", arg, err)
 				continue
 			}
 		}
 		if len(chain) == 0 {
-			glog.Errorf("%s: no certificates found", arg)
+			klog.Errorf("%s: no certificates found", arg)
 			continue
 		}
 		// Check the chain for embedded SCTs.
 		valid, invalid = checkChain(ctx, lf, chain, ll, hc)
-		glog.Errorf("Found %d embedded SCTs for %q, of which %d were validated", valid+invalid, arg, valid)
+		klog.Errorf("Found %d embedded SCTs for %q, of which %d were validated", valid+invalid, arg, valid)
 		totalInvalid += invalid
 	}
 	if totalInvalid > 0 {
@@ -113,11 +114,11 @@ func checkChain(ctx context.Context, lf logInfoFactory, chain []*x509.Certificat
 
 	var issuer *x509.Certificate
 	if len(chain) < 2 {
-		glog.Info("No issuer in chain; attempting online retrieval")
+		klog.Info("No issuer in chain; attempting online retrieval")
 		var err error
 		issuer, err = x509util.GetIssuer(leaf, hc)
 		if err != nil {
-			glog.Errorf("Failed to get issuer online: %v", err)
+			klog.Errorf("Failed to get issuer online: %v", err)
 		}
 	} else {
 		issuer = chain[1]
@@ -127,7 +128,7 @@ func checkChain(ctx context.Context, lf logInfoFactory, chain []*x509.Certificat
 	// leaf for all of the SCTs, as long as the timestamp field gets updated.
 	merkleLeaf, err := ct.MerkleTreeLeafForEmbeddedSCT([]*x509.Certificate{leaf, issuer}, 0)
 	if err != nil {
-		glog.Errorf("Failed to build Merkle leaf: %v", err)
+		klog.Errorf("Failed to build Merkle leaf: %v", err)
 		return 0, len(leaf.SCTList.SCTList)
 	}
 
@@ -160,7 +161,7 @@ func getAndCheckSiteChain(ctx context.Context, lf logInfoFactory, target string,
 		host += ":443"
 	}
 
-	glog.Infof("Retrieve certificate chain from TLS connection to %q", host)
+	klog.Infof("Retrieve certificate chain from TLS connection to %q", host)
 	dialer := net.Dialer{Timeout: hc.Timeout}
 	conn, err := tls.DialWithDialer(&dialer, "tcp", host, &tls.Config{InsecureSkipVerify: true})
 	if err != nil {
@@ -168,12 +169,12 @@ func getAndCheckSiteChain(ctx context.Context, lf logInfoFactory, target string,
 	}
 	defer func() {
 		if err := conn.Close(); err != nil {
-			glog.Errorf("conn.Close()=%q", err)
+			klog.Errorf("conn.Close()=%q", err)
 		}
 	}()
 
 	goChain := conn.ConnectionState().PeerCertificates
-	glog.Infof("Found chain of length %d", len(goChain))
+	klog.Infof("Found chain of length %d", len(goChain))
 
 	// Convert base crypto/x509.Certificates to our forked x509.Certificate type.
 	chain := make([]*x509.Certificate, len(goChain))
@@ -191,7 +192,7 @@ func getAndCheckSiteChain(ctx context.Context, lf logInfoFactory, target string,
 	if len(scts) > 0 {
 		merkleLeaf, err := ct.MerkleTreeLeafFromChain(chain, ct.X509LogEntryType, 0 /* timestamp added later */)
 		if err != nil {
-			glog.Errorf("Failed to build Merkle tree leaf: %v", err)
+			klog.Errorf("Failed to build Merkle tree leaf: %v", err)
 			return chain, 0, len(scts), nil
 		}
 		for i, sctData := range scts {
@@ -214,44 +215,44 @@ func getAndCheckSiteChain(ctx context.Context, lf logInfoFactory, target string,
 func checkSCT(ctx context.Context, liFactory logInfoFactory, subject string, merkleLeaf *ct.MerkleTreeLeaf, sctData *x509.SerializedSCT, ll *loglist.LogList, hc *http.Client) bool {
 	sct, err := x509util.ExtractSCT(sctData)
 	if err != nil {
-		glog.Errorf("Failed to deserialize %s data: %v", subject, err)
-		glog.Errorf("Data: %x", sctData.Val)
+		klog.Errorf("Failed to deserialize %s data: %v", subject, err)
+		klog.Errorf("Data: %x", sctData.Val)
 		return false
 	}
-	glog.Infof("Examine %s with timestamp: %d (%v) from logID: %x", subject, sct.Timestamp, ct.TimestampToTime(sct.Timestamp), sct.LogID.KeyID[:])
+	klog.Infof("Examine %s with timestamp: %d (%v) from logID: %x", subject, sct.Timestamp, ct.TimestampToTime(sct.Timestamp), sct.LogID.KeyID[:])
 	log := ll.FindLogByKeyHash(sct.LogID.KeyID)
 	if log == nil {
-		glog.Warningf("Unknown logID: %x, cannot validate %s", sct.LogID, subject)
+		klog.Warningf("Unknown logID: %x, cannot validate %s", sct.LogID, subject)
 		return false
 	}
 	logInfo, err := liFactory(log, hc)
 	if err != nil {
-		glog.Errorf("Failed to build log info for %q log: %v", log.Description, err)
+		klog.Errorf("Failed to build log info for %q log: %v", log.Description, err)
 		return false
 	}
 
 	result := true
-	glog.Infof("Validate %s against log %q...", subject, logInfo.Description)
+	klog.Infof("Validate %s against log %q...", subject, logInfo.Description)
 	if err := logInfo.VerifySCTSignature(*sct, *merkleLeaf); err != nil {
-		glog.Errorf("Failed to verify %s signature from log %q: %v", subject, log.Description, err)
+		klog.Errorf("Failed to verify %s signature from log %q: %v", subject, log.Description, err)
 		result = false
 	} else {
-		glog.Infof("Validate %s against log %q... validated", subject, log.Description)
+		klog.Infof("Validate %s against log %q... validated", subject, log.Description)
 	}
 
 	if *checkInclusion {
-		glog.Infof("Check %s inclusion against log %q...", subject, log.Description)
+		klog.Infof("Check %s inclusion against log %q...", subject, log.Description)
 		index, err := logInfo.VerifyInclusion(ctx, *merkleLeaf, sct.Timestamp)
 		if err != nil {
 			age := time.Since(ct.TimestampToTime(sct.Timestamp))
 			if age < logInfo.MMD {
-				glog.Warningf("Failed to verify inclusion proof (%v) but %s timestamp is only %v old, less than log's MMD of %d seconds", err, subject, age, log.MaximumMergeDelay)
+				klog.Warningf("Failed to verify inclusion proof (%v) but %s timestamp is only %v old, less than log's MMD of %d seconds", err, subject, age, log.MaximumMergeDelay)
 			} else {
-				glog.Errorf("Failed to verify inclusion proof for %s: %v", subject, err)
+				klog.Errorf("Failed to verify inclusion proof for %s: %v", subject, err)
 			}
 			return false
 		}
-		glog.Infof("Check %s inclusion against log %q... included at %d", subject, log.Description, index)
+		klog.Infof("Check %s inclusion against log %q... included at %d", subject, log.Description, index)
 	}
 	return result
 }
diff --git a/ctutil/sctscan/sctscan.go b/ctutil/sctscan/sctscan.go
index 92f915535e..9980dd7196 100644
--- a/ctutil/sctscan/sctscan.go
+++ b/ctutil/sctscan/sctscan.go
@@ -23,7 +23,6 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/ctutil"
@@ -32,6 +31,7 @@ import (
 	"github.com/google/certificate-transparency-go/scanner"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -46,9 +46,10 @@ var (
 )
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 	ctx := context.Background()
-	glog.CopyStandardLogTo("WARNING")
+	klog.CopyStandardLogTo("WARNING")
 
 	hc := &http.Client{
 		Timeout: *deadline,
@@ -64,20 +65,20 @@ func main() {
 	}
 	logClient, err := client.New(*logURI, hc, jsonclient.Options{UserAgent: "ct-go-sctscan/1.0"})
 	if err != nil {
-		glog.Exitf("Failed to create log client: %v", err)
+		klog.Exitf("Failed to create log client: %v", err)
 	}
 	llData, err := x509util.ReadFileOrURL(*logList, hc)
 	if err != nil {
-		glog.Exitf("Failed to read log list: %v", err)
+		klog.Exitf("Failed to read log list: %v", err)
 	}
 	ll, err := loglist.NewFromJSON(llData)
 	if err != nil {
-		glog.Exitf("Failed to parse log list: %v", err)
+		klog.Exitf("Failed to parse log list: %v", err)
 	}
-	glog.Warning("Performing validations via direct log queries")
+	klog.Warning("Performing validations via direct log queries")
 	logsByHash, err := ctutil.LogInfoByKeyHash(ll, hc)
 	if err != nil {
-		glog.Exitf("Failed to build log info map: %v", err)
+		klog.Exitf("Failed to build log info map: %v", err)
 	}
 
 	scanOpts := scanner.ScannerOptions{
@@ -96,9 +97,9 @@ func main() {
 			checkCertWithEmbeddedSCT(ctx, logsByHash, *inclusion, entry)
 		},
 		func(entry *ct.RawLogEntry) {
-			glog.Errorf("Internal error: found pre-cert! %+v", entry)
+			klog.Errorf("Internal error: found pre-cert! %+v", entry)
 		}); err != nil {
-		glog.Exitf("Scan failed: %v", err)
+		klog.Exitf("Scan failed: %v", err)
 	}
 }
 
@@ -122,48 +123,48 @@ func (e EmbeddedSCTMatcher) PrecertificateMatches(*ct.Precertificate) bool {
 func checkCertWithEmbeddedSCT(ctx context.Context, logsByKey map[[sha256.Size]byte]*ctutil.LogInfo, checkInclusion bool, rawEntry *ct.RawLogEntry) {
 	entry, err := rawEntry.ToLogEntry()
 	if x509.IsFatal(err) {
-		glog.Errorf("[%d] Internal error: failed to parse cert in entry: %v", rawEntry.Index, err)
+		klog.Errorf("[%d] Internal error: failed to parse cert in entry: %v", rawEntry.Index, err)
 		return
 	}
 
 	leaf := entry.X509Cert
 	if leaf == nil {
-		glog.Errorf("[%d] Internal error: no cert in entry", entry.Index)
+		klog.Errorf("[%d] Internal error: no cert in entry", entry.Index)
 		return
 	}
 	if len(entry.Chain) == 0 {
-		glog.Errorf("[%d] No issuance chain found", entry.Index)
+		klog.Errorf("[%d] No issuance chain found", entry.Index)
 		return
 	}
 	issuer, err := x509.ParseCertificate(entry.Chain[0].Data)
 	if err != nil {
-		glog.Errorf("[%d] Failed to parse issuer: %v", entry.Index, err)
+		klog.Errorf("[%d] Failed to parse issuer: %v", entry.Index, err)
 	}
 
 	// Build a Merkle leaf that corresponds to the embedded SCTs.  We can use the same
 	// leaf for all of the SCTs, as long as the timestamp field gets updated.
 	merkleLeaf, err := ct.MerkleTreeLeafForEmbeddedSCT([]*x509.Certificate{leaf, issuer}, 0)
 	if err != nil {
-		glog.Errorf("[%d] Failed to build Merkle leaf: %v", entry.Index, err)
+		klog.Errorf("[%d] Failed to build Merkle leaf: %v", entry.Index, err)
 		return
 	}
 
 	for i, sctData := range leaf.SCTList.SCTList {
 		sct, err := x509util.ExtractSCT(&sctData)
 		if err != nil {
-			glog.Errorf("[%d] Failed to deserialize SCT[%d] data: %v", entry.Index, i, err)
+			klog.Errorf("[%d] Failed to deserialize SCT[%d] data: %v", entry.Index, i, err)
 			continue
 		}
 		logInfo := logsByKey[sct.LogID.KeyID]
 		if logInfo == nil {
-			glog.Infof("[%d] SCT[%d] for unknown logID: %x, cannot validate SCT", entry.Index, i, sct.LogID)
+			klog.Infof("[%d] SCT[%d] for unknown logID: %x, cannot validate SCT", entry.Index, i, sct.LogID)
 			continue
 		}
 
 		if err := logInfo.VerifySCTSignature(*sct, *merkleLeaf); err != nil {
-			glog.Errorf("[%d] Failed to verify SCT[%d] signature from log %q: %v", entry.Index, i, logInfo.Description, err)
+			klog.Errorf("[%d] Failed to verify SCT[%d] signature from log %q: %v", entry.Index, i, logInfo.Description, err)
 		} else {
-			glog.V(1).Infof("[%d] Verified SCT[%d] against log %q", entry.Index, i, logInfo.Description)
+			klog.V(1).Infof("[%d] Verified SCT[%d] against log %q", entry.Index, i, logInfo.Description)
 		}
 
 		if !checkInclusion {
@@ -176,13 +177,13 @@ func checkCertWithEmbeddedSCT(ctx context.Context, logsByKey map[[sha256.Size]by
 			if sth != nil {
 				delta := time.Duration(sth.Timestamp-sct.Timestamp) * time.Millisecond
 				if delta < logInfo.MMD {
-					glog.Warningf("[%d] Failed to verify SCT[%d] inclusion proof (%v), but Log's MMD has not passed %d -> %d < %v", entry.Index, i, err, sct.Timestamp, sth.Timestamp, logInfo.MMD)
+					klog.Warningf("[%d] Failed to verify SCT[%d] inclusion proof (%v), but Log's MMD has not passed %d -> %d < %v", entry.Index, i, err, sct.Timestamp, sth.Timestamp, logInfo.MMD)
 					continue
 				}
 			}
-			glog.Errorf("[%d] Failed to verify SCT[%d] inclusion proof: %v", entry.Index, i, err)
+			klog.Errorf("[%d] Failed to verify SCT[%d] inclusion proof: %v", entry.Index, i, err)
 		} else {
-			glog.V(1).Infof("[%d] Checked SCT[%d] inclusion against log %q, at index %d", entry.Index, i, logInfo.Description, index)
+			klog.V(1).Infof("[%d] Checked SCT[%d] inclusion against log %q, at index %d", entry.Index, i, logInfo.Description, index)
 		}
 	}
 }
diff --git a/fixchain/ratelimiter/limiter_test.go b/fixchain/ratelimiter/limiter_test.go
index b4fea7a53a..5f2f6c0320 100644
--- a/fixchain/ratelimiter/limiter_test.go
+++ b/fixchain/ratelimiter/limiter_test.go
@@ -20,7 +20,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/glog"
+	"k8s.io/klog/v2"
 )
 
 var testlimits = []int{1, 10, 50, 100, 1000}
@@ -45,7 +45,7 @@ func TestRateLimiterSingleThreaded(t *testing.T) {
 			if qps > float64(limit)*1.01 {
 				t.Errorf("#%d: Too many operations per second. Expected ~%d, got %f", i, limit, qps)
 			}
-			glog.Infof("#%d: Expected ~%d, got %f", i, limit, qps)
+			klog.Infof("#%d: Expected ~%d, got %f", i, limit, qps)
 		})
 	}
 }
@@ -76,7 +76,7 @@ func TestRateLimiterGoroutines(t *testing.T) {
 			if qps > float64(limit)*1.01 {
 				t.Errorf("#%d: Too many operations per second. Expected ~%d, got %f", i, limit, qps)
 			}
-			glog.Infof("#%d: Expected ~%d, got %f", i, limit, qps)
+			klog.Infof("#%d: Expected ~%d, got %f", i, limit, qps)
 		})
 	}
 }
diff --git a/go.mod b/go.mod
index 35d409788a..cdccd0544d 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,6 @@ go 1.17
 
 require (
 	github.com/fullstorydev/grpcurl v1.8.7
-	github.com/golang/glog v1.0.0
 	github.com/golang/mock v1.6.0
 	github.com/google/go-cmp v0.5.8
 	github.com/google/trillian v1.5.1-0.20220819043421-0a389c4bb8d9
@@ -28,6 +27,7 @@ require (
 	google.golang.org/grpc v1.48.0
 	google.golang.org/protobuf v1.28.1
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/klog/v2 v2.70.1
 )
 
