Repository: cilium/cilium
Pull request #17124 (2021-08-10 14:46:29)

v1.10: Update Go to 1.16.7

tklauser: test-backport-1.10
maintainer-s-little-helper[bot]: Job 'Cilium-PR-K8s-1.21-kernel-4.9' failed and has not been observed before, so may be related to your PR:
<details><summary>Click to show.</summary>

### Test Name
```test-name
K8sConformance Portmap Chaining Check connectivity-check compliance with portmap chaining
```

### Failure Output
```failure-output
FAIL: connectivity-check pods are not ready after timeout
```

</details>

If it is a flake, comment `/mlh new-flake Cilium-PR-K8s-1.21-kernel-4.9` so I can create a new GitHub issue to track it.
tklauser: /mlh new-flake Cilium-PR-K8s-1.21-kernel-4.9

Patch:
diff --git a/.github/workflows/build-images-ci.yaml b/.github/workflows/build-images-ci.yaml
index f912106fcf..d5845216d9 100644
--- a/.github/workflows/build-images-ci.yaml
+++ b/.github/workflows/build-images-ci.yaml
@@ -106,7 +106,7 @@ jobs:
             quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:v1.10-race
             quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}-race
           build-args: |
-            BASE_IMAGE=quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46
+            BASE_IMAGE=quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8
             LOCKDEBUG=1
             RACE=1
             OPERATOR_VARIANT=${{ matrix.name }}
@@ -155,7 +155,7 @@ jobs:
           tags: |
             quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}-race
           build-args: |
-            BASE_IMAGE=quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46
+            BASE_IMAGE=quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8
             LOCKDEBUG=1
             RACE=1
             OPERATOR_VARIANT=${{ matrix.name }}
diff --git a/.github/workflows/lint-bpf-checks.yaml b/.github/workflows/lint-bpf-checks.yaml
index 630d923fbc..6461573620 100644
--- a/.github/workflows/lint-bpf-checks.yaml
+++ b/.github/workflows/lint-bpf-checks.yaml
@@ -84,7 +84,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
       - name: Cache LLVM and Clang
         id: cache-llvm
         uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
diff --git a/.github/workflows/lint-build-commits.yaml b/.github/workflows/lint-build-commits.yaml
index 107fcd7fa1..92ea457c97 100644
--- a/.github/workflows/lint-build-commits.yaml
+++ b/.github/workflows/lint-build-commits.yaml
@@ -23,7 +23,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
           
       - name: Cache LLVM and Clang
         id: cache-llvm
diff --git a/.github/workflows/lint-go.yaml b/.github/workflows/lint-go.yaml
index 97c919fe9a..21407f6810 100644
--- a/.github/workflows/lint-go.yaml
+++ b/.github/workflows/lint-go.yaml
@@ -20,7 +20,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
       - name: Checkout code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
@@ -46,7 +46,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
       - name: Checkout code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
@@ -71,7 +71,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
       - name: Checkout code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
@@ -97,7 +97,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
       - name: Checkout code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
@@ -123,7 +123,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
-          go-version: 1.16.6
+          go-version: 1.16.7
       - name: Checkout code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
diff --git a/.travis.yml b/.travis.yml
index 28a6e92036..505999a0a8 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,7 +3,7 @@ language: go
 dist: focal
 sudo: required
 
-go: "1.16.6"
+go: "1.16.7"
 
 jobs:
   include:
@@ -16,14 +16,14 @@ jobs:
       if: type != pull_request
       env:
         - RACE=1
-        - BASE_IMAGE=quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46
+        - BASE_IMAGE=quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8
         - LOCKDEBUG=1
     - arch: arm64-graviton2
       name: "arm64-graviton2-race"
       if: type != pull_request
       env:
         - RACE=1
-        - BASE_IMAGE=quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46
+        - BASE_IMAGE=quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8
         - LOCKDEBUG=1
       virt: vm
       group: edge
diff --git a/Documentation/gettingstarted/k3s.rst b/Documentation/gettingstarted/k3s.rst
index 38305ce8fe..344dab2d76 100644
--- a/Documentation/gettingstarted/k3s.rst
+++ b/Documentation/gettingstarted/k3s.rst
@@ -48,14 +48,6 @@ Should you encounter any issues during the installation, please refer to the
 Please consult the Kubernetes :ref:`k8s_requirements` for information on  how
 you need to configure your Kubernetes cluster to operate with Cilium.
 
-Mount the eBPF Filesystem
-=========================
-On each node, run the following to mount the eBPF Filesystem:
-
-.. code-block:: shell-session
-
-     sudo mount bpffs -t bpf /sys/fs/bpf
-
 Install Cilium
 ==============
 
diff --git a/Documentation/gettingstarted/k8s-install-helm.rst b/Documentation/gettingstarted/k8s-install-helm.rst
index d45c9f7b4f..0c57369426 100644
--- a/Documentation/gettingstarted/k8s-install-helm.rst
+++ b/Documentation/gettingstarted/k8s-install-helm.rst
@@ -58,7 +58,7 @@ Install Cilium
 
        .. code-block:: shell-session
 
-          NATIVE_CIDR="$(gcloud container clusters describe "${NAME} --zone "${ZONE}" --format 'value(clusterIpv4Cidr)')"
+          NATIVE_CIDR="$(gcloud container clusters describe "${NAME}" --zone "${ZONE}" --format 'value(clusterIpv4Cidr)')"
           echo $NATIVE_CIDR
 
        Deploy Cilium release via Helm:
@@ -217,14 +217,6 @@ Install Cilium
 
        .. include:: requirements-k3s.rst
 
-       **Mount the eBPF Filesystem:**
-
-       On each node, run the following to mount the eBPF Filesystem:
-
-       .. code-block:: shell-session
-
-          sudo mount bpffs -t bpf /sys/fs/bpf
-      
        **Install Cilium:**
 
        .. parsed-literal::
diff --git a/Documentation/gettingstarted/k8s-install-rancher-existing-nodes.rst b/Documentation/gettingstarted/k8s-install-rancher-existing-nodes.rst
index d32b913caf..10fe606d13 100644
--- a/Documentation/gettingstarted/k8s-install-rancher-existing-nodes.rst
+++ b/Documentation/gettingstarted/k8s-install-rancher-existing-nodes.rst
@@ -50,15 +50,6 @@ cluster:
 
