Repository: cilium/cilium
Pull request #10068 (2020-02-05 15:38:45)

linux: check policy routing of running kernel
Check the payload of the NLMSG_DONE type netlink
message for possible error, then determine whether
CONFIG_IP_MULTIPLE_TABLES is enabled.

Signed-off-by: Jianlin Lv <Jianlin.Lv@arm.com>

Fixes: #9834

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/cilium/cilium/10068)
<!-- Reviewable:end -->


coveralls: 
[![Coverage Status](https://coveralls.io/builds/28547412/badge)](https://coveralls.io/builds/28547412)

Coverage decreased (-0.009%) to 44.674% when pulling **f341cdff365ce5bbbedc1d120d929211c4d368e9 on iecedge:check_policy_ru** into **161fcd49340561363521f71e76d4408dcae9fe5c on cilium:master**.

maintainer-s-little-helper[bot]: Release note label not set, please set the appropriate release note.
joestringer: test-me-please
Jianlin-lv: > This looks nice and tidy!
> 
> Did you already submit the vendor change to the upstream library? If not, please do. We can rebase the netlink dependency on top when the upstream change is merged.

The change is already upstream, https://github.com/vishvananda/netlink/pull/520
joestringer: > The change is already upstream, vishvananda/netlink#520

Thanks. When the above is merged, please update this PR to the new version of the library using these instructions:

http://docs.cilium.io/en/latest/contributing/development/dev_setup/#add-update-a-golang-dependency
Jianlin-lv: > > The change is already upstream, [vishvananda/netlink#520](https://github.com/vishvananda/netlink/pull/520)
> 
> Thanks. When the above is merged, please update this PR to the new version of the library using these instructions:
> 
> http://docs.cilium.io/en/latest/contributing/development/dev_setup/#add-update-a-golang-dependency

@joestringer, vishvananda/netlink#520 have been merged,
When locally update github.com/vishvananda/netlink to latest and recompiling, 
I encountered one issue that
"# Github.com/vishvananda/netlink/nl
../../vendor/github.com/vishvananda/netlink/nl/addr_linux.go:58:2: undefined: unix.IfaCacheinfo
"
This issue needs to be resolved by upgrading golang.org/x/sys/unix， Refer：https://github.com/vishvananda/netlink/pull/514

I see "pinned to release-branch.go1.13" in the go.mod about sys/unix
Could I upgrade golang.org/x/sys/unix to latest?
joestringer: I think that makes sense, unfortunate it's relying on such a new implementation. /cc @aanm who will review such changes.
aanm: @Jianlin-lv it is be fine to pin the sys/unix to latest because Go 1.14 will be released during the Cilium 1.8 dev cycle.
aanm: @iecedge ^^^
iecedge: > Please run `./contrib/go-mod/update-vendor.sh` for each commit as there are files being added in the vendor directory that are not required.

vendor have been update by https://github.com/cilium/cilium/pull/10138 
This PR only keep code of checking policy routing
aanm: test-me-please

Patch:
diff --git a/.travis/prepare.sh b/.travis/prepare.sh
index 3b5c759940..b5e0455994 100755
--- a/.travis/prepare.sh
+++ b/.travis/prepare.sh
@@ -15,6 +15,5 @@ NEWPATH="/usr/local/clang/bin"
 export PATH="$NEWPATH:$PATH"
 
 # disable go modules to avoid downloading all dependencies when doing go get
-GO111MODULE=off go get github.com/cilium/go-bindata/go-bindata
 GO111MODULE=off go get golang.org/x/tools/cmd/cover
 GO111MODULE=off go get github.com/mattn/goveralls
diff --git a/CODEOWNERS b/CODEOWNERS
index 059979c977..6e8335cdb1 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -36,7 +36,6 @@ contrib/packaging/deb/ @eloycoto
 contrib/packaging/docker/ @aanm @ianvernon
 contrib/vagrant @cilium/ci
 daemon/ @cilium/agent
-daemon/bpf.sha @cilium/bpf
 daemon/datapath.* @cilium/bpf
 daemon/endpoint.* @cilium/endpoint
 daemon/health.* @cilium/health
diff --git a/Dockerfile b/Dockerfile
index 538baaba17..25e9278cba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ FROM quay.io/cilium/cilium-envoy:c31482c3e49670980c05cafc914320f7949b266f as cil
 # versions to be built while allowing the new versions to make changes
 # that are not backwards compatible.
 #
-FROM quay.io/cilium/cilium-builder:2020-02-13 as builder
+FROM quay.io/cilium/cilium-builder:2020-02-19 as builder
 LABEL maintainer="maintainer@cilium.io"
 WORKDIR /go/src/github.com/cilium/cilium
 COPY . ./
diff --git a/Dockerfile.builder b/Dockerfile.builder
index e51853892d..6f53d22613 100644
--- a/Dockerfile.builder
+++ b/Dockerfile.builder
@@ -56,8 +56,4 @@ RUN curl -sfL https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz | tar
         go get -d -u github.com/gordonklaus/ineffassign && \
         cd /go/src/github.com/gordonklaus/ineffassign && \
         git checkout -b 1003c8bd00dc2869cb5ca5282e6ce33834fed514 1003c8bd00dc2869cb5ca5282e6ce33834fed514 && \
-        go install && \
-        go get -d github.com/cilium/go-bindata/... && \
-        cd /go/src/github.com/cilium/go-bindata && \
-        git checkout -b e950ad39c6092155a6d89f04c90b1c46d8c97d49 e950ad39c6092155a6d89f04c90b1c46d8c97d49 && \
-        go install github.com/cilium/go-bindata/go-bindata
+        go install
diff --git a/Documentation/cmdref/cilium-agent.md b/Documentation/cmdref/cilium-agent.md
index 9853f7f25d..d6547b9e2c 100644
--- a/Documentation/cmdref/cilium-agent.md
+++ b/Documentation/cmdref/cilium-agent.md
@@ -92,7 +92,6 @@ cilium-agent [flags]
       --ip-allocation-timeout duration                        Time after which an incomplete CIDR allocation is considered failed (default 2m0s)
       --ipam string                                           Backend to use for IPAM
       --ipsec-key-file string                                 Path to IPSec key file
-      --ipv4-cluster-cidr-mask-size int                       Mask size for the cluster wide CIDR (default 8)
       --ipv4-node string                                      IPv4 address of node (default "auto")
       --ipv4-pod-subnets strings                              List of IPv4 pod subnets to preconfigure for encryption
       --ipv4-range string                                     Per-node IPv4 endpoint prefix, e.g. 10.16.0.0/16 (default "auto")
@@ -111,7 +110,6 @@ cilium-agent [flags]
       --k8s-require-ipv6-pod-cidr                             Require IPv6 PodCIDR to be specified in node resource
       --k8s-watcher-endpoint-selector string                  K8s endpoint watcher will watch for these k8s endpoints (default "metadata.name!=kube-scheduler,metadata.name!=kube-controller-manager,metadata.name!=etcd-operator,metadata.name!=gcp-controller-manager")
       --k8s-watcher-queue-size uint                           Queue size used to serialize each k8s event type (default 1024)
-      --keep-bpf-templates                                    Do not restore BPF template files from binary
       --keep-config                                           When restoring state, keeps containers' configuration in place
       --kube-proxy-replacement string                         auto-enable available features for kube-proxy replacement ("probe"), or enable only selected features (will panic if any selected feature cannot be enabled) ("partial") or enable all features (will panic if any feature cannot be enabled) ("strict"), or completely disable it (ignores any selected feature) ("disabled") (default "partial")
       --kvstore string                                        Key-value store type
diff --git a/Documentation/contributing/development/dev_setup.rst b/Documentation/contributing/development/dev_setup.rst
index bb31e390b1..172162f12e 100644
--- a/Documentation/contributing/development/dev_setup.rst
+++ b/Documentation/contributing/development/dev_setup.rst
@@ -30,8 +30,6 @@ contribute to Cilium:
 +----------------------------------------------------------------------------------+--------------------------+-------------------------------------------------------------------------------+
 | `go <https://golang.org/dl/>`_                                                   | |GO_RELEASE|             | N/A (OS-specific)                                                             |
 +----------------------------------------------------------------------------------+--------------------------+-------------------------------------------------------------------------------+
-| `go-bindata <https://github.com/cilium/go-bindata>`_                             | ``a0ff2567cfb``          | ``go get -u github.com/cilium/go-bindata/...``                                |
-+----------------------------------------------------------------------------------+--------------------------+-------------------------------------------------------------------------------+
 + `ginkgo <https://github.com/onsi/ginkgo>`__                                      | >= 1.4.0                 | ``go get -u github.com/onsi/ginkgo/ginkgo``                                   |
 +----------------------------------------------------------------------------------+--------------------------+-------------------------------------------------------------------------------+
 + `gomega <https://github.com/onsi/gomega>`_                                       | >= 1.2.0                 | ``go get -u github.com/onsi/gomega``                                          |
diff --git a/Documentation/install/upgrade.rst b/Documentation/install/upgrade.rst
index 6ddf719e44..f2338e0a7d 100644
--- a/Documentation/install/upgrade.rst
+++ b/Documentation/install/upgrade.rst
@@ -291,6 +291,48 @@ Annotations:
    upgrade. Connections should successfully re-establish without requiring
    clients to reconnect.
 
+.. _1.8_upgrade_notes:
+
+1.8 Upgrade Notes
+-----------------
+
+.. _1.8_required_changes:
+
+IMPORTANT: Changes required before upgrading to 1.8.0
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. warning::
+
+   Do not upgrade to 1.8.0 before reading the following section and completing
+   the required steps.
+
+* While operating in direct-routing mode (``--tunnel=disabled``), traffic with
+  a destination address matching a particular CIDR is automatically excluded
+  from being masqueraded. So far, this CIDR consisted of
+  ``<alloc-cidr>/<size>`` where the size could be set with the option
+  ``--ipv4-cluster-cidr-mask-size``. This was not always desirable and
+  limiting, therefore Cilium 1.6 had already introduced the option
+  ``--native-routing-cidr`` allowing to explicitly specify the CIDR for native
+  routing. With Cilium 1.8, the option ``--ipv4-cluster-cidr-mask-size`` is
+  being deprecated and all users must use the option ``--native-routing-cidr``
+  instead.
+
+  .. note:: The ENI IPAM mode automatically derives the native routing CIDR so
+            no action is required.
+
+Deprecated options
+~~~~~~~~~~~~~~~~~~
+
+* ``keep-bpf-templates``: This option no longer has any effect due to the BPF
+  assets not being compiled into the cilium-agent binary anymore. The option is
+  deprecated and will be removed in Cilium 1.9.
+
+Removed options
+~~~~~~~~~~~~~~~
+
+* ``enable-legacy-services``: This option was deprecated in Cilium 1.6 and is
+  now removed.
+
 .. _1.7_upgrade_notes:
 
 1.7 Upgrade Notes
diff --git a/Makefile b/Makefile
index 5895e6757e..788c6342c4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,4 @@
 include Makefile.defs
-include daemon/bpf.sha
 
 SUBDIRS_CILIUM_CONTAINER := proxylib envoy plugins/cilium-cni bpf cilium daemon cilium-health bugtool
 ifdef LIBNETWORK_PLUGIN
@@ -12,9 +11,6 @@ TESTPKGS_EVAL := $(subst github.com/cilium/cilium/,,$(shell $(CGO_DISABLED) $(GO
 TESTPKGS ?= $(TESTPKGS_EVAL)
 GOLANGVERSION := $(shell $(GO) version 2>/dev/null | grep -Eo '(go[0-9].[0-9])')
 GOLANG_SRCFILES := $(shell for pkg in $(subst github.com/cilium/cilium/,,$(GOFILES)); do find $$pkg -name *.go -print; done | grep -v vendor | sort | uniq)
-BPF_FILES_EVAL := $(shell git ls-files $(ROOT_DIR)/bpf/ | grep -v .gitignore | tr "\n" ' ')
-BPF_FILES ?= $(BPF_FILES_EVAL)
-BPF_SRCFILES := $(subst ../,,$(BPF_FILES))
 
 SWAGGER_VERSION := v0.20.1
 SWAGGER := $(CONTAINER_ENGINE_FULL) run --rm -v $(CURDIR):$(CURDIR) -w $(CURDIR) --entrypoint swagger quay.io/goswagger/swagger:$(SWAGGER_VERSION)
@@ -148,7 +144,6 @@ unit-tests: start-kvstores
 	$(QUIET) $(MAKE) -C tools/maptool/
 	$(QUIET) $(MAKE) -C test/bpf/
 	test/bpf/unit-test
-	$(QUIET) $(MAKE) -C daemon/ check-bindata
 ifeq ($(SKIP_VET),"false")
 	$(MAKE) govet
 endif
@@ -193,11 +188,16 @@ clean: clean-container
 	-$(MAKE) -C ./contrib/packaging/rpm clean
 	-rm -f GIT_VERSION
 
-install:
+install-bpf:
+	$(INSTALL) -m 0750 -d $(DESTDIR)$(LOCALSTATEDIR)/lib/cilium
+	-rm -f $(DESTDIR)$(LOCALSTATEDIR)/lib/cilium/bpf
+	$(foreach bpfsrc,$(BPF_SRCFILES), $(INSTALL) -D -m 0644 $(bpfsrc) $(DESTDIR)$(LOCALSTATEDIR)/lib/cilium/$(bpfsrc);)
+
+install: install-bpf
 	$(INSTALL) -m 0755 -d $(DESTDIR)$(BINDIR)
 	for i in $(SUBDIRS); do $(MAKE) -C $$i install; done
 
-install-container:
+install-container: install-bpf
 	$(INSTALL) -m 0755 -d $(DESTDIR)$(BINDIR)
 	for i in $(SUBDIRS_CILIUM_CONTAINER); do $(MAKE) -C $$i install; done
 
diff --git a/Makefile.defs b/Makefile.defs
index f59ee3cfca..70ee0708a7 100644
--- a/Makefile.defs
+++ b/Makefile.defs
@@ -10,6 +10,7 @@ BINDIR?=$(PREFIX)/bin
 CNIBINDIR?=/opt/cni/bin
 CNICONFDIR?=/etc/cni/net.d
 LIBDIR?=$(PREFIX)/lib
+LOCALSTATEDIR?=/var
 RUNDIR?=/var/run
 CONFDIR?=/etc
 
@@ -29,12 +30,18 @@ ifneq ($(wildcard $(dir $(lastword $(MAKEFILE_LIST)))/.git),)
 else
 	GIT_VERSION = $(shell cat $(ROOT_DIR)/GIT_VERSION)
 endif
-BUILD = $(VERSION) $(GIT_VERSION) $(shell go version)
+BUILD = $(VERSION) $(GIT_VERSION) $(shell $(GO) version)
 GOLDFLAGS = -X "github.com/cilium/cilium/pkg/version.Version=$(BUILD)"
 
 CILIUM_ENVOY_SHA=$(shell grep -o "FROM.*cilium/cilium-envoy:[0-9a-fA-F]*" $(ROOT_DIR)/Dockerfile | cut -d : -f 2)
 GOLDFLAGS += -X "github.com/cilium/cilium/pkg/envoy.RequiredEnvoyVersionSHA=$(CILIUM_ENVOY_SHA)"
-GOLDFLAGS += -X "github.com/cilium/cilium/pkg/datapath/loader.DatapathSHA=$(GO_BINDATA_SHA1SUM)"
+
+BPF_FILES_EVAL := $(shell git ls-files $(ROOT_DIR)/bpf/ | grep -v .gitignore | tr "\n" ' ')
+BPF_FILES ?= $(BPF_FILES_EVAL)
+BPF_SRCFILES := $(subst ../,,$(BPF_FILES))
+
+CILIUM_DATAPATH_SHA=$(shell cat $(BPF_FILES) | sha1sum | awk '{print $$1}')
+GOLDFLAGS += -X "github.com/cilium/cilium/pkg/datapath/loader.DatapathSHA=$(CILIUM_DATAPATH_SHA)"
 
 # Set DOCKER_IMAGE_TAG with "latest" by default
 ifeq ($(DOCKER_IMAGE_TAG),)
@@ -51,9 +58,9 @@ ifeq ($(GO111MODULE),on)
     GOCLEAN ?= -mod=vendor
 endif
 # Compile with '-mod=vendor' if go >= 1.13
-GO_MAJOR_VERSION_GE_1 := $(shell expr `go version | grep -E 'go[0-9]{1}+' -o | sed 's/go//g'` \>= 1)
+GO_MAJOR_VERSION_GE_1 := $(shell expr `$(GO) version | grep -E 'go[0-9]{1}+' -o | sed 's/go//g'` \>= 1)
 ifeq ($(GO_MAJOR_VERSION_GE_1),1)
-    GO_MINOR_VERSION_GE_13 := $(shell expr `go version | grep -E 'go[^ ]+' -o | sed 's/go1.//g'` \>= 13)
+    GO_MINOR_VERSION_GE_13 := $(shell expr `$(GO) version | grep -E 'go[^ ]+' -o | sed 's/go1.//g'` \>= 13)
     ifeq ($(GO_MINOR_VERSION_GE_13),1)
         GOFLAGS ?= -mod=vendor
         GOCLEAN ?= -mod=vendor
diff --git a/bpf/init.sh b/bpf/init.sh
index 71326b47fa..dac6e10ccf 100755
--- a/bpf/init.sh
+++ b/bpf/init.sh
@@ -456,8 +456,8 @@ case "${MODE}" in
 		CILIUM_IDX=$(cat /sys/class/net/${HOST_DEV1}/ifindex)
 		echo "#define CILIUM_IFINDEX $CILIUM_IDX" >> $RUNDIR/globals/node_config.h
 
-		CILIUM_EPHERMERAL_MIN=$(cat /proc/sys/net/ipv4/ip_local_port_range | awk '{print $1}')
-		echo "#define EPHERMERAL_MIN $CILIUM_EPHERMERAL_MIN" >> $RUNDIR/globals/node_config.h
+		CILIUM_EPHEMERAL_MIN=$(cat /proc/sys/net/ipv4/ip_local_port_range | awk '{print $1}')
+		echo "#define EPHEMERAL_MIN $CILIUM_EPHEMERAL_MIN" >> $RUNDIR/globals/node_config.h
 
 		if [ "$NODE_PORT" = "true" ]; then
 			sed -i '/^#.*NATIVE_DEV_IFINDEX.*$/d' $RUNDIR/globals/node_config.h
@@ -529,7 +529,7 @@ else
 fi
 
 if [ "$MODE" = "direct" ] || [ "$MODE" = "ipvlan" ] || [ "$MODE" = "routed" ] || [ "$NODE_PORT" = "true" ] ; then
-	if [ -z "$NATIVE_DEV" ]; then
+	if [ "$NATIVE_DEV" == "<nil>" ]; then
 		echo "No device specified for $MODE mode, ignoring..."
 	else
 		if [ "$IP6_HOST" != "<nil>" ]; then
@@ -631,7 +631,7 @@ bpf_load $HOST_DEV1 "" "ingress" bpf_hostdev_ingress.c bpf_hostdev_ingress.o to-
 # bpf_ipsec.o is also needed by proxy redirects, so we load it unconditionally
 bpf_load $HOST_DEV2 "" "ingress" bpf_ipsec.c bpf_ipsec.o from-netdev $CALLS_MAP
 if [ "$IPSEC" == "true" ]; then
-	if [ $ENCRYPT_DEV != "" ]; then
+	if [ "$ENCRYPT_DEV" != "<nil>" ]; then
 		bpf_load $ENCRYPT_DEV "" "ingress" bpf_network.c bpf_network.o from-network $CALLS_MAP
 	fi
 fi
@@ -639,7 +639,7 @@ if [ "$HOST_DEV1" != "$HOST_DEV2" ]; then
 	bpf_unload $HOST_DEV2 "egress"
 fi
 
-if [ -n "$XDP_DEV" ]; then
+if [ "$XDP_DEV" != "<nil>" ]; then
 	CIDR_MAP="cilium_cidr_v*"
 	COPTS=""
 	xdp_load $XDP_DEV $XDP_MODE "$COPTS" bpf_xdp.c bpf_xdp.o from-netdev $CIDR_MAP
diff --git a/bpf/lib/common.h b/bpf/lib/common.h
index 136375c292..7c46460dad 100644
--- a/bpf/lib/common.h
+++ b/bpf/lib/common.h
@@ -520,7 +520,7 @@ enum {
 #ifdef ENABLE_NODEPORT
 #define NAT_MIN_EGRESS		NODEPORT_PORT_MIN_NAT
 #else
-#define NAT_MIN_EGRESS		EPHERMERAL_MIN
+#define NAT_MIN_EGRESS		EPHEMERAL_MIN
 #endif
 
 enum {
diff --git a/bpf/lib/nodeport.h b/bpf/lib/nodeport.h
index e579fc6b8e..768293533c 100644
--- a/bpf/lib/nodeport.h
+++ b/bpf/lib/nodeport.h
@@ -1268,7 +1268,7 @@ static __always_inline int nodeport_nat_rev(struct __sk_buff *skb,
 		build_bug_on(!(NODEPORT_PORT_MIN_NAT < NODEPORT_PORT_MAX_NAT));
 		build_bug_on(!(NODEPORT_PORT_MIN     < NODEPORT_PORT_MAX));
 		build_bug_on(!(NODEPORT_PORT_MAX     < NODEPORT_PORT_MIN_NAT));
-		build_bug_on(!(NODEPORT_PORT_MAX     < EPHERMERAL_MIN));
+		build_bug_on(!(NODEPORT_PORT_MAX     < EPHEMERAL_MIN));
 		break;
 	}
 	return TC_ACT_OK;
diff --git a/bpf/node_config.h b/bpf/node_config.h
index 35db95c5d4..54771f9286 100644
--- a/bpf/node_config.h
+++ b/bpf/node_config.h
@@ -122,7 +122,7 @@ DEFINE_IPV6(SNAT_IPV6_EXTERNAL, 0xbe, 0xef, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0
 #define MONITOR_AGGREGATION 5
 #define MTU 1500
 #define ENABLE_IPSEC
-#define EPHERMERAL_MIN 32768
+#define EPHEMERAL_MIN 32768
 #ifdef ENABLE_MASQUERADE
 #define CT_MAP_TCP6 test_cilium_ct_tcp6_65535
 #define CT_MAP_ANY6 test_cilium_ct_any6_65535
diff --git a/contrib/backporting/check-stable b/contrib/backporting/check-stable
index 10f3f67951..26c321f508 100755
--- a/contrib/backporting/check-stable
+++ b/contrib/backporting/check-stable
@@ -152,7 +152,7 @@ generate_commit_list_for_pr () {
     entry_id=${entry_array[0]}
     entry_sha=${entry_array[1]}
     entry_sub=${entry_array[@]:2}
-    upstream="$(git log --since="1year" --pretty="%H" --no-merges --grep "$entry_sub" $REMOTE/master)"
+    upstream="$(git log -F --since="1year" --pretty="%H" --no-merges --grep "$entry_sub" $REMOTE/master)"
     upstream="$(git show $upstream | git patch-id)"
     upstream=($upstream)
     if [ "$entry_id" == "${upstream[0]}" ]; then
diff --git a/contrib/packaging/deb/Dockerfile b/contrib/packaging/deb/Dockerfile
index 740d1334fd..993b66aa29 100644
--- a/contrib/packaging/deb/Dockerfile
+++ b/contrib/packaging/deb/Dockerfile
@@ -19,8 +19,6 @@ RUN apt-get update && \
 ENV GOPATH /go
 ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH
 