 require (
@@ -69,11 +69,13 @@ require (
 	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/letsencrypt/pkcs11key/v4 v4.0.0 // indirect
+	github.com/mattn/go-isatty v0.0.11 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
 	github.com/miekg/pkcs11 v1.0.3 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.37.0 // indirect
@@ -118,9 +120,9 @@ require (
 	google.golang.org/api v0.93.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220706185917-7780775163c4 // indirect
+	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/klog/v2 v2.70.1 // indirect
 	sigs.k8s.io/yaml v1.2.0 // indirect
 )
diff --git a/go.sum b/go.sum
index c7911df184..01f4c14ac6 100644
--- a/go.sum
+++ b/go.sum
@@ -17,6 +17,7 @@ cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOY
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
 cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
 cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
+cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
 cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
 cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
 cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
@@ -31,12 +32,14 @@ cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2Z
 cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
 cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
 cloud.google.com/go v0.102.1 h1:vpK6iQWv/2uUeFJth4/cBHsQAGjn1iIE6AAlxipRaA0=
+cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/bigquery v1.17.0/go.mod h1:pUlbH9kNOnp6ayShsqKLB6w49z14ILAaq0hrjh93Ajw=
 cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
 cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
 cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
@@ -46,6 +49,7 @@ cloud.google.com/go/compute v1.7.0 h1:v/k9Eueb8aAJ0vZuxKMrgm6kPhCLZU9HxFU+AFDs9U
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/datastore v1.5.0/go.mod h1:RGUNM0FFAVkYA94BLTxoXBgfIyY1Riq67TwaBXH0lwc=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
 cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
 cloud.google.com/go/monitoring v1.1.0 h1:ZnyNdf/XRcynMmKzRSNTOdOyYPs6G7do1l2D2hIvIKo=
@@ -54,11 +58,14 @@ cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2k
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/pubsub v1.11.0-beta.schemas/go.mod h1:llNLsvx+RnsZJoY481TzC1XcdB2hWdR6gSWM5O4vgfs=
+cloud.google.com/go/spanner v1.36.0/go.mod h1:RKVKnqXxTMDuBPAsjxohvcSTH6qiRB6E0oMljFIKPr0=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+cloud.google.com/go/storage v1.15.0/go.mod h1:mjjQMoxxyGH7Jr8K5qrx6N2O0AHsczI61sMNn03GIZI=
 cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
 cloud.google.com/go/trace v1.0.0 h1:laKx2y7IWMjguCe5zZx6n7qLtREk4kyE69SXVC0VSN8=
 cloud.google.com/go/trace v1.0.0/go.mod h1:4iErSByzxkyHWzzlAj63/Gmjz0NH1ASqhJguHpGcr6A=
@@ -68,16 +75,27 @@ dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7
 github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/sprig v2.15.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
+github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
+github.com/apache/beam/sdks/v2 v2.0.0-20211012030016-ef4364519c94/go.mod h1:/kOom7hCyHVzAC/Z7HbZywkZZv6ywF+wb4CvgDVdcB8=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aws/aws-sdk-go v1.37.0 h1:GzFnhOIsrGyQ69s7VgqtrG2BG8v7X7vwB3Xpbd/DBBk=
 github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
@@ -90,12 +108,14 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0 h1:t/LhUZLVitR1Ow2YOnduCsavhwFUklBMoGVYUCqmCqk=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
 github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054 h1:uH66TXeswKn5PW5zdZ39xEwfS9an067BirqA+P4QaLI=
 github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
@@ -122,17 +142,25 @@ github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoC
 github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f h1:o/kfcElHqOiXqcou5a3rIlMc7oJbMQkeLk0VQJ7zgqY=
 github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
+github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -142,6 +170,7 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZm
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -158,15 +187,19 @@ github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4
 github.com/etcd-io/gofail v0.0.0-20190801230047-ad7f989257ca/go.mod h1:49H/RkXP8pKaZy4h0d+NW16rSLhyVBt4o6VLJbmOqDE=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0 h1:8xPHl4/q1VyqGIPif1F+1V3Y3lSmrq01EabUW3CoW5s=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/form3tech-oss/jwt-go v3.2.5+incompatible h1:/l4kBbb4/vGSsdtB5nUe8L7B9mImVMaBPw9L/0TBHU8=
 github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fullstorydev/grpcurl v1.8.7 h1:xJWosq3BQovQ4QrdPO72OrPiWuGgEsxY8ldYsJbPrqI=
 github.com/fullstorydev/grpcurl v1.8.7/go.mod h1:pVtM4qe3CMoLaIzYS8uvTuDj2jVYmXqMUkZeijnXp/E=
 github.com/getsentry/raven-go v0.2.0 h1:no+xWJRb5ZI7eE8TWgIq1jLulQiIoLG0IfYxv5JYMGs=
 github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -180,17 +213,18 @@ github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.0 h1:QK40JKJyMdUDz+h+xvCsru/bJhvG0UxvePV0ufL/AcE=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ=
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -227,6 +261,7 @@ github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
@@ -247,11 +282,14 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-licenses v0.0.0-20210329231322-ce1d9163b77d/go.mod h1:+TYOmkVoJOpwnS0wfdsJCV9CoD5nJYsHoFk/0CrTK4M=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/licenseclassifier v0.0.0-20210325184830-bb04aff29e72/go.mod h1:qsqn2hxC+vURpyBRygGUuinTO42MFRLcsmQ/P8v94+M=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -261,6 +299,7 @@ github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
@@ -317,10 +356,17 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
+github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jhump/gopoet v0.0.0-20190322174617-17282ff210b3/go.mod h1:me9yfT6IJSlOL3FCfrg+L6yzUEZ+5jW6WHt4Sk+UPUI=
 github.com/jhump/gopoet v0.1.0/go.mod h1:me9yfT6IJSlOL3FCfrg+L6yzUEZ+5jW6WHt4Sk+UPUI=
 github.com/jhump/goprotoc v0.5.0/go.mod h1:VrbvcYrQOrTi3i0Vf+m+oqQWk9l72mjkJCYo7UvLHRQ=
@@ -346,16 +392,18 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
@@ -363,11 +411,17 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0 h1:qLc/OznH7xMr5ARJgkZCCWk+EomQkiNTOoOF5LAgagc=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
+github.com/linkedin/goavro v2.1.0+incompatible/go.mod h1:bBCwI2eGYpUI/4820s67MElg9tdeLbINjLjiM2xZFYM=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.4 h1:snbPLB8fVfU9iwbbo30TPtbLRzwWu6aJS6Xh4eaaviA=
-github.com/mattn/go-isatty v0.0.3 h1:ns/ykhmWi7G9O+8a448SecJU3nSMBXJfqQkl0upE1jI=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11 h1:FxPOTFNqGkuDUGi3H/qkUbQO4ZiBa2brKq5r0l8TGeM=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -380,6 +434,7 @@ github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WT
 github.com/miekg/pkcs11 v1.0.3 h1:iMwmD7I5225wv84WxIG/bmxz9AXjWvTWIbM/TYHvWtw=
 github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
@@ -387,6 +442,9 @@ github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS4
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -398,16 +456,32 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007/go.mod h1:m2XC9Qq0AlmmVksL6FktJCdTYyLk7V3fKyp0sl1yWQo=
+github.com/mwitkow/go-proto-validators v0.2.0/go.mod h1:ZfA1hW+UH/2ZHOWvQ3HnQaU0DtnpXu850MZiy+YUgcc=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nightlyone/lockfile v1.0.0/go.mod h1:rywoIealpdNse2r832aiD9jRk8ErCatROs6LzC841CI=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
+github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
+github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
+github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
+github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pelletier/go-buffruneio v0.2.0/go.mod h1:JkE26KsDizTr40EUHkXVtNPvgGtbSNq5BcowyYOWdKo=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
@@ -444,6 +518,8 @@ github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0ua
 github.com/prometheus/prometheus v2.5.0+incompatible h1:7QPitgO2kOFG8ecuRn9O/4L9+10He72rVRJvMXrE9Hg=
 github.com/prometheus/prometheus v2.5.0+incompatible/go.mod h1:oAIUtOny2rjMX0OWN5vPR5/q/twIROJvdqnQKDdil/s=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/pseudomuto/protoc-gen-doc v1.5.1/go.mod h1:XpMKYg6zkcpgfpCfQ8GcWBDRtRxOmMR5w7pz4Xo+dYM=
+github.com/pseudomuto/protokit v0.2.0/go.mod h1:2PdH30hxVHsup8KpBTOXTBeMVhJZVio3Q8ViKSAXT0Q=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
@@ -451,11 +527,14 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rs/cors v1.8.2 h1:KCooALfAYGs415Cwu5ABvv9n9509fSiG5SQJn/AQo4U=
 github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
@@ -471,17 +550,27 @@ github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
+github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
+github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
 github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
 github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
+github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
+github.com/src-d/gcfg v1.4.0/go.mod h1:p/UMsR43ujA89BJY9duynAwIpvqEujIH/jFlfL7jWoI=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -489,6 +578,7 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 h1:uruHq4dN7GR16kFc5fp3d1RIYzJW5onx8Ybykw2YQFA=
@@ -497,23 +587,30 @@ github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce h1:fb190+cK2Xz/dvi9
 github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce/go.mod h1:o8v6yHRoik09Xen7gje4m9ERNah1d1PPsVq1VEx9vE4=
 github.com/transparency-dev/merkle v0.0.1 h1:T9/9gYB8uZl7VOJIhdwjALeRWlxUxSfDEysjfmx+L9E=
 github.com/transparency-dev/merkle v0.0.1/go.mod h1:B8FIw5LTq6DaULoHsVFRzYIUDkl8yuSwCdZnOZGKL/A=
+github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.7 h1:aXiFAgRugfJ27UFDsGJ9DB2FvTC73hlVXFSqq5bo9eU=
 github.com/urfave/cli v1.22.7/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 h1:eY9dn8+vbi4tKz5Qo6v2eYzo7kUS51QINcR5jNpbZS8=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
 go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
+go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/api/v3 v3.5.4 h1:OHVyt3TopwtUQ2GKdd5wu3PmmipR4FTwCqoEjSyRdIc=
 go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
+go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/pkg/v3 v3.5.4 h1:lrneYvz923dvC14R54XcA7FXoZ3mlGZAgmwhfm7HqOg=
 go.etcd.io/etcd/client/pkg/v3 v3.5.4/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
 go.etcd.io/etcd/client/v2 v2.305.4 h1:Dcx3/MYyfKcPNLpR4VVQUP5KgYrBeJtktBwEKkw08Ao=
 go.etcd.io/etcd/client/v2 v2.305.4/go.mod h1:Ud+VUwIi9/uQHOMA+4ekToJ12lTxlv0zB/+DHwTGEbU=
 go.etcd.io/etcd/client/v3 v3.5.4 h1:p83BUL3tAYS0OT/r0qglgc3M1JjhM0diV8DSWAhVXv4=
@@ -580,11 +677,17 @@ go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8=
 go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191117063200-497ca9f6d64f/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 h1:kUhD7nTDoI3fVd9G4ORWrbV5NY0liEs/Jg2pv5f+bBA=
 golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -627,6 +730,7 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVD
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -642,6 +746,7 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191119073136-fc4aabc6c914/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -661,10 +766,12 @@ golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210423184538-5f58ad60dda6/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -688,6 +795,8 @@ golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210413134643-5e61552d6c78/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
@@ -717,10 +826,14 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190221075227-b4e8571b14e0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -730,7 +843,9 @@ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191119060738-e882bf8e40c2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -758,11 +873,13 @@ golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210412220455-f1c623a9e750/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -825,6 +942,7 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190729092621-ff9f1409240a/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -832,6 +950,7 @@ golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191118222007-07fc4c7f2b98/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -862,6 +981,7 @@ golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
@@ -898,6 +1018,8 @@ google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34q
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
 google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
 google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
+google.golang.org/api v0.44.0/go.mod h1:EBOGZqzyhtvMDoxwS97ctnh0zUmYY6CxqXsc1AvkYD8=
+google.golang.org/api v0.45.0/go.mod h1:ISLIJCedJolbZvDfAk+Ctuq5hf+aJ33WgtUsfyFoLXA=
 google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
 google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
 google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
@@ -918,6 +1040,7 @@ google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69
 google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
 google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
 google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
+google.golang.org/api v0.86.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
 google.golang.org/api v0.93.0 h1:T2xt9gi0gHdxdnRkVQhT8mIvPaXKNsDNWz+L696M66M=
 google.golang.org/api v0.93.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -964,12 +1087,18 @@ google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210325141258-5636347f2b14/go.mod h1:f2Bd7+2PlaVKmvKQ52aspJZXIDaRQBVdOOBfJ5i8OEs=
 google.golang.org/genproto v0.0.0-20210329143202-679c6ae281ee/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
 google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
+google.golang.org/genproto v0.0.0-20210406143921-e86de6bf7a46/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210413151531-c14fb6ef47c3/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210420162539-3c870d7478d2/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
 google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
 google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
@@ -1011,6 +1140,7 @@ google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP
 google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
+google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220706185917-7780775163c4 h1:7YDGQC/0sigNGzsEWyb9s72jTxlFdwVEYNJHbfQ+Dtg=
 google.golang.org/genproto v0.0.0-20220706185917-7780775163c4/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
@@ -1048,6 +1178,7 @@ google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.48.0 h1:rQOsyJ/8+ufEDJd/Gdsz7HG220Mh9HAhFHRGnIjda0w=
 google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1067,15 +1198,24 @@ google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.28 h1:n1tBJnnK2r7g9OW2btFH91V92STTUevLXYFb8gy9EMk=
 gopkg.in/cheggaaa/pb.v1 v1.0.28/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/linkedin/goavro.v1 v1.0.5/go.mod h1:Aw5GdAbizjOEl0kAMHV9iHmA8reZzW/OKuJAl4Hb9F0=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
+gopkg.in/src-d/go-git-fixtures.v3 v3.5.0/go.mod h1:dLBcvytrw/TYZsNTWCnkNF2DSIlzWYqTe3rJR56Ac7g=
+gopkg.in/src-d/go-git.v4 v4.13.1/go.mod h1:nx5NYcxdKxq5fpltdHnPa2Exj4Sx0EclMWZQbYDu2z8=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/internal/witness/cmd/client/main.go b/internal/witness/cmd/client/main.go
index a7c695b739..e62399b46e 100644
--- a/internal/witness/cmd/client/main.go
+++ b/internal/witness/cmd/client/main.go
@@ -29,12 +29,12 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	wit_api "github.com/google/certificate-transparency-go/internal/witness/api"
 	wh "github.com/google/certificate-transparency-go/internal/witness/client/http"
 	"github.com/google/certificate-transparency-go/internal/witness/verifier"
 	"github.com/google/certificate-transparency-go/loglist3"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -63,26 +63,27 @@ type ctLog struct {
 }
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 	if *witness == "" {
-		glog.Exit("--witness_url must not be empty")
+		klog.Exit("--witness_url must not be empty")
 	}
 	if *witnessPK == "" {
-		glog.Exit("--witness_pk must not be empty")
+		klog.Exit("--witness_pk must not be empty")
 	}
 	ctx := context.Background()
 	// Set up the witness client.
 	wURL, err := url.Parse(*witness)
 	if err != nil {
-		glog.Exitf("Failed to parse witness URL: %v", err)
+		klog.Exitf("Failed to parse witness URL: %v", err)
 	}
 	pk, err := ct.PublicKeyFromB64(*witnessPK)
 	if err != nil {
-		glog.Exitf("Failed to create witness public key: %v", err)
+		klog.Exitf("Failed to create witness public key: %v", err)
 	}
 	wv, err := verifier.NewWitnessVerifier(pk)
 	if err != nil {
-		glog.Exitf("Failed to create witness signature verifier: %v", err)
+		klog.Exitf("Failed to create witness signature verifier: %v", err)
 	}
 	w := Witness{
 		Client: &wh.Witness{
@@ -93,7 +94,7 @@ func main() {
 	// Set up the log data.
 	ctLogs, err := populateLogs(*logList)
 	if err != nil {
-		glog.Exitf("Failed to set up log data: %v", err)
+		klog.Exitf("Failed to set up log data: %v", err)
 	}
 	// Now poll the witness for each log.
 	wg := &sync.WaitGroup{}
@@ -102,7 +103,7 @@ func main() {
 		go func(witness *Witness, log ctLog) {
 			defer wg.Done()
 			if err := log.getSTH(ctx, witness, *interval); err != nil {
-				glog.Errorf("getSTH: %v", err)
+				klog.Errorf("getSTH: %v", err)
 			}
 		}(&w, log)
 	}
@@ -160,11 +161,11 @@ func (l *ctLog) getSTH(ctx context.Context, witness *Witness, interval time.Dura
 			ctx, cancel := context.WithTimeout(ctx, interval)
 			defer cancel()
 
-			glog.V(2).Infof("Requesting STH for %s from witness", l.name)
+			klog.V(2).Infof("Requesting STH for %s from witness", l.name)
 			if err := l.getOnce(ctx, witness); err != nil {
-				glog.Warningf("Failed to retrieve STH for %s: %v", l.name, err)
+				klog.Warningf("Failed to retrieve STH for %s: %v", l.name, err)
 			} else {
-				glog.Infof("Verified the STH for %s at size %d!", l.name, l.wsth.TreeSize)
+				klog.Infof("Verified the STH for %s at size %d!", l.name, l.wsth.TreeSize)
 			}
 		}()
 
diff --git a/internal/witness/cmd/feeder/main.go b/internal/witness/cmd/feeder/main.go
index 284c0788bf..26453825d4 100644
--- a/internal/witness/cmd/feeder/main.go
+++ b/internal/witness/cmd/feeder/main.go
@@ -30,12 +30,12 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/client"
 	wh "github.com/google/certificate-transparency-go/internal/witness/client/http"
 	"github.com/google/certificate-transparency-go/jsonclient"
 	"github.com/google/certificate-transparency-go/loglist3"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -102,15 +102,16 @@ func createLogClient(key []byte, url string) (*client.LogClient, error) {
 }
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 	if *witness == "" {
-		glog.Exit("--witness_url must not be empty")
+		klog.Exit("--witness_url must not be empty")
 	}
 	ctx := context.Background()
 	// Set up the witness client.
 	var w wh.Witness
 	if wURL, err := url.Parse(*witness); err != nil {
-		glog.Exitf("Failed to parse witness URL: %v", err)
+		klog.Exitf("Failed to parse witness URL: %v", err)
 	} else {
 		w = wh.Witness{
 			URL: wURL,
@@ -119,7 +120,7 @@ func main() {
 	// Now set up the log data (with no initial witness STH).
 	ctLogs, err := populateLogs(*logList)
 	if err != nil {
-		glog.Exitf("Failed to set up log data: %v", err)
+		klog.Exitf("Failed to set up log data: %v", err)
 	}
 	// Now feed each log.
 	wg := &sync.WaitGroup{}
@@ -128,7 +129,7 @@ func main() {
 		go func(witness *wh.Witness, log ctLog) {
 			defer wg.Done()
 			if err := log.feed(ctx, witness, *interval); err != nil {
-				glog.Errorf("feedLog: %v", err)
+				klog.Errorf("feedLog: %v", err)
 			}
 		}(&w, log)
 	}
@@ -145,11 +146,11 @@ func (l *ctLog) feed(ctx context.Context, witness *wh.Witness, interval time.Dur
 			ctx, cancel := context.WithTimeout(ctx, interval)
 			defer cancel()
 
-			glog.V(2).Infof("Start feedOnce for %s", l.name)
+			klog.V(2).Infof("Start feedOnce for %s", l.name)
 			if err := l.feedOnce(ctx, witness); err != nil {
-				glog.Warningf("Failed to feed for %s: %v", l.name, err)
+				klog.Warningf("Failed to feed for %s: %v", l.name, err)
 			}
-			glog.V(2).Infof("feedOnce complete for %s", l.name)
+			klog.V(2).Infof("feedOnce complete for %s", l.name)
 		}()
 
 		select {
@@ -178,11 +179,11 @@ func (l *ctLog) feedOnce(ctx context.Context, w *wh.Witness) error {
 		return fmt.Errorf("failed to get latest size for %s: %v", l.name, err)
 	}
 	if wSize >= csth.TreeSize {
-		glog.V(1).Infof("Witness size %d >= log size %d for %s - nothing to do", wSize, csth.TreeSize, l.name)
+		klog.V(1).Infof("Witness size %d >= log size %d for %s - nothing to do", wSize, csth.TreeSize, l.name)
 		return nil
 	}
 
-	glog.Infof("Updating witness from size %d to %d for %s", wSize, csth.TreeSize, l.name)
+	klog.Infof("Updating witness from size %d to %d for %s", wSize, csth.TreeSize, l.name)
 	// If we want to update the witness then let's get a consistency proof.
 	var pf [][]byte
 	if wSize > 0 {
@@ -197,8 +198,8 @@ func (l *ctLog) feedOnce(ctx context.Context, w *wh.Witness) error {
 		return fmt.Errorf("failed to update STH: %v", err)
 	}
 	if errors.Is(err, wh.ErrSTHTooOld) {
-		glog.Infof("STH mismatch at log size %d for %s", wSize, l.name)
-		glog.Infof("%s", wsthRaw)
+		klog.Infof("STH mismatch at log size %d for %s", wSize, l.name)
+		klog.Infof("%s", wsthRaw)
 	}
 	// Parse the STH it returns.
 	var wsthJSON ct.GetSTHResponse
diff --git a/internal/witness/cmd/witness/config/config.go b/internal/witness/cmd/witness/config/config.go
index 6bb786bcd6..2ab7fe85d7 100644
--- a/internal/witness/cmd/witness/config/config.go
+++ b/internal/witness/cmd/witness/config/config.go
@@ -24,10 +24,10 @@ import (
 	"net/url"
 	"os"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/internal/witness/cmd/witness/impl"
 	"github.com/google/certificate-transparency-go/loglist3"
 	"gopkg.in/yaml.v3"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -41,16 +41,16 @@ func main() {
 	// Get all usable logs from the log list.
 	u, err := url.Parse(*logList)
 	if err != nil {
-		glog.Exitf("Failed to parse log_list_url as a URL: %v", err)
+		klog.Exitf("Failed to parse log_list_url as a URL: %v", err)
 	}
 	body, err := readURL(u)
 	if err != nil {
-		glog.Exitf("Failed to get log list data: %v", err)
+		klog.Exitf("Failed to get log list data: %v", err)
 	}
 	// Get data for all usable logs.
 	logList, err := loglist3.NewFromJSON(body)
 	if err != nil {
-		glog.Exitf("failed to parse JSON: %v", err)
+		klog.Exitf("failed to parse JSON: %v", err)
 	}
 	var config impl.LogConfig
 	usable := logList.SelectByStatus([]loglist3.LogStatus{loglist3.UsableLogStatus})
@@ -63,10 +63,10 @@ func main() {
 	}
 	data, err := yaml.Marshal(&config)
 	if err != nil {
-		glog.Exitf("Failed to marshal log config into YAML: %v", err)
+		klog.Exitf("Failed to marshal log config into YAML: %v", err)
 	}
 	if err := os.WriteFile(*configFile, data, 0644); err != nil {
-		glog.Exitf("Failed to write config to file: %v", err)
+		klog.Exitf("Failed to write config to file: %v", err)
 	}
 }
 
diff --git a/internal/witness/cmd/witness/impl/witness.go b/internal/witness/cmd/witness/impl/witness.go
index ab422d9fa8..3de2336dda 100644
--- a/internal/witness/cmd/witness/impl/witness.go
+++ b/internal/witness/cmd/witness/impl/witness.go
@@ -24,12 +24,12 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	ih "github.com/google/certificate-transparency-go/internal/witness/cmd/witness/internal/http"
 	"github.com/google/certificate-transparency-go/internal/witness/cmd/witness/internal/witness"
 	"github.com/gorilla/mux"
 	_ "github.com/mattn/go-sqlite3" // Load drivers for sqlite3
+	"k8s.io/klog/v2"
 )
 