 .. image:: images/rancher_add_nodes.png
 
-Before adding nodes to the cluster, ensure the BPF filesystem is mounted.
-You can persist the configuration using the following commands:
-
-.. code-block:: shell-session
-
-  sudo mount bpffs -t bpf /sys/fs/bpf
-  sudo bash -c "echo 'none /sys/fs/bpf bpf rw,relatime 0 0' >> /etc/fstab"
-
-
 Next, add nodes to the cluster using the Rancher-provided Docker commands. Be
 sure to add the appropriate number of nodes required for your cluster. After
 a few minutes, you will see that the Nodes overview will show an error message
diff --git a/Documentation/helm-values.rst b/Documentation/helm-values.rst
index 96838dfd94..5767fb9c42 100644
--- a/Documentation/helm-values.rst
+++ b/Documentation/helm-values.rst
@@ -49,6 +49,10 @@
      - Enable BPF clock source probing for more efficient tick retrieval.
      - bool
      - ``false``
+   * - bpf.lbExternalClusterIP
+     - Allow cluster external access to ClusterIP services.
+     - bool
+     - ``false``
    * - bpf.lbMapMax
      - Configure the maximum number of service entries in the load balancer maps.
      - int
@@ -73,14 +77,10 @@
      - Enables pre-allocation of eBPF map values. This increases memory usage but can reduce latency.
      - bool
      - ``false``
-   * - bpf.waitForMount
-     - Force the cilium-agent DaemonSet to wait in an initContainer until the eBPF filesystem has been mounted.
-     - bool
-     - ``false``
    * - certgen
      - Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually.
      - object
-     - ``{"image":{"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.4"},"podLabels":{},"ttlSecondsAfterFinished":1800}``
+     - ``{"image":{"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.5"},"podLabels":{},"ttlSecondsAfterFinished":1800}``
    * - certgen.podLabels
      - Labels to be added to hubble-certgen pods
      - object
@@ -124,7 +124,7 @@
    * - clustermesh.apiserver.image
      - Clustermesh API server image.
      - object
-     - ``{"digest":"sha256:a201c1bfdc67b7e583f476a1a4b95f28cec692f58a1eef30046b4c0bfd3e5a08","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.10.1","useDigest":true}``
+     - ``{"digest":"sha256:44f1e4bcfafcf58784c418520fb0387f8d817ebe75cced493ef4f492a1199f2d","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.10.3","useDigest":true}``
    * - clustermesh.apiserver.nodeSelector
      - Node labels for pod assignment ref: https://kubernetes.io/docs/user-guide/node-selection/
      - object
@@ -568,7 +568,7 @@
    * - hubble.relay.image
      - Hubble-relay container image.
      - object
-     - ``{"digest":"sha256:6f0d6b5698ab87b58923237caa071b5d7eb3e83ffd688e5e70a8edeca7a06cf4","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.10.1","useDigest":true}``
+     - ``{"digest":"sha256:af8ff09fe374c307356a85b0e0c158359a2e7299f93280151301b7f2fac27339","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.10.3","useDigest":true}``
    * - hubble.relay.listenHost
      - Host to listen to. Specify an empty string to bind to all the interfaces.
      - string
@@ -748,7 +748,7 @@
    * - image
      - Agent container image.
      - object
-     - ``{"digest":"sha256:f5fcdfd4929af5a8903b02da61332eea41dcdb512420b8c807e2e2904270561c","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.10.1","useDigest":true}``
+     - ``{"digest":"sha256:8419531c5d3677158802882bdfe2297915c43f2ebe3649551aaac22de9f6d565","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.10.3","useDigest":true}``
    * - imagePullSecrets
      - Configure image pull secrets for pulling container images
      - string
@@ -976,7 +976,7 @@
    * - operator.image
      - cilium-operator image.
      - object
-     - ``{"alibabacloudDigest":"sha256:07d692a357252f04f49bab97c47fe30a75d08d8f9f0896dc1452b335101b8938","awsDigest":"sha256:16c186f8909c6fcdc6c2db7e5ce31fa0616bb44c4b134bee52b005b9ee827b9f","azureDigest":"sha256:ae751480d95d7cd53c130821bc69f11662bc0a2aa283bc1efbe9a10ebdd4ed24","genericDigest":"sha256:a1588ee00a15f2f2b419e4acd36bd57d64a5f10eb52d0fd4de689e558a913cd8","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.10.1","useDigest":true}``
+     - ``{"alibabacloudDigest":"sha256:291e05fef5c2ebebce785a985903a50075e539804b3e946aab8042fc526262b6","awsDigest":"sha256:d3aed74d90b9326959a33a6a354b16117942dac0017090380b1bc3a1dbe8be2d","azureDigest":"sha256:8cba20e22205d3a9fbcbed8bfc11bdd4d8e2fd5b0ce08f6e0f35f441ddc1de7e","genericDigest":"sha256:337ebf27eae4fbad51cc4baf9110b3ec6753320dd33075bc136e2a1865be5eb5","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.10.3","useDigest":true}``
    * - operator.nodeSelector
      - Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/user-guide/node-selection/
      - object
@@ -1080,7 +1080,7 @@
    * - preflight.image
      - Cilium pre-flight image.
      - object
-     - ``{"digest":"sha256:f5fcdfd4929af5a8903b02da61332eea41dcdb512420b8c807e2e2904270561c","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.10.1","useDigest":true}``
+     - ``{"digest":"sha256:8419531c5d3677158802882bdfe2297915c43f2ebe3649551aaac22de9f6d565","pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.10.3","useDigest":true}``
    * - preflight.nodeSelector
      - Node labels for preflight pod assignment ref: https://kubernetes.io/docs/user-guide/node-selection/
      - object
diff --git a/Documentation/operations/system_requirements.rst b/Documentation/operations/system_requirements.rst
index 718a568058..f20c3e8f38 100644
--- a/Documentation/operations/system_requirements.rst
+++ b/Documentation/operations/system_requirements.rst
@@ -347,20 +347,17 @@ Mounted eBPF filesystem
             # mount | grep /sys/fs/bpf
             $ # if present should output, e.g. "none on /sys/fs/bpf type bpf"...
 
-This step is **required for production** environments but optional for testing
-and development. It allows the ``cilium-agent`` to pin eBPF resources to a
-persistent filesystem and make them persistent across restarts of the agent.
 If the eBPF filesystem is not mounted in the host filesystem, Cilium will
-automatically mount the filesystem but it will be unmounted and re-mounted when
-the Cilium pod is restarted. This in turn will cause eBPF resources to be
-re-created which will cause network connectivity to be disrupted while Cilium
-is not running. Mounting the eBPF filesystem in the host mount namespace will
-ensure that the agent can be restarted without affecting connectivity of any
-pods.
-
-In order to mount the eBPF filesystem, the following command must be run in the
-host mount namespace. The command must only be run once during the boot process
-of the machine.
+automatically mount the filesystem.
+
+Mounting this BPF filesystem allows the ``cilium-agent`` to persist eBPF
+resources across restarts of the agent so that the datapath can continue to
+operate while the agent is subsequently restarted or upgraded.
+
+Optionally it is also possible to mount the eBPF filesystem before Cilium is
+deployed in the cluster, the following command must be run in the host mount
+namespace. The command must only be run once during the boot process of the
+machine.
 
    .. code-block:: shell-session
 
diff --git a/GO_VERSION b/GO_VERSION
index de646d2fc1..293bfa8f06 100644
--- a/GO_VERSION
+++ b/GO_VERSION
@@ -1,1 +1,1 @@
-1.16.6
+1.16.7
diff --git a/daemon/cmd/daemon_main.go b/daemon/cmd/daemon_main.go
index 36bea475ba..65af7ed264 100644
--- a/daemon/cmd/daemon_main.go
+++ b/daemon/cmd/daemon_main.go
@@ -1202,7 +1202,7 @@ func initEnv(cmd *cobra.Command) {
 	// the path to an already mounted filesystem instead. This is
 	// useful if the daemon is being round inside a namespace and the
 	// BPF filesystem is mapped into the slave namespace.
-	bpf.CheckOrMountFS(option.Config.BPFRoot, k8s.IsEnabled())
+	bpf.CheckOrMountFS(option.Config.BPFRoot)
 	cgroups.CheckOrMountCgrpFS(option.Config.CGroupRoot)
 
 	option.Config.Opts.SetBool(option.Debug, debugDatapath)
diff --git a/images/builder/Dockerfile b/images/builder/Dockerfile
index ab4ed5e9d7..67683205df 100644
--- a/images/builder/Dockerfile
+++ b/images/builder/Dockerfile
@@ -2,9 +2,9 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG COMPILERS_IMAGE=quay.io/cilium/image-compilers:6ed96e618f68cd941b62b546fc8d161db0144d84@sha256:5245610a830b14972d5b287fc0318ac6ab0d420e4afc9b5db9032a04fd706d32
-ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46
+ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8
 ARG TESTER_IMAGE=quay.io/cilium/image-tester:eb76f0d4d585946bb0267b4c4478cceed17bbd87@sha256:c9a598cdc4843e62ab4e430f36343ca06d5292506261f17e466e0f1cbb48ddbb
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 ARG CILIUM_LLVM_IMAGE=quay.io/cilium/cilium-llvm:0147a23fdada32bd51b4f313c645bcb5fbe188d6@sha256:24fd3ad32471d0e45844c856c38f1b2d4ac8bd0a2d4edf64cffaaa3fd0b21202
 