-RUN go get -u github.com/cilium/go-bindata/...
-
 RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH"
 WORKDIR $GOPATH
 
diff --git a/contrib/packaging/rpm/Dockerfile b/contrib/packaging/rpm/Dockerfile
index d3e5348301..e93ac43205 100644
--- a/contrib/packaging/rpm/Dockerfile
+++ b/contrib/packaging/rpm/Dockerfile
@@ -6,7 +6,7 @@ RUN curl -sSL -o /etc/yum.repos.d/vbatts-bazel-fedora-28.repo \
 	https://copr.fedorainfracloud.org/coprs/vbatts/bazel/repo/fedora-28/vbatts-bazel-fedora-28.repo
 
 RUN dnf -y update && \
-	dnf -y install fedora-packager fedora-review golang go-bindata gettext \
+	dnf -y install fedora-packager fedora-review golang gettext \
 		git glibc-devel.x86_64 glibc-devel.i686 cmake bazel libtool wget \
 		clang make gcc-c++ elfutils-libelf-devel libstdc++-static && \
     mkdir -p /opt/cilium/
diff --git a/contrib/packaging/rpm/cilium.spec.envsubst b/contrib/packaging/rpm/cilium.spec.envsubst
index 9c334bb615..cb35465f20 100644
--- a/contrib/packaging/rpm/cilium.spec.envsubst
+++ b/contrib/packaging/rpm/cilium.spec.envsubst
@@ -59,7 +59,6 @@ Requires:      docker-engine >= 1.12, glibc-devel(x86-32), iproute >= 4.10, clan
 BuildRequires: %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang}
 
 BuildRequires: golang
-BuildRequires: go-bindata
 BuildRequires: glibc-devel(x86-32)
 BuildRequires: cmake
 BuildRequires: bazel
@@ -107,7 +106,6 @@ echo "%{version}.%{release}" > VERSION
 
 export PKG_BUILD=1
 
-make -C daemon apply-bindata
 make V=1 proxylib plugins bpf cilium daemon monitor cilium-health bugtool tools operator
 
 %install
diff --git a/contrib/scripts/bindata.sh b/contrib/scripts/bindata.sh
deleted file mode 100755
index 6a4a36f610..0000000000
--- a/contrib/scripts/bindata.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-arg1=$1
-
-BINDATA_FILE=bindata.go
-REQUIRED_GO_VERSION=$(cat ../GO_VERSION)
-
-if [[ "$arg1" == "apply" ]]; then
-  NEW_SHA1SUM=`sha1sum ${BINDATA_FILE} | awk '{ print $1}'`
-  GO_VERSION_USED=`go version | awk '{ print $3 }'`
-  BPF_FILES=`git ls-files ../bpf/ | grep -v .gitignore | tr "\n" ' '`
-  sed -i "s/GO_BINDATA_SHA1SUM=.*/GO_BINDATA_SHA1SUM=${NEW_SHA1SUM}/g" bpf.sha
-  sed -i "s#BPF_FILES=.*#BPF_FILES=${BPF_FILES}#g" bpf.sha
-  exit 0
-fi
-
-GO_BINDATA_SHA1SUM=$arg1
-
-if [[ $GO_BINDATA_SHA1SUM == "" ]]; then
-  echo "please provide a sha1sum for the expected bindata."
-  exit 1
-fi
-
-if echo "$GO_BINDATA_SHA1SUM bindata.go" | sha1sum -c --quiet; then
-  exit 0
-fi
-
-echo "########################################################################"
-echo ""
-echo "                  ERROR: bindata.go is out of date."
-echo ""
-echo " This can happen for two reasons:"
-echo " 1. You are using a go-bindata binary compiled with a different version"
-echo "    of golang (not ${REQUIRED_GO_VERSION}). If so, please up/downgrade."
-echo ""
-echo " 2. You have made changes to the bpf/ directory. Please run the"
-echo "    following command to update the SHA in daemon/bpf.sha:"
-echo ""
-echo "    $ make -C daemon apply-bindata"
-echo ""
-echo "########################################################################"
-
-exit 1
diff --git a/contrib/scripts/check-fmt.sh b/contrib/scripts/check-fmt.sh
index 37853cc067..faf1c1c28f 100755
--- a/contrib/scripts/check-fmt.sh
+++ b/contrib/scripts/check-fmt.sh
@@ -7,8 +7,7 @@ diff="$(find . ! \( -path './contrib' -prune \) \
         ! \( -path './vendor' -prune \) \
         ! \( -path './.git' -prune \) \
         ! \( -path '*.validate.go' -prune \) \
-        -type f -name '*.go' | grep -v "daemon/bindata.go" | \
-        xargs gofmt -d -l -s )"
+        -type f -name '*.go' | xargs gofmt -d -l -s )"
 
 if [ -n "$diff" ]; then
 	echo "Unformatted Go source code:"
diff --git a/contrib/scripts/fix-sha.sh b/contrib/scripts/fix-sha.sh
deleted file mode 100755
index e6f73d9cad..0000000000
--- a/contrib/scripts/fix-sha.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-SHA_PATH="daemon/bpf.sha"
-MAKE=${MAKE:-"make"}
-if [ ! -e "$SHA_PATH" ]; then
-	echo "Could not locate bpf.sha. Are you in the right directory?" >&2
-	exit 1
-fi
-
-echo "GO_BINDATA_SHA1SUM=01234567890abcdef78901234567890abcdef789" > "$SHA_PATH"
-echo "BPF_FILES=../bpf/.gitignore" >> "$SHA_PATH"
-${MAKE} -C daemon apply-bindata
-${MAKE} -C daemon apply-bindata
diff --git a/contrib/shell/util.sh b/contrib/shell/util.sh
index 52f83a49b2..64bc11877e 100644
--- a/contrib/shell/util.sh
+++ b/contrib/shell/util.sh
@@ -81,34 +81,4 @@ function relative() {
     done
 }
 
-# Continue rebasing and progressively update the daemon/bpf.sha each time there
-# is a merge conflict for it. If there are merge conflicts in other files, it
-# will stop rebasing and return for user input.
-#
-# Expected usage:
-#   $ git rebase origin/master
-#   <Merge failure on daemon/bpf.sha>
-#   $ rebase-bindata
-#   <For each conflict, your editor opens to review the commit. Save & exit>
-function rebase-bindata
-{
-    (
-        local dir
-        if ! git rebase --show-current-patch ; then
-            return
-        fi
-        set -x
-        while ! git rebase --continue ; do
-            dir=$(cd $(dirname ${BASH_SOURCE})/../.. && pwd)
-            $dir/contrib/scripts/fix-sha.sh
-            git add daemon/bpf.sha
-            if [ $(git diff --diff-filter=U | wc -l) -ne 0 ]; then
-                echo "Files that need manual merge:"
-                git diff --name-only --diff-filter=U
-                break
-            fi
-        done
-    )
-}
-
 trap "echo" EXIT
diff --git a/daemon/.gitignore b/daemon/.gitignore
index 626f19d2bd..cdfd18074a 100644
--- a/daemon/.gitignore
+++ b/daemon/.gitignore
@@ -1,5 +1,3 @@
-bindata.go
-
 cilium
 cilium-agent
 cilium-node-monitor
diff --git a/daemon/Makefile b/daemon/Makefile
index ddbd83de2a..8f2c5e9c80 100644
--- a/daemon/Makefile
+++ b/daemon/Makefile
@@ -1,25 +1,13 @@
-# We keep track of the SHA over bindata.go plus the go version used to
-# generate the bindata.go as it affects the generated code. A change
-# of version is likely causing a SHA conflict as well.
-include bpf.sha
-
 # GOBUILD relies on the order of makefile list to get VERSION file
 include ../Makefile.defs
 
-
 TARGET=cilium-agent
 LINKS=cilium-node-monitor
 SOURCES := $(shell find ../api ../common ../daemon ../pkg . \( -name '*.go'  ! -name '*_test.go' \))
-$(TARGET): $(SOURCES) check-bindata
+$(TARGET): $(SOURCES)
 	@$(ECHO_GO)
 	$(QUIET) CGO_ENABLED=0 $(GO) build $(GOBUILD) -o $(TARGET)
 
-GO_BINDATA := $(QUIET) go-bindata -prefix ../ -mode 0640 -modtime 1450269211 \
-	-ignore Makefile -ignore bpf_features.h -ignore lxc_config.h \
-	-ignore netdev_config.h -ignore node_config.h -ignore filter_config.h \
-	-ignore '.+\.o$$' -ignore '.+\.orig$$' -ignore '.+~$$' \
-	-ignore '\.DS_Store'
-
 all: $(TARGET) links
 
 links:
@@ -47,16 +35,3 @@ install:
 	$(foreach link,$(LINKS), ln -f -s $(TARGET) $(DESTDIR)$(BINDIR)/$(link) || cp $(TARGET) $(DESTDIR)$(BINDIR)/$(link);)
 
 endif
-
-.PHONY: check-bindata
-check-bindata: bindata.go
-	@echo "  CHECK contrib/scripts/bindata.sh"
-	$(QUIET) ../contrib/scripts/bindata.sh $(GO_BINDATA_SHA1SUM)
-
-apply-bindata: go-bindata
-	@$(ECHO_GEN)bpf.sha
-	$(QUIET) ../contrib/scripts/bindata.sh apply
-
-bindata.go go-bindata: $(BPF_FILES)
-	@$(ECHO_GEN) $@
-	$(GO_BINDATA) -o ./bindata.go $(BPF_FILES)
diff --git a/daemon/bpf.sha b/daemon/bpf.sha
deleted file mode 100644
index d846a53a0d..0000000000
--- a/daemon/bpf.sha
+++ /dev/null
@@ -1,2 +0,0 @@
-GO_BINDATA_SHA1SUM=cbfa4658613722c813e201abf9cab36a5653b20f
-BPF_FILES=../bpf/COPYING ../bpf/Makefile ../bpf/Makefile.bpf ../bpf/bpf_alignchecker.c ../bpf/bpf_features.h ../bpf/bpf_hostdev_ingress.c ../bpf/bpf_ipsec.c ../bpf/bpf_lxc.c ../bpf/bpf_netdev.c ../bpf/bpf_network.c ../bpf/bpf_overlay.c ../bpf/bpf_sock.c ../bpf/bpf_xdp.c ../bpf/cilium-map-migrate.c ../bpf/filter_config.h ../bpf/include/bpf/api.h ../bpf/include/elf/elf.h ../bpf/include/elf/gelf.h ../bpf/include/elf/libelf.h ../bpf/include/iproute2/bpf_elf.h ../bpf/include/linux/bpf.h ../bpf/include/linux/bpf_common.h ../bpf/include/linux/byteorder.h ../bpf/include/linux/byteorder/big_endian.h ../bpf/include/linux/byteorder/little_endian.h ../bpf/include/linux/icmp.h ../bpf/include/linux/icmpv6.h ../bpf/include/linux/if_arp.h ../bpf/include/linux/if_ether.h ../bpf/include/linux/if_packet.h ../bpf/include/linux/in.h ../bpf/include/linux/in6.h ../bpf/include/linux/ioctl.h ../bpf/include/linux/ip.h ../bpf/include/linux/ipv6.h ../bpf/include/linux/perf_event.h ../bpf/include/linux/swab.h ../bpf/include/linux/tcp.h ../bpf/include/linux/type_mapper.h ../bpf/include/linux/udp.h ../bpf/init.sh ../bpf/lib/arp.h ../bpf/lib/common.h ../bpf/lib/config.h ../bpf/lib/conntrack.h ../bpf/lib/conntrack_map.h ../bpf/lib/conntrack_test.h ../bpf/lib/csum.h ../bpf/lib/dbg.h ../bpf/lib/drop.h ../bpf/lib/encap.h ../bpf/lib/eps.h ../bpf/lib/eth.h ../bpf/lib/events.h ../bpf/lib/icmp6.h ../bpf/lib/identity.h ../bpf/lib/ipv4.h ../bpf/lib/ipv6.h ../bpf/lib/ipv6_test.h ../bpf/lib/l3.h ../bpf/lib/l4.h ../bpf/lib/lb.h ../bpf/lib/lxc.h ../bpf/lib/maps.h ../bpf/lib/metrics.h ../bpf/lib/nat.h ../bpf/lib/nat46.h ../bpf/lib/nodeport.h ../bpf/lib/policy.h ../bpf/lib/signal.h ../bpf/lib/tailcall.h ../bpf/lib/trace.h ../bpf/lib/utils.h ../bpf/lib/xdp.h ../bpf/lxc_config.h ../bpf/netdev_config.h ../bpf/node_config.h ../bpf/probes/raw_change_tail.t ../bpf/probes/raw_fib_lookup.t ../bpf/probes/raw_insn.h ../bpf/probes/raw_invalidate_hash.t ../bpf/probes/raw_lpm_map.t ../bpf/probes/raw_lru_map.t ../bpf/probes/raw_main.c ../bpf/probes/raw_max_insn.t ../bpf/probes/raw_sock_cookie.t ../bpf/run_probes.sh ../bpf/sockops/Makefile ../bpf/sockops/bpf_redir.c ../bpf/sockops/bpf_sockops.c ../bpf/sockops/bpf_sockops.h ../bpf/sockops/sockops_config.h 
diff --git a/daemon/daemon_main.go b/daemon/daemon_main.go
index c284f53a94..a357133216 100644
--- a/daemon/daemon_main.go
+++ b/daemon/daemon_main.go
@@ -23,13 +23,13 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 
 	"github.com/cilium/cilium/api/v1/server"
 	"github.com/cilium/cilium/api/v1/server/restapi"
 	"github.com/cilium/cilium/common"
-	_ "github.com/cilium/cilium/pkg/alignchecker"
 	"github.com/cilium/cilium/pkg/bpf"
 	"github.com/cilium/cilium/pkg/cgroups"
 	"github.com/cilium/cilium/pkg/cleanup"
@@ -59,6 +59,7 @@ import (
 	"github.com/cilium/cilium/pkg/policy"
 	"github.com/cilium/cilium/pkg/pprof"
 	"github.com/cilium/cilium/pkg/probe"
+	"github.com/cilium/cilium/pkg/sysctl"
 	"github.com/cilium/cilium/pkg/version"
 
 	"github.com/go-openapi/loads"
@@ -329,10 +330,6 @@ func init() {
 	flags.StringSlice(option.HostReachableServicesProtos, []string{option.HostServicesTCP, option.HostServicesUDP}, "Only enable reachability of services for host applications for specific protocols")
 	option.BindEnv(option.HostReachableServicesProtos)
 
-	flags.Bool(option.DeprecatedEnableLegacyServices, false, "Enable legacy (prior-v1.5) services")
-	flags.MarkDeprecated(option.DeprecatedEnableLegacyServices, "this option is deprecated as of v1.6")
-	option.BindEnv(option.DeprecatedEnableLegacyServices)
-
 	flags.Bool(option.EnableAutoDirectRoutingName, defaults.EnableAutoDirectRouting, "Enable automatic L2 routing between nodes")
 	option.BindEnv(option.EnableAutoDirectRoutingName)
 
@@ -408,6 +405,7 @@ func init() {
 
 	flags.Int(option.IPv4ClusterCIDRMaskSize, 8, "Mask size for the cluster wide CIDR")
 	option.BindEnv(option.IPv4ClusterCIDRMaskSize)
+	flags.MarkDeprecated(option.IPv4ClusterCIDRMaskSize, "This option is no longer supported and will be removed in v1.9")
 
 	flags.String(option.IPv4Range, AutoCIDR, "Per-node IPv4 endpoint prefix, e.g. 10.16.0.0/16")
 	option.BindEnv(option.IPv4Range)
@@ -458,6 +456,7 @@ func init() {
 
 	flags.Bool(option.KeepBPFTemplates, false, "Do not restore BPF template files from binary")
 	option.BindEnv(option.KeepBPFTemplates)
+	flags.MarkDeprecated(option.KeepBPFTemplates, "This option is no longer supported and will be removed in v1.9")
 
 	flags.String(option.KVStore, "", "Key-value store type")
 	option.BindEnv(option.KVStore)
@@ -722,9 +721,9 @@ func init() {
 	viper.BindPFlags(flags)
 }
 
-// RestoreExecPermissions restores file permissions to 0740 of all files inside
+// restoreExecPermissions restores file permissions to 0740 of all files inside
 // `searchDir` with the given regex `patterns`.
-func RestoreExecPermissions(searchDir string, patterns ...string) error {
+func restoreExecPermissions(searchDir string, patterns ...string) error {
 	fileList := []string{}
 	err := filepath.Walk(searchDir, func(path string, f os.FileInfo, err error) error {
 		for _, pattern := range patterns {
@@ -881,20 +880,11 @@ func initEnv(cmd *cobra.Command) {
 	if err := os.MkdirAll(option.Config.LibDir, defaults.RuntimePathRights); err != nil {
 		scopedLog.WithError(err).Fatal("Could not create library directory")
 	}
-	if !option.Config.KeepTemplates {
-		// We need to remove the old probes here as otherwise stale .t tests could
-		// still reside from newer Cilium versions which might break downgrade.
-		if err := os.RemoveAll(filepath.Join(option.Config.BpfDir, "/probes/")); err != nil {
-			scopedLog.WithError(err).Fatal("Could not delete old probes from library directory")
-		}
-		if err := RestoreAssets(option.Config.LibDir, defaults.BpfDir); err != nil {
-			scopedLog.WithError(err).Fatal("Unable to restore agent assets")
-		}
-		// Restore permissions of executable files
-		if err := RestoreExecPermissions(option.Config.LibDir, `.*\.sh`); err != nil {
-			scopedLog.WithError(err).Fatal("Unable to restore agent assets")
-		}
+	// Restore permissions of executable files
+	if err := restoreExecPermissions(option.Config.LibDir, `.*\.sh`); err != nil {
+		scopedLog.WithError(err).Fatal("Unable to restore agent asset permissions")
 	}
+
 	if option.Config.MaxControllerInterval < 0 {
 		scopedLog.Fatalf("Invalid %s value %d", option.MaxCtrlIntervalName, option.Config.MaxControllerInterval)
 	}
@@ -1507,6 +1497,16 @@ func initKubeProxyReplacementOptions() {
 				option.Config.EnableExternalIPs = false
 			}
 		}
+
+		if err := checkNodePortAndEphemeralPortRanges(); err != nil {
+			if strict {
+				log.Fatal(err)
+			} else {
+				log.Warn(fmt.Sprintf("%s Disabling the feature.", err))
+				option.Config.EnableNodePort = false
+				option.Config.EnableExternalIPs = false
+			}
+		}
 	}
 
 	if option.Config.EnableNodePort && option.Config.Device == "undefined" {
@@ -1566,3 +1566,25 @@ func initKubeProxyReplacementOptions() {
 		option.Config.EnableExternalIPs = false
 	}
 }
+
+func checkNodePortAndEphemeralPortRanges() error {
+	val, err := sysctl.Read("net.ipv4.ip_local_port_range")
+	if err != nil {
+		return fmt.Errorf("Unable to read net.ipv4.ip_local_port_range")
+	}
+	ephemeralPortRange := strings.Split(val, "\t")
+	if len(ephemeralPortRange) != 2 {
+		return fmt.Errorf("Invalid ephemeral port range: %s", val)
+	}
+	ephemeralPortMin, err := strconv.Atoi(ephemeralPortRange[0])
+	if err != nil {
+		return fmt.Errorf("Unable to parse min port value %s for ephemeral range", ephemeralPortRange[0])
+	}
+	if !(option.Config.NodePortMax < ephemeralPortMin) {
+		msg := `NodePort range (%d-%d) max port must be smaller than ephemeral range (%s-%s) min port. ` +
+			`Adjust ephemeral range port with "sysctl -w net.ipv4.ip_local_port_range='MIN MAX'".`
+		return fmt.Errorf(msg, option.Config.NodePortMin, option.Config.NodePortMax,
+			ephemeralPortRange[0], ephemeralPortRange[1])
+	}
+	return nil
+}
diff --git a/daemon/ipam.go b/daemon/ipam.go
index 6543f4f8d2..54d6d75a6d 100644
--- a/daemon/ipam.go
+++ b/daemon/ipam.go
@@ -284,7 +284,6 @@ func (d *Daemon) allocateIPs() error {
 	log.Infof("  Internal-Node IPv4: %s", node.GetInternalIPv4())
 
 	if option.Config.EnableIPv4 {
-		log.Infof("  Cluster IPv4 prefix: %s", node.GetIPv4ClusterRange())
 		log.Infof("  IPv4 allocation prefix: %s", node.GetIPv4AllocRange())
 
 		if c := option.Config.IPv4NativeRoutingCIDR(); c != nil {
@@ -329,8 +328,6 @@ func (d *Daemon) bootstrapIPAM() {
 	bootstrapStats.ipam.Start()
 	log.Info("Initializing node addressing")
 
-	node.SetIPv4ClusterCidrMaskSize(option.Config.IPv4ClusterCIDRMaskSize)
-
 	if option.Config.IPv4Range != AutoCIDR {
 		allocCIDR, err := cidr.ParseCIDR(option.Config.IPv4Range)
 		if err != nil {
diff --git a/daemon/policy.go b/daemon/policy.go
index e1ee18ea78..0b2683750f 100644
--- a/daemon/policy.go
+++ b/daemon/policy.go
@@ -18,6 +18,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	stdlog "log"
 	"net"
 	"strings"
 	"sync"
@@ -43,7 +44,6 @@ import (
 	"github.com/cilium/cilium/pkg/uuid"
 
 	"github.com/go-openapi/runtime/middleware"
-	"github.com/op/go-logging"
 )
 
 type policyTriggerMetrics struct{}
@@ -144,7 +144,7 @@ func (h *getPolicyResolve) Handle(params GetPolicyResolveParams) middleware.Resp
 			Trace:   policy.TRACE_ENABLED,
 			To:      labels.NewSelectLabelArrayFromModel(ctx.To.Labels),
 			DPorts:  ctx.To.Dports,
-			Logging: logging.NewLogBackend(buffer, "", 0),
+			Logging: stdlog.New(buffer, "", 0),
 		}
 		if ctx.Verbose {
 			searchCtx.Trace = policy.TRACE_VERBOSE
@@ -166,7 +166,7 @@ func (h *getPolicyResolve) Handle(params GetPolicyResolveParams) middleware.Resp
 	ctx := params.TraceSelector
 	ingressSearchCtx := policy.SearchContext{
 		Trace:   policy.TRACE_ENABLED,
-		Logging: logging.NewLogBackend(ingressBuffer, "", 0),
+		Logging: stdlog.New(ingressBuffer, "", 0),
 		From:    labels.NewSelectLabelArrayFromModel(ctx.From.Labels),
 		To:      labels.NewSelectLabelArrayFromModel(ctx.To.Labels),
 		DPorts:  ctx.To.Dports,
@@ -177,7 +177,7 @@ func (h *getPolicyResolve) Handle(params GetPolicyResolveParams) middleware.Resp
 
 	egressBuffer := new(bytes.Buffer)
 	egressSearchCtx := ingressSearchCtx
-	egressSearchCtx.Logging = logging.NewLogBackend(egressBuffer, "", 0)
+	egressSearchCtx.Logging = stdlog.New(egressBuffer, "", 0)
 
 	ingressVerdict := policyAPI.Allowed
 	egressVerdict := policyAPI.Allowed
diff --git a/daemon/status.go b/daemon/status.go
index 171bac21a4..85c863fade 100644
--- a/daemon/status.go
+++ b/daemon/status.go
@@ -168,14 +168,6 @@ func NewGetHealthzHandler(d *Daemon) GetHealthzHandler {
 	return &getHealthz{daemon: d}
 }
 