 // LogConfig contains a list of LogInfo (configuration options for a log).
@@ -93,7 +93,7 @@ func Main(ctx context.Context, opts ServerOpts) error {
 		return errors.New("DBFile is required")
 	}
 	// Start up local database.
-	glog.Infof("Connecting to local DB at %q", opts.DBFile)
+	klog.Infof("Connecting to local DB at %q", opts.DBFile)
 	db, err := sql.Open("sqlite3", opts.DBFile)
 	if err != nil {
 		return fmt.Errorf("failed to connect to DB: %w", err)
@@ -117,7 +117,7 @@ func Main(ctx context.Context, opts ServerOpts) error {
 		return fmt.Errorf("error creating witness: %v", err)
 	}
 
-	glog.Infof("Starting witness server...")
+	klog.Infof("Starting witness server...")
 	srv := ih.NewServer(w)
 	// These options are required as some logID values contain forward
 	// slashes, and will be PathUnescape-d later.
@@ -133,7 +133,7 @@ func Main(ctx context.Context, opts ServerOpts) error {
 		close(e)
 	}()
 	<-ctx.Done()
-	glog.Info("Server shutting down")
+	klog.Info("Server shutting down")
 	hServer.Shutdown(ctx)
 	return <-e
 }
diff --git a/internal/witness/cmd/witness/main.go b/internal/witness/cmd/witness/main.go
index 47e8ffc7c7..0905cd0ed3 100644
--- a/internal/witness/cmd/witness/main.go
+++ b/internal/witness/cmd/witness/main.go
@@ -22,9 +22,9 @@ import (
 	"flag"
 	"os"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/internal/witness/cmd/witness/impl"
 	"gopkg.in/yaml.v3"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -38,22 +38,23 @@ var (
 )
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 
 	if *witnessSK == "" {
-		glog.Exit("--private_key must not be empty")
+		klog.Exit("--private_key must not be empty")
 	}
 
 	if *configFile == "" {
-		glog.Exit("--config_file must not be empty")
+		klog.Exit("--config_file must not be empty")
 	}
 	fileData, err := os.ReadFile(*configFile)
 	if err != nil {
-		glog.Exitf("Failed to read from config file: %v", err)
+		klog.Exitf("Failed to read from config file: %v", err)
 	}
 	var lc impl.LogConfig
 	if err := yaml.Unmarshal(fileData, &lc); err != nil {
-		glog.Exitf("Failed to parse config file as proper YAML: %v", err)
+		klog.Exitf("Failed to parse config file as proper YAML: %v", err)
 	}
 
 	ctx := context.Background()
@@ -63,6 +64,6 @@ func main() {
 		PrivKey:    *witnessSK,
 		Config:     lc,
 	}); err != nil {
-		glog.Exitf("Error running witness: %v", err)
+		klog.Exitf("Error running witness: %v", err)
 	}
 }
diff --git a/jsonclient/client.go b/jsonclient/client.go
index dfab29127f..c3cf8515d0 100644
--- a/jsonclient/client.go
+++ b/jsonclient/client.go
@@ -30,10 +30,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/x509"
 	"golang.org/x/net/context/ctxhttp"
+	"k8s.io/klog/v2"
 )
 
 const maxJitter = 250 * time.Millisecond
@@ -176,7 +176,7 @@ func (c *JSONClient) GetAndParse(ctx context.Context, path string, params map[st
 		vals.Add(k, v)
 	}
 	fullURI := fmt.Sprintf("%s%s?%s", c.uri, path, vals.Encode())
-	glog.V(2).Infof("GET %s", fullURI)
+	klog.V(2).Infof("GET %s", fullURI)
 	httpReq, err := http.NewRequest(http.MethodGet, fullURI, nil)
 	if err != nil {
 		return nil, nil, err
@@ -222,7 +222,7 @@ func (c *JSONClient) PostAndParse(ctx context.Context, path string, req, rsp int
 		return nil, nil, err
 	}
 	fullURI := fmt.Sprintf("%s%s", c.uri, path)
-	glog.V(2).Infof("POST %s", fullURI)
+	klog.V(2).Infof("POST %s", fullURI)
 	httpReq, err := http.NewRequest(http.MethodPost, fullURI, bytes.NewReader(postBody))
 	if err != nil {
 		return nil, nil, err
diff --git a/loglist/findlog/main.go b/loglist/findlog/main.go
index b2deea571f..e1a42c48e2 100644
--- a/loglist/findlog/main.go
+++ b/loglist/findlog/main.go
@@ -26,10 +26,10 @@ import (
 	"os"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/loglist"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -45,18 +45,18 @@ func main() {
 
 	llData, err := x509util.ReadFileOrURL(*logList, client)
 	if err != nil {
-		glog.Exitf("Failed to read log list: %v", err)
+		klog.Exitf("Failed to read log list: %v", err)
 	}
 
 	var pubKey crypto.PublicKey
 	if *logListPubKeyFile != "" {
 		data, err := os.ReadFile(*logListPubKeyFile)
 		if err != nil {
-			glog.Exitf("Failed to read public key: %v", err)
+			klog.Exitf("Failed to read public key: %v", err)
 		}
 		pubKey, _ /* keyhash */, _ /* rest */, err = ct.PublicKeyFromPEM(data)
 		if err != nil {
-			glog.Exitf("Failed to parse public key: %v", err)
+			klog.Exitf("Failed to parse public key: %v", err)
 		}
 	}
 
@@ -66,7 +66,7 @@ func main() {
 	if pubKey != nil {
 		sig, err := x509util.ReadFileOrURL(*logListSig, client)
 		if err != nil {
-			glog.Exitf("Failed to read log list signature: %v", err)
+			klog.Exitf("Failed to read log list signature: %v", err)
 		}
 		factory = func(d []byte) (*loglist.LogList, error) {
 			return loglist.NewFromSignedJSON(d, sig, pubKey)
@@ -75,12 +75,12 @@ func main() {
 
 	ll, err := factory(llData)
 	if err != nil {
-		glog.Exitf("Failed to build log list: %v", err)
+		klog.Exitf("Failed to build log list: %v", err)
 	}
 
 	args := flag.Args()
 	if len(args) == 0 {
-		glog.Exitf("No logs specified")
+		klog.Exitf("No logs specified")
 	}
 	for _, arg := range args {
 		logs := ll.FuzzyFindLog(arg)
diff --git a/loglist/logfilter.go b/loglist/logfilter.go
index e6459f8904..867605864f 100644
--- a/loglist/logfilter.go
+++ b/loglist/logfilter.go
@@ -17,9 +17,9 @@ package loglist
 import (
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 // LogRoots maps Log-URLs (stated at LogList) to the pools of their accepted
@@ -53,7 +53,7 @@ func (ll *LogList) Compatible(cert *x509.Certificate, certRoot *x509.Certificate
 
 	// Check whether chain is ending with CA-cert.
 	if certRoot != nil && !certRoot.IsCA {
-		glog.Warningf("Compatible method expects fully rooted chain, while last cert of the chain provided is not root")
+		klog.Warningf("Compatible method expects fully rooted chain, while last cert of the chain provided is not root")
 		return compatible
 	}
 
diff --git a/loglist2/logfilter.go b/loglist2/logfilter.go
index 2851821fbc..225e644397 100644
--- a/loglist2/logfilter.go
+++ b/loglist2/logfilter.go
@@ -15,9 +15,9 @@
 package loglist2
 
 import (
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 // LogRoots maps Log-URLs (stated at LogList) to the pools of their accepted
@@ -64,7 +64,7 @@ func (ll *LogList) RootCompatible(certRoot *x509.Certificate, roots LogRoots) Lo
 
 	// Check whether root is a CA-cert.
 	if certRoot != nil && !certRoot.IsCA {
-		glog.Warningf("Compatible method expects fully rooted chain, while last cert of the chain provided is not root")
+		klog.Warningf("Compatible method expects fully rooted chain, while last cert of the chain provided is not root")
 		return compatible
 	}
 
diff --git a/loglist3/logfilter.go b/loglist3/logfilter.go
index efc0796555..41ed62f88c 100644
--- a/loglist3/logfilter.go
+++ b/loglist3/logfilter.go
@@ -15,9 +15,9 @@
 package loglist3
 
 import (
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 // LogRoots maps Log-URLs (stated at LogList) to the pools of their accepted
@@ -64,7 +64,7 @@ func (ll *LogList) RootCompatible(certRoot *x509.Certificate, roots LogRoots) Lo
 
 	// Check whether root is a CA-cert.
 	if certRoot != nil && !certRoot.IsCA {
-		glog.Warningf("Compatible method expects fully rooted chain, while last cert of the chain provided is not root")
+		klog.Warningf("Compatible method expects fully rooted chain, while last cert of the chain provided is not root")
 		return compatible
 	}
 
diff --git a/preload/preloader/preloader.go b/preload/preloader/preloader.go
index 3a306f20f9..32f6a83e5f 100644
--- a/preload/preloader/preloader.go
+++ b/preload/preloader/preloader.go
@@ -25,13 +25,13 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/jsonclient"
 	"github.com/google/certificate-transparency-go/preload"
 	"github.com/google/certificate-transparency-go/scanner"
 	"github.com/google/certificate-transparency-go/x509"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -87,11 +87,11 @@ func sctDumper(addedCerts <-chan *preload.AddedCert, sctWriter io.Writer) {
 		if encoder != nil {
 			err := encoder.Encode(c)
 			if err != nil {
-				glog.Fatalf("failed to encode to %s: %v", *sctInputFile, err)
+				klog.Fatalf("failed to encode to %s: %v", *sctInputFile, err)
 			}
 		}
 	}
-	glog.Infof("Added %d certs, %d failed, total: %d\n", numAdded, numFailed, numAdded+numFailed)
+	klog.Infof("Added %d certs, %d failed, total: %d\n", numAdded, numFailed, numAdded+numFailed)
 }
 
 func certSubmitter(ctx context.Context, addedCerts chan<- *preload.AddedCert, logClient client.AddLogClient, certs <-chan *ct.LogEntry) {
@@ -101,12 +101,12 @@ func certSubmitter(ctx context.Context, addedCerts chan<- *preload.AddedCert, lo
 		copy(chain[1:], c.Chain)
 		sct, err := logClient.AddChain(ctx, chain)
 		if err != nil {
-			glog.Errorf("failed to add chain with CN %s: %v\n", c.X509Cert.Subject.CommonName, err)
+			klog.Errorf("failed to add chain with CN %s: %v\n", c.X509Cert.Subject.CommonName, err)
 			recordFailure(addedCerts, chain[0], err)
 			continue
 		}
 		recordSct(addedCerts, chain[0], sct)
-		glog.V(2).Infof("Added chain for CN '%s', SCT: %s\n", c.X509Cert.Subject.CommonName, sct)
+		klog.V(2).Infof("Added chain for CN '%s', SCT: %s\n", c.X509Cert.Subject.CommonName, sct)
 	}
 }
 
@@ -117,25 +117,25 @@ func precertSubmitter(ctx context.Context, addedCerts chan<- *preload.AddedCert,
 		copy(chain[1:], c.Chain)
 		sct, err := logClient.AddPreChain(ctx, chain)
 		if err != nil {
-			glog.Errorf("failed to add pre-chain with CN %s: %v", c.Precert.TBSCertificate.Subject.CommonName, err)
+			klog.Errorf("failed to add pre-chain with CN %s: %v", c.Precert.TBSCertificate.Subject.CommonName, err)
 			recordFailure(addedCerts, chain[0], err)
 			continue
 		}
 		recordSct(addedCerts, chain[0], sct)
-		glog.V(2).Infof("Added precert chain for CN '%s', SCT: %s\n", c.Precert.TBSCertificate.Subject.CommonName, sct)
+		klog.V(2).Infof("Added precert chain for CN '%s', SCT: %s\n", c.Precert.TBSCertificate.Subject.CommonName, sct)
 	}
 }
 
 func main() {
 	flag.Parse()
-	glog.CopyStandardLogTo("WARNING")
+	klog.CopyStandardLogTo("WARNING")
 
 	var sctFileWriter io.Writer
 	var err error
 	if *sctInputFile != "" {
 		sctFile, err := os.Create(*sctInputFile)
 		if err != nil {
-			glog.Exitf("Failed to create SCT file: %v", err)
+			klog.Exitf("Failed to create SCT file: %v", err)
 		}
 		defer sctFile.Close()
 		sctFileWriter = sctFile
@@ -147,7 +147,7 @@ func main() {
 	defer func() {
 		err := sctWriter.Close()
 		if err != nil {
-			glog.Exitf("Failed to close SCT file: %v", err)
+			klog.Exitf("Failed to close SCT file: %v", err)
 		}
 	}()
 
@@ -166,7 +166,7 @@ func main() {
 		Transport: transport,
 	}, jsonclient.Options{UserAgent: "ct-go-preloader/1.0"})
 	if err != nil {
-		glog.Exitf("Failed to create client for source log: %v", err)
+		klog.Exitf("Failed to create client for source log: %v", err)
 	}
 
 	opts := scanner.ScannerOptions{
@@ -197,16 +197,16 @@ func main() {
 	if *targetTemporalLogCfg != "" {
 		cfg, err := client.TemporalLogConfigFromFile(*targetTemporalLogCfg)
 		if err != nil {
-			glog.Exitf("Failed to load temporal log config: %v", err)
+			klog.Exitf("Failed to load temporal log config: %v", err)
 		}
 		submitLogClient, err = client.NewTemporalLogClient(cfg, &http.Client{Transport: transport})
 		if err != nil {
-			glog.Exitf("Failed to create client for destination temporal log: %v", err)
+			klog.Exitf("Failed to create client for destination temporal log: %v", err)
 		}
 	} else {
 		submitLogClient, err = client.New(*targetLogURI, &http.Client{Transport: transport}, jsonclient.Options{UserAgent: "ct-go-preloader/1.0"})
 		if err != nil {
-			glog.Exitf("Failed to create client for destination log: %v", err)
+			klog.Exitf("Failed to create client for destination log: %v", err)
 		}
 	}
 
@@ -227,7 +227,7 @@ func main() {
 	addChainFunc := func(rawEntry *ct.RawLogEntry) {
 		entry, err := rawEntry.ToLogEntry()
 		if x509.IsFatal(err) {
-			glog.Errorf("Failed to parse cert at %d: %v", rawEntry.Index, err)
+			klog.Errorf("Failed to parse cert at %d: %v", rawEntry.Index, err)
 			return
 		}
 		certs <- entry
@@ -235,7 +235,7 @@ func main() {
 	addPreChainFunc := func(rawEntry *ct.RawLogEntry) {
 		entry, err := rawEntry.ToLogEntry()
 		if x509.IsFatal(err) {
-			glog.Errorf("Failed to parse precert at %d: %v", rawEntry.Index, err)
+			klog.Errorf("Failed to parse precert at %d: %v", rawEntry.Index, err)
 			return
 		}
 		precerts <- entry
diff --git a/scanner/fetcher.go b/scanner/fetcher.go
index b46259225e..c4bf47bb04 100644
--- a/scanner/fetcher.go
+++ b/scanner/fetcher.go
@@ -20,10 +20,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/jsonclient"
 	"github.com/google/trillian/client/backoff"
+	"k8s.io/klog/v2"
 )
 
 // LogClient implements the subset of CT log API that the Fetcher uses.
@@ -114,13 +114,13 @@ func (f *Fetcher) Prepare(ctx context.Context) (*ct.SignedTreeHead, error) {
 
 	sth, err := f.client.GetSTH(ctx)
 	if err != nil {
-		glog.Errorf("%s: GetSTH() failed: %v", f.uri, err)
+		klog.Errorf("%s: GetSTH() failed: %v", f.uri, err)
 		return nil, err
 	}
-	glog.Infof("%s: Got STH with %d certs", f.uri, sth.TreeSize)
+	klog.Infof("%s: Got STH with %d certs", f.uri, sth.TreeSize)
 
 	if size := int64(sth.TreeSize); f.opts.EndIndex == 0 || f.opts.EndIndex > size {
-		glog.Infof("%s: Reset EndIndex from %d to %d", f.uri, f.opts.EndIndex, size)
+		klog.Infof("%s: Reset EndIndex from %d to %d", f.uri, f.opts.EndIndex, size)
 		f.opts.EndIndex = size
 	}
 	f.sth = sth
@@ -131,7 +131,7 @@ func (f *Fetcher) Prepare(ctx context.Context) (*ct.SignedTreeHead, error) {
 // passed in context is canceled, or Stop is called (and pending work is
 // finished). For each successfully fetched batch, runs the fn callback.
 func (f *Fetcher) Run(ctx context.Context, fn func(EntryBatch)) error {
-	glog.V(1).Infof("%s: Starting up Fetcher...", f.uri)
+	klog.V(1).Infof("%s: Starting up Fetcher...", f.uri)
 	if _, err := f.Prepare(ctx); err != nil {
 		return err
 	}
@@ -154,14 +154,14 @@ func (f *Fetcher) Run(ctx context.Context, fn func(EntryBatch)) error {
 		wg.Add(1)
 		go func(idx int) {
 			defer wg.Done()
-			glog.V(1).Infof("%s: Fetcher worker %d starting...", f.uri, idx)
+			klog.V(1).Infof("%s: Fetcher worker %d starting...", f.uri, idx)
 			f.runWorker(ctx, ranges, fn)
-			glog.V(1).Infof("%s: Fetcher worker %d finished", f.uri, idx)
+			klog.V(1).Infof("%s: Fetcher worker %d finished", f.uri, idx)
 		}(w)
 	}
 	wg.Wait()
 
-	glog.V(1).Infof("%s: Fetcher terminated", f.uri)
+	klog.V(1).Infof("%s: Fetcher terminated", f.uri)
 	return nil
 }
 
@@ -182,8 +182,8 @@ func (f *Fetcher) genRanges(ctx context.Context) <-chan fetchRange {
 	ranges := make(chan fetchRange)
 
 	go func() {
-		glog.V(1).Infof("%s: Range generator starting", f.uri)
-		defer glog.V(1).Infof("%s: Range generator finished", f.uri)
+		klog.V(1).Infof("%s: Range generator starting", f.uri)
+		defer klog.V(1).Infof("%s: Range generator finished", f.uri)
 		defer close(ranges)
 		start, end := f.opts.StartIndex, f.opts.EndIndex
 
@@ -192,7 +192,7 @@ func (f *Fetcher) genRanges(ctx context.Context) <-chan fetchRange {
 			// including, possibly, the very first iteration.
 			if start == end { // Implies f.opts.Continuous == true.
 				if err := f.updateSTH(ctx); err != nil {
-					glog.Warningf("%s: Failed to obtain bigger STH: %v", f.uri, err)
+					klog.Warningf("%s: Failed to obtain bigger STH: %v", f.uri, err)
 					return
 				}
 				end = f.opts.EndIndex
@@ -202,7 +202,7 @@ func (f *Fetcher) genRanges(ctx context.Context) <-chan fetchRange {
 			next := fetchRange{start, batchEnd - 1}
 			select {
 			case <-ctx.Done():
-				glog.Warningf("%s: Cancelling genRanges: %v", f.uri, ctx.Err())
+				klog.Warningf("%s: Cancelling genRanges: %v", f.uri, ctx.Err())
 				return
 			case ranges <- next:
 			}
@@ -240,7 +240,7 @@ func (f *Fetcher) updateSTH(ctx context.Context) error {
 		if err != nil {
 			return err
 		}
-		glog.V(2).Infof("%s: Got STH with %d certs", f.uri, sth.TreeSize)
+		klog.V(2).Infof("%s: Got STH with %d certs", f.uri, sth.TreeSize)
 
 		quick := time.Now().Before(quickDeadline)
 		if sth.TreeSize <= lastSize || quick && sth.TreeSize < targetSize {
@@ -287,9 +287,9 @@ func (f *Fetcher) runWorker(ctx context.Context, ranges <-chan fetchRange, fn fu
 				return err
 			}); err != nil {
 				if rspErr, isRspErr := err.(jsonclient.RspError); isRspErr && rspErr.StatusCode == http.StatusTooManyRequests {
-					glog.V(2).Infof("%s: GetRawEntries() failed: %v", f.uri, err)
+					klog.V(2).Infof("%s: GetRawEntries() failed: %v", f.uri, err)
 				} else {
-					glog.Errorf("%s: GetRawEntries() failed: %v", f.uri, err)
+					klog.Errorf("%s: GetRawEntries() failed: %v", f.uri, err)
 				}
 				// There is no error reporting yet for this worker, so just retry again.
 				continue
diff --git a/scanner/scanner.go b/scanner/scanner.go
index fac44fdc00..bbea6e487f 100644
--- a/scanner/scanner.go
+++ b/scanner/scanner.go
@@ -22,9 +22,9 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/x509"
+	"k8s.io/klog/v2"
 )
 