 FROM ${COMPILERS_IMAGE} as compilers-image
diff --git a/images/cilium-docker-plugin/Dockerfile b/images/cilium-docker-plugin/Dockerfile
index 2ca500c8f5..ffa62896a1 100644
--- a/images/cilium-docker-plugin/Dockerfile
+++ b/images/cilium-docker-plugin/Dockerfile
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG BASE_IMAGE=scratch
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 
 # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit.
 # Represents the plataform where the build is happening, do not mix with
diff --git a/images/cilium/Dockerfile b/images/cilium/Dockerfile
index e78940f8ed..95075d2b7a 100644
--- a/images/cilium/Dockerfile
+++ b/images/cilium/Dockerfile
@@ -3,8 +3,8 @@
 # Copyright 2020-2021 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-ARG CILIUM_BUILDER_IMAGE=quay.io/cilium/cilium-builder:4a20eeed8b8994f08df412e61ad490b190ee8b65@sha256:084347720fe1425642f0df627205d73ab700b623892068c98025c90b658ebf73
-ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46
+ARG CILIUM_BUILDER_IMAGE=quay.io/cilium/cilium-builder:ca4eec60d250c8e370ed685d89bdbca26788144c@sha256:cfa857527c2aa1a0431b895a6c9617e8fe866a1491fc8c8cf88ec912bbf782ee
+ARG CILIUM_RUNTIME_IMAGE=quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8
 
 # cilium-envoy from github.com/cilium/proxy
 #
diff --git a/images/cilium/init-container.sh b/images/cilium/init-container.sh
index 08d508350e..2a19dbd7c9 100755
--- a/images/cilium/init-container.sh
+++ b/images/cilium/init-container.sh
@@ -13,7 +13,3 @@ if [ "${CILIUM_ALL_STATE}" = "true" ] \
     || [ "${CLEAN_CILIUM_STATE}" = "true" ]; then
 	cilium cleanup -f --all-state
 fi
-
-if [ "${CILIUM_WAIT_BPF_MOUNT}" = "true" ]; then
-	until mount | grep "/sys/fs/bpf type bpf"; do echo "BPF filesystem is not mounted yet"; sleep 1; done
-fi;
diff --git a/images/clustermesh-apiserver/Dockerfile b/images/clustermesh-apiserver/Dockerfile
index 076c88b6a2..6edf9c4d8f 100644
--- a/images/clustermesh-apiserver/Dockerfile
+++ b/images/clustermesh-apiserver/Dockerfile
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG BASE_IMAGE=scratch
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 ARG ALPINE_IMAGE=docker.io/library/alpine:3.12.7@sha256:36553b10a4947067b9fbb7d532951066293a68eae893beba1d9235f7d11a20ad
 
 # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit.
diff --git a/images/hubble-proto/Dockerfile b/images/hubble-proto/Dockerfile
index 67bf62dc94..5e18e0fe89 100644
--- a/images/hubble-proto/Dockerfile
+++ b/images/hubble-proto/Dockerfile
@@ -1,7 +1,7 @@
 # Copyright 2020-2021 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6-alpine3.12@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7-alpine3.12@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 ARG ALPINE_IMAGE=docker.io/library/alpine:3.12.7@sha256:36553b10a4947067b9fbb7d532951066293a68eae893beba1d9235f7d11a20ad
 
 FROM ${GOLANG_IMAGE} as builder
diff --git a/images/hubble-relay/Dockerfile b/images/hubble-relay/Dockerfile
index 555d25017e..52d504bc50 100644
--- a/images/hubble-relay/Dockerfile
+++ b/images/hubble-relay/Dockerfile
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG BASE_IMAGE=scratch
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 ARG ALPINE_IMAGE=docker.io/library/alpine:3.12.7@sha256:36553b10a4947067b9fbb7d532951066293a68eae893beba1d9235f7d11a20ad
 
 # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit.
diff --git a/images/operator/Dockerfile b/images/operator/Dockerfile
index fd5c89ad70..f1fb7708c4 100644
--- a/images/operator/Dockerfile
+++ b/images/operator/Dockerfile
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG BASE_IMAGE=scratch
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 ARG ALPINE_IMAGE=docker.io/library/alpine:3.12.7@sha256:36553b10a4947067b9fbb7d532951066293a68eae893beba1d9235f7d11a20ad
 
 # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit.
diff --git a/images/runtime/Dockerfile b/images/runtime/Dockerfile
index 36f79d979f..a54cac898b 100644
--- a/images/runtime/Dockerfile
+++ b/images/runtime/Dockerfile
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ARG TESTER_IMAGE=quay.io/cilium/image-tester:eb76f0d4d585946bb0267b4c4478cceed17bbd87@sha256:c9a598cdc4843e62ab4e430f36343ca06d5292506261f17e466e0f1cbb48ddbb
-ARG GOLANG_IMAGE=docker.io/library/golang:1.16.6@sha256:773f15a2f2368be3ef88bfc29cc602bac5bd918f1f6cd14b24502d8760e04173
+ARG GOLANG_IMAGE=docker.io/library/golang:1.16.7@sha256:5cdc91c9e67e7b95ef5a1c9156af24aaccbb4e339799efd441fd7e961b3e2e75
 ARG UBUNTU_IMAGE=docker.io/library/ubuntu:20.04@sha256:adf73ca014822ad8237623d388cedf4d5346aa72c270c5acc01431cc93e18e2d
 
 ARG CILIUM_LLVM_IMAGE=quay.io/cilium/cilium-llvm:0147a23fdada32bd51b4f313c645bcb5fbe188d6@sha256:24fd3ad32471d0e45844c856c38f1b2d4ac8bd0a2d4edf64cffaaa3fd0b21202
diff --git a/images/scripts/update-golang-image.sh b/images/scripts/update-golang-image.sh
index 56443f923b..b9d155eeaa 100755
--- a/images/scripts/update-golang-image.sh
+++ b/images/scripts/update-golang-image.sh
@@ -19,7 +19,7 @@ root_dir="$(git rev-parse --show-toplevel)"
 
 cd "${root_dir}"
 
-go_version=1.16.6
+go_version=1.16.7
 # Do not upgrade to alpine 3.13 as its nslookup tool returns 1, instead of 0
 # for domain name lookups.
 go_version_alpine=${go_version}-alpine3.12
diff --git a/install/kubernetes/cilium/README.md b/install/kubernetes/cilium/README.md
index 6b9644d82d..50df02fba6 100644
--- a/install/kubernetes/cilium/README.md
+++ b/install/kubernetes/cilium/README.md
@@ -27,7 +27,7 @@ Try Cilium on any Kubernetes distribution in under 15 minutes:
 
 | Minikube | Self-Managed K8s | Amazon EKS | Google GKE | Microsoft AKS |
 |:-:|:-:|:-:|:-:|:-:|
-| [![Minikube](https://raw.githubusercontent.com/cilium/charts/master/images/minikube.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) | [![Self-Managed Kubernetes](https://raw.githubusercontent.com/cilium/charts/master/images/k8s.png)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html | [![Amazon EKS](https://raw.githubusercontent.com/cilium/charts/master/images/aws.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) | [![Google GKE](https://raw.githubusercontent.com/cilium/charts/master/images/google-cloud.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) | [![Microsoft AKS](https://raw.githubusercontent.com/cilium/charts/master/images/azure.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) |
+| [![Minikube](https://raw.githubusercontent.com/cilium/charts/master/images/minikube.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Self-Managed Kubernetes](https://raw.githubusercontent.com/cilium/charts/master/images/k8s.png)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Amazon EKS](https://raw.githubusercontent.com/cilium/charts/master/images/aws.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Google GKE](https://raw.githubusercontent.com/cilium/charts/master/images/google-cloud.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Microsoft AKS](https://raw.githubusercontent.com/cilium/charts/master/images/azure.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) |
 
 Or, for a quick install with the default configuration:
 