-func checkLocks(d *Daemon) {
-	// Try to acquire a couple of global locks to have the status API fail
-	// in case of a deadlock on these locks
-
-	option.Config.ConfigPatchMutex.Lock()
-	option.Config.ConfigPatchMutex.Unlock()
-}
-
 func (d *Daemon) getNodeStatus() *models.ClusterStatus {
 	clusterStatus := models.ClusterStatus{
 		Self: d.nodeDiscovery.LocalNode.Fullname(),
diff --git a/go.mod b/go.mod
index 8c0051b335..afb2e0307c 100644
--- a/go.mod
+++ b/go.mod
@@ -60,7 +60,6 @@ require (
 	github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c // indirect
 	github.com/onsi/ginkgo v1.10.1
 	github.com/onsi/gomega v1.7.0
-	github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
 	github.com/opencontainers/go-digest v1.0.0-rc1 // indirect
 	github.com/opencontainers/image-spec v1.0.1 // indirect
 	github.com/optiopay/kafka v0.0.0-20180809090225-01ce283b732b
diff --git a/go.sum b/go.sum
index ac8fba8386..fee71e6962 100644
--- a/go.sum
+++ b/go.sum
@@ -313,8 +313,6 @@ github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 h1:lDH9UUVJtmYCjyT0CI4q8xvlXPxeZ0gYCVvWbmPlp88=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
 github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
diff --git a/pkg/aws/eni/instances.go b/pkg/aws/eni/instances.go
index 71de5c448f..2216a0a016 100644
--- a/pkg/aws/eni/instances.go
+++ b/pkg/aws/eni/instances.go
@@ -33,14 +33,6 @@ type instanceAPI interface {
 	GetSecurityGroups(ctx context.Context) (types.SecurityGroupMap, error)
 }
 
-// instance is the minimal representation of an AWS instance as needed by the
-// ENI allocator
-type instance struct {
-	// enis is a map of all ENIs attached to the instance indexed by the
-	// ENI ID
-	enis map[string]*v2.ENI
-}
-
 // InstancesManager maintains the list of instances. It must be kept up to date
 // by calling resync() regularly.
 type InstancesManager struct {
diff --git a/pkg/bpf/map_linux.go b/pkg/bpf/map_linux.go
index bde358bcd3..353c89f1a8 100644
--- a/pkg/bpf/map_linux.go
+++ b/pkg/bpf/map_linux.go
@@ -25,7 +25,6 @@ import (
 	"os"
 	"path"
 	"reflect"
-	"sync"
 	"time"
 	"unsafe"
 
@@ -98,7 +97,6 @@ type Map struct {
 	fd   int
 	name string
 	path string
-	once sync.Once
 	lock lock.RWMutex
 
 	// inParallelMode is true when the Map is currently being run in
diff --git a/pkg/datapath/alignchecker/alignchecker.go b/pkg/datapath/alignchecker/alignchecker.go
index d890ab0350..2b6cc7af1f 100644
--- a/pkg/datapath/alignchecker/alignchecker.go
+++ b/pkg/datapath/alignchecker/alignchecker.go
@@ -28,7 +28,6 @@ import (
 	"github.com/cilium/cilium/pkg/maps/policymap"
 	"github.com/cilium/cilium/pkg/maps/sockmap"
 	"github.com/cilium/cilium/pkg/maps/tunnel"
-	"github.com/cilium/cilium/pkg/monitor"
 )
 
 // CheckStructAlignments checks whether size and offsets of the C and Go
@@ -69,10 +68,6 @@ func CheckStructAlignments(path string) error {
 			reflect.TypeOf(eppolicymap.EndpointKey{}),
 			reflect.TypeOf(tunnel.TunnelEndpoint{}),
 		},
-		"trace_notify":      {reflect.TypeOf(monitor.TraceNotify{})},
-		"drop_notify":       {reflect.TypeOf(monitor.DropNotify{})},
-		"debug_msg":         {reflect.TypeOf(monitor.DebugMsg{})},
-		"debug_capture_msg": {reflect.TypeOf(monitor.DebugCapture{})},
 	}
 	return check.CheckStructAlignments(path, toCheck)
 }
diff --git a/pkg/datapath/iptables/iptables.go b/pkg/datapath/iptables/iptables.go
index a7b715b38c..c779e3e7a6 100644
--- a/pkg/datapath/iptables/iptables.go
+++ b/pkg/datapath/iptables/iptables.go
@@ -644,9 +644,6 @@ func (m *IptablesManager) remoteSnatDstAddrExclusion() string {
 	case option.Config.IPv4NativeRoutingCIDR() != nil:
 		return option.Config.IPv4NativeRoutingCIDR().String()
 
-	case option.Config.Tunnel == option.TunnelDisabled:
-		return node.GetIPv4ClusterRange().String()
-
 	default:
 		return node.GetIPv4AllocRange().String()
 	}
diff --git a/pkg/datapath/linux/datapath.go b/pkg/datapath/linux/datapath.go
index 3c40d1914f..2495c7354a 100644
--- a/pkg/datapath/linux/datapath.go
+++ b/pkg/datapath/linux/datapath.go
@@ -37,18 +37,17 @@ type linuxDatapath struct {
 	node           datapath.NodeHandler
 	nodeAddressing datapath.NodeAddressing
 	config         DatapathConfiguration
-	configWriter   *config.HeaderfileWriter
 	loader         *loader.Loader
 }
 
 // NewDatapath creates a new Linux datapath
 func NewDatapath(cfg DatapathConfiguration, ruleManager datapath.IptablesManager) datapath.Datapath {
 	dp := &linuxDatapath{
+		ConfigWriter:    &config.HeaderfileWriter{},
+		IptablesManager: ruleManager,
 		nodeAddressing:  NewNodeAddressing(),
 		config:          cfg,
-		ConfigWriter:    &config.HeaderfileWriter{},
 		loader:          loader.NewLoader(canDisableDwarfRelocations),
-		IptablesManager: ruleManager,
 	}
 
 	dp.node = NewNodeHandler(cfg, dp.nodeAddressing)
diff --git a/pkg/datapath/linux/ipsec/ipsec_linux.go b/pkg/datapath/linux/ipsec/ipsec_linux.go
index 212ffd137d..78a4682bd1 100644
--- a/pkg/datapath/linux/ipsec/ipsec_linux.go
+++ b/pkg/datapath/linux/ipsec/ipsec_linux.go
@@ -364,6 +364,9 @@ func DeleteIPsecEndpoint(remote *net.IPNet) {
 }
 
 func isXfrmPolicyCilium(policy netlink.XfrmPolicy) bool {
+	if policy.Mark == nil {
+		return false
+	}
 	if policy.Mark.Mask != linux_defaults.RouteMarkMask {
 		return false
 	}
@@ -375,6 +378,9 @@ func isXfrmPolicyCilium(policy netlink.XfrmPolicy) bool {
 }
 
 func isXfrmStateCilium(state netlink.XfrmState) bool {
+	if state.Mark == nil {
+		return false
+	}
 	if state.Mark.Mask != linux_defaults.RouteMarkMask {
 		return false
 	}
diff --git a/pkg/datapath/linux/node.go b/pkg/datapath/linux/node.go
index eba4b324eb..a3ae841a25 100644
--- a/pkg/datapath/linux/node.go
+++ b/pkg/datapath/linux/node.go
@@ -36,7 +36,7 @@ import (
 	"github.com/vishvananda/netlink"
 )
 
-var (
+const (
 	wildcardIPv4 = "0.0.0.0"
 	wildcardIPv6 = "0::0"
 )
@@ -215,19 +215,6 @@ func installDirectRoute(CIDR *cidr.CIDR, nodeIP net.IP) (routeSpec *netlink.Rout
 	return
 }
 
-func (n *linuxNodeHandler) lookupDirectRoute(CIDR *cidr.CIDR, nodeIP net.IP) ([]netlink.Route, error) {
-	routeSpec, err := createDirectRouteSpec(CIDR, nodeIP)
-	if err != nil {
-		return nil, err
-	}
-
-	family := netlink.FAMILY_V4
-	if nodeIP.To4() == nil {
-		family = netlink.FAMILY_V6
-	}
-	return netlink.RouteListFiltered(family, routeSpec, netlink.RT_FILTER_DST|netlink.RT_FILTER_GW|netlink.RT_FILTER_OIF)
-}
-
 func (n *linuxNodeHandler) updateDirectRoute(oldCIDR, newCIDR *cidr.CIDR, oldIP, newIP net.IP, firstAddition, directRouteEnabled bool) error {
 	if !directRouteEnabled {
 		// When the protocol family is disabled, the initial node addition will
diff --git a/pkg/datapath/linux/requirements.go b/pkg/datapath/linux/requirements.go
index a131d80a9e..88e45492b8 100644
--- a/pkg/datapath/linux/requirements.go
+++ b/pkg/datapath/linux/requirements.go
@@ -30,6 +30,7 @@ import (
 	"github.com/cilium/cilium/pkg/versioncheck"
 
 	go_version "github.com/blang/semver"
+	"github.com/vishvananda/netlink"
 	"golang.org/x/sys/unix"
 )
 
@@ -147,6 +148,12 @@ func CheckMinRequirements() {
 			"version is %s; kernel version that is running is: %s", minKernelVer, kernelVersion)
 	}
 
+	_, err = netlink.RuleList(netlink.FAMILY_V4)
+	if err == unix.EAFNOSUPPORT {
+		log.WithError(err).Error("Policy routing:NOT OK. " +
+			"Please enable kernel configuration item CONFIG_IP_MULTIPLE_TABLES")
+	}
+
 	if option.Config.EnableIPv6 {
 		if _, err := os.Stat("/proc/net/if_inet6"); os.IsNotExist(err) {
 			log.Fatalf("kernel: ipv6 is enabled in agent but ipv6 is either disabled or not compiled in the kernel")
@@ -203,6 +210,9 @@ func CheckMinRequirements() {
 	if err := os.Chdir(option.Config.LibDir); err != nil {
 		log.WithError(err).WithField(logfields.Path, option.Config.LibDir).Fatal("Could not change to runtime directory")
 	}
+	if _, err := os.Stat(option.Config.BpfDir); os.IsNotExist(err) {
+		log.WithError(err).Fatalf("BPF template directory: NOT OK. Please run 'make install-bpf'")
+	}
 	probeScript := filepath.Join(option.Config.BpfDir, "run_probes.sh")
 	if err := exec.Command(probeScript, option.Config.BpfDir, option.Config.StateDir).Run(); err != nil {
 		log.WithError(err).Fatal("BPF Verifier: NOT OK. Unable to run checker for bpf_features")
diff --git a/pkg/datapath/linux/route/route.go b/pkg/datapath/linux/route/route.go
index 04ae26e159..794a6ca040 100644
--- a/pkg/datapath/linux/route/route.go
+++ b/pkg/datapath/linux/route/route.go
@@ -47,10 +47,6 @@ func (r *Route) LogFields() logrus.Fields {
 	}
 }
 
-func (r *Route) getLogger() *logrus.Entry {
-	return log.WithFields(r.LogFields())
-}
-
 // ByMask is used to sort an array of routes by mask, narrow first.
 type ByMask []Route
 
diff --git a/pkg/datapath/loader/base.go b/pkg/datapath/loader/base.go
index 1db0850351..0125c14b0d 100644
--- a/pkg/datapath/loader/base.go
+++ b/pkg/datapath/loader/base.go
@@ -154,6 +154,9 @@ func (l *Loader) Reinitialize(ctx context.Context, o datapath.BaseProgramOwner,
 
 		args[initArgDevicePreFilter] = option.Config.DevicePreFilter
 		args[initArgModePreFilter] = option.Config.ModePreFilter
+	} else {
+		args[initArgDevicePreFilter] = "<nil>"
+		args[initArgModePreFilter] = "<nil>"
 	}
 
 	args[initArgLib] = option.Config.BpfDir
@@ -206,6 +209,8 @@ func (l *Loader) Reinitialize(ctx context.Context, o datapath.BaseProgramOwner,
 
 	if option.Config.EncryptInterface != "" {
 		args[initArgEncryptInterface] = option.Config.EncryptInterface
+	} else {
+		args[initArgEncryptInterface] = "<nil>"
 	}
 
 	if option.Config.Device != "undefined" {
@@ -229,6 +234,7 @@ func (l *Loader) Reinitialize(ctx context.Context, o datapath.BaseProgramOwner,
 		args[initArgDevice] = option.Config.Device
 	} else {
 		args[initArgMode] = option.Config.Tunnel
+		args[initArgDevice] = "<nil>"
 
 		if option.Config.IsFlannelMasterDeviceSet() {
 			args[initArgMode] = "flannel"
@@ -242,6 +248,8 @@ func (l *Loader) Reinitialize(ctx context.Context, o datapath.BaseProgramOwner,
 
 	if option.Config.EnableNodePort {
 		args[initArgNodePort] = "true"
+	} else {
+		args[initArgNodePort] = "false"
 	}
 
 	log.Info("Setting up base BPF datapath")
@@ -259,6 +267,12 @@ func (l *Loader) Reinitialize(ctx context.Context, o datapath.BaseProgramOwner,
 		}
 	}
 
+	for i, arg := range args {
+		if arg == "" {
+			log.Warningf("empty argument passed to bpf/init.sh at position %d", i)
+		}
+	}
+
 	prog := filepath.Join(option.Config.BpfDir, "init.sh")
 	ctx, cancel := context.WithTimeout(ctx, defaults.ExecTimeout)
 	defer cancel()
diff --git a/pkg/datapath/loader/cache.go b/pkg/datapath/loader/cache.go
index 9bf50f61ec..4151105b8a 100644
--- a/pkg/datapath/loader/cache.go
+++ b/pkg/datapath/loader/cache.go
@@ -34,32 +34,30 @@ import (
 	"gopkg.in/fsnotify.v1"
 )
 
-var (
-	templateWatcherQueueSize = 10
-
-	ignoredELFPrefixes = []string{
-		"2/",                    // Calls within the endpoint
-		"HOST_IP",               // Global
-		"IPV6_NODEPORT",         // Global
-		"ROUTER_IP",             // Global
-		"SNAT_IPV6_EXTERNAL",    // Global
-		"cilium_ct",             // All CT maps, including local
-		"cilium_encrypt_state",  // Global
-		"cilium_events",         // Global
-		"cilium_ipcache",        // Global
-		"cilium_lb",             // Global
-		"cilium_lxc",            // Global
-		"cilium_metrics",        // Global
-		"cilium_nodeport_neigh", // All nodeport neigh maps
-		"cilium_policy",         // Global
-		"cilium_proxy",          // Global
-		"cilium_signals",        // Global
-		"cilium_snat",           // All SNAT maps
-		"cilium_tunnel",         // Global
-		"from-container",        // Prog name
-		"to-container",          // Prog name
-	}
-)
+const templateWatcherQueueSize = 10
+
+var ignoredELFPrefixes = []string{
+	"2/",                    // Calls within the endpoint
+	"HOST_IP",               // Global
+	"IPV6_NODEPORT",         // Global
+	"ROUTER_IP",             // Global
+	"SNAT_IPV6_EXTERNAL",    // Global
+	"cilium_ct",             // All CT maps, including local
+	"cilium_encrypt_state",  // Global
+	"cilium_events",         // Global
+	"cilium_ipcache",        // Global
+	"cilium_lb",             // Global
+	"cilium_lxc",            // Global
+	"cilium_metrics",        // Global
+	"cilium_nodeport_neigh", // All nodeport neigh maps
+	"cilium_policy",         // Global
+	"cilium_proxy",          // Global
+	"cilium_signals",        // Global
+	"cilium_snat",           // All SNAT maps
+	"cilium_tunnel",         // Global
+	"from-container",        // Prog name
+	"to-container",          // Prog name
+}
 
 // RestoreTemplates populates the object cache from templates on the filesystem
 // at the specified path.
diff --git a/pkg/datapath/loader/compile.go b/pkg/datapath/loader/compile.go
index 7fab412ab3..3fdbc78ed9 100644
--- a/pkg/datapath/loader/compile.go
+++ b/pkg/datapath/loader/compile.go
@@ -39,6 +39,15 @@ const (
 	outputObject   = OutputType("obj")
 	outputAssembly = OutputType("asm")
 	outputSource   = OutputType("c")
+
+	compiler = "clang"
+	linker   = "llc"
+
+	endpointPrefix   = "bpf_lxc"
+	endpointProg     = endpointPrefix + "." + string(outputSource)
+	endpointObj      = endpointPrefix + ".o"
+	endpointObjDebug = endpointPrefix + ".dbg.o"
+	endpointAsm      = endpointPrefix + string(outputAssembly)
 )
 
 // progInfo describes a program to be compiled with the expected output format
@@ -64,19 +73,11 @@ type directoryInfo struct {
 }
 
 var (
-	compiler       = "clang"
-	linker         = "llc"
 	standardCFlags = []string{"-O2", "-target", "bpf",
 		fmt.Sprintf("-D__NR_CPUS__=%d", runtime.NumCPU()),
 		"-Wno-address-of-packed-member", "-Wno-unknown-warning-option"}
 	standardLDFlags = []string{"-march=bpf", "-mcpu=probe"}
 
-	endpointPrefix   = "bpf_lxc"
-	endpointProg     = fmt.Sprintf("%s.%s", endpointPrefix, outputSource)
-	endpointObj      = fmt.Sprintf("%s.o", endpointPrefix)
-	endpointObjDebug = fmt.Sprintf("%s.dbg.o", endpointPrefix)
-	endpointAsm      = fmt.Sprintf("%s.%s", endpointPrefix, outputAssembly)
-
 	// testIncludes allows the unit tests to inject additional include
 	// paths into the compile command at test time. It is usually nil.
 	testIncludes []string
diff --git a/pkg/datapath/loader/loader.go b/pkg/datapath/loader/loader.go
index c44fefd6be..7d88cd9140 100644
--- a/pkg/datapath/loader/loader.go
+++ b/pkg/datapath/loader/loader.go
@@ -36,12 +36,9 @@ import (
 	"github.com/vishvananda/netlink"
 )
 
-var (
+const (
 	Subsystem = "datapath-loader"
-	log       = logging.DefaultLogger.WithField(logfields.LogSubsys, Subsystem)
-)
 
-const (
 	symbolFromEndpoint = "from-container"
 	symbolToEndpoint   = "to-container"
 
@@ -49,6 +46,8 @@ const (
 	dirEgress  = "egress"
 )
 
+var log = logging.DefaultLogger.WithField(logfields.LogSubsys, Subsystem)
+
 // Loader is a wrapper structure around operations related to compiling,
 // loading, and reloading datapath programs.
 type Loader struct {
diff --git a/pkg/datapath/loader/template.go b/pkg/datapath/loader/template.go
index eab9f37c6f..9c1df8e90b 100644
--- a/pkg/datapath/loader/template.go
+++ b/pkg/datapath/loader/template.go
@@ -29,14 +29,19 @@ import (
 	"github.com/cilium/cilium/pkg/maps/policymap"
 )
 
+const (
+	CallsMapName = "cilium_calls_"
+
+	templateSecurityID = identity.ReservedIdentityWorld
+	templateLxcID      = uint16(65535)
+)
+
 var (
-	TemplateSecurityID = identity.ReservedIdentityWorld
-	TemplateLxcID      = uint16(65535)
-	TemplateMAC        = mac.MAC([]byte{0x02, 0x00, 0x60, 0x0D, 0xF0, 0x0D})
-	TemplateIPv4       = []byte{192, 0, 2, 3}
-	TemplateIPv6       = []byte{0x20, 0x01, 0xdb, 0x8, 0x0b, 0xad, 0xca, 0xfe, 0x60, 0x0d, 0xbe, 0xe2, 0x0b, 0xad, 0xca, 0xfe}
+	templateIPv4 = []byte{192, 0, 2, 3}
+	templateIPv6 = []byte{0x20, 0x01, 0xdb, 0x8, 0x0b, 0xad, 0xca, 0xfe, 0x60, 0x0d, 0xbe, 0xe2, 0x0b, 0xad, 0xca, 0xfe}
+
+	templateMAC = mac.MAC([]byte{0x02, 0x00, 0x60, 0x0D, 0xF0, 0x0D})
 
-	CallsMapName   = "cilium_calls_"
 	elfMapPrefixes = []string{
 		policymap.MapName,
 		CallsMapName,
@@ -77,7 +82,7 @@ type templateCfg struct {
 // means that the calling code must approprately substitute the ID in the ELF
 // prior to load, or it will fail with a relatively obvious error.
 func (t *templateCfg) GetID() uint64 {
-	return uint64(TemplateLxcID)
+	return uint64(templateLxcID)
 }
 
 // StringID returns the string form of the ID returned by GetID().
@@ -89,19 +94,19 @@ func (t *templateCfg) StringID() string {
 // ever some weird bug that causes the template value here to be used, it will
 // be in the least privileged security context.
 func (t *templateCfg) GetIdentity() identity.NumericIdentity {
-	return TemplateSecurityID
+	return templateSecurityID
 }
 
 // GetNodeMAC returns a well-known dummy MAC address which may be later
 // substituted in the ELF.
 func (t *templateCfg) GetNodeMAC() mac.MAC {
-	return TemplateMAC
+	return templateMAC
 }
 
 // IPv4Address always returns an IP in the documentation prefix (RFC5737) as
 // a nonsense address that should typically not be routable.
 func (t *templateCfg) IPv4Address() addressing.CiliumIPv4 {
-	return addressing.CiliumIPv4(TemplateIPv4)
+	return addressing.CiliumIPv4(templateIPv4)
 }
 
 // IPv6Address returns an IP in the documentation prefix (RFC3849) to ensure
@@ -109,7 +114,7 @@ func (t *templateCfg) IPv4Address() addressing.CiliumIPv4 {
 // described in the structure definition. This can't be guaranteed while using
 // a more appropriate prefix such as the discard prefix (RFC6666).
 func (t *templateCfg) IPv6Address() addressing.CiliumIPv6 {
-	return addressing.CiliumIPv6(TemplateIPv6)
+	return addressing.CiliumIPv6(templateIPv6)
 }
 