 // ScannerOptions holds configuration options for the Scanner.
@@ -99,7 +99,7 @@ func (s *Scanner) isCertErrorFatal(err error, logEntry *ct.LogEntry, index int64
 	} else if !x509.IsFatal(err) {
 		atomic.AddInt64(&s.entriesWithNonFatalErrors, 1)
 		// We'll make a note, but continue.
-		glog.V(1).Infof("Non-fatal error in %v at index %d: %v", logEntry.Leaf.TimestampedEntry.EntryType, index, err)
+		klog.V(1).Infof("Non-fatal error in %v at index %d: %v", logEntry.Leaf.TimestampedEntry.EntryType, index, err)
 		return false
 	}
 	return true
@@ -184,7 +184,7 @@ func (s *Scanner) matcherJob(entries <-chan entryInfo, foundCert func(*ct.RawLog
 	for e := range entries {
 		if err := s.processEntry(e, foundCert, foundPrecert); err != nil {
 			atomic.AddInt64(&s.unparsableEntries, 1)
-			glog.Errorf("Failed to parse entry at index %d: %s", e.index, err.Error())
+			klog.Errorf("Failed to parse entry at index %d: %s", e.index, err.Error())
 		}
 	}
 }
@@ -237,7 +237,7 @@ func (s *Scanner) logThroughput(treeSize int64, stop <-chan bool) {
 			remainingCerts := treeSize - int64(s.opts.StartIndex) - certsCnt
 			remainingSeconds := int(float64(remainingCerts) / throughput)
 			remainingString := humanTime(time.Duration(remainingSeconds) * time.Second)
-			glog.V(1).Infof("Processed: %d certs (to index %d), matched %d (%2.2f%%). Throughput (last %ds): %3.2f ETA: %s\n",
+			klog.V(1).Infof("Processed: %d certs (to index %d), matched %d (%2.2f%%). Throughput (last %ds): %3.2f ETA: %s\n",
 				certsCnt, s.opts.StartIndex+certsCnt, certsMatched,
 				(100.0*float64(certsMatched))/float64(certsCnt),
 				filled, throughput, remainingString)
@@ -258,7 +258,7 @@ func (s *Scanner) Scan(ctx context.Context, foundCert func(*ct.RawLogEntry), fou
 
 // ScanLog performs a scan against the Log, returning the count of scanned entries.
 func (s *Scanner) ScanLog(ctx context.Context, foundCert func(*ct.RawLogEntry), foundPrecert func(*ct.RawLogEntry)) (int64, error) {
-	glog.V(1).Infof("Starting up Scanner...")
+	klog.V(1).Infof("Starting up Scanner...")
 	s.certsProcessed = 0
 	s.certsMatched = 0
 	s.precertsSeen = 0
@@ -285,9 +285,9 @@ func (s *Scanner) ScanLog(ctx context.Context, foundCert func(*ct.RawLogEntry),
 		wg.Add(1)
 		go func(idx int) {
 			defer wg.Done()
-			glog.V(1).Infof("Matcher %d starting", idx)
+			klog.V(1).Infof("Matcher %d starting", idx)
 			s.matcherJob(entries, foundCert, foundPrecert)
-			glog.V(1).Infof("Matcher %d finished", idx)
+			klog.V(1).Infof("Matcher %d finished", idx)
 		}(w)
 	}
 
@@ -303,10 +303,10 @@ func (s *Scanner) ScanLog(ctx context.Context, foundCert func(*ct.RawLogEntry),
 		return -1, err
 	}
 
-	glog.V(1).Infof("Completed %d certs in %s", atomic.LoadInt64(&s.certsProcessed), humanTime(time.Since(startTime)))
-	glog.V(1).Infof("Saw %d precerts", atomic.LoadInt64(&s.precertsSeen))
-	glog.V(1).Infof("Saw %d unparsable entries", atomic.LoadInt64(&s.unparsableEntries))
-	glog.V(1).Infof("Saw %d non-fatal errors", atomic.LoadInt64(&s.entriesWithNonFatalErrors))
+	klog.V(1).Infof("Completed %d certs in %s", atomic.LoadInt64(&s.certsProcessed), humanTime(time.Since(startTime)))
+	klog.V(1).Infof("Saw %d precerts", atomic.LoadInt64(&s.precertsSeen))
+	klog.V(1).Infof("Saw %d unparsable entries", atomic.LoadInt64(&s.unparsableEntries))
+	klog.V(1).Infof("Saw %d non-fatal errors", atomic.LoadInt64(&s.entriesWithNonFatalErrors))
 
 	return int64(s.fetcher.opts.EndIndex), nil
 }
diff --git a/submission/distributor.go b/submission/distributor.go
index 7ce60cf6e1..81cdd69f48 100644
--- a/submission/distributor.go
+++ b/submission/distributor.go
@@ -23,7 +23,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/ctpolicy"
 	"github.com/google/certificate-transparency-go/jsonclient"
@@ -32,6 +31,7 @@ import (
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
 	"github.com/google/trillian/monitoring"
+	"k8s.io/klog/v2"
 
 	ct "github.com/google/certificate-transparency-go"
 )
@@ -192,13 +192,13 @@ func incErrCounter(logURL string, endpoint string, rspErr error) {
 	err, ok := rspErr.(client.RspError)
 	switch {
 	case !ok:
-		glog.Errorf("unknown_error (%s, %s) => %v", logURL, endpoint, rspErr)
+		klog.Errorf("unknown_error (%s, %s) => %v", logURL, endpoint, rspErr)
 		errCounter.Inc(logURL, endpoint, "unknown_error")
 	case err.Err != nil && err.StatusCode == http.StatusOK:
-		glog.Errorf("invalid_sct (%s, %s) => HTTP details: status=%d, body:\n%s", logURL, endpoint, err.StatusCode, err.Body)
+		klog.Errorf("invalid_sct (%s, %s) => HTTP details: status=%d, body:\n%s", logURL, endpoint, err.StatusCode, err.Body)
 		errCounter.Inc(logURL, endpoint, "invalid_sct")
 	case err.Err != nil: // err.StatusCode != http.StatusOK.
-		glog.Errorf("connection_error (%s, %s) => HTTP details: status=%d, body:\n%s", logURL, endpoint, err.StatusCode, err.Body)
+		klog.Errorf("connection_error (%s, %s) => HTTP details: status=%d, body:\n%s", logURL, endpoint, err.StatusCode, err.Body)
 		errCounter.Inc(logURL, endpoint, "connection_error")
 	}
 }
diff --git a/submission/distributor_test.go b/submission/distributor_test.go
index 7080840152..aa17d8eed6 100644
--- a/submission/distributor_test.go
+++ b/submission/distributor_test.go
@@ -23,7 +23,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/ctpolicy"
 	"github.com/google/certificate-transparency-go/loglist3"
@@ -34,6 +33,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/trillian/monitoring"
+	"k8s.io/klog/v2"
 )
 
 func newLocalStubLogClient(log *loglist3.Log) (client.AddLogClient, error) {
@@ -54,7 +54,7 @@ func ExampleDistributor() {
 	refresh := make(chan struct{})
 	go schedule.Every(ctx, time.Hour, func(ctx context.Context) {
 		if errs := d.RefreshRoots(ctx); len(errs) > 0 {
-			glog.Error(errs)
+			klog.Error(errs)
 		}
 		refresh <- struct{}{}
 	})
diff --git a/submission/proxy.go b/submission/proxy.go
index 25284458f5..c3be65be56 100644
--- a/submission/proxy.go
+++ b/submission/proxy.go
@@ -21,7 +21,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/asn1"
 	"github.com/google/certificate-transparency-go/ctpolicy"
@@ -30,6 +29,7 @@ import (
 	"github.com/google/certificate-transparency-go/tls"
 	"github.com/google/certificate-transparency-go/x509util"
 	"github.com/google/trillian/monitoring"
+	"k8s.io/klog/v2"
 )
 
 // CTPolicyType indicates CT-policy used for certificate submission.
@@ -144,14 +144,14 @@ func (p *Proxy) Run(ctx context.Context, llRefresh time.Duration, rootsRefresh t
 			case llData := <-p.llWatcher.LLUpdates:
 				logListUpdates.Inc()
 				if err := p.restartDistributor(ctx, llData.List); err != nil {
-					glog.Errorf("Unable to use Log-list:\n %v\n %v", err, llData.JSON)
+					klog.Errorf("Unable to use Log-list:\n %v\n %v", err, llData.JSON)
 				} else if !init {
 					init = true
 					p.Init <- true
 					close(p.Init)
 				}
 			case err := <-p.llWatcher.Errors:
-				glog.Error(err)
+				klog.Error(err)
 			}
 		}
 	}()
@@ -171,7 +171,7 @@ func (p *Proxy) restartDistributor(ctx context.Context, ll *loglist3.LogList) er
 	go schedule.Every(refreshCtx, p.rootsRefreshInterval, func(ectx context.Context) {
 		if errs := d.RefreshRoots(ectx); len(errs) > 0 {
 			for _, err := range errs {
-				glog.Warning(err)
+				klog.Warning(err)
 			}
 		}
 	})
diff --git a/submission/server/main.go b/submission/server/main.go
index 1282becc02..9260789749 100644
--- a/submission/server/main.go
+++ b/submission/server/main.go
@@ -23,10 +23,10 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/submission"
 	"github.com/google/trillian/monitoring/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"k8s.io/klog/v2"
 )
 
 // Flags.
@@ -47,11 +47,12 @@ func parsePolicyType() submission.CTPolicyType {
 	} else if *policyType == "apple" {
 		return submission.AppleCTPolicy
 	}
-	glog.Fatalf("flag policyType does not support value %q", *policyType)
+	klog.Fatalf("flag policyType does not support value %q", *policyType)
 	return submission.ChromeCTPolicy
 }
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 
 	plc := parsePolicyType()
diff --git a/trillian/ctfe/config.go b/trillian/ctfe/config.go
index ed40a543ec..4656c288fe 100644
--- a/trillian/ctfe/config.go
+++ b/trillian/ctfe/config.go
@@ -21,12 +21,12 @@ import (
 	"os"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/trillian/ctfe/configpb"
 	"github.com/google/certificate-transparency-go/x509"
 	"google.golang.org/protobuf/encoding/prototext"
 	"google.golang.org/protobuf/proto"
+	"k8s.io/klog/v2"
 )
 
 // ValidatedLogConfig represents the LogConfig with the information that has
@@ -152,7 +152,7 @@ func ValidateLogConfig(cfg *configpb.LogConfig) (*ValidatedLogConfig, error) {
 				// If "Any" is specified, then we can ignore the entire list and
 				// just disable EKU checking.
 				if ku == x509.ExtKeyUsageAny {
-					glog.Infof("%s: Found ExtKeyUsageAny, allowing all EKUs", cfg.Prefix)
+					klog.Infof("%s: Found ExtKeyUsageAny, allowing all EKUs", cfg.Prefix)
 					vCfg.KeyUsages = nil
 					break
 				}
diff --git a/trillian/ctfe/ct_server/main.go b/trillian/ctfe/ct_server/main.go
index 5472b21b22..7e099584a7 100644
--- a/trillian/ctfe/ct_server/main.go
+++ b/trillian/ctfe/ct_server/main.go
@@ -28,7 +28,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/trillian/ctfe"
 	"github.com/google/certificate-transparency-go/trillian/ctfe/configpb"
 	"github.com/google/trillian"
@@ -48,6 +47,7 @@ import (
 	"google.golang.org/grpc/resolver"
 	"google.golang.org/grpc/resolver/manual"
 	"google.golang.org/protobuf/proto"
+	"k8s.io/klog/v2"
 )
 
 // Global flags that affect all log instances.
@@ -76,6 +76,7 @@ const unknownRemoteUser = "UNKNOWN_REMOTE"
 
 // nolint:staticcheck
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 	ctx := context.Background()
 
@@ -108,16 +109,16 @@ func main() {
 	}
 
 	if err != nil {
-		glog.Exitf("Failed to read config: %v", err)
+		klog.Exitf("Failed to read config: %v", err)
 	}
 
 	beMap, err := ctfe.ValidateLogMultiConfig(cfg)
 	if err != nil {
-		glog.Exitf("Invalid config: %v", err)
+		klog.Exitf("Invalid config: %v", err)
 	}
 
-	glog.CopyStandardLogTo("WARNING")
-	glog.Info("**** CT HTTP Server Starting ****")
+	klog.CopyStandardLogTo("WARNING")
+	klog.Info("**** CT HTTP Server Starting ****")
 
 	metricsAt := *metricsEndpoint
 	if metricsAt == "" {
@@ -130,36 +131,36 @@ func main() {
 		cfg := clientv3.Config{Endpoints: strings.Split(*etcdServers, ","), DialTimeout: 5 * time.Second}
 		client, err := clientv3.New(cfg)
 		if err != nil {
-			glog.Exitf("Failed to connect to etcd at %v: %v", *etcdServers, err)
+			klog.Exitf("Failed to connect to etcd at %v: %v", *etcdServers, err)
 		}
 
 		httpManager, err := endpoints.NewManager(client, *etcdHTTPService)
 		if err != nil {
-			glog.Exitf("Failed to create etcd http manager: %v", err)
+			klog.Exitf("Failed to create etcd http manager: %v", err)
 		}
 		metricsManager, err := endpoints.NewManager(client, *etcdMetricsService)
 		if err != nil {
-			glog.Exitf("Failed to create etcd metrics manager: %v", err)
+			klog.Exitf("Failed to create etcd metrics manager: %v", err)
 		}
 
 		etcdHTTPKey := fmt.Sprintf("%s/%s", *etcdHTTPService, *httpEndpoint)
-		glog.Infof("Announcing our presence at %v with %+v", etcdHTTPKey, *httpEndpoint)
+		klog.Infof("Announcing our presence at %v with %+v", etcdHTTPKey, *httpEndpoint)
 		httpManager.AddEndpoint(ctx, etcdHTTPKey, endpoints.Endpoint{Addr: *httpEndpoint})
 
 		etcdMetricsKey := fmt.Sprintf("%s/%s", *etcdMetricsService, metricsAt)
-		glog.Infof("Announcing our presence in %v with %+v", *etcdMetricsService, metricsAt)
+		klog.Infof("Announcing our presence in %v with %+v", *etcdMetricsService, metricsAt)
 		metricsManager.AddEndpoint(ctx, etcdMetricsKey, endpoints.Endpoint{Addr: metricsAt})
 
 		defer func() {
-			glog.Infof("Removing our presence in %v", etcdHTTPKey)
+			klog.Infof("Removing our presence in %v", etcdHTTPKey)
 			httpManager.DeleteEndpoint(ctx, etcdHTTPKey)
-			glog.Infof("Removing our presence in %v", etcdMetricsKey)
+			klog.Infof("Removing our presence in %v", etcdMetricsKey)
 			metricsManager.DeleteEndpoint(ctx, etcdMetricsKey)
 		}()
 	} else if strings.Contains(*rpcBackend, ",") {
 		// This should probably not be used in production. Either use etcd or a gRPC
 		// load balancer. It's only used by the integration tests.
-		glog.Warning("Multiple RPC backends from flags not recommended for production. Should probably be using etcd or a gRPC load balancer / proxy.")
+		klog.Warning("Multiple RPC backends from flags not recommended for production. Should probably be using etcd or a gRPC load balancer / proxy.")
 		res := manual.NewBuilderWithScheme("whatever")
 		backends := strings.Split(*rpcBackend, ",")
 		addrs := make([]resolver.Address, 0, len(backends))
@@ -170,14 +171,14 @@ func main() {
 		resolver.SetDefaultScheme(res.Scheme())
 		dialOpts = append(dialOpts, grpc.WithDefaultServiceConfig(`{"loadBalancingConfig": [{"round_robin":{}}]}`), grpc.WithResolvers(res))
 	} else {
-		glog.Infof("Using regular DNS resolver")
+		klog.Infof("Using regular DNS resolver")
 		dialOpts = append(dialOpts, grpc.WithDefaultServiceConfig(`{"loadBalancingConfig": [{"round_robin":{}}]}`))
 	}
 
 	// Dial all our log backends.
 	clientMap := make(map[string]trillian.TrillianLogClient)
 	for _, be := range beMap {
-		glog.Infof("Dialling backend: %v", be)
+		klog.Infof("Dialling backend: %v", be)
 		if len(beMap) == 1 {
 			// If there's only one of them we use the blocking option as we can't
 			// serve anything until connected.
@@ -185,7 +186,7 @@ func main() {
 		}
 		conn, err := grpc.Dial(be.BackendSpec, dialOpts...)
 		if err != nil {
-			glog.Exitf("Could not dial RPC server: %v: %v", be, err)
+			klog.Exitf("Could not dial RPC server: %v: %v", be, err)
 		}
 		defer conn.Close()
 		clientMap[be.Name] = trillian.NewTrillianLogClient(conn)
@@ -203,7 +204,7 @@ func main() {
 	for _, c := range cfg.LogConfigs.Config {
 		inst, err := setupAndRegister(ctx, clientMap[c.LogBackendName], *rpcDeadline, c, corsMux, *handlerPrefix, *maskInternalErrors)
 		if err != nil {
-			glog.Exitf("Failed to set up log instance for %+v: %v", cfg, err)
+			klog.Exitf("Failed to set up log instance for %+v: %v", cfg, err)
 		}
 		if *getSTHInterval > 0 {
 			go inst.RunUpdateSTH(ctx, *getSTHInterval)
@@ -232,7 +233,7 @@ func main() {
 			mux.Handle("/metrics", promhttp.Handler())
 			metricsServer := http.Server{Addr: metricsAt, Handler: mux}
 			err := metricsServer.ListenAndServe()
-			glog.Warningf("Metrics server exited: %v", err)
+			klog.Warningf("Metrics server exited: %v", err)
 		}()
 	} else {
 		// Handle metrics on the DefaultServeMux.
@@ -244,7 +245,7 @@ func main() {
 	if *tracing {
 		handler, err = opencensus.EnableHTTPServerTracing(*tracingProjectID, *tracingPercent)
 		if err != nil {
-			glog.Exitf("Failed to initialize stackdriver / opencensus tracing: %v", err)
+			klog.Exitf("Failed to initialize stackdriver / opencensus tracing: %v", err)
 		}
 	}
 
@@ -257,19 +258,19 @@ func main() {
 		// Allow 60s for any pending requests to finish then terminate any stragglers
 		ctx, cancel := context.WithTimeout(context.Background(), time.Second*60)
 		defer cancel()
-		glog.Info("Shutting down HTTP server...")
+		klog.Info("Shutting down HTTP server...")
 		srv.Shutdown(ctx)
-		glog.Info("HTTP server shutdown")
+		klog.Info("HTTP server shutdown")
 	})
 
 	err = srv.ListenAndServe()
 	if err != http.ErrServerClosed {
-		glog.Warningf("Server exited: %v", err)
+		klog.Warningf("Server exited: %v", err)
 	}
 	// Wait will only block if the function passed to awaitSignal was called,
 	// in which case it'll block until the HTTP server has gracefully shutdown
 	shutdownWG.Wait()
-	glog.Flush()
+	klog.Flush()
 }
 
 // awaitSignal waits for standard termination signals, then runs the given
@@ -281,8 +282,8 @@ func awaitSignal(doneFn func()) {
 