@@ -70,8 +70,7 @@ contributors across the globe, there is almost always someone available to help.
 | bpf.monitorInterval | string | `"5s"` | Configure the typical time between monitor notifications for active connections. |
 | bpf.policyMapMax | int | `16384` | Configure the maximum number of entries in endpoint policy map (per endpoint). |
 | bpf.preallocateMaps | bool | `false` | Enables pre-allocation of eBPF map values. This increases memory usage but can reduce latency. |
-| bpf.waitForMount | bool | `false` | Force the cilium-agent DaemonSet to wait in an initContainer until the eBPF filesystem has been mounted. |
-| certgen | object | `{"image":{"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.4"},"podLabels":{},"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
+| certgen | object | `{"image":{"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.5"},"podLabels":{},"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
 | certgen.podLabels | object | `{}` | Labels to be added to hubble-certgen pods |
 | certgen.ttlSecondsAfterFinished | int | `1800` | Seconds after which the completed job pod will be deleted |
 | cgroup | object | `{"autoMount":{"enabled":true},"hostRoot":"/run/cilium/cgroupv2"}` | Configure cgroup related configuration |
diff --git a/install/kubernetes/cilium/README.md.gotmpl b/install/kubernetes/cilium/README.md.gotmpl
index 26187e1fe1..1e777a251d 100644
--- a/install/kubernetes/cilium/README.md.gotmpl
+++ b/install/kubernetes/cilium/README.md.gotmpl
@@ -29,7 +29,7 @@ Try Cilium on any Kubernetes distribution in under 15 minutes:
 
 | Minikube | Self-Managed K8s | Amazon EKS | Google GKE | Microsoft AKS |
 |:-:|:-:|:-:|:-:|:-:|
-| [![Minikube](https://raw.githubusercontent.com/cilium/charts/master/images/minikube.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) | [![Self-Managed Kubernetes](https://raw.githubusercontent.com/cilium/charts/master/images/k8s.png)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html | [![Amazon EKS](https://raw.githubusercontent.com/cilium/charts/master/images/aws.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) | [![Google GKE](https://raw.githubusercontent.com/cilium/charts/master/images/google-cloud.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) | [![Microsoft AKS](https://raw.githubusercontent.com/cilium/charts/master/images/azure.svg)](https://cilium.readthedocs.io/en/stable/gettingstarted/k8s-install-helm.html) |
+| [![Minikube](https://raw.githubusercontent.com/cilium/charts/master/images/minikube.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Self-Managed Kubernetes](https://raw.githubusercontent.com/cilium/charts/master/images/k8s.png)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Amazon EKS](https://raw.githubusercontent.com/cilium/charts/master/images/aws.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Google GKE](https://raw.githubusercontent.com/cilium/charts/master/images/google-cloud.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) | [![Microsoft AKS](https://raw.githubusercontent.com/cilium/charts/master/images/azure.svg)](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) |
 
 Or, for a quick install with the default configuration:
 
diff --git a/install/kubernetes/cilium/templates/_helpers.tpl b/install/kubernetes/cilium/templates/_helpers.tpl
index 6695c83b09..73de1dfca4 100644
--- a/install/kubernetes/cilium/templates/_helpers.tpl
+++ b/install/kubernetes/cilium/templates/_helpers.tpl
@@ -89,7 +89,7 @@ ca.key: {{ .cmca.Key | b64enc }}
 {{- template "clustermesh.apiserver.generate.ca" . }}
 {{- $CN := "clustermesh-apiserver.cilium.io" }}
 {{- $IPs := (list "127.0.0.1") }}
-{{- $SANs := (list $CN) }}
+{{- $SANs := (list $CN "*.mesh.cilium.io") }}
 {{- $cert := genSignedCert $CN $IPs $SANs (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .cmca -}}
 ca.crt: {{ .cmca.Cert | b64enc }}
 tls.crt: {{ $cert.Cert | b64enc }}
diff --git a/install/kubernetes/cilium/templates/cilium-agent-daemonset.yaml b/install/kubernetes/cilium/templates/cilium-agent-daemonset.yaml
index 2afa11abca..95eca0c5b0 100644
--- a/install/kubernetes/cilium/templates/cilium-agent-daemonset.yaml
+++ b/install/kubernetes/cilium/templates/cilium-agent-daemonset.yaml
@@ -427,12 +427,6 @@ spec:
               key: clean-cilium-bpf-state
               name: cilium-config
               optional: true
-        - name: CILIUM_WAIT_BPF_MOUNT
-          valueFrom:
-            configMapKeyRef:
-              key: wait-bpf-mount
-              name: cilium-config
-              optional: true
 {{- if .Values.k8sServiceHost }}
         - name: KUBERNETES_SERVICE_HOST
           value: {{ .Values.k8sServiceHost | quote }}
@@ -457,8 +451,6 @@ spec:
 {{- if not (eq .Values.containerRuntime.integration "crio") }}
         - mountPath: /sys/fs/bpf
           name: bpf-maps
-{{- /* Required for wait-bpf-mount to work */}}
-          mountPropagation: HostToContainer
 {{- end }}
 {{- if .Values.cgroup.autoMount.enabled }}
           # Required to mount cgroup filesystem from the host to cilium agent pod
diff --git a/install/kubernetes/cilium/templates/cilium-configmap.yaml b/install/kubernetes/cilium/templates/cilium-configmap.yaml
index 320de2e1c3..bda4117886 100644
--- a/install/kubernetes/cilium/templates/cilium-configmap.yaml
+++ b/install/kubernetes/cilium/templates/cilium-configmap.yaml
@@ -381,9 +381,6 @@ data:
   enable-l7-proxy: {{ .Values.l7Proxy | quote }}
 {{- end }}
 
-  # wait-bpf-mount makes init container wait until bpf filesystem is mounted
-  wait-bpf-mount: "{{ .Values.bpf.waitForMount }}"
-
 {{- if ne .Values.cni.chainingMode "none" }}
   # Enable chaining with another CNI plugin
   #
diff --git a/install/kubernetes/cilium/templates/cilium-nodeinit-daemonset.yaml b/install/kubernetes/cilium/templates/cilium-nodeinit-daemonset.yaml
index 31f28e5caa..5c748a7e52 100644
--- a/install/kubernetes/cilium/templates/cilium-nodeinit-daemonset.yaml
+++ b/install/kubernetes/cilium/templates/cilium-nodeinit-daemonset.yaml
@@ -93,9 +93,6 @@ spec:
                       while PATH="${PATH}:/home/kubernetes/bin" crictl ps | grep -v "node-init" | grep -q "POD_cilium"; do sleep 1; done
                     fi
 
-                    systemctl disable sys-fs-bpf.mount || true
-                    systemctl stop sys-fs-bpf.mount || true
-
                     if ip link show cilium_host; then
                       echo "Deleting cilium_host interface..."
                       ip link del cilium_host
@@ -139,44 +136,6 @@ spec:
               set -o pipefail
               set -o nounset
 
-              mount | grep "/sys/fs/bpf type bpf" || {
-                # Mount the filesystem until next reboot
-                echo "Mounting BPF filesystem..."
-                mount bpffs /sys/fs/bpf -t bpf
-
-                # Configure systemd to mount after next boot
-                echo "Installing BPF filesystem mount"
-                cat >/tmp/sys-fs-bpf.mount <<EOF
-              [Unit]
-              Description=Mount BPF filesystem (Cilium)
-              Documentation=http://docs.cilium.io/
-              DefaultDependencies=no
-              Before=local-fs.target umount.target
-              After=swap.target
-
-              [Mount]
-              What=bpffs
-              Where=/sys/fs/bpf
-              Type=bpf
-              Options=rw,nosuid,nodev,noexec,relatime,mode=700
-
-              [Install]
-              WantedBy=multi-user.target
-              EOF
-
-                if [ -d "/etc/systemd/system/" ]; then
-                  mv /tmp/sys-fs-bpf.mount /etc/systemd/system/
-                  echo "Installed sys-fs-bpf.mount to /etc/systemd/system/"
-                elif [ -d "/lib/systemd/system/" ]; then
-                  mv /tmp/sys-fs-bpf.mount /lib/systemd/system/
-                  echo "Installed sys-fs-bpf.mount to /lib/systemd/system/"
-                fi
-
-                # Ensure that filesystem gets mounted on next reboot
-                systemctl enable sys-fs-bpf.mount
-                systemctl start sys-fs-bpf.mount
-              }
-
               echo "Link information:"
               ip link
 
diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml
index cd385d7f6c..b9d2b10d19 100644
--- a/install/kubernetes/cilium/values.yaml
+++ b/install/kubernetes/cilium/values.yaml
@@ -230,10 +230,6 @@ bpf:
   # -- Enable BPF clock source probing for more efficient tick retrieval.
   clockProbe: false
 