 // wrap takes an endpoint configuration and optional stats tracker and wraps
@@ -134,19 +139,19 @@ func elfMapSubstitutions(ep datapath.Endpoint) map[string]string {
 
 	epID := uint16(ep.GetID())
 	for _, name := range elfMapPrefixes {
-		templateStr := bpf.LocalMapName(name, TemplateLxcID)
+		templateStr := bpf.LocalMapName(name, templateLxcID)
 		desiredStr := bpf.LocalMapName(name, epID)
 		result[templateStr] = desiredStr
 	}
 	if ep.ConntrackLocalLocked() {
 		for _, name := range elfCtMapPrefixes {
-			templateStr := bpf.LocalMapName(name, TemplateLxcID)
+			templateStr := bpf.LocalMapName(name, templateLxcID)
 			desiredStr := bpf.LocalMapName(name, epID)
 			result[templateStr] = desiredStr
 		}
 	}
 
-	result[policymap.CallString(TemplateLxcID)] = policymap.CallString(epID)
+	result[policymap.CallString(templateLxcID)] = policymap.CallString(epID)
 	return result
 }
 
diff --git a/pkg/defaults/node.go b/pkg/defaults/node.go
index 2fe6af4b3e..d3d0126adf 100644
--- a/pkg/defaults/node.go
+++ b/pkg/defaults/node.go
@@ -27,9 +27,6 @@ const (
 	// DefaultIPv4PrefixLen is the length used to allocate container IPv4 addresses from.
 	DefaultIPv4PrefixLen = 16
 
-	// DefaultIPv4ClusterPrefixLen is the IPv4 prefix length of the entire cluster.
-	DefaultIPv4ClusterPrefixLen = 8
-
 	// DefaultNAT46Prefix is the IPv6 prefix to represent NATed IPv4 addresses.
 	DefaultNAT46Prefix = "0:0:0:0:0:FFFF::/96"
 
@@ -41,19 +38,8 @@ const (
 var (
 	// Default addressing schema
 	//
-	// cluster:		    beef:beef:beef:beef::/64
 	// node:                    beef:beef:beef:beef:<node>:<node>:/96
-	// state:                   beef:beef:beef:beef:<node>:<node>:<state>:/112
-	// lxc:                     beef:beef:beef:beef:<node>:<node>:<state>:<lxc>/128
-
-	// ClusterIPv6Mask represents the CIDR Mask for an entire cluster.
-	ClusterIPv6Mask = net.CIDRMask(64, 128)
-
-	// NodeIPv6Mask represents the CIDR Mask for the cilium node.
-	NodeIPv6Mask = net.CIDRMask(96, 128)
-
-	// StateIPv6Mask represents the CIDR Mask for the state position.
-	StateIPv6Mask = net.CIDRMask(112, 128)
+	// lxc:                     beef:beef:beef:beef:<node>:<node>::<lxc>/128
 
 	// ContainerIPv6Mask is the IPv6 prefix length for address assigned to
 	// container. The default is L3 only and thus /128.
diff --git a/pkg/endpoint/endpoint.go b/pkg/endpoint/endpoint.go
index 45120a4b2a..2a362defe7 100644
--- a/pkg/endpoint/endpoint.go
+++ b/pkg/endpoint/endpoint.go
@@ -1473,18 +1473,6 @@ func APICanModify(e *Endpoint) error {
 	return nil
 }
 
-func (e *Endpoint) getIDandLabels() string {
-	e.unconditionalRLock()
-	defer e.runlock()
-
-	labels := ""
-	if e.SecurityIdentity != nil {
-		labels = e.SecurityIdentity.Labels.String()
-	}
-
-	return fmt.Sprintf("%d (%s)", e.ID, labels)
-}
-
 // MetadataResolverCB provides an implementation for resolving the endpoint
 // metadata for an endpoint such as the associated labels and annotations.
 type MetadataResolverCB func(ns, podName string) (identityLabels labels.Labels, infoLabels labels.Labels, annotations map[string]string, err error)
diff --git a/pkg/endpoint/events.go b/pkg/endpoint/events.go
index 3f3053cbe3..241bf314f4 100644
--- a/pkg/endpoint/events.go
+++ b/pkg/endpoint/events.go
@@ -121,12 +121,6 @@ type EndpointPolicyVisibilityEvent struct {
 	annoCB AnnotationsResolverCB
 }
 
-// EndpointPolicyVisibilityEventResult contains the results of doing an update
-// of the visibility policy.
-type EndpointPolicyVisibilityEventResult struct {
-	err error
-}
-
 // Handle handles the policy visibility update.
 func (ev *EndpointPolicyVisibilityEvent) Handle(res chan interface{}) {
 	e := ev.ep
diff --git a/pkg/endpoint/id/allocator.go b/pkg/endpoint/id/allocator.go
index 13340aaf2f..4f0970008a 100644
--- a/pkg/endpoint/id/allocator.go
+++ b/pkg/endpoint/id/allocator.go
@@ -18,8 +18,6 @@ import (
 	"fmt"
 
 	"github.com/cilium/cilium/pkg/idpool"
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 )
 
 const (
@@ -29,7 +27,6 @@ const (
 
 var (
 	pool = idpool.NewIDPool(minID, maxID)
-	log  = logging.DefaultLogger.WithField(logfields.LogSubsys, "endpoint")
 )
 
 // ReallocatePool starts over with a new pool.
diff --git a/pkg/endpoint/proxy.go b/pkg/endpoint/proxy.go
index 09a710b461..a77f8b64a4 100644
--- a/pkg/endpoint/proxy.go
+++ b/pkg/endpoint/proxy.go
@@ -19,11 +19,9 @@ import (
 	"reflect"
 
 	"github.com/cilium/cilium/pkg/completion"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/policy"
 	"github.com/cilium/cilium/pkg/proxy/logger"
 	"github.com/cilium/cilium/pkg/revert"
-	"github.com/sirupsen/logrus"
 )
 
 // EndpointProxy defines any L7 proxy with which an Endpoint must interact.
@@ -51,19 +49,6 @@ func (e *Endpoint) updateProxyRedirect(l4 *policy.L4Filter, proxyWaitGroup *comp
 	return e.proxy.CreateOrUpdateRedirect(l4, e.ProxyID(l4), e, proxyWaitGroup)
 }
 
-// removeProxyRedirect removes a previously installed proxy redirect for an
-// endpoint.
-func (e *Endpoint) removeProxyRedirect(id string, proxyWaitGroup *completion.WaitGroup) (error, revert.FinalizeFunc, revert.RevertFunc) {
-	if e.isProxyDisabled() {
-		return nil, nil, nil
-	}
-	log.WithFields(logrus.Fields{
-		logfields.EndpointID: e.ID,
-		logfields.L4PolicyID: id,
-	}).Debug("Removing redirect to endpoint")
-	return e.proxy.RemoveRedirect(id, proxyWaitGroup)
-}
-
 func (e *Endpoint) removeNetworkPolicy() {
 	if e.isProxyDisabled() {
 		return
diff --git a/pkg/fqdn/dnsproxy/helpers.go b/pkg/fqdn/dnsproxy/helpers.go
index 0940eb4af5..feb6eaff65 100644
--- a/pkg/fqdn/dnsproxy/helpers.go
+++ b/pkg/fqdn/dnsproxy/helpers.go
@@ -17,31 +17,10 @@ package dnsproxy
 import (
 	"fmt"
 	"net"
-	"strings"
 
 	"github.com/miekg/dns"
 )
 
-// prepareNameMatch ensures that a name is an anchored regexp and that names
-// with only "." (aka not a regexp) escape the "." so it does not match any
-// character. DNS expects lowercase lookups (ignoring the highest ascii bit)
-// and we mimic this by lowercasing the name here, and lookups later.
-// Note: The trailing "." in a FQDN is assumed, and isn't added here.
-func prepareNameMatch(name string) string {
-	name = strings.ToLower(name) // lowercase it
-
-	// anchor it
-	out := make([]string, 0, 3)
-	if !strings.HasPrefix(name, "^") {
-		out = append(out, "^")
-	}
-	out = append(out, name)
-	if !strings.HasSuffix(name, "$") {
-		out = append(out, "$")
-	}
-	return strings.Join(out, "")
-}
-
 // lookupTargetDNSServer finds the intended DNS target server for a specific
 // request (passed in via ServeDNS). The IP:port combination is
 // returned.
diff --git a/pkg/identity/config.go b/pkg/identity/config.go
deleted file mode 100644
index be653dec02..0000000000
--- a/pkg/identity/config.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2018 Authors of Cilium
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package identity
-
-import (
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
-)
-
-var (
-	log = logging.DefaultLogger.WithField(logfields.LogSubsys, "identity")
-)
diff --git a/pkg/ipam/allocator.go b/pkg/ipam/allocator.go
index 0670ca55e5..716bd131aa 100644
--- a/pkg/ipam/allocator.go
+++ b/pkg/ipam/allocator.go
@@ -34,8 +34,6 @@ const (
 	familyIPv6     = "ipv6"
 )
 
-type owner string
-
 // Error definitions
 var (
 	// ErrIPv4Disabled is returned when IPv4 allocation is disabled
diff --git a/pkg/k8s/endpointsynchronizer/logfields.go b/pkg/k8s/endpointsynchronizer/logfields.go
index 29748628e8..5011a2ba68 100644
--- a/pkg/k8s/endpointsynchronizer/logfields.go
+++ b/pkg/k8s/endpointsynchronizer/logfields.go
@@ -14,18 +14,8 @@
 
 package endpointsynchronizer
 
-import (
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
-)
-
 // logging field definitions
 const (
 	// subsysEndpointSync is the value for logfields.LogSubsys
 	subsysEndpointSync = "endpointsynchronizer"
 )
-
-var (
-	// log is the endpointsynchronizer package logger object.
-	log = logging.DefaultLogger.WithField(logfields.LogSubsys, subsysEndpointSync)
-)
diff --git a/pkg/kvstore/allocator/allocator.go b/pkg/kvstore/allocator/allocator.go
index 281dc207aa..57077939f1 100644
--- a/pkg/kvstore/allocator/allocator.go
+++ b/pkg/kvstore/allocator/allocator.go
@@ -20,7 +20,6 @@ import (
 	"path"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/cilium/cilium/pkg/allocator"
 	"github.com/cilium/cilium/pkg/idpool"
@@ -35,16 +34,6 @@ var (
 	log = logging.DefaultLogger.WithField(logfields.LogSubsys, "kvstorebackend")
 )
 
-const (
-	// maxAllocAttempts is the number of attempted allocation requests
-	// performed before failing.
-	maxAllocAttempts = 16
-
-	// listTimeout is the time to wait for the initial list operation to
-	// succeed when creating a new allocator
-	listTimeout = 3 * time.Minute
-)
-
 // kvstoreBackend is an implentaton of pkg/allocator.Backend. It store
 // identities in the following format:
 //
@@ -103,8 +92,6 @@ type kvstoreBackend struct {
 	backend kvstore.BackendOperations
 
 	keyType allocator.AllocatorKey
-
-	ctx context.Context
 }
 
 func locklessCapability(backend kvstore.BackendOperations) bool {
@@ -140,12 +127,12 @@ func NewKVStoreBackend(basePath, suffix string, typ allocator.AllocatorKey, back
 // lockPath locks a key in the scope of an allocator
 func (k *kvstoreBackend) lockPath(ctx context.Context, key string) (*kvstore.Lock, error) {
 	suffix := strings.TrimPrefix(key, k.basePrefix)
-	return kvstore.LockPath(ctx, path.Join(k.lockPrefix, suffix))
+	return kvstore.LockPath(ctx, k.backend, path.Join(k.lockPrefix, suffix))
 }
 
 // DeleteAllKeys will delete all keys
 func (k *kvstoreBackend) DeleteAllKeys(ctx context.Context) {
-	kvstore.Client().DeletePrefix(ctx, k.basePrefix)
+	k.backend.DeletePrefix(ctx, k.basePrefix)
 }
 
 // AllocateID allocates a key->ID mapping in the kvstore.
@@ -198,7 +185,7 @@ func (k *kvstoreBackend) createValueNodeKey(ctx context.Context, key string, new
 // Lock locks a key in the scope of an allocator
 func (k *kvstoreBackend) lock(ctx context.Context, key string) (*kvstore.Lock, error) {
 	suffix := strings.TrimPrefix(key, k.basePrefix)
-	return kvstore.LockPath(ctx, path.Join(k.lockPrefix, suffix))
+	return kvstore.LockPath(ctx, k.backend, path.Join(k.lockPrefix, suffix))
 }
 
 // Lock locks a key in the scope of an allocator
diff --git a/pkg/kvstore/consul.go b/pkg/kvstore/consul.go
index 517f68d0a6..406900ae73 100644
--- a/pkg/kvstore/consul.go
+++ b/pkg/kvstore/consul.go
@@ -658,7 +658,7 @@ func (c *consulClient) createIfExists(ctx context.Context, condKey, key string,
 	//
 	// Lock the conditional key to serialize all CreateIfExists() calls
 
-	l, err := LockPath(ctx, condKey)
+	l, err := LockPath(ctx, c, condKey)
 	if err != nil {
 		return fmt.Errorf("unable to lock condKey for CreateIfExists: %s", err)
 	}
diff --git a/pkg/kvstore/lock.go b/pkg/kvstore/lock.go
index 7ebad66486..88ee494e98 100644
--- a/pkg/kvstore/lock.go
+++ b/pkg/kvstore/lock.go
@@ -132,13 +132,13 @@ type Lock struct {
 // returned also contains a patch specific local Mutex which will be held.
 //
 // It is required to call Unlock() on the returned Lock to unlock
-func LockPath(ctx context.Context, path string) (l *Lock, err error) {
+func LockPath(ctx context.Context, backend BackendOperations, path string) (l *Lock, err error) {
 	id, err := kvstoreLocks.lock(ctx, path)
 	if err != nil {
 		return nil, err
 	}
 
-	lock, err := Client().LockPath(ctx, path)
+	lock, err := backend.LockPath(ctx, path)
 	if err != nil {
 		kvstoreLocks.unlock(path, id)
 		Trace("Failed to lock", err, logrus.Fields{fieldKey: path})
diff --git a/pkg/maps/encrypt/encrypt.go b/pkg/maps/encrypt/encrypt.go
index e5df74c68b..5fdb8abaa4 100644
--- a/pkg/maps/encrypt/encrypt.go
+++ b/pkg/maps/encrypt/encrypt.go
@@ -20,8 +20,6 @@ import (
 	"unsafe"
 
 	"github.com/cilium/cilium/pkg/bpf"
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 )
 
 // EncryptKey is the context ID for the encryption session
@@ -64,8 +62,6 @@ func newEncryptKey(key uint32) *EncryptKey {
 	}
 }
 
-var log = logging.DefaultLogger.WithField(logfields.LogSubsys, "encryptMap")
-
 const (
 	// MapName name of map used to pin map for datapath
 	MapName = "cilium_encrypt_state"
diff --git a/pkg/maps/eppolicymap/eppolicymap.go b/pkg/maps/eppolicymap/eppolicymap.go
index ed773168a9..b2d107d3de 100644
--- a/pkg/maps/eppolicymap/eppolicymap.go
+++ b/pkg/maps/eppolicymap/eppolicymap.go
@@ -16,7 +16,6 @@ package eppolicymap
 
 import (
 	"fmt"
-	"net"
 	"sync"
 	"unsafe"
 
@@ -109,13 +108,6 @@ func (v *EPPolicyValue) GetValuePtr() unsafe.Pointer { return unsafe.Pointer(v)
 // NewValue returns a new empty instance of the Endpoint Policy fd
 func (k EndpointKey) NewValue() bpf.MapValue { return &EPPolicyValue{} }
 
-// newEndpointKey return a new key from the IP address.
-func newEndpointKey(ip net.IP) *EndpointKey {
-	return &EndpointKey{
-		EndpointKey: bpf.NewEndpointKey(ip),
-	}
-}
-
 func writeEndpoint(keys []*lxcmap.EndpointKey, fd int) error {
 	if option.Config.SockopsEnable == false {
 		return nil
diff --git a/pkg/maps/lxcmap/lxcmap.go b/pkg/maps/lxcmap/lxcmap.go
index 48e70364f0..9a74263f19 100644
--- a/pkg/maps/lxcmap/lxcmap.go
+++ b/pkg/maps/lxcmap/lxcmap.go
@@ -21,13 +21,9 @@ import (
 
 	"github.com/cilium/cilium/common/addressing"
 	"github.com/cilium/cilium/pkg/bpf"
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/mac"
 )
 
-var log = logging.DefaultLogger.WithField(logfields.LogSubsys, "map-lxc")
-
 const (
 	MapName = "cilium_lxc"
 
diff --git a/pkg/maps/nat/nat.go b/pkg/maps/nat/nat.go
index acd4945e64..67954d7054 100644
--- a/pkg/maps/nat/nat.go
+++ b/pkg/maps/nat/nat.go
@@ -40,8 +40,6 @@ const (
 	MinPortSnatDefault = 1024
 	// MaxPortSnatDefault represents default max port from range.
 	MaxPortSnatDefault = 65535
-
-	mapCount = 2
 )
 
 // Map represents a NAT map.
diff --git a/pkg/maps/policymap/policymap.go b/pkg/maps/policymap/policymap.go
index 407343cc08..b0f8f93401 100644
--- a/pkg/maps/policymap/policymap.go
+++ b/pkg/maps/policymap/policymap.go
@@ -21,8 +21,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/bpf"
 	"github.com/cilium/cilium/pkg/byteorder"
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/policy/trafficdirection"
 	"github.com/cilium/cilium/pkg/u8proto"
 )
@@ -49,8 +47,6 @@ const (
 )
 
 var (
-	log = logging.DefaultLogger.WithField(logfields.LogSubsys, "map-policy")
-
 	// MaxEntries is the upper limit of entries in the per endpoint policy
 	// table
 	MaxEntries = 16384
diff --git a/pkg/metrics/status.go b/pkg/metrics/status.go
index e10d8230e8..c7a9844d00 100644
--- a/pkg/metrics/status.go
+++ b/pkg/metrics/status.go
@@ -15,8 +15,6 @@
 package metrics
 
 import (
-	"time"
-
 	clientPkg "github.com/cilium/cilium/pkg/client"
 	healthClientPkg "github.com/cilium/cilium/pkg/health/client"
 
@@ -24,10 +22,6 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	updateLatencyMetricsInterval = 30 * time.Second
-)
-
 type statusCollector struct {
 	ciliumClient *clientPkg.Client
 	healthClient *healthClientPkg.Client
diff --git a/pkg/monitor/agent/agent.go b/pkg/monitor/agent/agent.go
index 5fed6a5d36..fdcf2787f5 100644
--- a/pkg/monitor/agent/agent.go
+++ b/pkg/monitor/agent/agent.go
@@ -60,7 +60,6 @@ func buildServer(path string) (net.Listener, error) {
 // in non-BPF events.
 type Agent struct {
 	mutex     lock.Mutex
-	lost      uint64
 	server1_2 net.Listener
 	monitor   *Monitor
 	queue     chan payload.Payload
diff --git a/pkg/monitor/agent/listener/listener.go b/pkg/monitor/agent/listener/listener.go
index a1d79791d1..09c30ec3d3 100644
--- a/pkg/monitor/agent/listener/listener.go
+++ b/pkg/monitor/agent/listener/listener.go
@@ -48,6 +48,9 @@ type MonitorListener interface {
 
 	// Version returns the API version of this listener
 	Version() Version
+
+	// Close closes the listener.
+	Close()
 }
 
 // IsDisconnected is a convenience function that wraps the absurdly long set of
diff --git a/pkg/monitor/agent/listener1_2.go b/pkg/monitor/agent/listener1_2.go
index a851e41452..3a2792bb55 100644
--- a/pkg/monitor/agent/listener1_2.go
+++ b/pkg/monitor/agent/listener1_2.go
@@ -17,6 +17,7 @@ package agent
 import (
 	"encoding/gob"
 	"net"
+	"sync"
 
 	"github.com/cilium/cilium/pkg/monitor/agent/listener"
 	"github.com/cilium/cilium/pkg/monitor/payload"
@@ -29,6 +30,8 @@ type listenerv1_2 struct {
 	conn      net.Conn
 	queue     chan *payload.Payload
 	cleanupFn func(listener.MonitorListener)
+	// Used to prevent queue from getting closed multiple times.
+	once sync.Once
 }
 
 func newListenerv1_2(c net.Conn, queueSize int, cleanupFn func(listener.MonitorListener)) *listenerv1_2 {
@@ -55,7 +58,7 @@ func (ml *listenerv1_2) Enqueue(pl *payload.Payload) {
 // intended to be a goroutine.
 func (ml *listenerv1_2) drainQueue() {
 	defer func() {
-		ml.conn.Close()
+		ml.Close()
 		ml.cleanupFn(ml)
 	}()
 
@@ -78,3 +81,11 @@ func (ml *listenerv1_2) drainQueue() {
 func (ml *listenerv1_2) Version() listener.Version {
 	return listener.Version1_2
 }
+
+// Close closes the underlying socket and payload queue.
+func (ml *listenerv1_2) Close() {
+	ml.once.Do(func() {
+		ml.conn.Close()
+		close(ml.queue)
+	})
+}
diff --git a/pkg/monitor/agent/monitor.go b/pkg/monitor/agent/monitor.go
index ec975e4b18..2d5e8a6699 100644
--- a/pkg/monitor/agent/monitor.go
+++ b/pkg/monitor/agent/monitor.go
@@ -35,10 +35,6 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-const (
-	pollTimeout = 5000
-)
-
 var (
 	eventsMapName = "cilium_events"
 )
@@ -112,7 +108,7 @@ func NewMonitor(ctx context.Context, nPages int, server1_2 net.Listener) (m *Mon
 // cancelable context to this goroutine and the cancelFunc is assigned to
 // perfReaderCancel. Note that cancelling parentCtx (e.g. on program shutdown)
 // will also cancel the derived context.
-func (m *Monitor) registerNewListener(parentCtx context.Context, conn net.Conn, version listener.Version) {
+func (m *Monitor) registerNewListener(parentCtx context.Context, newListener listener.MonitorListener) {
 	m.Lock()
 	defer m.Unlock()
 
@@ -123,15 +119,14 @@ func (m *Monitor) registerNewListener(parentCtx context.Context, conn net.Conn,
 		m.perfReaderCancel = cancel
 		go m.handleEvents(perfEventReaderCtx)
 	}
-
-	switch version {
+	version := newListener.Version()
+	switch newListener.Version() {
 	case listener.Version1_2:
-		newListener := newListenerv1_2(conn, option.Config.MonitorQueueSize, m.removeListener)
 		m.listeners[newListener] = struct{}{}
 
 	default:
-		conn.Close()
-		log.WithField("version", version).Error("Closing new connection from unsupported monitor client version")
+		newListener.Close()
+		log.WithField("version", version).Error("Closing listener from unsupported monitor client version")
 	}
 
 	log.WithFields(logrus.Fields{
@@ -256,7 +251,8 @@ func (m *Monitor) connectionHandler1_2(parentCtx context.Context, server net.Lis
 			continue
 		}
 