 	// Now block main and wait for a signal
 	sig := <-sigs
-	glog.Warningf("Signal received: %v", sig)
-	glog.Flush()
+	klog.Warningf("Signal received: %v", sig)
+	klog.Flush()
 
 	doneFn()
 }
@@ -302,7 +303,7 @@ func setupAndRegister(ctx context.Context, client trillian.TrillianLogClient, de
 		MaskInternalErrors: maskInternalErrors,
 	}
 	if *quotaRemote {
-		glog.Info("Enabling quota for requesting IP")
+		klog.Info("Enabling quota for requesting IP")
 		opts.RemoteQuotaUser = func(r *http.Request) string {
 			var remoteUser = realip.FromRequest(r)
 			if len(remoteUser) == 0 {
@@ -312,7 +313,7 @@ func setupAndRegister(ctx context.Context, client trillian.TrillianLogClient, de
 		}
 	}
 	if *quotaIntermediate {
-		glog.Info("Enabling quota for intermediate certificates")
+		klog.Info("Enabling quota for intermediate certificates")
 		opts.CertificateQuotaUser = ctfe.QuotaUserForCert
 	}
 	// Full handler pattern will be of the form "/logs/yyz/ct/v1/add-chain", where "/logs" is the
@@ -324,7 +325,7 @@ func setupAndRegister(ctx context.Context, client trillian.TrillianLogClient, de
 	// log is at "/log/..." this is now supported.
 	lhp := globalHandlerPrefix
 	if ohPrefix := cfg.OverrideHandlerPrefix; len(ohPrefix) > 0 {
-		glog.Infof("Log with prefix: %s is using a custom HandlerPrefix: %s", cfg.Prefix, ohPrefix)
+		klog.Infof("Log with prefix: %s is using a custom HandlerPrefix: %s", cfg.Prefix, ohPrefix)
 		lhp = "/" + strings.Trim(ohPrefix, "/")
 	}
 	inst, err := ctfe.SetUpInstance(ctx, opts)
diff --git a/trillian/ctfe/handlers.go b/trillian/ctfe/handlers.go
index a6ac346258..d51794e821 100644
--- a/trillian/ctfe/handlers.go
+++ b/trillian/ctfe/handlers.go
@@ -30,7 +30,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/asn1"
 	"github.com/google/certificate-transparency-go/tls"
 	"github.com/google/certificate-transparency-go/trillian/util"
@@ -42,6 +41,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/prototext"
+	"k8s.io/klog/v2"
 
 	ct "github.com/google/certificate-transparency-go"
 )
@@ -166,9 +166,9 @@ func (a AppHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		latency := a.Info.TimeSource.Now().Sub(startTime).Seconds()
 		rspLatency.Observe(latency, label0, label1, strconv.Itoa(statusCode))
 	}()
-	glog.V(2).Infof("%s: request %v %q => %s", a.Info.LogPrefix, r.Method, r.URL, a.Name)
+	klog.V(2).Infof("%s: request %v %q => %s", a.Info.LogPrefix, r.Method, r.URL, a.Name)
 	if r.Method != a.Method {
-		glog.Warningf("%s: %s wrong HTTP method: %v", a.Info.LogPrefix, a.Name, r.Method)
+		klog.Warningf("%s: %s wrong HTTP method: %v", a.Info.LogPrefix, a.Name, r.Method)
 		a.Info.SendHTTPError(w, http.StatusMethodNotAllowed, fmt.Errorf("method not allowed: %s", r.Method))
 		a.Info.RequestLog.Status(logCtx, http.StatusMethodNotAllowed)
 		return
@@ -192,17 +192,17 @@ func (a AppHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	var err error
 	statusCode, err = a.Handler(ctx, a.Info, w, r)
 	a.Info.RequestLog.Status(ctx, statusCode)
-	glog.V(2).Infof("%s: %s <= st=%d", a.Info.LogPrefix, a.Name, statusCode)
+	klog.V(2).Infof("%s: %s <= st=%d", a.Info.LogPrefix, a.Name, statusCode)
 	rspsCounter.Inc(label0, label1, strconv.Itoa(statusCode))
 	if err != nil {
-		glog.Warningf("%s: %s handler error: %v", a.Info.LogPrefix, a.Name, err)
+		klog.Warningf("%s: %s handler error: %v", a.Info.LogPrefix, a.Name, err)
 		a.Info.SendHTTPError(w, statusCode, err)
 		return
 	}
 
 	// Additional check, for consistency the handler must return an error for non-200 st
 	if statusCode != http.StatusOK {
-		glog.Warningf("%s: %s handler non 200 without error: %d %v", a.Info.LogPrefix, a.Name, statusCode, err)
+		klog.Warningf("%s: %s handler non 200 without error: %d %v", a.Info.LogPrefix, a.Name, statusCode, err)
 		a.Info.SendHTTPError(w, http.StatusInternalServerError, fmt.Errorf("http handler misbehaved, st: %d", statusCode))
 		return
 	}
@@ -377,19 +377,19 @@ func (li *logInfo) getSTH(ctx context.Context) (*ct.SignedTreeHead, error) {
 func ParseBodyAsJSONChain(r *http.Request) (ct.AddChainRequest, error) {
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
-		glog.V(1).Infof("Failed to read request body: %v", err)
+		klog.V(1).Infof("Failed to read request body: %v", err)
 		return ct.AddChainRequest{}, err
 	}
 
 	var req ct.AddChainRequest
 	if err := json.Unmarshal(body, &req); err != nil {
-		glog.V(1).Infof("Failed to parse request body: %v", err)
+		klog.V(1).Infof("Failed to parse request body: %v", err)
 		return ct.AddChainRequest{}, err
 	}
 
 	// The cert chain is not allowed to be empty. We'll defer other validation for later
 	if len(req.Chain) == 0 {
-		glog.V(1).Infof("Request chain is empty: %s", body)
+		klog.V(1).Infof("Request chain is empty: %s", body)
 		return ct.AddChainRequest{}, errors.New("cert chain was empty")
 	}
 
@@ -473,9 +473,9 @@ func addChainInternal(ctx context.Context, li *logInfo, w http.ResponseWriter, r
 		}
 	}
 
-	glog.V(2).Infof("%s: %s => grpc.QueueLeaves", li.LogPrefix, method)
+	klog.V(2).Infof("%s: %s => grpc.QueueLeaves", li.LogPrefix, method)
 	rsp, err := li.rpcClient.QueueLeaf(ctx, &req)
-	glog.V(2).Infof("%s: %s <= grpc.QueueLeaves err=%v", li.LogPrefix, method, err)
+	klog.V(2).Infof("%s: %s <= grpc.QueueLeaves err=%v", li.LogPrefix, method, err)
 	if err != nil {
 		return li.toHTTPStatus(err), fmt.Errorf("backend QueueLeaves request failed: %s", err)
 	}
@@ -511,7 +511,7 @@ func addChainInternal(ctx context.Context, li *logInfo, w http.ResponseWriter, r
 		// reason is logged and http status is already set
 		return http.StatusInternalServerError, fmt.Errorf("failed to write response: %s", err)
 	}
-	glog.V(3).Infof("%s: %s <= SCT", li.LogPrefix, method)
+	klog.V(3).Infof("%s: %s <= SCT", li.LogPrefix, method)
 	if sct.Timestamp == timeMillis {
 		lastSCTTimestamp.Set(float64(sct.Timestamp), strconv.FormatInt(li.logID, 10))
 	}
@@ -588,9 +588,9 @@ func getSTHConsistency(ctx context.Context, li *logInfo, w http.ResponseWriter,
 			ChargeTo:       li.chargeUser(r),
 		}
 
-		glog.V(2).Infof("%s: GetSTHConsistency(%d, %d) => grpc.GetConsistencyProof %+v", li.LogPrefix, first, second, prototext.Format(&req))
+		klog.V(2).Infof("%s: GetSTHConsistency(%d, %d) => grpc.GetConsistencyProof %+v", li.LogPrefix, first, second, prototext.Format(&req))
 		rsp, err := li.rpcClient.GetConsistencyProof(ctx, &req)
-		glog.V(2).Infof("%s: GetSTHConsistency <= grpc.GetConsistencyProof err=%v", li.LogPrefix, err)
+		klog.V(2).Infof("%s: GetSTHConsistency <= grpc.GetConsistencyProof err=%v", li.LogPrefix, err)
 		if err != nil {
 			return li.toHTTPStatus(err), fmt.Errorf("backend GetConsistencyProof request failed: %s", err)
 		}
@@ -615,7 +615,7 @@ func getSTHConsistency(ctx context.Context, li *logInfo, w http.ResponseWriter,
 			jsonRsp.Consistency = emptyProof
 		}
 	} else {
-		glog.V(2).Infof("%s: GetSTHConsistency(%d, %d) starts from 0 so return empty proof", li.LogPrefix, first, second)
+		klog.V(2).Infof("%s: GetSTHConsistency(%d, %d) starts from 0 so return empty proof", li.LogPrefix, first, second)
 		jsonRsp.Consistency = emptyProof
 	}
 
@@ -702,7 +702,7 @@ func getProofByHash(ctx context.Context, li *logInfo, w http.ResponseWriter, r *
 	w.Header().Set(contentTypeHeader, contentTypeJSON)
 	jsonData, err := json.Marshal(&proofRsp)
 	if err != nil {
-		glog.Warningf("%s: Failed to marshal get-proof-by-hash resp: %v", li.LogPrefix, proofRsp)
+		klog.Warningf("%s: Failed to marshal get-proof-by-hash resp: %v", li.LogPrefix, proofRsp)
 		return http.StatusInternalServerError, fmt.Errorf("failed to marshal get-proof-by-hash resp: %s", err)
 	}
 
@@ -796,7 +796,7 @@ func getRoots(_ context.Context, li *logInfo, w http.ResponseWriter, _ *http.Req
 	enc := json.NewEncoder(w)
 	err := enc.Encode(jsonMap)
 	if err != nil {
-		glog.Warningf("%s: get_roots failed: %v", li.LogPrefix, err)
+		klog.Warningf("%s: get_roots failed: %v", li.LogPrefix, err)
 		return http.StatusInternalServerError, fmt.Errorf("get-roots failed with: %s", err)
 	}
 
@@ -891,9 +891,9 @@ func verifyAddChain(li *logInfo, req ct.AddChainRequest, expectingPrecert bool)
 	// The type of the leaf must match the one the handler expects
 	if isPrecert != expectingPrecert {
 		if expectingPrecert {
-			glog.Warningf("%s: Cert (or precert with invalid CT ext) submitted as precert chain: %x", li.LogPrefix, req.Chain)
+			klog.Warningf("%s: Cert (or precert with invalid CT ext) submitted as precert chain: %x", li.LogPrefix, req.Chain)
 		} else {
-			glog.Warningf("%s: Precert (or cert with invalid CT ext) submitted as cert chain: %x", li.LogPrefix, req.Chain)
+			klog.Warningf("%s: Precert (or cert with invalid CT ext) submitted as cert chain: %x", li.LogPrefix, req.Chain)
 		}
 		return nil, fmt.Errorf("cert / precert mismatch: %T", expectingPrecert)
 	}
@@ -1054,14 +1054,14 @@ func marshalGetEntriesResponse(li *logInfo, leaves []*trillian.LogLeaf) (ct.GetE
 		// or data storage that should be investigated.
 		var treeLeaf ct.MerkleTreeLeaf
 		if rest, err := tls.Unmarshal(leaf.LeafValue, &treeLeaf); err != nil {
-			glog.Errorf("%s: Failed to deserialize Merkle leaf from backend: %d", li.LogPrefix, leaf.LeafIndex)
+			klog.Errorf("%s: Failed to deserialize Merkle leaf from backend: %d", li.LogPrefix, leaf.LeafIndex)
 		} else if len(rest) > 0 {
-			glog.Errorf("%s: Trailing data after Merkle leaf from backend: %d", li.LogPrefix, leaf.LeafIndex)
+			klog.Errorf("%s: Trailing data after Merkle leaf from backend: %d", li.LogPrefix, leaf.LeafIndex)
 		}
 
 		extraData := leaf.ExtraData
 		if len(extraData) == 0 {
-			glog.Errorf("%s: Missing ExtraData for leaf %d", li.LogPrefix, leaf.LeafIndex)
+			klog.Errorf("%s: Missing ExtraData for leaf %d", li.LogPrefix, leaf.LeafIndex)
 		}
 		jsonRsp.Entries = append(jsonRsp.Entries, ct.LeafEntry{
 			LeafInput: leaf.LeafValue,
diff --git a/trillian/ctfe/handlers_test.go b/trillian/ctfe/handlers_test.go
index 43ac23b6cd..abf485ca14 100644
--- a/trillian/ctfe/handlers_test.go
+++ b/trillian/ctfe/handlers_test.go
@@ -32,7 +32,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/golang/mock/gomock"
 	"github.com/google/certificate-transparency-go/tls"
 	"github.com/google/certificate-transparency-go/trillian/mockclient"
@@ -49,6 +48,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
+	"k8s.io/klog/v2"
 
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/trillian/ctfe/configpb"
@@ -169,7 +169,7 @@ func setupTest(t *testing.T, pemRoots []string, signer crypto.Signer) handlerTes
 
 	for _, pemRoot := range pemRoots {
 		if !info.roots.AppendCertsFromPEM([]byte(pemRoot)) {
-			glog.Fatal("failed to load cert pool")
+			klog.Fatal("failed to load cert pool")
 		}
 	}
 
diff --git a/trillian/ctfe/instance.go b/trillian/ctfe/instance.go
index c717afdd29..918880d6d0 100644
--- a/trillian/ctfe/instance.go
+++ b/trillian/ctfe/instance.go
@@ -24,7 +24,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/asn1"
 	"github.com/google/certificate-transparency-go/schedule"
 	"github.com/google/certificate-transparency-go/trillian/util"
@@ -33,6 +32,7 @@ import (
 	"github.com/google/trillian"
 	"github.com/google/trillian/crypto/keys"
 	"github.com/google/trillian/monitoring"
+	"k8s.io/klog/v2"
 )
 
 // InstanceOptions describes the options for a log instance.
@@ -83,11 +83,11 @@ type Instance struct {
 // up-to-date with any tree head changes that are not triggered by us.
 func (i *Instance) RunUpdateSTH(ctx context.Context, period time.Duration) {
 	c := i.li.instanceOpts.Validated.Config
-	glog.Infof("Start internal get-sth operations on %v (%d)", c.Prefix, c.LogId)
+	klog.Infof("Start internal get-sth operations on %v (%d)", c.Prefix, c.LogId)
 	schedule.Every(ctx, period, func(ctx context.Context) {
-		glog.V(1).Infof("Force internal get-sth for %v (%d)", c.Prefix, c.LogId)
+		klog.V(1).Infof("Force internal get-sth for %v (%d)", c.Prefix, c.LogId)
 		if _, err := i.li.getSTH(ctx); err != nil {
-			glog.Warningf("Failed to retrieve STH for %v (%d): %v", c.Prefix, c.LogId, err)
+			klog.Warningf("Failed to retrieve STH for %v (%d): %v", c.Prefix, c.LogId, err)
 		}
 	})
 }
diff --git a/trillian/ctfe/requestlog.go b/trillian/ctfe/requestlog.go
index 8b18bdac5a..7a3497748b 100644
--- a/trillian/ctfe/requestlog.go
+++ b/trillian/ctfe/requestlog.go
@@ -18,9 +18,9 @@ import (
 	"context"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 const vLevel = 9
@@ -81,24 +81,24 @@ type DefaultRequestLog struct {
 
 // Start logs the start of request processing.
 func (dlr *DefaultRequestLog) Start(ctx context.Context) context.Context {
-	glog.V(vLevel).Info("RL: Start")
+	klog.V(vLevel).Info("RL: Start")
 	return ctx
 }
 
 // LogPrefix logs the prefix of the CT log that this request is for.
 func (dlr *DefaultRequestLog) LogPrefix(_ context.Context, p string) {
-	glog.V(vLevel).Infof("RL: LogPrefix: %s", p)
+	klog.V(vLevel).Infof("RL: LogPrefix: %s", p)
 }
 
 // AddDERToChain logs the raw bytes of a submitted certificate.
 func (dlr *DefaultRequestLog) AddDERToChain(_ context.Context, d []byte) {
-	glog.V(vLevel).Infof("RL: Cert DER: %x", d)
+	klog.V(vLevel).Infof("RL: Cert DER: %x", d)
 }
 
 // AddCertToChain logs some issuer / subject / timing fields from a
 // certificate that is part of a submitted chain.
 func (dlr *DefaultRequestLog) AddCertToChain(_ context.Context, cert *x509.Certificate) {
-	glog.V(vLevel).Infof("RL: Cert: Sub: %s Iss: %s notBef: %s notAft: %s",
+	klog.V(vLevel).Infof("RL: Cert: Sub: %s Iss: %s notBef: %s notAft: %s",
 		x509util.NameToString(cert.Subject),
 		x509util.NameToString(cert.Issuer),
 		cert.NotBefore.Format(time.RFC1123Z),
@@ -107,35 +107,35 @@ func (dlr *DefaultRequestLog) AddCertToChain(_ context.Context, cert *x509.Certi
 
 // FirstAndSecond logs request parameters.
 func (dlr *DefaultRequestLog) FirstAndSecond(_ context.Context, f, s int64) {
-	glog.V(vLevel).Infof("RL: First: %d Second: %d", f, s)
+	klog.V(vLevel).Infof("RL: First: %d Second: %d", f, s)
 }
 
 // StartAndEnd logs request parameters.
 func (dlr *DefaultRequestLog) StartAndEnd(_ context.Context, s, e int64) {
-	glog.V(vLevel).Infof("RL: Start: %d End: %d", s, e)
+	klog.V(vLevel).Infof("RL: Start: %d End: %d", s, e)
 }
 
 // LeafIndex logs request parameters.
 func (dlr *DefaultRequestLog) LeafIndex(_ context.Context, li int64) {
-	glog.V(vLevel).Infof("RL: LeafIndex: %d", li)
+	klog.V(vLevel).Infof("RL: LeafIndex: %d", li)
 }
 
 // TreeSize logs request parameters.
 func (dlr *DefaultRequestLog) TreeSize(_ context.Context, ts int64) {
-	glog.V(vLevel).Infof("RL: TreeSize: %d", ts)
+	klog.V(vLevel).Infof("RL: TreeSize: %d", ts)
 }
 
 // LeafHash logs request parameters.
 func (dlr *DefaultRequestLog) LeafHash(_ context.Context, lh []byte) {
-	glog.V(vLevel).Infof("RL: LeafHash: %x", lh)
+	klog.V(vLevel).Infof("RL: LeafHash: %x", lh)
 }
 
 // IssueSCT logs an SCT that will be issued to a client.
 func (dlr *DefaultRequestLog) IssueSCT(_ context.Context, sct []byte) {
-	glog.V(vLevel).Infof("RL: Issuing SCT: %x", sct)
+	klog.V(vLevel).Infof("RL: Issuing SCT: %x", sct)
 }
 
 // Status logs the response HTTP status code after processing completes.
 func (dlr *DefaultRequestLog) Status(_ context.Context, s int) {
-	glog.V(vLevel).Infof("RL: Status: %d", s)
+	klog.V(vLevel).Infof("RL: Status: %d", s)
 }
diff --git a/trillian/ctfe/sth.go b/trillian/ctfe/sth.go
index ac3aac3439..db2a9a54c4 100644
--- a/trillian/ctfe/sth.go
+++ b/trillian/ctfe/sth.go
@@ -20,11 +20,11 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/trillian"
 	"github.com/google/trillian/types"
 	"google.golang.org/protobuf/encoding/prototext"
+	"k8s.io/klog/v2"
 )
 
 type contextKey string
@@ -129,9 +129,9 @@ func getSignedLogRoot(ctx context.Context, client trillian.TrillianLogClient, lo
 		req.ChargeTo = appendUserCharge(req.ChargeTo, quotaUser)
 	}
 
-	glog.V(2).Infof("%s: GetSTH => grpc.GetLatestSignedLogRoot %+v", prefix, prototext.Format(&req))
+	klog.V(2).Infof("%s: GetSTH => grpc.GetLatestSignedLogRoot %+v", prefix, prototext.Format(&req))
 	rsp, err := client.GetLatestSignedLogRoot(ctx, &req)
-	glog.V(2).Infof("%s: GetSTH <= grpc.GetLatestSignedLogRoot err=%v", prefix, err)
+	klog.V(2).Infof("%s: GetSTH <= grpc.GetLatestSignedLogRoot err=%v", prefix, err)
 	if err != nil {
 		return nil, err
 	}
@@ -141,7 +141,7 @@ func getSignedLogRoot(ctx context.Context, client trillian.TrillianLogClient, lo
 	if slr == nil {
 		return nil, errors.New("no log root returned")
 	}
-	glog.V(3).Infof("%s: GetSTH <= slr=%+v", prefix, slr)
+	klog.V(3).Infof("%s: GetSTH <= slr=%+v", prefix, slr)
 	var currentRoot types.LogRootV1
 	if err := currentRoot.UnmarshalBinary(slr.GetLogRoot()); err != nil {
 		return nil, fmt.Errorf("failed to unmarshal root: %v", slr)
diff --git a/trillian/docs/Operation.md b/trillian/docs/Operation.md
index ceff769dbf..2bf4d63887 100644
--- a/trillian/docs/Operation.md
+++ b/trillian/docs/Operation.md
@@ -139,11 +139,11 @@ disqualification.
 ## Troubleshooting
 
 All of the Trillian and CTFE binaries use the
-[glog](https://github.com/golang/glog) library for logging, so additional
-diagnostic information can be obtained by modifying the glog options, for
+[klog](https://github.com/kubernetes/klog) library for logging, so additional
+diagnostic information can be obtained by modifying the klog options, for
 example, by enabling `--logtostderr -v 1`.
 