-  # -- Force the cilium-agent DaemonSet to wait in an initContainer until the
-  # eBPF filesystem has been mounted.
-  waitForMount: false
-
   # -- Enables pre-allocation of eBPF map values. This increases
   # memory usage but can reduce latency.
   preallocateMaps: false
@@ -538,7 +534,7 @@ hostServices:
 certgen:
   image:
     repository: quay.io/cilium/certgen
-    tag: v0.1.4
+    tag: v0.1.5
     pullPolicy: IfNotPresent
   # -- Seconds after which the completed job pod will be deleted
   ttlSecondsAfterFinished: 1800
diff --git a/jenkinsfiles/ginkgo-gke.Jenkinsfile b/jenkinsfiles/ginkgo-gke.Jenkinsfile
index 0670c1e4e1..fee9191be8 100644
--- a/jenkinsfiles/ginkgo-gke.Jenkinsfile
+++ b/jenkinsfiles/ginkgo-gke.Jenkinsfile
@@ -73,7 +73,7 @@ pipeline {
                         env.DOCKER_TAG = env.DOCKER_TAG + "-race"
                         env.RACE = 1
                         env.LOCKDEBUG = 1
-                        env.BASE_IMAGE = "quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46"
+                        env.BASE_IMAGE = "quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8"
                     }
                 }
             }
diff --git a/jenkinsfiles/ginkgo-kernel.Jenkinsfile b/jenkinsfiles/ginkgo-kernel.Jenkinsfile
index c526145ae9..6c6ae6637f 100644
--- a/jenkinsfiles/ginkgo-kernel.Jenkinsfile
+++ b/jenkinsfiles/ginkgo-kernel.Jenkinsfile
@@ -90,7 +90,7 @@ pipeline {
                         env.DOCKER_TAG = env.DOCKER_TAG + "-race"
                         env.RACE = 1
                         env.LOCKDEBUG = 1
-                        env.BASE_IMAGE = "quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46"
+                        env.BASE_IMAGE = "quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8"
                     }
                 }
             }
diff --git a/jenkinsfiles/ginkgo-runtime-kernel.Jenkinsfile b/jenkinsfiles/ginkgo-runtime-kernel.Jenkinsfile
index 4b67024382..08144b080d 100644
--- a/jenkinsfiles/ginkgo-runtime-kernel.Jenkinsfile
+++ b/jenkinsfiles/ginkgo-runtime-kernel.Jenkinsfile
@@ -34,7 +34,7 @@ pipeline {
             )}"""
         BASE_IMAGE="""${sh(
                 returnStdout: true,
-                script: 'if [ "${run_with_race_detection}" = "" ]; then echo -n "scratch"; else echo -n "quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46"; fi'
+                script: 'if [ "${run_with_race_detection}" = "" ]; then echo -n "scratch"; else echo -n "quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8"; fi'
             )}"""
     }
 
diff --git a/jenkinsfiles/kubernetes-upstream.Jenkinsfile b/jenkinsfiles/kubernetes-upstream.Jenkinsfile
index aacb61e35a..2e7d64cab2 100644
--- a/jenkinsfiles/kubernetes-upstream.Jenkinsfile
+++ b/jenkinsfiles/kubernetes-upstream.Jenkinsfile
@@ -53,7 +53,7 @@ pipeline {
                         env.DOCKER_TAG = env.DOCKER_TAG + "-race"
                         env.RACE = 1
                         env.LOCKDEBUG = 1
-                        env.BASE_IMAGE = "quay.io/cilium/cilium-runtime:d4a66542a6a5e46ecf8c4f9d851db6ab32c031ce@sha256:9ba0c83b2aac482ce6be626cb3d7b5f0fa7cad78a4c023a83ecfba3efb276a46"
+                        env.BASE_IMAGE = "quay.io/cilium/cilium-runtime:eb9e137d466aab551e9729c36269db34711873c4@sha256:ed1d5bfd0afedaf42724957796d75ac873d3e01564026ad62186650c51ddddf8"
                     }
                 }
             }
diff --git a/operator/k8s_node.go b/operator/k8s_node.go
index c3d5d51ad4..127d33f4da 100644
--- a/operator/k8s_node.go
+++ b/operator/k8s_node.go
@@ -23,7 +23,6 @@ import (
 	operatorOption "github.com/cilium/cilium/operator/option"
 	"github.com/cilium/cilium/pkg/controller"
 	"github.com/cilium/cilium/pkg/ipam/allocator"
-	ipamOption "github.com/cilium/cilium/pkg/ipam/option"
 	"github.com/cilium/cilium/pkg/k8s"
 	cilium_v2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
 	v2 "github.com/cilium/cilium/pkg/k8s/client/clientset/versioned/typed/cilium.io/v2"
@@ -46,7 +45,7 @@ import (
 func runNodeWatcher(nodeManager *allocator.NodeEventHandler) error {
 	log.Info("Starting to synchronize k8s nodes to kvstore")
 
-	ciliumNodeStore, err := store.JoinSharedStore(store.Configuration{
+	ciliumNodeKVStore, err := store.JoinSharedStore(store.Configuration{
 		Prefix:     nodeStore.NodeStorePrefix,
 		KeyCreator: nodeStore.KeyCreator,
 	})
@@ -54,7 +53,7 @@ func runNodeWatcher(nodeManager *allocator.NodeEventHandler) error {
 		return err
 	}
 
-	k8sNodeStore, nodeController := informer.NewInformer(
+	ciliumNodeStore, nodeController := informer.NewInformer(
 		cache.NewListWatchFromClient(k8s.CiliumClient().CiliumV2().RESTClient(),
 			cilium_v2.CNPluralName, v1.NamespaceAll, fields.Everything()),
 		&cilium_v2.CiliumNode{},
@@ -63,7 +62,7 @@ func runNodeWatcher(nodeManager *allocator.NodeEventHandler) error {
 			AddFunc: func(obj interface{}) {
 				if ciliumNode := k8s.ObjToCiliumNode(obj); ciliumNode != nil {
 					nodeNew := nodeTypes.ParseCiliumNode(ciliumNode)
-					ciliumNodeStore.UpdateKeySync(context.TODO(), &nodeNew)
+					ciliumNodeKVStore.UpdateKeySync(context.TODO(), &nodeNew)
 				}
 			},
 			UpdateFunc: func(oldObj, newObj interface{}) {
@@ -74,7 +73,7 @@ func runNodeWatcher(nodeManager *allocator.NodeEventHandler) error {
 						}
 
 						nodeNew := nodeTypes.ParseCiliumNode(newNode)
-						ciliumNodeStore.UpdateKeySync(context.TODO(), &nodeNew)
+						ciliumNodeKVStore.UpdateKeySync(context.TODO(), &nodeNew)
 					}
 				}
 			},
@@ -84,7 +83,7 @@ func runNodeWatcher(nodeManager *allocator.NodeEventHandler) error {
 					return
 				}
 				deletedNode := nodeTypes.ParseCiliumNode(n)
-				ciliumNodeStore.DeleteLocalKey(context.TODO(), &deletedNode)
+				ciliumNodeKVStore.DeleteLocalKey(context.TODO(), &deletedNode)
 				deleteCiliumNode(nodeManager, n.Name)
 			},
 		},
@@ -96,44 +95,30 @@ func runNodeWatcher(nodeManager *allocator.NodeEventHandler) error {
 		cache.WaitForCacheSync(wait.NeverStop, nodeController.HasSynced)
 