-		m.registerNewListener(parentCtx, conn, listener.Version1_2)
+		newListener := newListenerv1_2(conn, option.Config.MonitorQueueSize, m.removeListener)
+		m.registerNewListener(parentCtx, newListener)
 	}
 }
 
diff --git a/pkg/monitor/alignchecker/alignchecker.go b/pkg/monitor/alignchecker/alignchecker.go
new file mode 100644
index 0000000000..87651d7c74
--- /dev/null
+++ b/pkg/monitor/alignchecker/alignchecker.go
@@ -0,0 +1,35 @@
+// Copyright 2020 Authors of Cilium
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package alignchecker
+
+import (
+	"reflect"
+
+	check "github.com/cilium/cilium/pkg/alignchecker"
+	"github.com/cilium/cilium/pkg/monitor"
+)
+
+// See pkg/datapath/alignchecker/alignchecker.go:CheckStructAlignments()
+// comment.
+func CheckStructAlignments(path string) error {
+	// Validate alignments of C and Go equivalent structs
+	toCheck := map[string][]reflect.Type{
+		"trace_notify":      {reflect.TypeOf(monitor.TraceNotify{})},
+		"drop_notify":       {reflect.TypeOf(monitor.DropNotify{})},
+		"debug_msg":         {reflect.TypeOf(monitor.DebugMsg{})},
+		"debug_capture_msg": {reflect.TypeOf(monitor.DebugCapture{})},
+	}
+	return check.CheckStructAlignments(path, toCheck)
+}
diff --git a/pkg/ipcache/logfields.go b/pkg/monitor/alignchecker/doc.go
similarity index 77%
rename from pkg/ipcache/logfields.go
rename to pkg/monitor/alignchecker/doc.go
index ea7023f1e8..d578f7d218 100644
--- a/pkg/ipcache/logfields.go
+++ b/pkg/monitor/alignchecker/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Authors of Cilium
+// Copyright 2020 Authors of Cilium
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,8 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ipcache
-
-const (
-	fieldIdentities = "identities"
-)
+// Package alignchecker is a thin wrapper around pkg/alignchecker to validate
+// monitor object alignment.
+package alignchecker
diff --git a/pkg/monitor/format/format.go b/pkg/monitor/format/format.go
index e8ee087b44..b1b2b8d518 100644
--- a/pkg/monitor/format/format.go
+++ b/pkg/monitor/format/format.go
@@ -21,15 +21,11 @@ import (
 	"fmt"
 
 	"github.com/cilium/cilium/pkg/byteorder"
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/monitor"
 	monitorAPI "github.com/cilium/cilium/pkg/monitor/api"
 	"github.com/cilium/cilium/pkg/monitor/payload"
 )
 
-var log = logging.DefaultLogger.WithField(logfields.LogSubsys, "monitor-format")
-
 // Verbosity levels for formatting output.
 type Verbosity uint8
 
diff --git a/pkg/node/node_address.go b/pkg/node/node_address.go
index 956864ccf5..7586ffc5cb 100644
--- a/pkg/node/node_address.go
+++ b/pkg/node/node_address.go
@@ -34,8 +34,6 @@ import (
 )
 
 var (
-	ipv4ClusterCidrMaskSize = defaults.DefaultIPv4ClusterPrefixLen
-
 	ipv4Loopback        net.IP
 	ipv4ExternalAddress net.IP
 	ipv4InternalAddress net.IP
@@ -59,11 +57,6 @@ func makeIPv6HostIP() net.IP {
 	return ip
 }
 
-// SetIPv4ClusterCidrMaskSize sets the size of the mask of the IPv4 cluster prefix
-func SetIPv4ClusterCidrMaskSize(size int) {
-	ipv4ClusterCidrMaskSize = size
-}
-
 // InitDefaultPrefix initializes the node address and allocation prefixes with
 // default values derived from the system. device can be set to the primary
 // network device of the system in which case the first address with global
@@ -151,19 +144,6 @@ func InitDefaultPrefix(device string) {
 	}
 }
 
-// GetIPv4ClusterRange returns the IPv4 prefix of the cluster
-func GetIPv4ClusterRange() *net.IPNet {
-	if ipv4AllocRange == nil {
-		return nil
-	}
-
-	mask := net.CIDRMask(ipv4ClusterCidrMaskSize, 32)
-	return &net.IPNet{
-		IP:   ipv4AllocRange.IPNet.IP.Mask(mask),
-		Mask: mask,
-	}
-}
-
 // GetIPv4Loopback returns the loopback IPv4 address of this node.
 func GetIPv4Loopback() net.IP {
 	return ipv4Loopback
@@ -289,16 +269,8 @@ func ValidatePostInit() error {
 		}
 	}
 
-	if option.Config.EnableIPv4 {
-		if ipv4InternalAddress == nil {
-			return fmt.Errorf("BUG: Internal IPv4 node address was not configured")
-		}
-
-		ones, _ := ipv4AllocRange.Mask.Size()
-		if ipv4ClusterCidrMaskSize > ones {
-			return fmt.Errorf("IPv4 per node allocation prefix (%s) must be inside cluster prefix (%s)",
-				ipv4AllocRange, GetIPv4ClusterRange())
-		}
+	if option.Config.EnableIPv4 && ipv4InternalAddress == nil {
+		return fmt.Errorf("BUG: Internal IPv4 node address was not configured")
 	}
 
 	return nil
diff --git a/pkg/node/store/store.go b/pkg/node/store/store.go
index 67d2a8c66f..aca6c8dcec 100644
--- a/pkg/node/store/store.go
+++ b/pkg/node/store/store.go
@@ -20,8 +20,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/kvstore"
 	"github.com/cilium/cilium/pkg/kvstore/store"
-	"github.com/cilium/cilium/pkg/logging"
-	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/node"
 	"github.com/cilium/cilium/pkg/option"
 	"github.com/cilium/cilium/pkg/source"
@@ -39,8 +37,6 @@ var (
 		n := node.Node{}
 		return &n
 	}
-
-	log = logging.DefaultLogger.WithField(logfields.LogSubsys, "node-store")
 )
 
 // NodeObserver implements the store.Observer interface and delegates update
diff --git a/pkg/option/config.go b/pkg/option/config.go
index 63f286e3ce..f9706a22b3 100644
--- a/pkg/option/config.go
+++ b/pkg/option/config.go
@@ -224,6 +224,8 @@ const (
 	KeepConfig = "keep-config"
 
 	// KeepBPFTemplates do not restore BPF template files from binary
+	// Deprecated: This option is no longer available since cilium-agent does
+	//             not include the BPF templates anymore.
 	KeepBPFTemplates = "keep-bpf-templates"
 
 	// KVStore key-value store type
@@ -636,9 +638,6 @@ const (
 	// subject to egress masquerading
 	EgressMasqueradeInterfaces = "egress-masquerade-interfaces"
 
-	// DeprecatedEnableLegacyServices enables the legacy services
-	DeprecatedEnableLegacyServices = "enable-legacy-services"
-
 	// PolicyTriggerInterval is the amount of time between triggers of policy
 	// updates are invoked.
 	PolicyTriggerInterval = "policy-trigger-interval"
@@ -1072,7 +1071,6 @@ type DaemonConfig struct {
 	DisableEnvoyVersionCheck      bool
 	FixedIdentityMapping          map[string]string
 	FixedIdentityMappingValidator func(val string) (string, error)
-	IPv4ClusterCIDRMaskSize       int
 	IPv4Range                     string
 	IPv6Range                     string
 	IPv4ServiceRange              string
@@ -1709,7 +1707,6 @@ func (c *DaemonConfig) Populate() {
 	c.HTTPRequestTimeout = viper.GetInt(HTTPRequestTimeout)
 	c.HTTPRetryCount = viper.GetInt(HTTPRetryCount)
 	c.HTTPRetryTimeout = viper.GetInt(HTTPRetryTimeout)
-	c.IPv4ClusterCIDRMaskSize = viper.GetInt(IPv4ClusterCIDRMaskSize)
 	c.IdentityChangeGracePeriod = viper.GetDuration(IdentityChangeGracePeriod)
 	c.IPAM = viper.GetString(IPAM)
 	c.IPv4Range = viper.GetString(IPv4Range)
@@ -1830,7 +1827,7 @@ func (c *DaemonConfig) Populate() {
 
 	err = c.populateNodePortRange()
 	if err != nil {
-		log.WithError(err).Fatal("NodePortRange can not be parsed.")
+		log.WithError(err).Fatal("Failed to populate NodePortRange")
 	}
 
 	hostServicesProtos := viper.GetStringSlice(HostReachableServicesProtos)
@@ -1960,12 +1957,12 @@ func (c *DaemonConfig) populateNodePortRange() error {
 			return fmt.Errorf("Unable to parse max port value for NodePort range: %s", err.Error())
 		}
 		if c.NodePortMax <= c.NodePortMin {
-			return errors.New("NodePort range min port must be smaller than max port!")
+			return errors.New("NodePort range min port must be smaller than max port")
 		}
 	case 0:
 		log.Warning("NodePort range was set but is empty.")
 	default:
-		return errors.New("Unable to parse min/max port value for NodePort range!")
+		return fmt.Errorf("Unable to parse min/max port value for NodePort range: %s", NodePortRange)
 	}
 
 	return nil
diff --git a/pkg/policy/policy.go b/pkg/policy/policy.go
index eba0c88e34..31c7f105a3 100644
--- a/pkg/policy/policy.go
+++ b/pkg/policy/policy.go
@@ -17,14 +17,13 @@ package policy
 import (
 	"fmt"
 	"io"
+	stdlog "log"
 	"strconv"
 	"strings"
 
 	"github.com/cilium/cilium/api/v1/models"
 	"github.com/cilium/cilium/pkg/labels"
 	"github.com/cilium/cilium/pkg/policy/api"
-
-	"github.com/op/go-logging"
 )
 
 type Tracing int
@@ -48,7 +47,7 @@ func (s *SearchContext) PolicyTrace(format string, a ...interface{}) {
 		if s.Logging != nil {
 			format = "%-" + s.CallDepth() + "s" + format
 			a = append([]interface{}{""}, a...)
-			s.Logging.Logger.Printf(format, a...)
+			s.Logging.Printf(format, a...)
 		}
 	}
 }
@@ -60,7 +59,7 @@ func (s *SearchContext) PolicyTraceVerbose(format string, a ...interface{}) {
 	case TRACE_VERBOSE:
 		log.Debugf(format, a...)
 		if s.Logging != nil {
-			s.Logging.Logger.Printf(format, a...)
+			s.Logging.Printf(format, a...)
 		}
 	}
 }
@@ -69,7 +68,7 @@ func (s *SearchContext) PolicyTraceVerbose(format string, a ...interface{}) {
 type SearchContext struct {
 	Trace   Tracing
 	Depth   int
-	Logging *logging.LogBackend
+	Logging *stdlog.Logger
 	From    labels.LabelArray
 	To      labels.LabelArray
 	DPorts  []*models.Port
@@ -109,7 +108,7 @@ func (s *SearchContext) CallDepth() string {
 // logging set to write to 'log'.
 func (s *SearchContext) WithLogger(log io.Writer) *SearchContext {
 	result := *s
-	result.Logging = logging.NewLogBackend(log, "", 0)
+	result.Logging = stdlog.New(log, "", 0)
 	if result.Trace == TRACE_DISABLED {
 		result.Trace = TRACE_ENABLED
 	}
diff --git a/pkg/proxy/proxy.go b/pkg/proxy/proxy.go
index 6ec0adc449..7b1f55cfb5 100644
--- a/pkg/proxy/proxy.go
+++ b/pkg/proxy/proxy.go
@@ -424,8 +424,6 @@ func (p *Proxy) CreateOrUpdateRedirect(l4 policy.ProxyPolicy, id string, localEn
 			}
 			revertStack.Push(implUpdateRevertFunc)
 
-			redir.lastUpdated = time.Now()
-
 			scopedLog.WithField(logfields.Object, logfields.Repr(redir)).
 				Debug("updated existing ", l4.GetL7Parser(), " proxy instance")
 
diff --git a/pkg/proxy/redirect.go b/pkg/proxy/redirect.go
index 3a3be73304..b064ef4dff 100644
--- a/pkg/proxy/redirect.go
+++ b/pkg/proxy/redirect.go
@@ -15,8 +15,6 @@
 package proxy
 
 import (
-	"time"
-
 	"github.com/cilium/cilium/pkg/completion"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/policy"
@@ -48,14 +46,12 @@ type Redirect struct {
 	dstPort        uint16
 	endpointID     uint64
 	localEndpoint  logger.EndpointUpdater
-	created        time.Time
 	implementation RedirectImplementation
 
 	// The following fields are updated while the redirect is alive, the
 	// mutex must be held to read and write these fields
-	mutex       lock.RWMutex
-	lastUpdated time.Time
-	rules       policy.L7DataMap
+	mutex lock.RWMutex
+	rules policy.L7DataMap
 }
 
 func newRedirect(localEndpoint logger.EndpointUpdater, listener *ProxyPort, dstPort uint16) *Redirect {
@@ -64,8 +60,6 @@ func newRedirect(localEndpoint logger.EndpointUpdater, listener *ProxyPort, dstP
 		dstPort:       dstPort,
 		endpointID:    localEndpoint.GetID(),
 		localEndpoint: localEndpoint,
-		created:       time.Now(),
-		lastUpdated:   time.Now(),
 	}
 }
 
diff --git a/pkg/service/service.go b/pkg/service/service.go
index 3183973f44..b0cd3ff470 100644
--- a/pkg/service/service.go
+++ b/pkg/service/service.go
@@ -80,12 +80,13 @@ func (svc *svcInfo) deepCopyToLBSVC() *lb.SVC {
 		backends[i] = *backend.DeepCopy()
 	}
 	return &lb.SVC{
-		Frontend:      *svc.frontend.DeepCopy(),
-		Backends:      backends,
-		Type:          svc.svcType,
-		TrafficPolicy: svc.svcTrafficPolicy,
-		Name:          svc.svcName,
-		Namespace:     svc.svcNamespace,
+		Frontend:            *svc.frontend.DeepCopy(),
+		Backends:            backends,
+		Type:                svc.svcType,
+		TrafficPolicy:       svc.svcTrafficPolicy,
+		HealthCheckNodePort: svc.svcHealthCheckNodePort,
+		Name:                svc.svcName,
+		Namespace:           svc.svcNamespace,
 	}
 }
 
diff --git a/pkg/sysctl/sysctl.go b/pkg/sysctl/sysctl.go
index 199a903b68..fe4d87eae8 100644
--- a/pkg/sysctl/sysctl.go
+++ b/pkg/sysctl/sysctl.go
@@ -17,6 +17,7 @@ package sysctl
 import (
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -59,3 +60,14 @@ func Enable(name string) error {
 func Write(name string, val string) error {
 	return writeSysctl(name, val)
 }
+
+// Read reads the given sysctl parameter.
+func Read(name string) (string, error) {
+	fPath := fullPath(name)
+	val, err := ioutil.ReadFile(fPath)
+	if err != nil {
+		return "", fmt.Errorf("Failed to read %s: %s", fPath, val)
+	}
+
+	return strings.TrimRight(string(val), "\n"), nil
+}
diff --git a/pkg/trigger/trigger.go b/pkg/trigger/trigger.go
index cf0d3faf28..93970fcbf6 100644
--- a/pkg/trigger/trigger.go
+++ b/pkg/trigger/trigger.go
@@ -21,10 +21,6 @@ import (
 	"github.com/cilium/cilium/pkg/lock"
 )
 
-const (
-	metricLabelReason = "reason"
-)
-
 // MetricsObserver is the interface a metrics collector has to implement in
 // order to collect trigger metrics
 type MetricsObserver interface {
diff --git a/plugins/cilium-cni/cilium-cni.go b/plugins/cilium-cni/cilium-cni.go
index eed470e225..9147c271bf 100644
--- a/plugins/cilium-cni/cilium-cni.go
+++ b/plugins/cilium-cni/cilium-cni.go
@@ -121,11 +121,6 @@ func releaseIP(client *client.Client, ip string) {
 	}
 }
 
-func releaseIPs(client *client.Client, addr *models.AddressPair) {
-	releaseIP(client, addr.IPV6)
-	releaseIP(client, addr.IPV4)
-}
-
 func addIPConfigToLink(ip addressing.CiliumIP, routes []route.Route, link netlink.Link, ifName string) error {
 	log.WithFields(logrus.Fields{
 		logfields.IPAddr:    ip,
diff --git a/tools/alignchecker/main.go b/tools/alignchecker/main.go
index ecd22137f8..4ba00e600f 100644
--- a/tools/alignchecker/main.go
+++ b/tools/alignchecker/main.go
@@ -18,7 +18,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/cilium/cilium/pkg/datapath/alignchecker"
+	datapathchecker "github.com/cilium/cilium/pkg/datapath/alignchecker"
+	monitorchecker "github.com/cilium/cilium/pkg/monitor/alignchecker"
 )
 