-Other useful glog options for debugging specific problems are:
+Other useful klog options for debugging specific problems are:
 
  - `--vmodule`: increase the logging level selectively in particular
    code files.
diff --git a/trillian/integration/copier.go b/trillian/integration/copier.go
index 9fc9b8b8c8..ec4197d6ac 100644
--- a/trillian/integration/copier.go
+++ b/trillian/integration/copier.go
@@ -22,12 +22,12 @@ import (
 	"math/rand"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/scanner"
 	"github.com/google/certificate-transparency-go/trillian/ctfe/configpb"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 
 	ct "github.com/google/certificate-transparency-go"
 )
@@ -96,9 +96,9 @@ func NewCopyChainGeneratorFromOpts(ctx context.Context, client *client.LogClient
 			return nil, fmt.Errorf("failed to read trusted roots for target log: %v", err)
 		}
 	}
-	if glog.V(4) {
+	if klog.V(4).Enabled() {
 		for _, cert := range targetPool.RawCertificates() {
-			glog.Infof("target root cert: %x Subject: %v", sha256.Sum256(cert.Raw), cert.Subject)
+			klog.Infof("target root cert: %x Subject: %v", sha256.Sum256(cert.Raw), cert.Subject)
 		}
 	}
 
@@ -111,13 +111,13 @@ func NewCopyChainGeneratorFromOpts(ctx context.Context, client *client.LogClient
 	for _, root := range srcRoots {
 		cert, err := x509.ParseCertificate(root.Data)
 		if x509.IsFatal(err) {
-			glog.Warningf("Failed to parse root certificate from source log: %v", err)
+			klog.Warningf("Failed to parse root certificate from source log: %v", err)
 			continue
 		}
-		glog.V(4).Infof("source log root cert: %x Subject: %v", sha256.Sum256(cert.Raw), cert.Subject)
+		klog.V(4).Infof("source log root cert: %x Subject: %v", sha256.Sum256(cert.Raw), cert.Subject)
 		sourcePool.AddCert(cert)
 		if targetPool.Included(cert) {
-			glog.V(3).Infof("source log root cert is accepted by target: %x Subject: %v", sha256.Sum256(cert.Raw), cert.Subject)
+			klog.V(3).Infof("source log root cert is accepted by target: %x Subject: %v", sha256.Sum256(cert.Raw), cert.Subject)
 			seenOverlap = true
 		}
 	}
@@ -133,7 +133,7 @@ func NewCopyChainGeneratorFromOpts(ctx context.Context, client *client.LogClient
 			return nil, fmt.Errorf("failed to get STH for source log: %v", err)
 		}
 		startIndex = rand.Int63n(int64(sth.TreeSize))
-		glog.Infof("starting CopyChainGenerator from index %d (of %d) in source log", startIndex, sth.TreeSize)
+		klog.Infof("starting CopyChainGenerator from index %d (of %d) in source log", startIndex, sth.TreeSize)
 	}
 
 	generator := &CopyChainGenerator{
@@ -168,25 +168,25 @@ func NewCopyChainGeneratorFromOpts(ctx context.Context, client *client.LogClient
 // processBatch extracts chains of the desired type from a batch of entries and sends
 // them down the channel.  May block on the channel consumer.
 func (g *CopyChainGenerator) processBatch(batch scanner.EntryBatch, chains chan []ct.ASN1Cert, eType ct.LogEntryType) {
-	glog.V(2).Infof("processBatch(%d): examine batch [%d, %d)", eType, batch.Start, int(batch.Start)+len(batch.Entries))
+	klog.V(2).Infof("processBatch(%d): examine batch [%d, %d)", eType, batch.Start, int(batch.Start)+len(batch.Entries))
 	for i, entry := range batch.Entries {
 		index := batch.Start + int64(i)
 		entry, err := ct.RawLogEntryFromLeaf(index, &entry)
 		if err != nil {
-			glog.Errorf("processBatch(%d): failed to build raw log entry %d: %v", eType, index, err)
+			klog.Errorf("processBatch(%d): failed to build raw log entry %d: %v", eType, index, err)
 			continue
 		}
 		if entry.Leaf.TimestampedEntry.EntryType != eType {
-			glog.V(4).Infof("skip entry %d as EntryType=%d not %d", index, entry.Leaf.TimestampedEntry.EntryType, eType)
+			klog.V(4).Infof("skip entry %d as EntryType=%d not %d", index, entry.Leaf.TimestampedEntry.EntryType, eType)
 			continue
 		}
 		root, err := x509.ParseCertificate(entry.Chain[len(entry.Chain)-1].Data)
 		if err != nil {
-			glog.V(3).Infof("skip entry %d as its root cannot be parsed to check accepted: %v", index, err)
+			klog.V(3).Infof("skip entry %d as its root cannot be parsed to check accepted: %v", index, err)
 			continue
 		}
 		if !g.targetRoots.Included(root) {
-			glog.V(3).Infof("skip entry %d as its root is not accepted by target log", index)
+			klog.V(3).Infof("skip entry %d as its root is not accepted by target log", index)
 			continue
 		}
 		if !g.start.IsZero() || !g.limit.IsZero() {
@@ -194,15 +194,15 @@ func (g *CopyChainGenerator) processBatch(batch scanner.EntryBatch, chains chan
 			// whether it complies with them.
 			cert, err := x509.ParseCertificate(entry.Cert.Data)
 			if x509.IsFatal(err) {
-				glog.V(3).Infof("skip entry %d as its leaf cannot be parsed to check NotAfter: %v", index, err)
+				klog.V(3).Infof("skip entry %d as its leaf cannot be parsed to check NotAfter: %v", index, err)
 				continue
 			}
 			if !g.start.IsZero() && cert.NotAfter.Before(g.start) {
-				glog.V(3).Infof("skip entry %d as its NotAfter (%v) is before %v", index, cert.NotAfter, g.start)
+				klog.V(3).Infof("skip entry %d as its NotAfter (%v) is before %v", index, cert.NotAfter, g.start)
 				continue
 			}
 			if !g.limit.IsZero() && !cert.NotAfter.Before(g.limit) {
-				glog.V(3).Infof("skip entry %d as its NotAfter (%v) is after %v", index, cert.NotAfter, g.limit)
+				klog.V(3).Infof("skip entry %d as its NotAfter (%v) is after %v", index, cert.NotAfter, g.limit)
 				continue
 			}
 		}
diff --git a/trillian/integration/ct_hammer/main.go b/trillian/integration/ct_hammer/main.go
index a29b4ab487..e182f77cff 100644
--- a/trillian/integration/ct_hammer/main.go
+++ b/trillian/integration/ct_hammer/main.go
@@ -31,7 +31,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/fixchain/ratelimiter"
 	"github.com/google/certificate-transparency-go/jsonclient"
@@ -43,6 +42,7 @@ import (
 	"github.com/google/trillian/monitoring"
 	"github.com/google/trillian/monitoring/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -103,7 +103,7 @@ func newLimiter(rate int) integration.Limiter {
 func copierGeneratorFactory(ctx context.Context) integration.GeneratorFactory {
 	var tlsCfg *tls.Config
 	if *skipHTTPSVerify {
-		glog.Warning("Skipping HTTPS connection verification")
+		klog.Warning("Skipping HTTPS connection verification")
 		tlsCfg = &tls.Config{InsecureSkipVerify: *skipHTTPSVerify}
 	}
 	httpClient := &http.Client{
@@ -124,30 +124,30 @@ func copierGeneratorFactory(ctx context.Context) integration.GeneratorFactory {
 	if *srcPubKey != "" {
 		pubkey, err := os.ReadFile(*srcPubKey)
 		if err != nil {
-			glog.Exit(err)
+			klog.Exit(err)
 		}
 		opts.PublicKey = string(pubkey)
 	}
 	if len(*srcLogName) > 0 {
 		llData, err := x509util.ReadFileOrURL(*logList, httpClient)
 		if err != nil {
-			glog.Exitf("Failed to read log list: %v", err)
+			klog.Exitf("Failed to read log list: %v", err)
 		}
 		ll, err := loglist.NewFromJSON(llData)
 		if err != nil {
-			glog.Exitf("Failed to build log list: %v", err)
+			klog.Exitf("Failed to build log list: %v", err)
 		}
 
 		logs := ll.FindLogByName(*srcLogName)
 		if len(logs) == 0 {
-			glog.Exitf("No log with name like %q found in loglist %q", *srcLogName, *logList)
+			klog.Exitf("No log with name like %q found in loglist %q", *srcLogName, *logList)
 		}
 		if len(logs) > 1 {
 			logNames := make([]string, len(logs))
 			for i, log := range logs {
 				logNames[i] = fmt.Sprintf("%q", log.Description)
 			}
-			glog.Exitf("Multiple logs with name like %q found in loglist: %s", *srcLogName, strings.Join(logNames, ","))
+			klog.Exitf("Multiple logs with name like %q found in loglist: %s", *srcLogName, strings.Join(logNames, ","))
 		}
 		uri = "https://" + logs[0].URL
 		if opts.PublicKey == "" {
@@ -157,9 +157,9 @@ func copierGeneratorFactory(ctx context.Context) integration.GeneratorFactory {
 
 	logClient, err := client.New(uri, httpClient, opts)
 	if err != nil {
-		glog.Exitf("Failed to create client for %q: %v", uri, err)
+		klog.Exitf("Failed to create client for %q: %v", uri, err)
 	}
-	glog.Infof("Testing with certs copied from log at %s starting at index %d", uri, *startIndex)
+	klog.Infof("Testing with certs copied from log at %s starting at index %d", uri, *startIndex)
 	genOpts := integration.CopyChainOptions{
 		StartIndex:    *startIndex,
 		BufSize:       *chainBufSize,
@@ -172,9 +172,10 @@ func copierGeneratorFactory(ctx context.Context) integration.GeneratorFactory {
 }
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 	if *logConfig == "" {
-		glog.Exit("Test aborted as no log config provided (via --log_config)")
+		klog.Exit("Test aborted as no log config provided (via --log_config)")
 	}
 	if *seed == -1 {
 		*seed = time.Now().UTC().UnixNano() & 0xFFFFFFFF
@@ -184,7 +185,7 @@ func main() {
 
 	cfg, err := ctfe.LogConfigFromFile(*logConfig)
 	if err != nil {
-		glog.Exitf("Failed to read log config: %v", err)
+		klog.Exitf("Failed to read log config: %v", err)
 	}
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -196,15 +197,15 @@ func main() {
 	} else if *testDir != "" {
 		// Test cert chains will be generated as synthetic certs from a template.
 		// Retrieve the test data holding the template and key.
-		glog.Infof("Testing with synthetic certs based on data from %s", *testDir)
+		klog.Infof("Testing with synthetic certs based on data from %s", *testDir)
 		generatorFactory, err = integration.SyntheticGeneratorFactory(*testDir, *leafNotAfter)
 		if err != nil {
-			glog.Exitf("Failed to make cert generator: %v", err)
+			klog.Exitf("Failed to make cert generator: %v", err)
 		}
 	}
 
 	if generatorFactory == nil {
-		glog.Warningf("Warning: add-[pre-]chain operations disabled as no cert generation method available")
+		klog.Warningf("Warning: add-[pre-]chain operations disabled as no cert generation method available")
 		*addChainBias = 0
 		*addPreChainBias = 0
 		generatorFactory = func(c *configpb.LogConfig) (integration.ChainGenerator, error) {
@@ -240,10 +241,10 @@ func main() {
 		mf = prometheus.MetricFactory{}
 		http.Handle("/metrics", promhttp.Handler())
 		server := http.Server{Addr: *metricsEndpoint, Handler: nil}
-		glog.Infof("Serving metrics at %v", *metricsEndpoint)
+		klog.Infof("Serving metrics at %v", *metricsEndpoint)
 		go func() {
 			err := server.ListenAndServe()
-			glog.Warningf("Metrics server exited: %v", err)
+			klog.Warningf("Metrics server exited: %v", err)
 		}()
 	} else {
 		mf = monitoring.InertMetricFactory{}
@@ -274,7 +275,7 @@ func main() {
 		wg.Add(1)
 		pool, err := integration.NewRandomPool(*httpServers, c.PublicKey, c.Prefix)
 		if err != nil {
-			glog.Exitf("Failed to create client pool: %v", err)
+			klog.Exitf("Failed to create client pool: %v", err)
 		}
 
 		mmd := *mmd
@@ -286,7 +287,7 @@ func main() {
 
 		generator, err := generatorFactory(c)
 		if err != nil {
-			glog.Exitf("Failed to build chain generator: %v", err)
+			klog.Exitf("Failed to build chain generator: %v", err)
 		}
 
 		cfg := integration.HammerConfig{
@@ -316,17 +317,17 @@ func main() {
 	}
 	wg.Wait()
 
-	glog.Infof("completed tests on all %d logs:", len(cfg))
+	klog.Infof("completed tests on all %d logs:", len(cfg))
 	close(results)
 	errCount := 0
 	for e := range results {
 		if e.err != nil {
 			errCount++
-			glog.Errorf("  %s: failed with %v", e.prefix, e.err)
+			klog.Errorf("  %s: failed with %v", e.prefix, e.err)
 		}
 	}
 	if errCount > 0 {
-		glog.Exitf("non-zero error count (%d), exiting", errCount)
+		klog.Exitf("non-zero error count (%d), exiting", errCount)
 	}
-	glog.Info("  no errors; done")
+	klog.Info("  no errors; done")
 }
diff --git a/trillian/integration/hammer.go b/trillian/integration/hammer.go
index e26879a94c..4aa0b4b70c 100644
--- a/trillian/integration/hammer.go
+++ b/trillian/integration/hammer.go
@@ -25,7 +25,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/schedule"
 	"github.com/google/certificate-transparency-go/tls"
@@ -36,6 +35,7 @@ import (
 	"github.com/transparency-dev/merkle"
 	"github.com/transparency-dev/merkle/proof"
 	"github.com/transparency-dev/merkle/rfc6962"
+	"k8s.io/klog/v2"
 
 	ct "github.com/google/certificate-transparency-go"
 )
@@ -331,7 +331,7 @@ func newHammerState(cfg *HammerConfig) (*hammerState, error) {
 	}
 
 	if cfg.LogCfg.IsMirror {
-		glog.Warningf("%v: disabling add-[pre-]chain for mirror log", cfg.LogCfg.Prefix)
+		klog.Warningf("%v: disabling add-[pre-]chain for mirror log", cfg.LogCfg.Prefix)
 		cfg.EPBias.Bias[ctfe.AddChainName] = 0
 		cfg.EPBias.Bias[ctfe.AddPreChainName] = 0
 	}
@@ -356,7 +356,7 @@ func (s *hammerState) lastTreeSize() uint64 {
 }
 
 func (s *hammerState) needOps(ops ...ctfe.EntrypointName) {
-	glog.V(2).Infof("need operations %+v to satisfy dependencies", ops)
+	klog.V(2).Infof("need operations %+v to satisfy dependencies", ops)
 	s.nextOp = append(s.nextOp, ops...)
 }
 
@@ -366,7 +366,7 @@ func (s *hammerState) needOps(ops ...ctfe.EntrypointName) {
 func (s *hammerState) addMultiple(ctx context.Context, addOne func(context.Context) error) error {
 	var wg sync.WaitGroup
 	numAdds := rand.Intn(s.cfg.MaxParallelChains) + 1
-	glog.V(2).Infof("%s: do %d parallel add operations...", s.cfg.LogCfg.Prefix, numAdds)
+	klog.V(2).Infof("%s: do %d parallel add operations...", s.cfg.LogCfg.Prefix, numAdds)
 	errs := make(chan error, numAdds)
 	for i := 0; i < numAdds; i++ {
 		wg.Add(1)
@@ -378,7 +378,7 @@ func (s *hammerState) addMultiple(ctx context.Context, addOne func(context.Conte
 		}()
 	}
 	wg.Wait()
-	glog.V(2).Infof("%s: do %d parallel add operations...done", s.cfg.LogCfg.Prefix, numAdds)
+	klog.V(2).Infof("%s: do %d parallel add operations...done", s.cfg.LogCfg.Prefix, numAdds)
 	select {
 	case err := <-errs:
 		return err
@@ -428,11 +428,11 @@ func (s *hammerState) addChain(ctx context.Context) error {
 	sct, err := s.client().AddChain(ctx, chain)
 	if err != nil {
 		if err, ok := err.(client.RspError); ok {
-			glog.Errorf("%s: add-chain(%s): error %v HTTP status %d body %s", s.cfg.LogCfg.Prefix, choice, err.Error(), err.StatusCode, err.Body)
+			klog.Errorf("%s: add-chain(%s): error %v HTTP status %d body %s", s.cfg.LogCfg.Prefix, choice, err.Error(), err.StatusCode, err.Body)
 		}
 		return fmt.Errorf("failed to add-chain(%s): %v", choice, err)
 	}
-	glog.V(2).Infof("%s: Uploaded %s cert, got SCT(time=%q)", s.cfg.LogCfg.Prefix, choice, timeFromMS(sct.Timestamp))
+	klog.V(2).Infof("%s: Uploaded %s cert, got SCT(time=%q)", s.cfg.LogCfg.Prefix, choice, timeFromMS(sct.Timestamp))
 	// Calculate leaf hash =  SHA256(0x00 | tls-encode(MerkleTreeLeaf))
 	submitted := submittedCert{precert: false, sct: sct}
 	leaf := ct.MerkleTreeLeaf{
@@ -452,7 +452,7 @@ func (s *hammerState) addChain(ctx context.Context) error {
 	}
 	submitted.leafHash = sha256.Sum256(append([]byte{ct.TreeLeafPrefix}, submitted.leafData...))
 	s.pending.tryAppendCert(time.Now(), s.cfg.MMD, &submitted)
-	glog.V(3).Infof("%s: Uploaded %s cert has leaf-hash %x", s.cfg.LogCfg.Prefix, choice, submitted.leafHash)
+	klog.V(3).Infof("%s: Uploaded %s cert has leaf-hash %x", s.cfg.LogCfg.Prefix, choice, submitted.leafHash)
 	return nil
 }
 