 		// Since we processed all events received from k8s we know that
-		// at this point the list in k8sNodeStore should be the source of truth
-		// and we need to delete all nodes in the kvNodeStore that are *not*
-		// present in the k8sNodeStore.
-
-		switch option.Config.IPAM {
-		case ipamOption.IPAMENI, ipamOption.IPAMAzure, ipamOption.IPAMAlibabaCloud:
-			nodes, err := ciliumK8sClient.CiliumV2().CiliumNodes().List(context.TODO(), meta_v1.ListOptions{})
-			if err != nil {
-				log.WithError(err).Warning("Unable to list CiliumNodes. Won't clean up stale CiliumNodes")
-			} else {
-				for _, node := range nodes.Items {
-					if _, ok, err := k8sNodeStore.GetByKey(node.Name); !ok && err == nil {
-						deleteCiliumNode(nodeManager, node.Name)
-					}
-				}
-			}
-		}
-
-		listOfK8sNodes := k8sNodeStore.ListKeys()
-
-		kvStoreNodes := ciliumNodeStore.SharedKeysMap()
-		for _, k8sNode := range listOfK8sNodes {
-			// The remaining kvStoreNodes are leftovers
-			kvStoreNodeName := nodeTypes.GetKeyNodeName(option.Config.ClusterName, k8sNode)
+		// at this point the list in ciliumNodeStore should be the source of
+		// truth and we need to delete all nodes in the kvNodeStore that are
+		// *not* present in the ciliumNodeStore.
+		listOfCiliumNodes := ciliumNodeStore.ListKeys()
+
+		kvStoreNodes := ciliumNodeKVStore.SharedKeysMap()
+		for _, ciliumNode := range listOfCiliumNodes {
+			// The remaining kvStoreNodes are leftovers that need to be GCed
+			kvStoreNodeName := nodeTypes.GetKeyNodeName(option.Config.ClusterName, ciliumNode)
 			delete(kvStoreNodes, kvStoreNodeName)
 		}
 
 		for _, kvStoreNode := range kvStoreNodes {
+			// Only delete the nodes that belong to our cluster
 			if strings.HasPrefix(kvStoreNode.GetKeyName(), option.Config.ClusterName) {
-				ciliumNodeStore.DeleteLocalKey(context.TODO(), kvStoreNode)
+				ciliumNodeKVStore.DeleteLocalKey(context.TODO(), kvStoreNode)
 			}
 		}
 
 	}()
 
 	if operatorOption.Config.CNPNodeStatusGCInterval != 0 {
-		go runCNPNodeStatusGC("cnp-node-gc", false, ciliumNodeStore)
-		go runCNPNodeStatusGC("ccnp-node-gc", true, ciliumNodeStore)
+		go runCNPNodeStatusGC("cnp-node-gc", false, ciliumNodeKVStore)
+		go runCNPNodeStatusGC("ccnp-node-gc", true, ciliumNodeKVStore)
 	}
 
 	return nil
diff --git a/operator/k8s_pod_controller.go b/operator/k8s_pod_controller.go
index f6e8875481..6a1f93c7fc 100644
--- a/operator/k8s_pod_controller.go
+++ b/operator/k8s_pod_controller.go
@@ -43,7 +43,7 @@ var (
 func enableUnmanagedKubeDNSController() {
 	// These functions will block until the resources are synced with k8s.
 	watchers.CiliumEndpointsInit(k8s.CiliumClient().CiliumV2(), wait.NeverStop)
-	watchers.UnmanagedPodsInit(k8s.WatcherClient())
+	watchers.UnmanagedKubeDNSPodsInit(k8s.WatcherClient())
 
 	controller.NewManager().UpdateController("restart-unmanaged-kube-dns",
 		controller.ControllerParams{
@@ -54,7 +54,7 @@ func enableUnmanagedKubeDNSController() {
 						delete(lastPodRestart, podName)
 					}
 				}
-				for _, podItem := range watchers.UnmanagedPodStore.List() {
+				for _, podItem := range watchers.UnmanagedKubeDNSPodStore.List() {
 					pod, ok := podItem.(*slim_corev1.Pod)
 					if !ok {
 						log.Errorf("unexpected type mapping: found %T, expected %T", pod, &slim_corev1.Pod{})
diff --git a/operator/watchers/pod.go b/operator/watchers/pod.go
index 995d0eef38..8890d5e673 100644
--- a/operator/watchers/pod.go
+++ b/operator/watchers/pod.go
@@ -36,13 +36,13 @@ var (
 	// PodStoreSynced is closed once the PodStore is synced with k8s.
 	PodStoreSynced = make(chan struct{})
 
-	// UnmanagedPodStore has a minimal copy of the unmanaged kube-dns pods running
+	// UnmanagedKubeDNSPodStore has a minimal copy of the unmanaged kube-dns pods running
 	// in the cluster.
 	// Warning: The pods stored in the cache are not intended to be used for Update
 	// operations in k8s as some of its fields are not populated.
-	UnmanagedPodStore cache.Store
+	UnmanagedKubeDNSPodStore cache.Store
 
-	// UnmanagedPodStoreSynced is closed once the UnmanagedPodStore is synced
+	// UnmanagedPodStoreSynced is closed once the UnmanagedKubeDNSPodStore is synced
 	// with k8s.
 	UnmanagedPodStoreSynced = make(chan struct{})
 )
@@ -109,9 +109,9 @@ func convertToPod(obj interface{}) interface{} {
 	}
 }
 
-func UnmanagedPodsInit(k8sClient kubernetes.Interface) {
+func UnmanagedKubeDNSPodsInit(k8sClient kubernetes.Interface) {
 	var unmanagedPodInformer cache.Controller
-	UnmanagedPodStore, unmanagedPodInformer = informer.NewInformer(
+	UnmanagedKubeDNSPodStore, unmanagedPodInformer = informer.NewInformer(
 		cache.NewFilteredListWatchFromClient(k8sClient.CoreV1().RESTClient(),
 			"pods", v1.NamespaceAll, func(options *metav1.ListOptions) {
 				options.LabelSelector = "k8s-app=kube-dns"
diff --git a/pkg/bpf/bpffs_linux.go b/pkg/bpf/bpffs_linux.go
index 62edbba2df..ff3a460e83 100644
--- a/pkg/bpf/bpffs_linux.go
+++ b/pkg/bpf/bpffs_linux.go
@@ -169,7 +169,7 @@ func hasMultipleMounts() (bool, error) {
 
 // checkOrMountCustomLocation tries to check or mount the BPF filesystem in the
 // given path.
-func checkOrMountCustomLocation(bpfRoot string, printWarning bool) error {
+func checkOrMountCustomLocation(bpfRoot string) error {
 	setMapRoot(bpfRoot)
 
 	// Check whether the custom location has a BPFFS mount.
@@ -181,7 +181,7 @@ func checkOrMountCustomLocation(bpfRoot string, printWarning bool) error {
 	// If the custom location has no mount, let's mount BPFFS there.
 	if !mounted {
 		setMapRoot(bpfRoot)
-		if err := mountFS(printWarning); err != nil {
+		if err := mountFS(true); err != nil {
 			return err
 		}
 