 func main() {
@@ -32,8 +33,12 @@ func main() {
 		fmt.Fprintf(os.Stderr, "Cannot check alignment against %s: %s\n", bpfObjPath, err)
 		os.Exit(1)
 	}
-	if err := alignchecker.CheckStructAlignments(bpfObjPath); err != nil {
-		fmt.Fprintf(os.Stderr, "C and Go structs alignment check failed: %s\n", err)
+	if err := datapathchecker.CheckStructAlignments(bpfObjPath); err != nil {
+		fmt.Fprintf(os.Stderr, "C and Go structs alignment check in datapath failed: %s\n", err)
+		os.Exit(1)
+	}
+	if err := monitorchecker.CheckStructAlignments(bpfObjPath); err != nil {
+		fmt.Fprintf(os.Stderr, "C and Go structs alignment check in monitor failed: %s\n", err)
 		os.Exit(1)
 	}
 	fmt.Fprintf(os.Stdout, "OK\n")
diff --git a/vendor/github.com/op/go-logging/.travis.yml b/vendor/github.com/op/go-logging/.travis.yml
deleted file mode 100644
index 70e012b81e..0000000000
--- a/vendor/github.com/op/go-logging/.travis.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-language: go
-
-go:
-  - 1.0
-  - 1.1
-  - tip
diff --git a/vendor/github.com/op/go-logging/CHANGELOG.md b/vendor/github.com/op/go-logging/CHANGELOG.md
deleted file mode 100644
index 4b7d2335ca..0000000000
--- a/vendor/github.com/op/go-logging/CHANGELOG.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# Changelog
-
-## 2.0.0-rc1 (2016-02-11)
-
-Time flies and it has been three years since this package was first released.
-There have been a couple of API changes I have wanted to do for some time but
-I've tried to maintain backwards compatibility. Some inconsistencies in the
-API have started to show, proper vendor support in Go out of the box and
-the fact that `go vet` will give warnings -- I have decided to bump the major
-version.
-
-* Make eg. `Info` and `Infof` do different things. You want to change all calls
-	to `Info` with a string format go to `Infof` etc. In many cases, `go vet` will
-	guide you.
-* `Id` in `Record` is now called `ID`
-
-## 1.0.0 (2013-02-21)
-
-Initial release
diff --git a/vendor/github.com/op/go-logging/CONTRIBUTORS b/vendor/github.com/op/go-logging/CONTRIBUTORS
deleted file mode 100644
index 958416ef1d..0000000000
--- a/vendor/github.com/op/go-logging/CONTRIBUTORS
+++ /dev/null
@@ -1,5 +0,0 @@
-Alec Thomas <alec@swapoff.org>
-Guilhem Lettron <guilhem.lettron@optiflows.com>
-Ivan Daniluk <ivan.daniluk@gmail.com>
-Nimi Wariboko Jr <nimi@channelmeter.com>
-Róbert Selvek <robert.selvek@gmail.com>
diff --git a/vendor/github.com/op/go-logging/LICENSE b/vendor/github.com/op/go-logging/LICENSE
deleted file mode 100644
index f1f6cfcef9..0000000000
--- a/vendor/github.com/op/go-logging/LICENSE
+++ /dev/null
@@ -1,27 +0,0 @@
-Copyright (c) 2013 Örjan Persson. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/op/go-logging/README.md b/vendor/github.com/op/go-logging/README.md
deleted file mode 100644
index 0a7326b05a..0000000000
--- a/vendor/github.com/op/go-logging/README.md
+++ /dev/null
@@ -1,93 +0,0 @@
-## Golang logging library
-
-[![godoc](http://img.shields.io/badge/godoc-reference-blue.svg?style=flat)](https://godoc.org/github.com/op/go-logging) [![build](https://img.shields.io/travis/op/go-logging.svg?style=flat)](https://travis-ci.org/op/go-logging)
-
-Package logging implements a logging infrastructure for Go. Its output format
-is customizable and supports different logging backends like syslog, file and
-memory. Multiple backends can be utilized with different log levels per backend
-and logger.
-
-**_NOTE:_** backwards compatibility promise have been dropped for master. Please
-vendor this package or use `gopkg.in/op/go-logging.v1` for previous version. See
-[changelog](CHANGELOG.md) for details.
-
-## Example
-
-Let's have a look at an [example](examples/example.go) which demonstrates most
-of the features found in this library.
-
-[![Example Output](examples/example.png)](examples/example.go)
-
-```go
-package main
-
-import (
-	"os"
-
-	"github.com/op/go-logging"
-)
-
-var log = logging.MustGetLogger("example")
-
-// Example format string. Everything except the message has a custom color
-// which is dependent on the log level. Many fields have a custom output
-// formatting too, eg. the time returns the hour down to the milli second.
-var format = logging.MustStringFormatter(
-	`%{color}%{time:15:04:05.000} %{shortfunc} ▶ %{level:.4s} %{id:03x}%{color:reset} %{message}`,
-)
-
-// Password is just an example type implementing the Redactor interface. Any
-// time this is logged, the Redacted() function will be called.
-type Password string
-
-func (p Password) Redacted() interface{} {
-	return logging.Redact(string(p))
-}
-
-func main() {
-	// For demo purposes, create two backend for os.Stderr.
-	backend1 := logging.NewLogBackend(os.Stderr, "", 0)
-	backend2 := logging.NewLogBackend(os.Stderr, "", 0)
-
-	// For messages written to backend2 we want to add some additional
-	// information to the output, including the used log level and the name of
-	// the function.
-	backend2Formatter := logging.NewBackendFormatter(backend2, format)
-
-	// Only errors and more severe messages should be sent to backend1
-	backend1Leveled := logging.AddModuleLevel(backend1)
-	backend1Leveled.SetLevel(logging.ERROR, "")
-
-	// Set the backends to be used.
-	logging.SetBackend(backend1Leveled, backend2Formatter)
-
-	log.Debugf("debug %s", Password("secret"))
-	log.Info("info")
-	log.Notice("notice")
-	log.Warning("warning")
-	log.Error("err")
-	log.Critical("crit")
-}
-```
-
-## Installing
-
-### Using *go get*
-
-    $ go get github.com/op/go-logging
-
-After this command *go-logging* is ready to use. Its source will be in:
-
-    $GOPATH/src/pkg/github.com/op/go-logging
-
-You can use `go get -u` to update the package.
-
-## Documentation
-
-For docs, see http://godoc.org/github.com/op/go-logging or run:
-
-    $ godoc github.com/op/go-logging
-
-## Additional resources
-
-* [wslog](https://godoc.org/github.com/cryptix/exp/wslog) -- exposes log messages through a WebSocket.
diff --git a/vendor/github.com/op/go-logging/backend.go b/vendor/github.com/op/go-logging/backend.go
deleted file mode 100644
index 74d9201083..0000000000
--- a/vendor/github.com/op/go-logging/backend.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package logging
-
-// defaultBackend is the backend used for all logging calls.
-var defaultBackend LeveledBackend
-
-// Backend is the interface which a log backend need to implement to be able to
-// be used as a logging backend.
-type Backend interface {
-	Log(Level, int, *Record) error
-}
-
-// SetBackend replaces the backend currently set with the given new logging
-// backend.
-func SetBackend(backends ...Backend) LeveledBackend {
-	var backend Backend
-	if len(backends) == 1 {
-		backend = backends[0]
-	} else {
-		backend = MultiLogger(backends...)
-	}
-
-	defaultBackend = AddModuleLevel(backend)
-	return defaultBackend
-}
-
-// SetLevel sets the logging level for the specified module. The module
-// corresponds to the string specified in GetLogger.
-func SetLevel(level Level, module string) {
-	defaultBackend.SetLevel(level, module)
-}
-
-// GetLevel returns the logging level for the specified module.
-func GetLevel(module string) Level {
-	return defaultBackend.GetLevel(module)
-}
diff --git a/vendor/github.com/op/go-logging/format.go b/vendor/github.com/op/go-logging/format.go
deleted file mode 100644
index 7160674a86..0000000000
--- a/vendor/github.com/op/go-logging/format.go
+++ /dev/null
@@ -1,414 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package logging
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-)
-
-// TODO see Formatter interface in fmt/print.go
-// TODO try text/template, maybe it have enough performance
-// TODO other template systems?
-// TODO make it possible to specify formats per backend?
-type fmtVerb int
-
-const (
-	fmtVerbTime fmtVerb = iota
-	fmtVerbLevel
-	fmtVerbID
-	fmtVerbPid
-	fmtVerbProgram
-	fmtVerbModule
-	fmtVerbMessage
-	fmtVerbLongfile
-	fmtVerbShortfile
-	fmtVerbLongpkg
-	fmtVerbShortpkg
-	fmtVerbLongfunc
-	fmtVerbShortfunc
-	fmtVerbCallpath
-	fmtVerbLevelColor
-
-	// Keep last, there are no match for these below.
-	fmtVerbUnknown
-	fmtVerbStatic
-)
-
-var fmtVerbs = []string{
-	"time",
-	"level",
-	"id",
-	"pid",
-	"program",
-	"module",
-	"message",
-	"longfile",
-	"shortfile",
-	"longpkg",
-	"shortpkg",
-	"longfunc",
-	"shortfunc",
-	"callpath",
-	"color",
-}
-
-const rfc3339Milli = "2006-01-02T15:04:05.999Z07:00"
-
-var defaultVerbsLayout = []string{
-	rfc3339Milli,
-	"s",
-	"d",
-	"d",
-	"s",
-	"s",
-	"s",
-	"s",
-	"s",
-	"s",
-	"s",
-	"s",
-	"s",
-	"0",
-	"",
-}
-
-var (
-	pid     = os.Getpid()
-	program = filepath.Base(os.Args[0])
-)
-
-func getFmtVerbByName(name string) fmtVerb {
-	for i, verb := range fmtVerbs {
-		if name == verb {
-			return fmtVerb(i)
-		}
-	}
-	return fmtVerbUnknown
-}
-
-// Formatter is the required interface for a custom log record formatter.
-type Formatter interface {
-	Format(calldepth int, r *Record, w io.Writer) error
-}
-
-// formatter is used by all backends unless otherwise overriden.
-var formatter struct {
-	sync.RWMutex
-	def Formatter
-}
-
-func getFormatter() Formatter {
-	formatter.RLock()
-	defer formatter.RUnlock()
-	return formatter.def
-}
-
-var (
-	// DefaultFormatter is the default formatter used and is only the message.
-	DefaultFormatter = MustStringFormatter("%{message}")
-
-	// GlogFormatter mimics the glog format
-	GlogFormatter = MustStringFormatter("%{level:.1s}%{time:0102 15:04:05.999999} %{pid} %{shortfile}] %{message}")
-)
-
-// SetFormatter sets the default formatter for all new backends. A backend will
-// fetch this value once it is needed to format a record. Note that backends
-// will cache the formatter after the first point. For now, make sure to set
-// the formatter before logging.
-func SetFormatter(f Formatter) {
-	formatter.Lock()
-	defer formatter.Unlock()
-	formatter.def = f
-}
-
-var formatRe = regexp.MustCompile(`%{([a-z]+)(?::(.*?[^\\]))?}`)
-
-type part struct {
-	verb   fmtVerb
-	layout string
-}
-
-// stringFormatter contains a list of parts which explains how to build the
-// formatted string passed on to the logging backend.
-type stringFormatter struct {
-	parts []part
-}
-
-// NewStringFormatter returns a new Formatter which outputs the log record as a
-// string based on the 'verbs' specified in the format string.
-//
-// The verbs:
-//
-// General:
-//     %{id}        Sequence number for log message (uint64).
-//     %{pid}       Process id (int)
-//     %{time}      Time when log occurred (time.Time)
-//     %{level}     Log level (Level)
-//     %{module}    Module (string)
-//     %{program}   Basename of os.Args[0] (string)
-//     %{message}   Message (string)
-//     %{longfile}  Full file name and line number: /a/b/c/d.go:23
-//     %{shortfile} Final file name element and line number: d.go:23
-//     %{callpath}  Callpath like main.a.b.c...c  "..." meaning recursive call ~. meaning truncated path
-//     %{color}     ANSI color based on log level
-//
-// For normal types, the output can be customized by using the 'verbs' defined
-// in the fmt package, eg. '%{id:04d}' to make the id output be '%04d' as the
-// format string.
-//
-// For time.Time, use the same layout as time.Format to change the time format
-// when output, eg "2006-01-02T15:04:05.999Z-07:00".
-//
-// For the 'color' verb, the output can be adjusted to either use bold colors,
-// i.e., '%{color:bold}' or to reset the ANSI attributes, i.e.,
-// '%{color:reset}' Note that if you use the color verb explicitly, be sure to
-// reset it or else the color state will persist past your log message.  e.g.,
-// "%{color:bold}%{time:15:04:05} %{level:-8s}%{color:reset} %{message}" will
-// just colorize the time and level, leaving the message uncolored.
-//
-// For the 'callpath' verb, the output can be adjusted to limit the printing
-// the stack depth. i.e. '%{callpath:3}' will print '~.a.b.c'
-//
-// Colors on Windows is unfortunately not supported right now and is currently
-// a no-op.
-//
-// There's also a couple of experimental 'verbs'. These are exposed to get
-// feedback and needs a bit of tinkering. Hence, they might change in the
-// future.
-//
-// Experimental:
-//     %{longpkg}   Full package path, eg. github.com/go-logging
-//     %{shortpkg}  Base package path, eg. go-logging
-//     %{longfunc}  Full function name, eg. littleEndian.PutUint32
-//     %{shortfunc} Base function name, eg. PutUint32
-//     %{callpath}  Call function path, eg. main.a.b.c
-func NewStringFormatter(format string) (Formatter, error) {
-	var fmter = &stringFormatter{}
-
-	// Find the boundaries of all %{vars}
-	matches := formatRe.FindAllStringSubmatchIndex(format, -1)
-	if matches == nil {
-		return nil, errors.New("logger: invalid log format: " + format)
-	}
-
-	// Collect all variables and static text for the format
-	prev := 0
-	for _, m := range matches {
-		start, end := m[0], m[1]
-		if start > prev {
-			fmter.add(fmtVerbStatic, format[prev:start])
-		}
-
-		name := format[m[2]:m[3]]
-		verb := getFmtVerbByName(name)
-		if verb == fmtVerbUnknown {
-			return nil, errors.New("logger: unknown variable: " + name)
-		}
-
-		// Handle layout customizations or use the default. If this is not for the
-		// time, color formatting or callpath, we need to prefix with %.
-		layout := defaultVerbsLayout[verb]
-		if m[4] != -1 {
-			layout = format[m[4]:m[5]]
-		}
-		if verb != fmtVerbTime && verb != fmtVerbLevelColor && verb != fmtVerbCallpath {
-			layout = "%" + layout
-		}
-
-		fmter.add(verb, layout)
-		prev = end
-	}
-	end := format[prev:]
-	if end != "" {
-		fmter.add(fmtVerbStatic, end)
-	}
-
-	// Make a test run to make sure we can format it correctly.
-	t, err := time.Parse(time.RFC3339, "2010-02-04T21:00:57-08:00")
-	if err != nil {
-		panic(err)
-	}
-	testFmt := "hello %s"
-	r := &Record{
-		ID:     12345,
-		Time:   t,
-		Module: "logger",
-		Args:   []interface{}{"go"},
-		fmt:    &testFmt,
-	}
-	if err := fmter.Format(0, r, &bytes.Buffer{}); err != nil {
-		return nil, err
-	}
-
-	return fmter, nil
-}
-
-// MustStringFormatter is equivalent to NewStringFormatter with a call to panic
-// on error.
-func MustStringFormatter(format string) Formatter {
-	f, err := NewStringFormatter(format)
-	if err != nil {
-		panic("Failed to initialized string formatter: " + err.Error())
-	}
-	return f
-}
-
-func (f *stringFormatter) add(verb fmtVerb, layout string) {
-	f.parts = append(f.parts, part{verb, layout})
-}
-
-func (f *stringFormatter) Format(calldepth int, r *Record, output io.Writer) error {
-	for _, part := range f.parts {
-		if part.verb == fmtVerbStatic {
-			output.Write([]byte(part.layout))
-		} else if part.verb == fmtVerbTime {
-			output.Write([]byte(r.Time.Format(part.layout)))
-		} else if part.verb == fmtVerbLevelColor {
-			doFmtVerbLevelColor(part.layout, r.Level, output)
-		} else if part.verb == fmtVerbCallpath {
-			depth, err := strconv.Atoi(part.layout)
-			if err != nil {
-				depth = 0
-			}
-			output.Write([]byte(formatCallpath(calldepth+1, depth)))
-		} else {
-			var v interface{}
-			switch part.verb {
-			case fmtVerbLevel:
-				v = r.Level
-				break
-			case fmtVerbID:
-				v = r.ID
-				break
-			case fmtVerbPid:
-				v = pid
-				break
-			case fmtVerbProgram:
-				v = program
-				break
-			case fmtVerbModule:
-				v = r.Module
-				break
-			case fmtVerbMessage:
-				v = r.Message()
-				break
-			case fmtVerbLongfile, fmtVerbShortfile:
-				_, file, line, ok := runtime.Caller(calldepth + 1)
-				if !ok {
-					file = "???"
-					line = 0
-				} else if part.verb == fmtVerbShortfile {
-					file = filepath.Base(file)
-				}
-				v = fmt.Sprintf("%s:%d", file, line)
-			case fmtVerbLongfunc, fmtVerbShortfunc,
-				fmtVerbLongpkg, fmtVerbShortpkg:
-				// TODO cache pc
-				v = "???"
-				if pc, _, _, ok := runtime.Caller(calldepth + 1); ok {
-					if f := runtime.FuncForPC(pc); f != nil {
-						v = formatFuncName(part.verb, f.Name())
-					}
-				}
-			default:
-				panic("unhandled format part")
-			}
-			fmt.Fprintf(output, part.layout, v)
-		}
-	}
-	return nil
-}
-
-// formatFuncName tries to extract certain part of the runtime formatted
-// function name to some pre-defined variation.
-//
-// This function is known to not work properly if the package path or name
-// contains a dot.
-func formatFuncName(v fmtVerb, f string) string {
-	i := strings.LastIndex(f, "/")
-	j := strings.Index(f[i+1:], ".")
-	if j < 1 {
-		return "???"
-	}
-	pkg, fun := f[:i+j+1], f[i+j+2:]
-	switch v {
-	case fmtVerbLongpkg:
-		return pkg
-	case fmtVerbShortpkg:
-		return path.Base(pkg)
-	case fmtVerbLongfunc:
-		return fun
-	case fmtVerbShortfunc:
-		i = strings.LastIndex(fun, ".")
-		return fun[i+1:]
-	}
-	panic("unexpected func formatter")
-}
-
-func formatCallpath(calldepth int, depth int) string {
-	v := ""
-	callers := make([]uintptr, 64)
-	n := runtime.Callers(calldepth+2, callers)
-	oldPc := callers[n-1]
-
-	start := n - 3
-	if depth > 0 && start >= depth {
-		start = depth - 1
-		v += "~."
-	}
-	recursiveCall := false
-	for i := start; i >= 0; i-- {
-		pc := callers[i]
-		if oldPc == pc {
-			recursiveCall = true
-			continue
-		}
-		oldPc = pc
-		if recursiveCall {
-			recursiveCall = false
-			v += ".."
-		}
-		if i < start {
-			v += "."
-		}
-		if f := runtime.FuncForPC(pc); f != nil {
-			v += formatFuncName(fmtVerbShortfunc, f.Name())
-		}
-	}
-	return v
-}
-
-// backendFormatter combines a backend with a specific formatter making it
-// possible to have different log formats for different backends.
-type backendFormatter struct {
-	b Backend
-	f Formatter
-}
-
-// NewBackendFormatter creates a new backend which makes all records that
-// passes through it beeing formatted by the specific formatter.
-func NewBackendFormatter(b Backend, f Formatter) Backend {
-	return &backendFormatter{b, f}
-}
-
-// Log implements the Log function required by the Backend interface.
-func (bf *backendFormatter) Log(level Level, calldepth int, r *Record) error {
-	// Make a shallow copy of the record and replace any formatter
-	r2 := *r
-	r2.formatter = bf.f
-	return bf.b.Log(level, calldepth+1, &r2)
-}
diff --git a/vendor/github.com/op/go-logging/level.go b/vendor/github.com/op/go-logging/level.go
deleted file mode 100644
index 98dd191873..0000000000
--- a/vendor/github.com/op/go-logging/level.go
+++ /dev/null
@@ -1,128 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package logging
-
-import (
-	"errors"
-	"strings"
-	"sync"
-)
-
-// ErrInvalidLogLevel is used when an invalid log level has been used.
-var ErrInvalidLogLevel = errors.New("logger: invalid log level")
-
-// Level defines all available log levels for log messages.
-type Level int
-
-// Log levels.
-const (
-	CRITICAL Level = iota
-	ERROR
-	WARNING
-	NOTICE
-	INFO
-	DEBUG
-)
-
-var levelNames = []string{
-	"CRITICAL",
-	"ERROR",
-	"WARNING",
-	"NOTICE",
-	"INFO",
-	"DEBUG",
-}
-
-// String returns the string representation of a logging level.
-func (p Level) String() string {
-	return levelNames[p]
-}
-
-// LogLevel returns the log level from a string representation.
-func LogLevel(level string) (Level, error) {
-	for i, name := range levelNames {
-		if strings.EqualFold(name, level) {
-			return Level(i), nil
-		}
-	}
-	return ERROR, ErrInvalidLogLevel
-}
-
-// Leveled interface is the interface required to be able to add leveled
-// logging.
-type Leveled interface {
-	GetLevel(string) Level
-	SetLevel(Level, string)
-	IsEnabledFor(Level, string) bool
-}
-
-// LeveledBackend is a log backend with additional knobs for setting levels on
-// individual modules to different levels.
-type LeveledBackend interface {
-	Backend
-	Leveled
-}
-
-type moduleLeveled struct {
-	levels    map[string]Level
-	backend   Backend
-	formatter Formatter
-	once      sync.Once
-}
-
-// AddModuleLevel wraps a log backend with knobs to have different log levels
-// for different modules.
-func AddModuleLevel(backend Backend) LeveledBackend {
-	var leveled LeveledBackend
-	var ok bool
-	if leveled, ok = backend.(LeveledBackend); !ok {
-		leveled = &moduleLeveled{
-			levels:  make(map[string]Level),
-			backend: backend,
-		}
-	}
-	return leveled
-}
-
-// GetLevel returns the log level for the given module.
-func (l *moduleLeveled) GetLevel(module string) Level {
-	level, exists := l.levels[module]
-	if exists == false {
-		level, exists = l.levels[""]
-		// no configuration exists, default to debug
-		if exists == false {
-			level = DEBUG
-		}
-	}
-	return level
-}
-
-// SetLevel sets the log level for the given module.
-func (l *moduleLeveled) SetLevel(level Level, module string) {
-	l.levels[module] = level
-}
-
-// IsEnabledFor will return true if logging is enabled for the given module.
-func (l *moduleLeveled) IsEnabledFor(level Level, module string) bool {
-	return level <= l.GetLevel(module)
-}
-
-func (l *moduleLeveled) Log(level Level, calldepth int, rec *Record) (err error) {
-	if l.IsEnabledFor(level, rec.Module) {
-		// TODO get rid of traces of formatter here. BackendFormatter should be used.
-		rec.formatter = l.getFormatterAndCacheCurrent()
-		err = l.backend.Log(level, calldepth+1, rec)
-	}
-	return
-}
-
-func (l *moduleLeveled) getFormatterAndCacheCurrent() Formatter {
-	l.once.Do(func() {
-		if l.formatter == nil {
-			l.formatter = getFormatter()
-		}
-	})
-	return l.formatter
-}
diff --git a/vendor/github.com/op/go-logging/log_nix.go b/vendor/github.com/op/go-logging/log_nix.go
deleted file mode 100644
index 4ff2ab1ab8..0000000000
--- a/vendor/github.com/op/go-logging/log_nix.go
+++ /dev/null
@@ -1,109 +0,0 @@
-// +build !windows
-
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package logging
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"log"
-)
-
-type color int
-
-const (
-	ColorBlack = iota + 30
-	ColorRed
-	ColorGreen
-	ColorYellow
-	ColorBlue
-	ColorMagenta
-	ColorCyan
-	ColorWhite
-)
-
-var (
-	colors = []string{
-		CRITICAL: ColorSeq(ColorMagenta),
-		ERROR:    ColorSeq(ColorRed),
-		WARNING:  ColorSeq(ColorYellow),
-		NOTICE:   ColorSeq(ColorGreen),
-		DEBUG:    ColorSeq(ColorCyan),
-	}
-	boldcolors = []string{
-		CRITICAL: ColorSeqBold(ColorMagenta),
-		ERROR:    ColorSeqBold(ColorRed),
-		WARNING:  ColorSeqBold(ColorYellow),
-		NOTICE:   ColorSeqBold(ColorGreen),
-		DEBUG:    ColorSeqBold(ColorCyan),
-	}
-)
-
-// LogBackend utilizes the standard log module.
-type LogBackend struct {
-	Logger      *log.Logger
-	Color       bool
-	ColorConfig []string
-}
-
-// NewLogBackend creates a new LogBackend.
-func NewLogBackend(out io.Writer, prefix string, flag int) *LogBackend {
-	return &LogBackend{Logger: log.New(out, prefix, flag)}
-}
-
-// Log implements the Backend interface.
-func (b *LogBackend) Log(level Level, calldepth int, rec *Record) error {
-	if b.Color {
-		col := colors[level]
-		if len(b.ColorConfig) > int(level) && b.ColorConfig[level] != "" {
-			col = b.ColorConfig[level]
-		}
-
-		buf := &bytes.Buffer{}
-		buf.Write([]byte(col))
-		buf.Write([]byte(rec.Formatted(calldepth + 1)))
-		buf.Write([]byte("\033[0m"))
-		// For some reason, the Go logger arbitrarily decided "2" was the correct
-		// call depth...
-		return b.Logger.Output(calldepth+2, buf.String())
-	}
-
-	return b.Logger.Output(calldepth+2, rec.Formatted(calldepth+1))
-}
-
-// ConvertColors takes a list of ints representing colors for log levels and
-// converts them into strings for ANSI color formatting
-func ConvertColors(colors []int, bold bool) []string {
-	converted := []string{}
-	for _, i := range colors {
-		if bold {
-			converted = append(converted, ColorSeqBold(color(i)))
-		} else {
-			converted = append(converted, ColorSeq(color(i)))
-		}
-	}
-
-	return converted
-}
-
-func ColorSeq(color color) string {
-	return fmt.Sprintf("\033[%dm", int(color))
-}
-
-func ColorSeqBold(color color) string {
-	return fmt.Sprintf("\033[%d;1m", int(color))
-}
-
-func doFmtVerbLevelColor(layout string, level Level, output io.Writer) {
-	if layout == "bold" {
-		output.Write([]byte(boldcolors[level]))
-	} else if layout == "reset" {
-		output.Write([]byte("\033[0m"))
-	} else {
-		output.Write([]byte(colors[level]))
-	}
-}
diff --git a/vendor/github.com/op/go-logging/log_windows.go b/vendor/github.com/op/go-logging/log_windows.go
deleted file mode 100644
index b8dc92c67a..0000000000
--- a/vendor/github.com/op/go-logging/log_windows.go
+++ /dev/null
@@ -1,107 +0,0 @@
-// +build windows
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package logging
-
-import (
-	"bytes"
-	"io"
-	"log"
-	"syscall"
-)
-
-var (
-	kernel32DLL                 = syscall.NewLazyDLL("kernel32.dll")
-	setConsoleTextAttributeProc = kernel32DLL.NewProc("SetConsoleTextAttribute")
-)
-
-// Character attributes
-// Note:
-// -- The attributes are combined to produce various colors (e.g., Blue + Green will create Cyan).
-//    Clearing all foreground or background colors results in black; setting all creates white.
-// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms682088(v=vs.85).aspx#_win32_character_attributes.
-const (
-	fgBlack     = 0x0000
-	fgBlue      = 0x0001
-	fgGreen     = 0x0002
-	fgCyan      = 0x0003
-	fgRed       = 0x0004
-	fgMagenta   = 0x0005
-	fgYellow    = 0x0006
-	fgWhite     = 0x0007
-	fgIntensity = 0x0008
-	fgMask      = 0x000F
-)
-
-var (
-	colors = []uint16{
-		INFO:     fgWhite,
-		CRITICAL: fgMagenta,
-		ERROR:    fgRed,
-		WARNING:  fgYellow,
-		NOTICE:   fgGreen,
-		DEBUG:    fgCyan,
-	}
-	boldcolors = []uint16{
-		INFO:     fgWhite | fgIntensity,
-		CRITICAL: fgMagenta | fgIntensity,
-		ERROR:    fgRed | fgIntensity,
-		WARNING:  fgYellow | fgIntensity,
-		NOTICE:   fgGreen | fgIntensity,
-		DEBUG:    fgCyan | fgIntensity,
-	}
-)
-
-type file interface {
-	Fd() uintptr
-}
-
-// LogBackend utilizes the standard log module.
-type LogBackend struct {
-	Logger *log.Logger
-	Color  bool
-
-	// f is set to a non-nil value if the underlying writer which logs writes to
-	// implements the file interface. This makes us able to colorise the output.
-	f file
-}
-
-// NewLogBackend creates a new LogBackend.
-func NewLogBackend(out io.Writer, prefix string, flag int) *LogBackend {
-	b := &LogBackend{Logger: log.New(out, prefix, flag)}
-
-	// Unfortunately, the API used only takes an io.Writer where the Windows API
-	// need the actual fd to change colors.
-	if f, ok := out.(file); ok {
-		b.f = f
-	}
-
-	return b
-}
-
-func (b *LogBackend) Log(level Level, calldepth int, rec *Record) error {
-	if b.Color && b.f != nil {
-		buf := &bytes.Buffer{}
-		setConsoleTextAttribute(b.f, colors[level])
-		buf.Write([]byte(rec.Formatted(calldepth + 1)))
-		err := b.Logger.Output(calldepth+2, buf.String())
-		setConsoleTextAttribute(b.f, fgWhite)
-		return err
-	}
-	return b.Logger.Output(calldepth+2, rec.Formatted(calldepth+1))
-}
-
-// setConsoleTextAttribute sets the attributes of characters written to the
-// console screen buffer by the WriteFile or WriteConsole function.
-// See http://msdn.microsoft.com/en-us/library/windows/desktop/ms686047(v=vs.85).aspx.
-func setConsoleTextAttribute(f file, attribute uint16) bool {
-	ok, _, _ := setConsoleTextAttributeProc.Call(f.Fd(), uintptr(attribute), 0)
-	return ok != 0
-}
-
-func doFmtVerbLevelColor(layout string, level Level, output io.Writer) {
-	// TODO not supported on Windows since the io.Writer here is actually a
-	// bytes.Buffer.
-}
diff --git a/vendor/github.com/op/go-logging/logger.go b/vendor/github.com/op/go-logging/logger.go
deleted file mode 100644
index 535ed9b1e2..0000000000
--- a/vendor/github.com/op/go-logging/logger.go
+++ /dev/null
@@ -1,259 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package logging implements a logging infrastructure for Go. It supports
-// different logging backends like syslog, file and memory. Multiple backends
-// can be utilized with different log levels per backend and logger.
-package logging
-
-import (
-	"bytes"
-	"fmt"
-	"log"
-	"os"
-	"strings"
-	"sync/atomic"
-	"time"
-)
-
-// Redactor is an interface for types that may contain sensitive information
-// (like passwords), which shouldn't be printed to the log. The idea was found
-// in relog as part of the vitness project.
-type Redactor interface {
-	Redacted() interface{}
-}
-
-// Redact returns a string of * having the same length as s.
-func Redact(s string) string {
-	return strings.Repeat("*", len(s))
-}
-
-var (
-	// Sequence number is incremented and utilized for all log records created.
-	sequenceNo uint64
-
-	// timeNow is a customizable for testing purposes.
-	timeNow = time.Now
-)
-
-// Record represents a log record and contains the timestamp when the record
-// was created, an increasing id, filename and line and finally the actual
-// formatted log line.
-type Record struct {
-	ID     uint64
-	Time   time.Time
-	Module string
-	Level  Level
-	Args   []interface{}
-
-	// message is kept as a pointer to have shallow copies update this once
-	// needed.
-	message   *string
-	fmt       *string
-	formatter Formatter
-	formatted string
-}
-
-// Formatted returns the formatted log record string.
-func (r *Record) Formatted(calldepth int) string {
-	if r.formatted == "" {
-		var buf bytes.Buffer
-		r.formatter.Format(calldepth+1, r, &buf)
-		r.formatted = buf.String()
-	}
-	return r.formatted
-}
-
-// Message returns the log record message.
-func (r *Record) Message() string {
-	if r.message == nil {
-		// Redact the arguments that implements the Redactor interface
-		for i, arg := range r.Args {
-			if redactor, ok := arg.(Redactor); ok == true {
-				r.Args[i] = redactor.Redacted()
-			}
-		}
-		var buf bytes.Buffer
-		if r.fmt != nil {
-			fmt.Fprintf(&buf, *r.fmt, r.Args...)
-		} else {
-			// use Fprintln to make sure we always get space between arguments
-			fmt.Fprintln(&buf, r.Args...)
-			buf.Truncate(buf.Len() - 1) // strip newline
-		}
-		msg := buf.String()
-		r.message = &msg
-	}
-	return *r.message
-}
-
-// Logger is the actual logger which creates log records based on the functions
-// called and passes them to the underlying logging backend.
-type Logger struct {
-	Module      string
-	backend     LeveledBackend
-	haveBackend bool
-
-	// ExtraCallDepth can be used to add additional call depth when getting the
-	// calling function. This is normally used when wrapping a logger.
-	ExtraCalldepth int
-}
-
-// SetBackend overrides any previously defined backend for this logger.
-func (l *Logger) SetBackend(backend LeveledBackend) {
-	l.backend = backend
-	l.haveBackend = true
-}
-
-// TODO call NewLogger and remove MustGetLogger?
-
-// GetLogger creates and returns a Logger object based on the module name.
-func GetLogger(module string) (*Logger, error) {
-	return &Logger{Module: module}, nil
-}
-
-// MustGetLogger is like GetLogger but panics if the logger can't be created.
-// It simplifies safe initialization of a global logger for eg. a package.
-func MustGetLogger(module string) *Logger {
-	logger, err := GetLogger(module)
-	if err != nil {
-		panic("logger: " + module + ": " + err.Error())
-	}
-	return logger
-}
-
-// Reset restores the internal state of the logging library.
-func Reset() {
-	// TODO make a global Init() method to be less magic? or make it such that
-	// if there's no backends at all configured, we could use some tricks to
-	// automatically setup backends based if we have a TTY or not.
-	sequenceNo = 0
-	b := SetBackend(NewLogBackend(os.Stderr, "", log.LstdFlags))
-	b.SetLevel(DEBUG, "")
-	SetFormatter(DefaultFormatter)
-	timeNow = time.Now
-}
-
-// IsEnabledFor returns true if the logger is enabled for the given level.
-func (l *Logger) IsEnabledFor(level Level) bool {
-	return defaultBackend.IsEnabledFor(level, l.Module)
-}
-
-func (l *Logger) log(lvl Level, format *string, args ...interface{}) {
-	if !l.IsEnabledFor(lvl) {
-		return
-	}
-
-	// Create the logging record and pass it in to the backend
-	record := &Record{
-		ID:     atomic.AddUint64(&sequenceNo, 1),
-		Time:   timeNow(),
-		Module: l.Module,
-		Level:  lvl,
-		fmt:    format,
-		Args:   args,
-	}
-
-	// TODO use channels to fan out the records to all backends?
-	// TODO in case of errors, do something (tricky)
-
-	// calldepth=2 brings the stack up to the caller of the level
-	// methods, Info(), Fatal(), etc.
-	// ExtraCallDepth allows this to be extended further up the stack in case we
-	// are wrapping these methods, eg. to expose them package level
-	if l.haveBackend {
-		l.backend.Log(lvl, 2+l.ExtraCalldepth, record)
-		return
-	}
-
-	defaultBackend.Log(lvl, 2+l.ExtraCalldepth, record)
-}
-
-// Fatal is equivalent to l.Critical(fmt.Sprint()) followed by a call to os.Exit(1).
-func (l *Logger) Fatal(args ...interface{}) {
-	l.log(CRITICAL, nil, args...)
-	os.Exit(1)
-}
-
-// Fatalf is equivalent to l.Critical followed by a call to os.Exit(1).
-func (l *Logger) Fatalf(format string, args ...interface{}) {
-	l.log(CRITICAL, &format, args...)
-	os.Exit(1)
-}
-
-// Panic is equivalent to l.Critical(fmt.Sprint()) followed by a call to panic().
-func (l *Logger) Panic(args ...interface{}) {
-	l.log(CRITICAL, nil, args...)
-	panic(fmt.Sprint(args...))
-}
-
-// Panicf is equivalent to l.Critical followed by a call to panic().
-func (l *Logger) Panicf(format string, args ...interface{}) {
-	l.log(CRITICAL, &format, args...)
-	panic(fmt.Sprintf(format, args...))
-}
-
-// Critical logs a message using CRITICAL as log level.
-func (l *Logger) Critical(args ...interface{}) {
-	l.log(CRITICAL, nil, args...)
-}
-
-// Criticalf logs a message using CRITICAL as log level.
-func (l *Logger) Criticalf(format string, args ...interface{}) {
-	l.log(CRITICAL, &format, args...)
-}
-
-// Error logs a message using ERROR as log level.
-func (l *Logger) Error(args ...interface{}) {
-	l.log(ERROR, nil, args...)
-}
-
-// Errorf logs a message using ERROR as log level.
-func (l *Logger) Errorf(format string, args ...interface{}) {
-	l.log(ERROR, &format, args...)
-}
-
-// Warning logs a message using WARNING as log level.
-func (l *Logger) Warning(args ...interface{}) {
-	l.log(WARNING, nil, args...)
-}
-
-// Warningf logs a message using WARNING as log level.
-func (l *Logger) Warningf(format string, args ...interface{}) {
-	l.log(WARNING, &format, args...)
-}
-
-// Notice logs a message using NOTICE as log level.
-func (l *Logger) Notice(args ...interface{}) {
-	l.log(NOTICE, nil, args...)
-}
-
-// Noticef logs a message using NOTICE as log level.
-func (l *Logger) Noticef(format string, args ...interface{}) {
-	l.log(NOTICE, &format, args...)
-}
-
-// Info logs a message using INFO as log level.
-func (l *Logger) Info(args ...interface{}) {
-	l.log(INFO, nil, args...)
-}
-
-// Infof logs a message using INFO as log level.
-func (l *Logger) Infof(format string, args ...interface{}) {
-	l.log(INFO, &format, args...)
-}
-
-// Debug logs a message using DEBUG as log level.
-func (l *Logger) Debug(args ...interface{}) {
-	l.log(DEBUG, nil, args...)
-}
-
-// Debugf logs a message using DEBUG as log level.
-func (l *Logger) Debugf(format string, args ...interface{}) {
-	l.log(DEBUG, &format, args...)
-}
-
-func init() {
-	Reset()
-}
diff --git a/vendor/github.com/op/go-logging/memory.go b/vendor/github.com/op/go-logging/memory.go
deleted file mode 100644
index 8d5152c0ba..0000000000
--- a/vendor/github.com/op/go-logging/memory.go
+++ /dev/null
@@ -1,237 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !appengine
-
-package logging
-
-import (
-	"sync"
-	"sync/atomic"
-	"time"
-	"unsafe"
-)
-
-// TODO pick one of the memory backends and stick with it or share interface.
-
-// InitForTesting is a convenient method when using logging in a test. Once
-// called, the time will be frozen to January 1, 1970 UTC.
-func InitForTesting(level Level) *MemoryBackend {
-	Reset()
-
-	memoryBackend := NewMemoryBackend(10240)
-
-	leveledBackend := AddModuleLevel(memoryBackend)
-	leveledBackend.SetLevel(level, "")
-	SetBackend(leveledBackend)
-
-	timeNow = func() time.Time {
-		return time.Unix(0, 0).UTC()
-	}
-	return memoryBackend
-}
-
-// Node is a record node pointing to an optional next node.
-type node struct {
-	next   *node
-	Record *Record
-}
-
-// Next returns the next record node. If there's no node available, it will
-// return nil.
-func (n *node) Next() *node {
-	return n.next
-}
-
-// MemoryBackend is a simple memory based logging backend that will not produce
-// any output but merly keep records, up to the given size, in memory.
-type MemoryBackend struct {
-	size       int32
-	maxSize    int32
-	head, tail unsafe.Pointer
-}
-
-// NewMemoryBackend creates a simple in-memory logging backend.
-func NewMemoryBackend(size int) *MemoryBackend {
-	return &MemoryBackend{maxSize: int32(size)}
-}
-
-// Log implements the Log method required by Backend.
-func (b *MemoryBackend) Log(level Level, calldepth int, rec *Record) error {
-	var size int32
-
-	n := &node{Record: rec}
-	np := unsafe.Pointer(n)
-
-	// Add the record to the tail. If there's no records available, tail and
-	// head will both be nil. When we successfully set the tail and the previous
-	// value was nil, it's safe to set the head to the current value too.
-	for {
-		tailp := b.tail
-		swapped := atomic.CompareAndSwapPointer(
-			&b.tail,
-			tailp,
-			np,
-		)
-		if swapped == true {
-			if tailp == nil {
-				b.head = np
-			} else {
-				(*node)(tailp).next = n
-			}
-			size = atomic.AddInt32(&b.size, 1)
-			break
-		}
-	}
-
-	// Since one record was added, we might have overflowed the list. Remove
-	// a record if that is the case. The size will fluctate a bit, but
-	// eventual consistent.
-	if b.maxSize > 0 && size > b.maxSize {
-		for {
-			headp := b.head
-			head := (*node)(b.head)
-			if head.next == nil {
-				break
-			}
-			swapped := atomic.CompareAndSwapPointer(
-				&b.head,
-				headp,
-				unsafe.Pointer(head.next),
-			)
-			if swapped == true {
-				atomic.AddInt32(&b.size, -1)
-				break
-			}
-		}
-	}
-	return nil
-}
-
-// Head returns the oldest record node kept in memory. It can be used to
-// iterate over records, one by one, up to the last record.
-//
-// Note: new records can get added while iterating. Hence the number of records
-// iterated over might be larger than the maximum size.
-func (b *MemoryBackend) Head() *node {
-	return (*node)(b.head)
-}
-
-type event int
-
-const (
-	eventFlush event = iota
-	eventStop
-)
-
-// ChannelMemoryBackend is very similar to the MemoryBackend, except that it
-// internally utilizes a channel.
-type ChannelMemoryBackend struct {
-	maxSize    int
-	size       int
-	incoming   chan *Record
-	events     chan event
-	mu         sync.Mutex
-	running    bool
-	flushWg    sync.WaitGroup
-	stopWg     sync.WaitGroup
-	head, tail *node
-}
-
-// NewChannelMemoryBackend creates a simple in-memory logging backend which
-// utilizes a go channel for communication.
-//
-// Start will automatically be called by this function.
-func NewChannelMemoryBackend(size int) *ChannelMemoryBackend {
-	backend := &ChannelMemoryBackend{
-		maxSize:  size,
-		incoming: make(chan *Record, 1024),
-		events:   make(chan event),
-	}
-	backend.Start()
-	return backend
-}
-
-// Start launches the internal goroutine which starts processing data from the
-// input channel.
-func (b *ChannelMemoryBackend) Start() {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	// Launch the goroutine unless it's already running.
-	if b.running != true {
-		b.running = true
-		b.stopWg.Add(1)
-		go b.process()
-	}
-}
-
-func (b *ChannelMemoryBackend) process() {
-	defer b.stopWg.Done()
-	for {
-		select {
-		case rec := <-b.incoming:
-			b.insertRecord(rec)
-		case e := <-b.events:
-			switch e {
-			case eventStop:
-				return
-			case eventFlush:
-				for len(b.incoming) > 0 {
-					b.insertRecord(<-b.incoming)
-				}
-				b.flushWg.Done()
-			}
-		}
-	}
-}
-
-func (b *ChannelMemoryBackend) insertRecord(rec *Record) {
-	prev := b.tail
-	b.tail = &node{Record: rec}
-	if prev == nil {
-		b.head = b.tail
-	} else {
-		prev.next = b.tail
-	}
-
-	if b.maxSize > 0 && b.size >= b.maxSize {
-		b.head = b.head.next
-	} else {
-		b.size++
-	}
-}
-
-// Flush waits until all records in the buffered channel have been processed.
-func (b *ChannelMemoryBackend) Flush() {
-	b.flushWg.Add(1)
-	b.events <- eventFlush
-	b.flushWg.Wait()
-}
-
-// Stop signals the internal goroutine to exit and waits until it have.
-func (b *ChannelMemoryBackend) Stop() {
-	b.mu.Lock()
-	if b.running == true {
-		b.running = false
-		b.events <- eventStop
-	}
-	b.mu.Unlock()
-	b.stopWg.Wait()
-}
-
-// Log implements the Log method required by Backend.
-func (b *ChannelMemoryBackend) Log(level Level, calldepth int, rec *Record) error {
-	b.incoming <- rec
-	return nil
-}
-
-// Head returns the oldest record node kept in memory. It can be used to
-// iterate over records, one by one, up to the last record.
-//
-// Note: new records can get added while iterating. Hence the number of records
-// iterated over might be larger than the maximum size.
-func (b *ChannelMemoryBackend) Head() *node {
-	return b.head
-}
diff --git a/vendor/github.com/op/go-logging/multi.go b/vendor/github.com/op/go-logging/multi.go
deleted file mode 100644
index 3731653e68..0000000000
--- a/vendor/github.com/op/go-logging/multi.go
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package logging
-
-// TODO remove Level stuff from the multi logger. Do one thing.
-
-// multiLogger is a log multiplexer which can be used to utilize multiple log
-// backends at once.
-type multiLogger struct {
-	backends []LeveledBackend
-}
-
-// MultiLogger creates a logger which contain multiple loggers.
-func MultiLogger(backends ...Backend) LeveledBackend {
-	var leveledBackends []LeveledBackend
-	for _, backend := range backends {
-		leveledBackends = append(leveledBackends, AddModuleLevel(backend))
-	}
-	return &multiLogger{leveledBackends}
-}
-
-// Log passes the log record to all backends.
-func (b *multiLogger) Log(level Level, calldepth int, rec *Record) (err error) {
-	for _, backend := range b.backends {
-		if backend.IsEnabledFor(level, rec.Module) {
-			// Shallow copy of the record for the formatted cache on Record and get the
-			// record formatter from the backend.
-			r2 := *rec
-			if e := backend.Log(level, calldepth+1, &r2); e != nil {
-				err = e
-			}
-		}
-	}
-	return
-}
-
-// GetLevel returns the highest level enabled by all backends.
-func (b *multiLogger) GetLevel(module string) Level {
-	var level Level
-	for _, backend := range b.backends {
-		if backendLevel := backend.GetLevel(module); backendLevel > level {
-			level = backendLevel
-		}
-	}
-	return level
-}
-
-// SetLevel propagates the same level to all backends.
-func (b *multiLogger) SetLevel(level Level, module string) {
-	for _, backend := range b.backends {
-		backend.SetLevel(level, module)
-	}
-}
-
-// IsEnabledFor returns true if any of the backends are enabled for it.
-func (b *multiLogger) IsEnabledFor(level Level, module string) bool {
-	for _, backend := range b.backends {
-		if backend.IsEnabledFor(level, module) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/vendor/github.com/op/go-logging/syslog.go b/vendor/github.com/op/go-logging/syslog.go
deleted file mode 100644
index 4faa531709..0000000000
--- a/vendor/github.com/op/go-logging/syslog.go
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//+build !windows,!plan9
-
-package logging
-
-import "log/syslog"
-
-// SyslogBackend is a simple logger to syslog backend. It automatically maps
-// the internal log levels to appropriate syslog log levels.
-type SyslogBackend struct {
-	Writer *syslog.Writer
-}
-
-// NewSyslogBackend connects to the syslog daemon using UNIX sockets with the
-// given prefix. If prefix is not given, the prefix will be derived from the
-// launched command.
-func NewSyslogBackend(prefix string) (b *SyslogBackend, err error) {
-	var w *syslog.Writer
-	w, err = syslog.New(syslog.LOG_CRIT, prefix)
-	return &SyslogBackend{w}, err
-}
-
-// NewSyslogBackendPriority is the same as NewSyslogBackend, but with custom
-// syslog priority, like syslog.LOG_LOCAL3|syslog.LOG_DEBUG etc.
-func NewSyslogBackendPriority(prefix string, priority syslog.Priority) (b *SyslogBackend, err error) {
-	var w *syslog.Writer
-	w, err = syslog.New(priority, prefix)
-	return &SyslogBackend{w}, err
-}
-
-// Log implements the Backend interface.
-func (b *SyslogBackend) Log(level Level, calldepth int, rec *Record) error {
-	line := rec.Formatted(calldepth + 1)
-	switch level {
-	case CRITICAL:
-		return b.Writer.Crit(line)
-	case ERROR:
-		return b.Writer.Err(line)
-	case WARNING:
-		return b.Writer.Warning(line)
-	case NOTICE:
-		return b.Writer.Notice(line)
-	case INFO:
-		return b.Writer.Info(line)
-	case DEBUG:
-		return b.Writer.Debug(line)
-	default:
-	}
-	panic("unhandled log level")
-}
diff --git a/vendor/github.com/op/go-logging/syslog_fallback.go b/vendor/github.com/op/go-logging/syslog_fallback.go
deleted file mode 100644
index 91bc18de63..0000000000
--- a/vendor/github.com/op/go-logging/syslog_fallback.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2013, Örjan Persson. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//+build windows plan9
-
-package logging
-
-import (
-	"fmt"
-)
-
-type Priority int
-
-type SyslogBackend struct {
-}
-
-func NewSyslogBackend(prefix string) (b *SyslogBackend, err error) {
-	return nil, fmt.Errorf("Platform does not support syslog")
-}
-
-func NewSyslogBackendPriority(prefix string, priority Priority) (b *SyslogBackend, err error) {
-	return nil, fmt.Errorf("Platform does not support syslog")
-}
-
-func (b *SyslogBackend) Log(level Level, calldepth int, rec *Record) error {
-	return fmt.Errorf("Platform does not support syslog")
-}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 752d16bfa5..1323ea209a 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -324,8 +324,6 @@ github.com/onsi/gomega/matchers/support/goraph/edge
 github.com/onsi/gomega/matchers/support/goraph/node
 github.com/onsi/gomega/matchers/support/goraph/util
 github.com/onsi/gomega/types
-# github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 => github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
-github.com/op/go-logging
 # github.com/opencontainers/go-digest v1.0.0-rc1 => github.com/opencontainers/go-digest v1.0.0-rc1
 github.com/opencontainers/go-digest
 # github.com/opencontainers/image-spec v1.0.1 => github.com/opencontainers/image-spec v1.0.1