@@ -484,13 +484,13 @@ func (s *hammerState) addChainInvalid(ctx context.Context) error {
 		// Remove the initial ASN.1 SEQUENCE type byte (0x30) to make an unparsable cert.
 		chain[0].Data[0] = 0x00
 	default:
-		glog.Exitf("Unhandled choice %s", choice)
+		klog.Exitf("Unhandled choice %s", choice)
 	}
 
 	sct, err := s.client().AddChain(ctx, chain)
-	glog.V(3).Infof("invalid add-chain(%s) => error %v", choice, err)
+	klog.V(3).Infof("invalid add-chain(%s) => error %v", choice, err)
 	if err, ok := err.(client.RspError); ok {
-		glog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
+		klog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
 	}
 	if err == nil {
 		return fmt.Errorf("unexpected success: add-chain(%s): %+v", choice, sct)
@@ -554,11 +554,11 @@ func (s *hammerState) addPreChain(ctx context.Context) error {
 	sct, err := s.client().AddPreChain(ctx, prechain)
 	if err != nil {
 		if err, ok := err.(client.RspError); ok {
-			glog.Errorf("%s: add-pre-chain(%s): error %v HTTP status %d body %s", s.cfg.LogCfg.Prefix, choice, err.Error(), err.StatusCode, err.Body)
+			klog.Errorf("%s: add-pre-chain(%s): error %v HTTP status %d body %s", s.cfg.LogCfg.Prefix, choice, err.Error(), err.StatusCode, err.Body)
 		}
 		return fmt.Errorf("failed to add-pre-chain: %v", err)
 	}
-	glog.V(2).Infof("%s: Uploaded %s pre-cert, got SCT(time=%q)", s.cfg.LogCfg.Prefix, choice, timeFromMS(sct.Timestamp))
+	klog.V(2).Infof("%s: Uploaded %s pre-cert, got SCT(time=%q)", s.cfg.LogCfg.Prefix, choice, timeFromMS(sct.Timestamp))
 
 	// Calculate leaf hash =  SHA256(0x00 | tls-encode(MerkleTreeLeaf))
 	submitted := submittedCert{precert: true, sct: sct}
@@ -582,7 +582,7 @@ func (s *hammerState) addPreChain(ctx context.Context) error {
 	}
 	submitted.leafHash = sha256.Sum256(append([]byte{ct.TreeLeafPrefix}, submitted.leafData...))
 	s.pending.tryAppendCert(time.Now(), s.cfg.MMD, &submitted)
-	glog.V(3).Infof("%s: Uploaded %s pre-cert has leaf-hash %x", s.cfg.LogCfg.Prefix, choice, submitted.leafHash)
+	klog.V(3).Infof("%s: Uploaded %s pre-cert has leaf-hash %x", s.cfg.LogCfg.Prefix, choice, submitted.leafHash)
 	return nil
 }
 
@@ -614,13 +614,13 @@ func (s *hammerState) addPreChainInvalid(ctx context.Context) error {
 		// Remove the initial ASN.1 SEQUENCE type byte (0x30) to make an unparsable cert.
 		prechain[0].Data[0] = 0x00
 	default:
-		glog.Exitf("Unhandled choice %s", choice)
+		klog.Exitf("Unhandled choice %s", choice)
 	}
 
 	sct, err := s.client().AddPreChain(ctx, prechain)
-	glog.V(3).Infof("invalid add-pre-chain(%s) => error %v", choice, err)
+	klog.V(3).Infof("invalid add-pre-chain(%s) => error %v", choice, err)
 	if err, ok := err.(client.RspError); ok {
-		glog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
+		klog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
 	}
 	if err == nil {
 		return fmt.Errorf("unexpected success: add-pre-chain: %+v", sct)
@@ -638,7 +638,7 @@ func (s *hammerState) getSTH(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("failed to get-sth: %v", err)
 	}
-	glog.V(2).Infof("%s: Got STH(time=%q, size=%d)", s.cfg.LogCfg.Prefix, timeFromMS(s.sth[0].Timestamp), s.sth[0].TreeSize)
+	klog.V(2).Infof("%s: Got STH(time=%q, size=%d)", s.cfg.LogCfg.Prefix, timeFromMS(s.sth[0].Timestamp), s.sth[0].TreeSize)
 	return nil
 }
 
@@ -651,17 +651,17 @@ func (s *hammerState) chooseSTHs(ctx context.Context) (*ct.SignedTreeHead, *ct.S
 	}
 	which := rand.Intn(sthCount)
 	if s.sth[which] == nil {
-		glog.V(3).Infof("%s: skipping get-sth-consistency as no earlier STH", s.cfg.LogCfg.Prefix)
+		klog.V(3).Infof("%s: skipping get-sth-consistency as no earlier STH", s.cfg.LogCfg.Prefix)
 		s.needOps(ctfe.GetSTHName)
 		return nil, sthNow, errSkip{}
 	}
 	if s.sth[which].TreeSize == 0 {
-		glog.V(3).Infof("%s: skipping get-sth-consistency as no earlier STH", s.cfg.LogCfg.Prefix)
+		klog.V(3).Infof("%s: skipping get-sth-consistency as no earlier STH", s.cfg.LogCfg.Prefix)
 		s.needOps(ctfe.AddChainName, ctfe.GetSTHName)
 		return nil, sthNow, errSkip{}
 	}
 	if s.sth[which].TreeSize == sthNow.TreeSize {
-		glog.V(3).Infof("%s: skipping get-sth-consistency as same size (%d)", s.cfg.LogCfg.Prefix, sthNow.TreeSize)
+		klog.V(3).Infof("%s: skipping get-sth-consistency as same size (%d)", s.cfg.LogCfg.Prefix, sthNow.TreeSize)
 		s.needOps(ctfe.AddChainName, ctfe.GetSTHName)
 		return nil, sthNow, errSkip{}
 	}
@@ -684,11 +684,11 @@ func (s *hammerState) getSTHConsistency(ctx context.Context) error {
 
 		// Otherwise, let's use our imagination and make one up, if possible...
 		if sthNow.TreeSize < 2 {
-			glog.V(3).Infof("%s: current STH size too small to invent a smaller STH for consistency proof (%d)", s.cfg.LogCfg.Prefix, sthNow.TreeSize)
+			klog.V(3).Infof("%s: current STH size too small to invent a smaller STH for consistency proof (%d)", s.cfg.LogCfg.Prefix, sthNow.TreeSize)
 			return errSkip{}
 		}
 		sthOld = &ct.SignedTreeHead{TreeSize: uint64(1 + rand.Int63n(int64(sthNow.TreeSize)))}
-		glog.V(3).Infof("%s: Inventing a smaller STH size for consistency proof (%d)", s.cfg.LogCfg.Prefix, sthOld.TreeSize)
+		klog.V(3).Infof("%s: Inventing a smaller STH size for consistency proof (%d)", s.cfg.LogCfg.Prefix, sthOld.TreeSize)
 	}
 
 	proof, err := s.client().GetSTHConsistency(ctx, sthOld.TreeSize, sthNow.TreeSize)
@@ -696,14 +696,14 @@ func (s *hammerState) getSTHConsistency(ctx context.Context) error {
 		return fmt.Errorf("failed to get-sth-consistency(%d, %d): %v", sthOld.TreeSize, sthNow.TreeSize, err)
 	}
 	if sthOld.Timestamp == 0 {
-		glog.V(3).Infof("%s: Skipping consistency proof verification for invented STH", s.cfg.LogCfg.Prefix)
+		klog.V(3).Infof("%s: Skipping consistency proof verification for invented STH", s.cfg.LogCfg.Prefix)
 		return nil
 	}
 
 	if err := s.checkCTConsistencyProof(sthOld, sthNow, proof); err != nil {
 		return fmt.Errorf("get-sth-consistency(%d, %d) proof check failed: %v", sthOld.TreeSize, sthNow.TreeSize, err)
 	}
-	glog.V(2).Infof("%s: Got STH consistency proof (size=%d => %d) len %d",
+	klog.V(2).Infof("%s: Got STH consistency proof (size=%d => %d) len %d",
 		s.cfg.LogCfg.Prefix, sthOld.TreeSize, sthNow.TreeSize, len(proof))
 	return nil
 }
@@ -755,12 +755,12 @@ func (s *hammerState) getSTHConsistencyInvalid(ctx context.Context) error {
 		}
 		proof = resp.Consistency
 	default:
-		glog.Exitf("Unhandled choice %s", choice)
+		klog.Exitf("Unhandled choice %s", choice)
 	}
 
-	glog.V(3).Infof("invalid get-sth-consistency(%s) => error %v", choice, err)
+	klog.V(3).Infof("invalid get-sth-consistency(%s) => error %v", choice, err)
 	if err, ok := err.(client.RspError); ok {
-		glog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
+		klog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
 	}
 	if err == nil {
 		return fmt.Errorf("unexpected success: get-sth-consistency(%s): %+v", choice, proof)
@@ -833,12 +833,12 @@ func (s *hammerState) getProofByHashInvalid(ctx context.Context) error {
 			err = client.RspError{Err: err, StatusCode: httpRsp.StatusCode, Body: body}
 		}
 	default:
-		glog.Exitf("Unhandled choice %s", choice)
+		klog.Exitf("Unhandled choice %s", choice)
 	}
 
-	glog.V(3).Infof("invalid get-proof-by-hash(%s) => error %v", choice, err)
+	klog.V(3).Infof("invalid get-proof-by-hash(%s) => error %v", choice, err)
 	if err, ok := err.(client.RspError); ok {
-		glog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
+		klog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
 	}
 	if err == nil {
 		return fmt.Errorf("unexpected success: get-proof-by-hash(%s): %+v", choice, rsp)
@@ -848,18 +848,18 @@ func (s *hammerState) getProofByHashInvalid(ctx context.Context) error {
 
 func (s *hammerState) getEntries(ctx context.Context) error {
 	if s.sth[0] == nil {
-		glog.V(3).Infof("%s: skipping get-entries as no earlier STH", s.cfg.LogCfg.Prefix)
+		klog.V(3).Infof("%s: skipping get-entries as no earlier STH", s.cfg.LogCfg.Prefix)
 		s.needOps(ctfe.GetSTHName)
 		return errSkip{}
 	}
 	lastSize := s.lastTreeSize()
 	if lastSize == 0 {
 		if s.pending.empty() {
-			glog.V(3).Infof("%s: skipping get-entries as tree size 0", s.cfg.LogCfg.Prefix)
+			klog.V(3).Infof("%s: skipping get-entries as tree size 0", s.cfg.LogCfg.Prefix)
 			s.needOps(ctfe.AddChainName, ctfe.GetSTHName)
 			return errSkip{}
 		}
-		glog.V(3).Infof("%s: skipping get-entries as STH stale", s.cfg.LogCfg.Prefix)
+		klog.V(3).Infof("%s: skipping get-entries as STH stale", s.cfg.LogCfg.Prefix)
 		s.needOps(ctfe.GetSTHName)
 		return errSkip{}
 	}
@@ -894,7 +894,7 @@ func (s *hammerState) getEntries(ctx context.Context) error {
 			return fmt.Errorf("leaf[%d].ts.EntryType=%v; want {X509,Precert}LogEntryType", i, ts.EntryType)
 		}
 	}
-	glog.V(2).Infof("%s: Got entries [%d:%d)\n", s.cfg.LogCfg.Prefix, first, first+len(entries))
+	klog.V(2).Infof("%s: Got entries [%d:%d)\n", s.cfg.LogCfg.Prefix, first, first+len(entries))
 	return nil
 }
 
@@ -919,13 +919,13 @@ func (s *hammerState) getEntriesInvalid(ctx context.Context) error {
 		first = 10
 		last = 5
 	default:
-		glog.Exitf("Unhandled choice %s", choice)
+		klog.Exitf("Unhandled choice %s", choice)
 	}
 
 	entries, err := s.client().GetEntries(ctx, first, last)
-	glog.V(3).Infof("invalid get-entries(%s) => error %v", choice, err)
+	klog.V(3).Infof("invalid get-entries(%s) => error %v", choice, err)
 	if err, ok := err.(client.RspError); ok {
-		glog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
+		klog.V(3).Infof("   HTTP status %d body %s", err.StatusCode, err.Body)
 	}
 	if err == nil {
 		return fmt.Errorf("unexpected success: get-entries(%d,%d): %d entries", first, last, len(entries))
@@ -938,7 +938,7 @@ func (s *hammerState) getRoots(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("failed to get-roots: %v", err)
 	}
-	glog.V(2).Infof("%s: Got roots (len=%d)", s.cfg.LogCfg.Prefix, len(roots))
+	klog.V(2).Infof("%s: Got roots (len=%d)", s.cfg.LogCfg.Prefix, len(roots))
 	return nil
 }
 
@@ -1005,7 +1005,7 @@ func (s *hammerState) performOp(ctx context.Context, ep ctfe.EntrypointName) (in
 		err = s.getRoots(ctx)
 	case ctfe.GetEntryAndProofName:
 		status = http.StatusNotImplemented
-		glog.V(2).Infof("%s: hammering entrypoint %s not yet implemented", s.cfg.LogCfg.Prefix, ep)
+		klog.V(2).Infof("%s: hammering entrypoint %s not yet implemented", s.cfg.LogCfg.Prefix, ep)
 	default:
 		err = fmt.Errorf("internal error: unknown entrypoint %s selected", ep)
 	}
@@ -1053,17 +1053,17 @@ func (s *hammerState) chooseOp() (ctfe.EntrypointName, bool) {
 func (s *hammerState) retryOneOp(ctx context.Context) error {
 	ep, invalid := s.chooseOp()
 	if invalid {
-		glog.V(3).Infof("perform invalid %s operation", ep)
+		klog.V(3).Infof("perform invalid %s operation", ep)
 		invalidReqs.Inc(s.label(), string(ep))
 		err := s.performInvalidOp(ctx, ep)
 		if _, ok := err.(errSkip); ok {
-			glog.V(2).Infof("invalid operation %s was skipped", ep)
+			klog.V(2).Infof("invalid operation %s was skipped", ep)
 			return nil
 		}
 		return err
 	}
 
-	glog.V(3).Infof("perform %s operation", ep)
+	klog.V(3).Infof("perform %s operation", ep)
 	deadline := time.Now().Add(s.cfg.MaxRetryDuration)
 
 	for {
@@ -1081,17 +1081,17 @@ func (s *hammerState) retryOneOp(ctx context.Context) error {
 			rsps.Inc(s.label(), string(ep), strconv.Itoa(status))
 			return nil
 		case errSkip:
-			glog.V(2).Infof("operation %s was skipped", ep)
+			klog.V(2).Infof("operation %s was skipped", ep)
 			return nil
 		default:
 			errs.Inc(s.label(), string(ep))
 			if s.cfg.IgnoreErrors {
 				left := time.Until(deadline)
 				if left < 0 {
-					glog.Warningf("%s: gave up retrying failed op %v after %v, returning last err: %v", s.cfg.LogCfg.Prefix, ep, s.cfg.MaxRetryDuration, err)
+					klog.Warningf("%s: gave up retrying failed op %v after %v, returning last err: %v", s.cfg.LogCfg.Prefix, ep, s.cfg.MaxRetryDuration, err)
 					return err
 				}
-				glog.Warningf("%s: op %v failed after %v (will retry for %v more): %v", s.cfg.LogCfg.Prefix, ep, period, left, err)
+				klog.Warningf("%s: op %v failed after %v (will retry for %v more): %v", s.cfg.LogCfg.Prefix, ep, period, left, err)
 			} else {
 				return err
 			}
@@ -1114,7 +1114,7 @@ func HammerCTLog(ctx context.Context, cfg HammerConfig) error {
 	defer cancel()
 
 	go schedule.Every(ctx, cfg.EmitInterval, func(ctx context.Context) {
-		glog.Info(s.String())
+		klog.Info(s.String())
 	})
 
 	for count := uint64(1); count < cfg.Operations; count++ {
@@ -1126,7 +1126,7 @@ func HammerCTLog(ctx context.Context, cfg HammerConfig) error {
 			return err
 		}
 	}
-	glog.Infof("%s: completed %d operations on log", cfg.LogCfg.Prefix, cfg.Operations)
+	klog.Infof("%s: completed %d operations on log", cfg.LogCfg.Prefix, cfg.Operations)
 
 	return nil
 }
diff --git a/trillian/integration/logenv.go b/trillian/integration/logenv.go
index 75f0eedfa6..50504a641f 100644
--- a/trillian/integration/logenv.go
+++ b/trillian/integration/logenv.go
@@ -22,7 +22,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/trillian/ctfe"
 	"github.com/google/certificate-transparency-go/trillian/ctfe/configpb"
 	"github.com/google/trillian"
@@ -30,6 +29,7 @@ import (
 	"github.com/google/trillian/monitoring/prometheus"
 	"github.com/google/trillian/testonly/integration"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"k8s.io/klog/v2"
 
 	stestonly "github.com/google/trillian/storage/testonly"
 )
@@ -80,7 +80,7 @@ func NewCTLogEnv(ctx context.Context, cfgs []*configpb.LogConfig, numSequencers
 		for _, cfg := range cfgs {
 			vCfg, err := ctfe.ValidateLogConfig(cfg)
 			if err != nil {
-				glog.Fatalf("ValidateLogConfig failed: %+v: %v", cfg, err)
+				klog.Fatalf("ValidateLogConfig failed: %+v: %v", cfg, err)
 			}
 			opts := ctfe.InstanceOptions{
 				Validated:     vCfg,
@@ -91,7 +91,7 @@ func NewCTLogEnv(ctx context.Context, cfgs []*configpb.LogConfig, numSequencers
 			}
 			inst, err := ctfe.SetUpInstance(ctx, opts)
 			if err != nil {
-				glog.Fatalf("Failed to set up log instance for %+v: %v", cfg, err)
+				klog.Fatalf("Failed to set up log instance for %+v: %v", cfg, err)
 			}
 			for path, handler := range inst.Handlers {
 				http.Handle(path, handler)
diff --git a/trillian/migrillian/core/controller.go b/trillian/migrillian/core/controller.go
index 1cc90e7be1..c1dd6f3ced 100644
--- a/trillian/migrillian/core/controller.go
+++ b/trillian/migrillian/core/controller.go
@@ -23,12 +23,11 @@ import (
 	"sync"
 	"time"
 
-	"github.com/golang/glog"
-
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/scanner"
 	"github.com/google/certificate-transparency-go/trillian/migrillian/configpb"
+	"k8s.io/klog/v2"
 
 	"github.com/google/trillian/monitoring"
 	"github.com/google/trillian/util/clock"
@@ -138,12 +137,12 @@ func (c *Controller) RunWhenMasterWithRestarts(ctx context.Context) {
 	uri := c.ctClient.BaseURI()
 	treeID := c.plClient.treeID
 	for run := true; run; run = c.opts.Continuous && ctx.Err() == nil {
-		glog.Infof("Starting migration Controller (%d<-%q)", treeID, uri)
+		klog.Infof("Starting migration Controller (%d<-%q)", treeID, uri)
 		if err := c.RunWhenMaster(ctx); err != nil {
-			glog.Errorf("Controller.RunWhenMaster(%d<-%q): %v", treeID, uri, err)
+			klog.Errorf("Controller.RunWhenMaster(%d<-%q): %v", treeID, uri, err)
 			continue
 		}
-		glog.Infof("Controller stopped (%d<-%q)", treeID, uri)
+		klog.Infof("Controller stopped (%d<-%q)", treeID, uri)
 	}
 }
 
@@ -166,7 +165,7 @@ func (c *Controller) RunWhenMaster(ctx context.Context) error {
 	defer func(ctx context.Context) {
 		metrics.isMaster.Set(0, c.label)
 		if err := el.Close(ctx); err != nil {
-			glog.Warningf("%s: Election.Close(): %v", c.label, err)
+			klog.Warningf("%s: Election.Close(): %v", c.label, err)
 		}
 	}(ctx)
 
@@ -183,7 +182,7 @@ func (c *Controller) RunWhenMaster(ctx context.Context) error {
 			return err
 		}
 
-		glog.Infof("%s: running as master", c.label)
+		klog.Infof("%s: running as master", c.label)
 		metrics.masterRuns.Inc(c.label)
 