@@ -211,7 +211,7 @@ func checkOrMountCustomLocation(bpfRoot string, printWarning bool) error {
 //    probably Cilium is running inside container which has mounted /sys/fs/bpf
 //    from host, but host doesn't have proper BPFFS mount, so that mount is just
 //    the empty directory. In that case, mount BPFFS under /run/cilium/bpffs.
-func checkOrMountDefaultLocations(printWarning bool) error {
+func checkOrMountDefaultLocations() error {
 	// Check whether /sys/fs/bpf has a BPFFS mount.
 	mounted, bpffsInstance, err := mountinfo.IsMountFS(mountinfo.FilesystemTypeBPFFS, mapRoot)
 	if err != nil {
@@ -221,7 +221,7 @@ func checkOrMountDefaultLocations(printWarning bool) error {
 	// If /sys/fs/bpf is not mounted at all, we should mount
 	// BPFFS there.
 	if !mounted {
-		if err := mountFS(printWarning); err != nil {
+		if err := mountFS(false); err != nil {
 			return err
 		}
 
@@ -251,7 +251,7 @@ func checkOrMountDefaultLocations(printWarning bool) error {
 			return err
 		}
 		if !cMounted {
-			if err := mountFS(printWarning); err != nil {
+			if err := mountFS(false); err != nil {
 				return err
 			}
 		} else if !cBpffsInstance {
@@ -264,13 +264,13 @@ func checkOrMountDefaultLocations(printWarning bool) error {
 	return nil
 }
 
-func checkOrMountFS(bpfRoot string, printWarning bool) error {
+func checkOrMountFS(bpfRoot string) error {
 	if bpfRoot == "" {
-		if err := checkOrMountDefaultLocations(printWarning); err != nil {
+		if err := checkOrMountDefaultLocations(); err != nil {
 			return err
 		}
 	} else {
-		if err := checkOrMountCustomLocation(bpfRoot, printWarning); err != nil {
+		if err := checkOrMountCustomLocation(bpfRoot); err != nil {
 			return err
 		}
 	}
@@ -292,9 +292,9 @@ func checkOrMountFS(bpfRoot string, printWarning bool) error {
 //
 // If printWarning is set, will print a warning if bpffs has not previously been
 // mounted.
-func CheckOrMountFS(bpfRoot string, printWarning bool) {
+func CheckOrMountFS(bpfRoot string) {
 	mountOnce.Do(func() {
-		if err := checkOrMountFS(bpfRoot, printWarning); err != nil {
+		if err := checkOrMountFS(bpfRoot); err != nil {
 			log.WithError(err).Fatal("Unable to mount BPF filesystem")
 		}
 	})
diff --git a/pkg/policy/repository.go b/pkg/policy/repository.go
index 6de0a6faec..a70bb25c14 100644
--- a/pkg/policy/repository.go
+++ b/pkg/policy/repository.go
@@ -536,9 +536,15 @@ func (p *Repository) GetRulesMatching(lbls labels.LabelArray) (ingressMatch bool
 			if len(r.Ingress) > 0 {
 				ingressMatch = true
 			}
+			if len(r.IngressDeny) > 0 {
+				ingressMatch = true
+			}
 			if len(r.Egress) > 0 {
 				egressMatch = true
 			}
+			if len(r.EgressDeny) > 0 {
+				egressMatch = true
+			}
 		}
 
 		if ingressMatch && egressMatch {
diff --git a/tools/maptool/main.go b/tools/maptool/main.go
index 048c85b11e..fe39127788 100644
--- a/tools/maptool/main.go
+++ b/tools/maptool/main.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Authors of Cilium
+// Copyright 2019-2021 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,7 +20,6 @@ import (
 	"strings"
 
 	"github.com/cilium/cilium/pkg/bpf"
-	"github.com/cilium/cilium/pkg/defaults"
 	"github.com/cilium/cilium/pkg/maps/eppolicymap"
 	"github.com/cilium/cilium/pkg/maps/sockmap"
 )
@@ -59,7 +58,7 @@ func main() {
 	if err := bpf.ConfigureResourceLimits(); err != nil {
 		fmt.Fprintf(os.Stdout, "Failed to configure resource limits: %s\n", err)
 	}
-	bpf.CheckOrMountFS(defaults.DefaultMapRoot, true)
+	bpf.CheckOrMountFS("")
 
 	bpfObjPath := os.Args[2]
 	if err := createMap(bpfObjPath); err != nil {


Test patch:
diff --git a/images/cilium-test/Dockerfile b/images/cilium-test/Dockerfile
index d69d0ac283..7091bcfb6a 100644
--- a/images/cilium-test/Dockerfile
+++ b/images/cilium-test/Dockerfile
@@ -3,7 +3,7 @@
 # Copyright 2020-2021 Authors of Cilium
 # SPDX-License-Identifier: Apache-2.0
 
-ARG CILIUM_BUILDER_IMAGE=quay.io/cilium/cilium-builder:4a20eeed8b8994f08df412e61ad490b190ee8b65@sha256:084347720fe1425642f0df627205d73ab700b623892068c98025c90b658ebf73
+ARG CILIUM_BUILDER_IMAGE=quay.io/cilium/cilium-builder:ca4eec60d250c8e370ed685d89bdbca26788144c@sha256:cfa857527c2aa1a0431b895a6c9617e8fe866a1491fc8c8cf88ec912bbf782ee
 ARG UBUNTU_IMAGE=docker.io/library/ubuntu:20.04@sha256:adf73ca014822ad8237623d388cedf4d5346aa72c270c5acc01431cc93e18e2d
 
 FROM ${UBUNTU_IMAGE} as rootfs
diff --git a/pkg/bpf/map_linux_test.go b/pkg/bpf/map_linux_test.go
index fad00b85ed..217fb83339 100644
--- a/pkg/bpf/map_linux_test.go
+++ b/pkg/bpf/map_linux_test.go
@@ -71,7 +71,7 @@ var (
 )
 
 func runTests(m *testing.M) (int, error) {
-	CheckOrMountFS("", false)
+	CheckOrMountFS("")
 	if err := ConfigureResourceLimits(); err != nil {
 		return 1, fmt.Errorf("Failed to configure rlimit")
 	}
diff --git a/pkg/datapath/linux/node_linux_test.go b/pkg/datapath/linux/node_linux_test.go
index b5bb3ef06f..4daad94c8b 100644
--- a/pkg/datapath/linux/node_linux_test.go
+++ b/pkg/datapath/linux/node_linux_test.go
@@ -1415,8 +1415,9 @@ func (s *linuxPrivilegedIPv4OnlyTestSuite) TestArpPingHandling(c *check.C) {
 	}
 	c.Assert(found, check.Equals, false)
 
+	now = time.Now()
 	c.Assert(linuxNodeHandler.NodeAdd(nodev3), check.IsNil)
-	time.Sleep(100 * time.Millisecond) // insertNeighbor is invoked async
+	wait(nodev3.Identity(), &now, false)
 
 	nextHop = net.ParseIP("9.9.9.250")
 	// Check that both node{2,3} are via nextHop (gw)
diff --git a/pkg/maps/ctmap/ctmap_privileged_test.go b/pkg/maps/ctmap/ctmap_privileged_test.go
index 246237e46c..2326582873 100644
--- a/pkg/maps/ctmap/ctmap_privileged_test.go
+++ b/pkg/maps/ctmap/ctmap_privileged_test.go
@@ -44,7 +44,7 @@ func Test(t *testing.T) {
 }
 
 func (k *CTMapTestSuite) SetUpSuite(c *C) {
-	bpf.CheckOrMountFS("", false)
+	bpf.CheckOrMountFS("")
 	err := bpf.ConfigureResourceLimits()
 	c.Assert(err, IsNil)
 }
diff --git a/pkg/maps/eppolicymap/eppolicymap_test.go b/pkg/maps/eppolicymap/eppolicymap_test.go
index 835b22e45a..b721250a3e 100644
--- a/pkg/maps/eppolicymap/eppolicymap_test.go
+++ b/pkg/maps/eppolicymap/eppolicymap_test.go
@@ -53,13 +53,13 @@ func (e *EPPolicyMapTestSuite) TearDownTest(c *C) {
 }
 