Test patch:
diff --git a/bpf/lib/conntrack_test.h b/bpf/lib/conntrack_test.h
index 475b730d62..a25b1668c3 100644
--- a/bpf/lib/conntrack_test.h
+++ b/bpf/lib/conntrack_test.h
@@ -159,4 +159,12 @@ static void test___ct_lookup()
 	assert(res == CT_ESTABLISHED);
 	assert(monitor == 0);
 	assert(timeout_in(entry, CT_CLOSE_TIMEOUT - 1));
+
+	/* Label connection as new if the tuple wasn't previously tracked */
+	tuple = (void *)__TUPLE_NOEXIST;
+	seen_flags.value = TCP_FLAG_SYN;
+	res = __ct_lookup(map, &skb, tuple, ACTION_CREATE, CT_INGRESS,
+			  &ct_state, true, seen_flags, &monitor);
+	assert(res == CT_NEW);
+	assert(monitor == TRACE_PAYLOAD_LEN);
 }
diff --git a/pkg/datapath/linux/node_linux_test.go b/pkg/datapath/linux/node_linux_test.go
index 8a0affead2..3498b4cae8 100644
--- a/pkg/datapath/linux/node_linux_test.go
+++ b/pkg/datapath/linux/node_linux_test.go
@@ -624,6 +624,19 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateEncapsulation(c *check.C) {
 	}
 }
 