 		// Run while still master (or until an error).
@@ -195,7 +194,7 @@ func (c *Controller) RunWhenMaster(ctx context.Context) error {
 		} else if mctx.Err() == nil {
 			// We are still the master, so try to resign and emit the real error.
 			if rerr := el.Resign(ctx); rerr != nil {
-				glog.Errorf("%s: Election.Resign(): %v", c.label, rerr)
+				klog.Errorf("%s: Election.Resign(): %v", c.label, rerr)
 			}
 			return err
 		}
@@ -214,7 +213,7 @@ func (c *Controller) runWithRestarts(ctx context.Context) error {
 		return err
 	}
 	for err != nil && ctx.Err() == nil {
-		glog.Errorf("%s: Controller.Run: %v", c.label, err)
+		klog.Errorf("%s: Controller.Run: %v", c.label, err)
 		sleepRandom(ctx, 0, c.opts.StartDelay)
 		err = c.Run(ctx)
 	}
@@ -280,7 +279,7 @@ func (c *Controller) fetchTail(ctx context.Context, begin uint64) (uint64, error
 	if int64(begin) > fo.StartIndex {
 		fo.StartIndex = int64(begin)
 	}
-	glog.Infof("%s: fetching range [%d, %d)", c.label, fo.StartIndex, fo.EndIndex)
+	klog.Infof("%s: fetching range [%d, %d)", c.label, fo.StartIndex, fo.EndIndex)
 
 	fetcher := scanner.NewFetcher(c.ctClient, &fo)
 	sth, err := fetcher.Prepare(ctx)
@@ -307,7 +306,7 @@ func (c *Controller) fetchTail(ctx context.Context, begin uint64) (uint64, error
 		go func() {
 			defer wg.Done()
 			if err := c.runSubmitter(cctx, batches); err != nil {
-				glog.Errorf("%s: Stopping due to submitter error: %v", c.label, err)
+				klog.Errorf("%s: Stopping due to submitter error: %v", c.label, err)
 				cancel() // Stop the other submitters and the Fetcher.
 			}
 		}()
@@ -342,7 +341,7 @@ func (c *Controller) verifyConsistency(ctx context.Context, treeSize uint64, roo
 		return nil
 	}
 	if c.opts.NoConsistencyCheck {
-		glog.Warningf("%s: skipping consistency check", c.label)
+		klog.Warningf("%s: skipping consistency check", c.label)
 		return nil
 	}
 	pf, err := c.ctClient.GetSTHConsistency(ctx, treeSize, sth.TreeSize)
@@ -369,7 +368,7 @@ func (c *Controller) runSubmitter(ctx context.Context, batches <-chan scanner.En
 			// shut down the Controller.
 			return fmt.Errorf("failed to add batch [%d, %d): %v", b.Start, end, err)
 		}
-		glog.Infof("%s: added batch [%d, %d)", c.label, b.Start, end)
+		klog.Infof("%s: added batch [%d, %d)", c.label, b.Start, end)
 		metrics.entriesStored.Add(entries, c.label)
 	}
 	return nil
diff --git a/trillian/migrillian/core/trillian.go b/trillian/migrillian/core/trillian.go
index 702eec796f..2bda319571 100644
--- a/trillian/migrillian/core/trillian.go
+++ b/trillian/migrillian/core/trillian.go
@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/scanner"
 	"github.com/google/certificate-transparency-go/trillian/migrillian/configpb"
@@ -32,6 +31,7 @@ import (
 	"github.com/google/trillian/types"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"k8s.io/klog/v2"
 )
 
 var errRetry = errors.New("retry")
@@ -121,7 +121,7 @@ func (c *PreorderedLogClient) addSequencedLeaves(ctx context.Context, b *scanner
 		switch status.Code(err) {
 		case codes.ResourceExhausted: // There was (probably) a quota error.
 			end := b.Start + int64(len(b.Entries))
-			glog.Errorf("%d: retrying batch [%d, %d) due to error: %v", c.treeID, b.Start, end, err)
+			klog.Errorf("%d: retrying batch [%d, %d) due to error: %v", c.treeID, b.Start, end, err)
 			return errRetry
 		case codes.OK:
 			if rsp == nil {
@@ -146,9 +146,9 @@ func (c *PreorderedLogClient) buildLogLeaf(index int64, entry *ct.LeafEntry) (*t
 	// Don't return on x509 parsing errors because we want to migrate this log
 	// entry as is. But log the error so that it can be flagged by monitoring.
 	if _, err = rle.ToLogEntry(); x509.IsFatal(err) {
-		glog.Errorf("%s: index=%d: x509 fatal error: %v", c.prefix, index, err)
+		klog.Errorf("%s: index=%d: x509 fatal error: %v", c.prefix, index, err)
 	} else if err != nil {
-		glog.Infof("%s: index=%d: x509 non-fatal error: %v", c.prefix, index, err)
+		klog.Infof("%s: index=%d: x509 non-fatal error: %v", c.prefix, index, err)
 	}
 	// TODO(pavelkalinnikov): Verify cert chain if error is nil or non-fatal.
 
diff --git a/trillian/migrillian/main.go b/trillian/migrillian/main.go
index 7476e61833..a2296ef741 100644
--- a/trillian/migrillian/main.go
+++ b/trillian/migrillian/main.go
@@ -26,10 +26,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/glog"
 	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
+	"k8s.io/klog/v2"
 
 	"github.com/google/certificate-transparency-go/client"
 	"github.com/google/certificate-transparency-go/jsonclient"
@@ -60,25 +60,26 @@ var (
 )
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
-	glog.CopyStandardLogTo("WARNING")
-	defer glog.Flush()
+	klog.CopyStandardLogTo("WARNING")
+	defer klog.Flush()
 
 	if *backend == "" {
-		glog.Exit("--backend flag must be specified")
+		klog.Exit("--backend flag must be specified")
 	}
 	cfg, err := getConfig()
 	if err != nil {
-		glog.Exitf("Failed to load MigrillianConfig: %v", err)
+		klog.Exitf("Failed to load MigrillianConfig: %v", err)
 	}
 	if err := core.ValidateConfig(cfg); err != nil {
-		glog.Exitf("Failed to validate MigrillianConfig: %v", err)
+		klog.Exitf("Failed to validate MigrillianConfig: %v", err)
 	}
 
-	glog.Infof("Dialling Trillian backend: %v", *backend)
+	klog.Infof("Dialling Trillian backend: %v", *backend)
 	conn, err := grpc.Dial(*backend, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithBlock())
 	if err != nil {
-		glog.Exitf("Could not dial Trillian server: %v: %v", *backend, err)
+		klog.Exitf("Could not dial Trillian server: %v: %v", *backend, err)
 	}
 	defer conn.Close()
 
@@ -92,7 +93,7 @@ func main() {
 	for _, mc := range cfg.MigrationConfigs.Config {
 		ctrl, err := getController(ctx, mc, httpClient, mf, ef, conn)
 		if err != nil {
-			glog.Exitf("Failed to create Controller for %q: %v", mc.SourceUri, err)
+			klog.Exitf("Failed to create Controller for %q: %v", mc.SourceUri, err)
 		}
 		ctrls = append(ctrls, ctrl)
 	}
@@ -101,7 +102,7 @@ func main() {
 	http.Handle("/metrics", promhttp.Handler())
 	go func() {
 		err := http.ListenAndServe(*metricsEndpoint, nil)
-		glog.Fatalf("http.ListenAndServe(): %v", err)
+		klog.Fatalf("http.ListenAndServe(): %v", err)
 	}()
 
 	cctx, cancel := context.WithCancel(ctx)
@@ -186,11 +187,11 @@ func newPreorderedLogClient(
 // function which releases the resources associated with the factory.
 func getElectionFactory() (election2.Factory, func()) {
 	if *forceMaster {
-		glog.Warning("Acting as master for all logs")
+		klog.Warning("Acting as master for all logs")
 		return election2.NoopFactory{}, func() {}
 	}
 	if len(*etcdServers) == 0 {
-		glog.Exit("Either --force_master or --etcd_servers must be supplied")
+		klog.Exit("Either --force_master or --etcd_servers must be supplied")
 	}
 
 	cli, err := clientv3.New(clientv3.Config{
@@ -198,11 +199,11 @@ func getElectionFactory() (election2.Factory, func()) {
 		DialTimeout: 5 * time.Second,
 	})
 	if err != nil || cli == nil {
-		glog.Exitf("Failed to create etcd client: %v", err)
+		klog.Exitf("Failed to create etcd client: %v", err)
 	}
 	closeFn := func() {
 		if err := cli.Close(); err != nil {
-			glog.Warningf("etcd client Close(): %v", err)
+			klog.Warningf("etcd client Close(): %v", err)
 		}
 	}
 
diff --git a/trillian/util/log_leaf.go b/trillian/util/log_leaf.go
index 01c81d9dd3..71d3d89b69 100644
--- a/trillian/util/log_leaf.go
+++ b/trillian/util/log_leaf.go
@@ -17,10 +17,10 @@ package util
 import (
 	"crypto/sha256"
 
-	"github.com/golang/glog"
 	ct "github.com/google/certificate-transparency-go"
 	"github.com/google/certificate-transparency-go/tls"
 	"github.com/google/trillian"
+	"k8s.io/klog/v2"
 )
 
 // BuildLogLeaf returns a Trillian LogLeaf structure for a (pre-)cert and the
@@ -31,13 +31,13 @@ func BuildLogLeaf(logPrefix string,
 ) (trillian.LogLeaf, error) {
 	leafData, err := tls.Marshal(merkleLeaf)
 	if err != nil {
-		glog.Warningf("%s: Failed to serialize Merkle leaf: %v", logPrefix, err)
+		klog.Warningf("%s: Failed to serialize Merkle leaf: %v", logPrefix, err)
 		return trillian.LogLeaf{}, err
 	}
 
 	extraData, err := ExtraDataForChain(cert, chain, isPrecert)
 	if err != nil {
-		glog.Warningf("%s: Failed to serialize chain for ExtraData: %v", logPrefix, err)
+		klog.Warningf("%s: Failed to serialize chain for ExtraData: %v", logPrefix, err)
 		return trillian.LogLeaf{}, err
 	}
 
diff --git a/x509util/certcheck/certcheck.go b/x509util/certcheck/certcheck.go
index f9aee630c3..4b0e7fa310 100644
--- a/x509util/certcheck/certcheck.go
+++ b/x509util/certcheck/certcheck.go
@@ -24,9 +24,9 @@ import (
 	"os"
 	"strings"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -49,12 +49,12 @@ func addCerts(filename string, pool *x509.CertPool) {
 	if filename != "" {
 		dataList, err := x509util.ReadPossiblePEMFile(filename, "CERTIFICATE")
 		if err != nil {
-			glog.Exitf("Failed to read certificate file: %v", err)
+			klog.Exitf("Failed to read certificate file: %v", err)
 		}
 		for _, data := range dataList {
 			certs, err := x509.ParseCertificates(data)
 			if err != nil {
-				glog.Exitf("Failed to parse certificate from %s: %v", filename, err)
+				klog.Exitf("Failed to parse certificate from %s: %v", filename, err)
 			}
 			for _, cert := range certs {
 				pool.AddCert(cert)
@@ -64,6 +64,7 @@ func addCerts(filename string, pool *x509.CertPool) {
 }
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 
 	failed := false
@@ -76,7 +77,7 @@ func main() {
 			chain, err = chainFromFile(target)
 		}
 		if err != nil {
-			glog.Errorf("%v", err)
+			klog.Errorf("%v", err)
 		}
 		if x509.IsFatal(err) {
 			failed = true
@@ -90,7 +91,7 @@ func main() {
 			}
 			if *checkRevoked {
 				if err := checkRevocation(cert, *verbose); err != nil {
-					glog.Errorf("%s: certificate is revoked: %v", target, err)
+					klog.Errorf("%s: certificate is revoked: %v", target, err)
 					failed = true
 				}
 			}
@@ -105,7 +106,7 @@ func main() {
 				DisableNameConstraintChecks:    !*checkNameConstraint,
 			}
 			if err := validateChain(chain, opts, *root, *intermediate, *useSystemRoots); err != nil {
-				glog.Errorf("%s: verification error: %v", target, err)
+				klog.Errorf("%s: verification error: %v", target, err)
 				failed = true
 			}
 		}
@@ -191,7 +192,7 @@ func validateChain(chain []*x509.Certificate, opts x509.VerifyOptions, rootsFile
 	if useSystemRoots {
 		systemRoots, err := x509.SystemCertPool()
 		if err != nil {
-			glog.Errorf("Failed to get system roots: %v", err)
+			klog.Errorf("Failed to get system roots: %v", err)
 		}
 		roots = systemRoots
 	}
@@ -224,17 +225,17 @@ func checkRevocation(cert *x509.Certificate, verbose bool) error {
 	for _, crldp := range cert.CRLDistributionPoints {
 		crlDataList, err := x509util.ReadPossiblePEMURL(crldp, "X509 CRL")
 		if err != nil {
-			glog.Errorf("failed to retrieve CRL from %q: %v", crldp, err)
+			klog.Errorf("failed to retrieve CRL from %q: %v", crldp, err)
 			continue
 		}
 		for _, crlData := range crlDataList {
 			crl, err := x509.ParseCertificateList(crlData)
 			if x509.IsFatal(err) {
-				glog.Errorf("failed to parse CRL from %q: %v", crldp, err)
+				klog.Errorf("failed to parse CRL from %q: %v", crldp, err)
 				continue
 			}
 			if err != nil {
-				glog.Errorf("non-fatal error parsing CRL from %q: %v", crldp, err)
+				klog.Errorf("non-fatal error parsing CRL from %q: %v", crldp, err)
 			}
 			if verbose {
 				fmt.Printf("\nRevocation data from %s:\n", crldp)
diff --git a/x509util/crlcheck/crlcheck.go b/x509util/crlcheck/crlcheck.go
index 0adae33316..4cfcbd925d 100644
--- a/x509util/crlcheck/crlcheck.go
+++ b/x509util/crlcheck/crlcheck.go
@@ -24,9 +24,9 @@ import (
 	"os"
 	"time"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
 	"github.com/google/certificate-transparency-go/x509util"
+	"k8s.io/klog/v2"
 )
 
 var (
@@ -36,6 +36,7 @@ var (
 )
 
 func main() {
+	klog.InitFlags(nil)
 	flag.Parse()
 
 	// Build a list of possible CA certs from command line arguments.
@@ -43,15 +44,15 @@ func main() {
 	if *caFile != "" {
 		caDataList, err := x509util.ReadPossiblePEMFile(*caFile, "CERTIFICATE")
 		if err != nil {
-			glog.Exitf("%s: failed to read CA cert data: %v", *caFile, err)
+			klog.Exitf("%s: failed to read CA cert data: %v", *caFile, err)
 		}
 		for _, caData := range caDataList {
 			certs, err := x509.ParseCertificates(caData)
 			if err != nil {
-				glog.Errorf("%s: %v", *caFile, err)
+				klog.Errorf("%s: %v", *caFile, err)
 			}
 			if len(certs) == 0 {
-				glog.Errorf("%s: no certificates found", *caFile)
+				klog.Errorf("%s: no certificates found", *caFile)
 			}
 			caCerts = append(caCerts, certs[0])
 		}
@@ -61,12 +62,12 @@ func main() {
 	for _, arg := range flag.Args() {
 		if *expectCerts {
 			if err := processCertArg(arg, caCerts); err != nil {
-				glog.Errorf("%s: failed to read certificate data: %v", arg, err)
+				klog.Errorf("%s: failed to read certificate data: %v", arg, err)
 				errored = true
 			}
 		} else {
 			if err := processCRLArg(arg, caCerts); err != nil {
-				glog.Errorf("%s: failed to read CRL data: %v", arg, err)
+				klog.Errorf("%s: failed to read CRL data: %v", arg, err)
 				errored = true
 			}
 		}
@@ -98,11 +99,11 @@ func processCRL(data []byte, caCerts []*x509.Certificate) (*x509.CertificateList
 	if err != nil && *strict {
 		return nil, fmt.Errorf("strict CRL parse error: %v", err)
 	}
-	glog.Infof("Processing CRL:\n%s", x509util.CRLToString(certList))
+	klog.Infof("Processing CRL:\n%s", x509util.CRLToString(certList))
 
 	verified := false
 	if len(caCerts) == 0 {
-		glog.Warningf("Skipping signature validation as no CA certs available")
+		klog.Warningf("Skipping signature validation as no CA certs available")
 		verified = true
 	}
 	var verifyErr error
@@ -110,7 +111,7 @@ func processCRL(data []byte, caCerts []*x509.Certificate) (*x509.CertificateList
 		if err := caCert.CheckCertificateListSignature(certList); err != nil {
 			verifyErr = err
 		} else {
-			glog.Infof("CRL signature verified against CA cert %q", x509util.NameToString(caCert.Subject))
+			klog.Infof("CRL signature verified against CA cert %q", x509util.NameToString(caCert.Subject))
 			verifyErr = nil
 			verified = true
 			break
@@ -136,10 +137,10 @@ func processCertArg(filename string, caCerts []*x509.Certificate) error {
 		for i := 1; i < len(dataList); i++ {
 			issuer, err := x509.ParseCertificate(dataList[i])
 			if err != nil {
-				glog.Warningf("Failed to parse [%d] in chain: %v", i, err)
+				klog.Warningf("Failed to parse [%d] in chain: %v", i, err)
 				continue
 			}
-			glog.Infof("Treating cert [%d] with subject %q as potential issuer", i, x509util.NameToString(issuer.Subject))
+			klog.Infof("Treating cert [%d] with subject %q as potential issuer", i, x509util.NameToString(issuer.Subject))
 			caCerts = append(caCerts, issuer)
 		}
 	}
@@ -155,19 +156,19 @@ func processCert(data []byte, caCerts []*x509.Certificate) error {
 	}
 	issuer, err := x509util.GetIssuer(cert, client)
 	if err != nil {
-		glog.Warningf("Failed to retrieve issuer for cert: %v", err)
+		klog.Warningf("Failed to retrieve issuer for cert: %v", err)
 	}
 	if issuer != nil {
-		glog.Infof("Using issuer %q", x509util.NameToString(issuer.Subject))
+		klog.Infof("Using issuer %q", x509util.NameToString(issuer.Subject))
 		caCerts = append(caCerts, issuer)
 	}
 	expired := false
 	if time.Now().After(cert.NotAfter) {
-		glog.Errorf("Certificate is expired (since %v)", cert.NotAfter)
+		klog.Errorf("Certificate is expired (since %v)", cert.NotAfter)
 		expired = true
 	}
 	for _, crldp := range cert.CRLDistributionPoints {
-		glog.Infof("Retrieving CRL from %q", crldp)
+		klog.Infof("Retrieving CRL from %q", crldp)
 		rsp, err := client.Get(crldp)
 		if err != nil || rsp.StatusCode != http.StatusOK {
 			return fmt.Errorf("failed to get CRL from %q: %v", crldp, err)
@@ -187,9 +188,9 @@ func processCert(data []byte, caCerts []*x509.Certificate) error {
 		// Check the CRL for the presence of the original cert.
 		for _, rev := range certList.TBSCertList.RevokedCertificates {
 			if rev.SerialNumber.Cmp(cert.SerialNumber) == 0 {
-				glog.Errorf("%s: certificate with serial number %v revoked at %v", crldp, cert.SerialNumber, rev.RevocationTime)
+				klog.Errorf("%s: certificate with serial number %v revoked at %v", crldp, cert.SerialNumber, rev.RevocationTime)
 				if rev.RevocationReason != x509.Unspecified {
-					glog.Errorf("  revocation reason: %s\v", x509util.RevocationReasonToString(rev.RevocationReason))
+					klog.Errorf("  revocation reason: %s\v", x509util.RevocationReasonToString(rev.RevocationReason))
 				}
 				break
 			}
diff --git a/x509util/pem_cert_pool.go b/x509util/pem_cert_pool.go
index d89c533875..e419659fa9 100644
--- a/x509util/pem_cert_pool.go
+++ b/x509util/pem_cert_pool.go
@@ -21,8 +21,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/golang/glog"
 	"github.com/google/certificate-transparency-go/x509"
+	"k8s.io/klog/v2"
 )
 
 // String for certificate blocks in BEGIN / END PEM headers
@@ -80,7 +80,7 @@ func (p *PEMCertPool) AppendCertsFromPEM(pemCerts []byte) (ok bool) {
 
 		cert, err := x509.ParseCertificate(block.Bytes)
 		if x509.IsFatal(err) {
-			glog.Warningf("error parsing PEM certificate: %v", err)
+			klog.Warningf("error parsing PEM certificate: %v", err)
 			return false
 		}