 func (e *EPPolicyMapTestSuite) TestCreateEPPolicy(c *C) {
-	bpf.CheckOrMountFS("", false)
+	bpf.CheckOrMountFS("")
 	CreateEPPolicyMap()
 }
 
 func (e *EPPolicyMapTestSuite) TestWriteEndpoint(c *C) {
 	option.Config.SockopsEnable = true
-	bpf.CheckOrMountFS("", false)
+	bpf.CheckOrMountFS("")
 	keys := make([]*lxcmap.EndpointKey, 1)
 	many := make([]*lxcmap.EndpointKey, 256)
 	fd, err := bpf.CreateMap(bpf.MapTypeHash,
@@ -86,7 +86,7 @@ func (e *EPPolicyMapTestSuite) TestWriteEndpoint(c *C) {
 // in invalid fd in if its disabled.
 func (e *EPPolicyMapTestSuite) TestWriteEndpointFails(c *C) {
 	option.Config.SockopsEnable = true
-	bpf.CheckOrMountFS("", false)
+	bpf.CheckOrMountFS("")
 	keys := make([]*lxcmap.EndpointKey, 1)
 	_, err := bpf.CreateMap(bpf.MapTypeHash,
 		uint32(unsafe.Sizeof(policymap.PolicyKey{})),
@@ -102,7 +102,7 @@ func (e *EPPolicyMapTestSuite) TestWriteEndpointFails(c *C) {
 
 func (e *EPPolicyMapTestSuite) TestWriteEndpointDisabled(c *C) {
 	option.Config.SockopsEnable = false
-	bpf.CheckOrMountFS("", false)
+	bpf.CheckOrMountFS("")
 	keys := make([]*lxcmap.EndpointKey, 1)
 	fd, err := bpf.CreateMap(bpf.MapTypeHash,
 		uint32(unsafe.Sizeof(policymap.PolicyKey{})),
diff --git a/pkg/maps/policymap/policymap_privileged_test.go b/pkg/maps/policymap/policymap_privileged_test.go
index dfccff39d1..6fa97d749f 100644
--- a/pkg/maps/policymap/policymap_privileged_test.go
+++ b/pkg/maps/policymap/policymap_privileged_test.go
@@ -48,7 +48,7 @@ var (
 )
 
 func runTests(m *testing.M) (int, error) {
-	bpf.CheckOrMountFS("", false)
+	bpf.CheckOrMountFS("")
 	if err := bpf.ConfigureResourceLimits(); err != nil {
 		return 1, fmt.Errorf("Failed to configure rlimit")
 	}
diff --git a/pkg/policy/repository_deny_test.go b/pkg/policy/repository_deny_test.go
index 7fbf1d07f8..79809963a5 100644
--- a/pkg/policy/repository_deny_test.go
+++ b/pkg/policy/repository_deny_test.go
@@ -260,6 +260,74 @@ func (ds *PolicyTestSuite) TestComputePolicyDenyEnforcementAndRules(c *C) {
 
 }
 
+func (ds *PolicyTestSuite) TestGetRulesMatching(c *C) {
+	repo := NewPolicyRepository(nil, nil)
+	repo.selectorCache = testSelectorCache
+
+	fooToBar := &SearchContext{
+		From: labels.ParseSelectLabelArray("foo"),
+		To:   labels.ParseSelectLabelArray("bar"),
+	}
+
+	repo.Mutex.RLock()
+	// no rules loaded: Allows() => denied
+	c.Assert(repo.AllowsIngressRLocked(fooToBar), Equals, api.Denied)
+	repo.Mutex.RUnlock()
+
+	bar := labels.ParseSelectLabel("bar")
+	foo := labels.ParseSelectLabel("foo")
+	tag := labels.LabelArray{labels.ParseLabel("tag")}
+	ingressDenyRule := api.Rule{
+		EndpointSelector: api.NewESFromLabels(bar),
+		IngressDeny: []api.IngressDenyRule{
+			{
+				IngressCommonRule: api.IngressCommonRule{
+					FromEndpoints: []api.EndpointSelector{
+						api.NewESFromLabels(foo),
+					},
+				},
+			},
+		},
+		Labels: tag,
+	}
+
+	egressDenyRule := api.Rule{
+		EndpointSelector: api.NewESFromLabels(bar),
+		EgressDeny: []api.EgressDenyRule{
+			{
+				EgressCommonRule: api.EgressCommonRule{
+					ToEndpoints: []api.EndpointSelector{
+						api.NewESFromLabels(foo),
+					},
+				},
+			},
+		},
+		Labels: tag,
+	}
+
+	// When no policy is applied.
+	ingressMatch, egressMatch := repo.GetRulesMatching(labels.LabelArray{bar, foo})
+	c.Assert(ingressMatch, Equals, false)
+	c.Assert(egressMatch, Equals, false)
+
+	// When ingress deny policy is applied.
+	_, _, err := repo.Add(ingressDenyRule, []Endpoint{})
+	c.Assert(err, IsNil)
+	ingressMatch, egressMatch = repo.GetRulesMatching(labels.LabelArray{bar, foo})
+	c.Assert(ingressMatch, Equals, true)
+	c.Assert(egressMatch, Equals, false)
+
+	// Delete igress deny policy.
+	repo.DeleteByLabels(tag)
+
+	// When egress deny policy is applied.
+	_, _, err = repo.Add(egressDenyRule, []Endpoint{})
+	c.Assert(err, IsNil)
+	ingressMatch, egressMatch = repo.GetRulesMatching(labels.LabelArray{bar, foo})
+	c.Assert(ingressMatch, Equals, false)
+	c.Assert(egressMatch, Equals, true)
+}
+
 func (ds *PolicyTestSuite) TestDeniesIngress(c *C) {
 	repo := NewPolicyRepository(nil, nil)
 	repo.selectorCache = testSelectorCache
diff --git a/test/k8sT/manifests/demo-customcalls.yaml b/test/k8sT/manifests/demo-customcalls.yaml
index a48c13bfff..6d5ed10320 100644
--- a/test/k8sT/manifests/demo-customcalls.yaml
+++ b/test/k8sT/manifests/demo-customcalls.yaml
@@ -99,7 +99,7 @@ metadata:
 spec:
   containers:
   - name: cilium-builder
-    image: quay.io/cilium/cilium-builder:4a20eeed8b8994f08df412e61ad490b190ee8b65@sha256:084347720fe1425642f0df627205d73ab700b623892068c98025c90b658ebf73
+    image: quay.io/cilium/cilium-builder:ca4eec60d250c8e370ed685d89bdbca26788144c@sha256:cfa857527c2aa1a0431b895a6c9617e8fe866a1491fc8c8cf88ec912bbf782ee
     workingDir: /cilium
     command: ["sleep"]
     args:
diff --git a/test/kubernetes-test.sh b/test/kubernetes-test.sh
index c8e95cd966..a6ef8bf9ed 100755
--- a/test/kubernetes-test.sh
+++ b/test/kubernetes-test.sh
@@ -65,7 +65,7 @@ test -d kubernetes && rm -rfv kubernetes
 git clone https://github.com/kubernetes/kubernetes.git -b ${KUBERNETES_VERSION} --depth 1
 cd kubernetes
 
-GO_VERSION="1.16.6"
+GO_VERSION="1.16.7"
 sudo rm -fr /usr/local/go
 curl -LO https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz
 sudo tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz
diff --git a/test/packet/scripts/install.sh b/test/packet/scripts/install.sh
index 7b45e6074c..7a68586722 100644
--- a/test/packet/scripts/install.sh
+++ b/test/packet/scripts/install.sh
@@ -5,7 +5,7 @@ set -e
 # Ensure no prompts from apt & co.
 export DEBIAN_FRONTEND=noninteractive
 
-GOLANG_VERSION="1.16.6"
+GOLANG_VERSION="1.16.7"
 VAGRANT_VERSION="2.2.16"
 PACKER_VERSION="1.3.5"