+func lookupDirectRoute(CIDR *cidr.CIDR, nodeIP net.IP) ([]netlink.Route, error) {
+	routeSpec, err := createDirectRouteSpec(CIDR, nodeIP)
+	if err != nil {
+		return nil, err
+	}
+
+	family := netlink.FAMILY_V4
+	if nodeIP.To4() == nil {
+		family = netlink.FAMILY_V6
+	}
+	return netlink.RouteListFiltered(family, routeSpec, netlink.RT_FILTER_DST|netlink.RT_FILTER_GW|netlink.RT_FILTER_OIF)
+}
+
 func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	ip4Alloc1 := cidr.MustParseCIDR("5.5.5.0/24")
 	ip4Alloc2 := cidr.MustParseCIDR("6.6.6.0/24")
@@ -666,7 +679,7 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	err = linuxNodeHandler.NodeAdd(nodev1)
 	c.Assert(err, check.IsNil)
 
-	foundRoutes, err := linuxNodeHandler.lookupDirectRoute(ip4Alloc1, externalNode1IP4v1)
+	foundRoutes, err := lookupDirectRoute(ip4Alloc1, externalNode1IP4v1)
 	c.Assert(err, check.IsNil)
 	if s.enableIPv4 {
 		c.Assert(len(foundRoutes), check.Equals, 1)
@@ -685,7 +698,7 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	err = linuxNodeHandler.NodeUpdate(nodev1, nodev2)
 	c.Assert(err, check.IsNil)
 
-	foundRoutes, err = linuxNodeHandler.lookupDirectRoute(ip4Alloc1, externalNode1IP4v2)
+	foundRoutes, err = lookupDirectRoute(ip4Alloc1, externalNode1IP4v2)
 	c.Assert(err, check.IsNil)
 	if s.enableIPv4 {
 		c.Assert(len(foundRoutes), check.Equals, 1)
@@ -705,12 +718,12 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// node routes for alloc1 ranges should be gone
-	foundRoutes, err = linuxNodeHandler.lookupDirectRoute(ip4Alloc1, externalNode1IP4v2)
+	foundRoutes, err = lookupDirectRoute(ip4Alloc1, externalNode1IP4v2)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(foundRoutes), check.Equals, 0) // route should not exist regardless whether ipv4 is enabled or not
 
 	// node routes for alloc2 ranges should have been installed
-	foundRoutes, err = linuxNodeHandler.lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
+	foundRoutes, err = lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
 	c.Assert(err, check.IsNil)
 	if s.enableIPv4 {
 		c.Assert(len(foundRoutes), check.Equals, 1)
@@ -729,7 +742,7 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// node routes for alloc2 ranges should have been removed
-	foundRoutes, err = linuxNodeHandler.lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
+	foundRoutes, err = lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(foundRoutes), check.Equals, 0)
 
@@ -745,7 +758,7 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// node routes for alloc2 ranges should have been removed
-	foundRoutes, err = linuxNodeHandler.lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
+	foundRoutes, err = lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
 	c.Assert(err, check.IsNil)
 	if s.enableIPv4 {
 		c.Assert(len(foundRoutes), check.Equals, 1)
@@ -758,7 +771,7 @@ func (s *linuxPrivilegedBaseTestSuite) TestNodeUpdateDirectRouting(c *check.C) {
 	c.Assert(err, check.IsNil)
 
 	// node routes for alloc2 ranges should be gone
-	foundRoutes, err = linuxNodeHandler.lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
+	foundRoutes, err = lookupDirectRoute(ip4Alloc2, externalNode1IP4v2)
 	c.Assert(err, check.IsNil)
 	c.Assert(len(foundRoutes), check.Equals, 0) // route should not exist regardless whether ipv4 is enabled or not
 }
diff --git a/pkg/datapath/loader/doc_test.go b/pkg/datapath/loader/doc_test.go
index c00816eb96..d0f26e8fc5 100644
--- a/pkg/datapath/loader/doc_test.go
+++ b/pkg/datapath/loader/doc_test.go
@@ -35,6 +35,6 @@ func Test(t *testing.T) {
 
 func (s *LoaderTestSuite) SetUpTest(c *C) {
 	node.InitDefaultPrefix("")
-	node.SetInternalIPv4(TemplateIPv4)
-	node.SetIPv4Loopback(TemplateIPv4)
+	node.SetInternalIPv4(templateIPv4)
+	node.SetIPv4Loopback(templateIPv4)
 }
diff --git a/pkg/kvstore/base_test.go b/pkg/kvstore/base_test.go
index c9f118d86d..e9ee7da296 100644
--- a/pkg/kvstore/base_test.go
+++ b/pkg/kvstore/base_test.go
@@ -38,7 +38,7 @@ func (s *BaseTests) TestLock(c *C) {
 	defer Client().DeletePrefix(context.TODO(), prefix)
 
 	for i := 0; i < 10; i++ {
-		lock, err := LockPath(context.Background(), fmt.Sprintf("%sfoo/%d", prefix, i))
+		lock, err := LockPath(context.Background(), Client(), fmt.Sprintf("%sfoo/%d", prefix, i))
 		c.Assert(err, IsNil)
 		c.Assert(lock, Not(IsNil))
 		lock.Unlock(context.TODO())
diff --git a/pkg/maps/policymap/policymap_privileged_test.go b/pkg/maps/policymap/policymap_privileged_test.go
index ccd123fb15..d71cf03d75 100644
--- a/pkg/maps/policymap/policymap_privileged_test.go
+++ b/pkg/maps/policymap/policymap_privileged_test.go
@@ -24,6 +24,8 @@ import (
 
 	"github.com/cilium/cilium/pkg/bpf"
 	"github.com/cilium/cilium/pkg/checker"
+	"github.com/cilium/cilium/pkg/logging"
+	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/policy/trafficdirection"
 	"github.com/cilium/cilium/pkg/u8proto"
 
@@ -31,6 +33,8 @@ import (
 	. "gopkg.in/check.v1"
 )
 
+var log = logging.DefaultLogger.WithField(logfields.LogSubsys, "map-policy")
+
 func Test(t *testing.T) {
 	TestingT(t)
 }
diff --git a/pkg/monitor/agent/listener1_2_test.go b/pkg/monitor/agent/listener1_2_test.go
new file mode 100644
index 0000000000..1075ac9b9b
--- /dev/null
+++ b/pkg/monitor/agent/listener1_2_test.go
@@ -0,0 +1,48 @@
+// Copyright 2018-2020 Authors of Cilium
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +build !privileged_tests
+
+package agent
+
+import (
+	"net"
+	"testing"
+
+	. "gopkg.in/check.v1"
+
+	"github.com/cilium/cilium/pkg/monitor/agent/listener"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type ListenerSuite struct{}
+
+var _ = Suite(&ListenerSuite{})
+
+func (m *ListenerSuite) TestListenerv1_2(c *C) {
+	closed := make(chan bool)
+	server, client := net.Pipe()
+	l := newListenerv1_2(client, 10, func(listener listener.MonitorListener) {
+		closed <- true
+	})
+	// Verify the listener version.
+	c.Assert(l.Version(), Equals, listener.Version1_2)
+	// Calling Close() multiple times shouldn't cause panic.
+	l.Close()
+	l.Close()
+	// Make sure the cleanup function gets called.
+	<-closed
+	server.Close()
+}
diff --git a/pkg/node/node_address_test.go b/pkg/node/node_address_test.go
index 025d66da37..c83b8757d2 100644
--- a/pkg/node/node_address_test.go
+++ b/pkg/node/node_address_test.go
@@ -31,24 +31,10 @@ import (
 
 func (s *NodeSuite) TestMaskCheck(c *C) {
 	InitDefaultPrefix("")
-	SetIPv4ClusterCidrMaskSize(24)
 
 	allocCIDR := cidr.MustParseCIDR("1.1.1.1/16")
 	SetIPv4AllocRange(allocCIDR)
-
-	// must fail, cluster /24 > per node alloc prefix /16
-	c.Assert(ValidatePostInit(), Not(IsNil))
-
 	SetInternalIPv4(allocCIDR.IP)
-
-	// OK, cluster /16 == per node alloc prefix /16
-	SetIPv4ClusterCidrMaskSize(16)
-	c.Assert(ValidatePostInit(), IsNil)
-
-	// OK, cluster /8 < per node alloc prefix /16
-	SetIPv4ClusterCidrMaskSize(8)
-	c.Assert(ValidatePostInit(), IsNil)
-
 	c.Assert(IsHostIPv4(GetInternalIPv4()), Equals, true)
 	c.Assert(IsHostIPv4(GetExternalIPv4()), Equals, true)
 	c.Assert(IsHostIPv6(GetIPv6()), Equals, true)
diff --git a/pkg/policy/distillery_test.go b/pkg/policy/distillery_test.go
index f69277c40e..beeadad1aa 100644
--- a/pkg/policy/distillery_test.go
+++ b/pkg/policy/distillery_test.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	stdlog "log"
 	"testing"
 
 	"github.com/cilium/cilium/pkg/checker"
@@ -30,7 +31,6 @@ import (
 	"github.com/cilium/cilium/pkg/policy/trafficdirection"
 	"github.com/cilium/cilium/pkg/testutils"
 
-	logging "github.com/op/go-logging"
 	. "gopkg.in/check.v1"
 )
 
@@ -304,7 +304,7 @@ func (d *policyDistillery) distillPolicy(epLabels labels.LabelArray) (MapState,
 		To:    epLabels,
 		Trace: TRACE_VERBOSE,
 	}
-	ingressL4.Logging = logging.NewLogBackend(d.log, "", 0)
+	ingressL4.Logging = stdlog.New(d.log, "", 0)
 	io.WriteString(d.log, fmt.Sprintf("[distill] Evaluating L4 -> %s", epLabels))
 	l4IngressPolicy, err := d.Repository.ResolveL4IngressPolicy(&ingressL4)
 	if err != nil {
diff --git a/pkg/policy/l4_filter_test.go b/pkg/policy/l4_filter_test.go
index 7ecae2a09e..51a6061c50 100644
--- a/pkg/policy/l4_filter_test.go
+++ b/pkg/policy/l4_filter_test.go
@@ -19,6 +19,7 @@ package policy
 import (
 	"bytes"
 	"fmt"
+	stdlog "log"
 
 	"github.com/cilium/cilium/pkg/checker"
 	"github.com/cilium/cilium/pkg/identity/cache"
@@ -28,7 +29,6 @@ import (
 	"github.com/cilium/cilium/pkg/testutils/allocator"
 	"github.com/cilium/proxy/go/cilium/api"
 
-	"github.com/op/go-logging"
 	. "gopkg.in/check.v1"
 )
 
@@ -143,7 +143,7 @@ func (ds *PolicyTestSuite) TestMergeAllowAllL3AndAllowAllL7(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err := repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -186,7 +186,7 @@ func (ds *PolicyTestSuite) TestMergeAllowAllL3AndAllowAllL7(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctx = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err = repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -240,7 +240,7 @@ func (ds *PolicyTestSuite) TestMergeAllowAllL3AndShadowedL7(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	ingressState := traceState{}
 	res, err := rule1.resolveIngressPolicy(testPolicyContext, &ctx, &ingressState, L4PolicyMap{}, nil)
@@ -303,7 +303,7 @@ func (ds *PolicyTestSuite) TestMergeAllowAllL3AndShadowedL7(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctx = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err := repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -377,7 +377,7 @@ func (ds *PolicyTestSuite) TestMergeIdenticalAllowAllL3AndRestrictedL7HTTP(c *C)
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state := traceState{}
@@ -436,7 +436,7 @@ func (ds *PolicyTestSuite) TestMergeIdenticalAllowAllL3AndRestrictedL7Kafka(c *C
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"9092/TCP": &L4Filter{
@@ -514,7 +514,7 @@ func (ds *PolicyTestSuite) TestMergeIdenticalAllowAllL3AndMismatchingParsers(c *
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state := traceState{}
@@ -558,7 +558,7 @@ func (ds *PolicyTestSuite) TestMergeIdenticalAllowAllL3AndMismatchingParsers(c *
 
 	buffer = new(bytes.Buffer)
 	ctxToA = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state = traceState{}
@@ -603,7 +603,7 @@ func (ds *PolicyTestSuite) TestMergeIdenticalAllowAllL3AndMismatchingParsers(c *
 
 	buffer = new(bytes.Buffer)
 	ctxToA = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	err = conflictingParsersIngressRule.Sanitize()
@@ -648,7 +648,7 @@ func (ds *PolicyTestSuite) TestMergeIdenticalAllowAllL3AndMismatchingParsers(c *
 
 	buffer = new(bytes.Buffer)
 	ctxAToC := SearchContext{From: labelsA, To: labelsC, Trace: TRACE_VERBOSE}
-	ctxAToC.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxAToC.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	err = conflictingParsersEgressRule.Sanitize()
@@ -701,7 +701,7 @@ func (ds *PolicyTestSuite) TestMergeTLSPolicies(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctxFromFoo := SearchContext{From: labels.ParseSelectLabelArray("foo"), Trace: TRACE_VERBOSE}
-	ctxFromFoo.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxFromFoo.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	err := egressRule.Sanitize()
@@ -779,7 +779,7 @@ func (ds *PolicyTestSuite) TestL3RuleShadowedByL3AllowAll(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"80/TCP": &L4Filter{
@@ -839,7 +839,7 @@ func (ds *PolicyTestSuite) TestL3RuleShadowedByL3AllowAll(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctxToA = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected = L4PolicyMap{"80/TCP": &L4Filter{
@@ -912,7 +912,7 @@ func (ds *PolicyTestSuite) TestL3RuleWithL7RulePartiallyShadowedByL3AllowAll(c *
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"80/TCP": &L4Filter{
@@ -983,7 +983,7 @@ func (ds *PolicyTestSuite) TestL3RuleWithL7RulePartiallyShadowedByL3AllowAll(c *
 
 	buffer = new(bytes.Buffer)
 	ctxToA = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected = L4PolicyMap{"80/TCP": &L4Filter{
@@ -1067,7 +1067,7 @@ func (ds *PolicyTestSuite) TestL3RuleWithL7RuleShadowedByL3AllowAll(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"80/TCP": &L4Filter{
@@ -1148,7 +1148,7 @@ func (ds *PolicyTestSuite) TestL3RuleWithL7RuleShadowedByL3AllowAll(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctxToA = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 
 	expected = L4PolicyMap{"80/TCP": &L4Filter{
 		Port:     80,
@@ -1232,7 +1232,7 @@ func (ds *PolicyTestSuite) TestL3SelectingEndpointAndL3AllowAllMergeConflictingL
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state := traceState{}
@@ -1283,7 +1283,7 @@ func (ds *PolicyTestSuite) TestL3SelectingEndpointAndL3AllowAllMergeConflictingL
 
 	buffer = new(bytes.Buffer)
 	ctxToA = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state = traceState{}
@@ -1338,7 +1338,7 @@ func (ds *PolicyTestSuite) TestMergingWithDifferentEndpointsSelectedAllowSameL7(
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"80/TCP": &L4Filter{
@@ -1375,7 +1375,7 @@ func (ds *PolicyTestSuite) TestMergingWithDifferentEndpointsSelectedAllowSameL7(
 
 	buffer = new(bytes.Buffer)
 	ctxToC := SearchContext{To: labelsC, Trace: TRACE_VERBOSE}
-	ctxToC.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToC.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state = traceState{}
@@ -1414,7 +1414,7 @@ func (ds *PolicyTestSuite) TestMergingWithDifferentEndpointSelectedAllowAllL7(c
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"80/TCP": &L4Filter{
@@ -1443,7 +1443,7 @@ func (ds *PolicyTestSuite) TestMergingWithDifferentEndpointSelectedAllowAllL7(c
 
 	buffer = new(bytes.Buffer)
 	ctxToC := SearchContext{To: labelsC, Trace: TRACE_VERBOSE}
-	ctxToC.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToC.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	state = traceState{}
@@ -1490,7 +1490,7 @@ func (ds *PolicyTestSuite) TestAllowingLocalhostShadowsL7(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctxToA := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctxToA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToA.Logging = stdlog.New(buffer, "", 0)
 
 	expected := L4PolicyMap{"80/TCP": &L4Filter{
 		Port:     80,
@@ -1524,7 +1524,7 @@ func (ds *PolicyTestSuite) TestAllowingLocalhostShadowsL7(c *C) {
 	// Endpoints not selected by the rule should not match the rule.
 	buffer = new(bytes.Buffer)
 	ctxToC := SearchContext{To: labelsC, Trace: TRACE_VERBOSE}
-	ctxToC.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxToC.Logging = stdlog.New(buffer, "", 0)
 
 	state = traceState{}
 	res, err = rule.resolveIngressPolicy(testPolicyContext, toFoo, &state, L4PolicyMap{}, nil)
@@ -1549,7 +1549,7 @@ func (ds *PolicyTestSuite) TestEntitiesL3(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctxFromA := SearchContext{From: labelsA, Trace: TRACE_VERBOSE}
-	ctxFromA.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctxFromA.Logging = stdlog.New(buffer, "", 0)
 	c.Log(buffer)
 
 	expected := L4PolicyMap{"0/ANY": &L4Filter{
diff --git a/pkg/policy/repository_test.go b/pkg/policy/repository_test.go
index ba13617d88..38d0b45a08 100644
--- a/pkg/policy/repository_test.go
+++ b/pkg/policy/repository_test.go
@@ -19,6 +19,7 @@ package policy
 import (
 	"bytes"
 	"fmt"
+	stdlog "log"
 	"testing"
 
 	"github.com/cilium/cilium/api/v1/models"
@@ -29,7 +30,6 @@ import (
 	"github.com/cilium/cilium/pkg/option"
 	"github.com/cilium/cilium/pkg/policy/api"
 
-	logging "github.com/op/go-logging"
 	. "gopkg.in/check.v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -537,7 +537,7 @@ func (ds *PolicyTestSuite) TestAllowsEgress(c *C) {
 	ctx := &SearchContext{
 		To:      labels.ParseSelectLabelArray("foo", "groupB"),
 		From:    labels.ParseSelectLabelArray("bar", "groupA"),
-		Logging: logging.NewLogBackend(buffer, "", 0),
+		Logging: stdlog.New(buffer, "", 0),
 		Trace:   TRACE_VERBOSE,
 	}
 	verdict := repo.AllowsEgressRLocked(ctx)
@@ -1836,7 +1836,7 @@ func (repo *Repository) checkTrace(c *C, ctx *SearchContext, trace string,
 	expectedVerdict api.Decision) {
 
 	buffer := new(bytes.Buffer)
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	repo.Mutex.RLock()
 	verdict := repo.AllowsIngressRLocked(ctx)
diff --git a/pkg/policy/rule_test.go b/pkg/policy/rule_test.go
index 763fd7f0d1..f8a2c83ba6 100644
--- a/pkg/policy/rule_test.go
+++ b/pkg/policy/rule_test.go
@@ -18,6 +18,7 @@ package policy
 
 import (
 	"bytes"
+	stdlog "log"
 	"net"
 
 	"github.com/cilium/cilium/api/v1/models"
@@ -27,7 +28,6 @@ import (
 	"github.com/cilium/cilium/pkg/labels"
 	"github.com/cilium/cilium/pkg/policy/api"
 
-	logging "github.com/op/go-logging"
 	. "gopkg.in/check.v1"
 )
 
@@ -223,7 +223,7 @@ func (ds *PolicyTestSuite) TestL4Policy(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{To: labels.ParseSelectLabelArray("bar"), Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	res.Ingress, err = rule2.resolveIngressPolicy(testPolicyContext, &ctx, &ingressState, L4PolicyMap{}, nil)
 	c.Assert(err, IsNil)
@@ -317,7 +317,7 @@ func (ds *PolicyTestSuite) TestMergeL4PolicyEgress(c *C) {
 	buffer := new(bytes.Buffer)
 	fromBar := &SearchContext{
 		From:    labels.ParseSelectLabelArray("bar"),
-		Logging: logging.NewLogBackend(buffer, "", 0),
+		Logging: stdlog.New(buffer, "", 0),
 		Trace:   TRACE_VERBOSE,
 	}
 
@@ -1351,7 +1351,7 @@ func checkIngress(c *C, repo *Repository, ctx *SearchContext, verdict api.Decisi
 	defer repo.Mutex.RUnlock()
 
 	buffer := new(bytes.Buffer)
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 	expectResult(c, verdict, repo.AllowsIngressRLocked(ctx), buffer)
 }
 
@@ -1360,7 +1360,7 @@ func checkEgress(c *C, repo *Repository, ctx *SearchContext, verdict api.Decisio
 	defer repo.Mutex.RUnlock()
 
 	buffer := new(bytes.Buffer)
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 	expectResult(c, verdict, repo.AllowsEgressRLocked(ctx), buffer)
 }
 
@@ -1522,7 +1522,7 @@ func (ds *PolicyTestSuite) TestEgressL4AllowAll(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{From: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4EgressPolicy, err := repo.ResolveL4EgressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -1576,7 +1576,7 @@ func (ds *PolicyTestSuite) TestEgressL4AllowWorld(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{From: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4EgressPolicy, err := repo.ResolveL4EgressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -1629,7 +1629,7 @@ func (ds *PolicyTestSuite) TestEgressL4AllowAllEntity(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{From: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4EgressPolicy, err := repo.ResolveL4EgressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -1677,7 +1677,7 @@ func (ds *PolicyTestSuite) TestEgressL3AllowWorld(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{From: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 }
 
 func (ds *PolicyTestSuite) TestEgressL3AllowAllEntity(c *C) {
@@ -1712,7 +1712,7 @@ func (ds *PolicyTestSuite) TestEgressL3AllowAllEntity(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{From: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 }
 
 func (ds *PolicyTestSuite) TestL4WildcardMerge(c *C) {
@@ -1790,7 +1790,7 @@ func (ds *PolicyTestSuite) TestL4WildcardMerge(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err := repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -1890,7 +1890,7 @@ func (ds *PolicyTestSuite) TestL4WildcardMerge(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctx = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err = repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -1951,7 +1951,7 @@ func (ds *PolicyTestSuite) TestL4WildcardMerge(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctx = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err = repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -2001,7 +2001,7 @@ func (ds *PolicyTestSuite) TestL4WildcardMerge(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctx = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err = repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -2058,7 +2058,7 @@ func (ds *PolicyTestSuite) TestL3L4L7Merge(c *C) {
 
 	buffer := new(bytes.Buffer)
 	ctx := SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err := repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
@@ -2121,7 +2121,7 @@ func (ds *PolicyTestSuite) TestL3L4L7Merge(c *C) {
 
 	buffer = new(bytes.Buffer)
 	ctx = SearchContext{To: labelsA, Trace: TRACE_VERBOSE}
-	ctx.Logging = logging.NewLogBackend(buffer, "", 0)
+	ctx.Logging = stdlog.New(buffer, "", 0)
 
 	l4IngressPolicy, err = repo.ResolveL4IngressPolicy(&ctx)
 	c.Assert(err, IsNil)
diff --git a/pkg/sysctl/sysctl_linux_privileged_test.go b/pkg/sysctl/sysctl_linux_privileged_test.go
index 70e68d1ae9..b80fafec38 100644
--- a/pkg/sysctl/sysctl_linux_privileged_test.go
+++ b/pkg/sysctl/sysctl_linux_privileged_test.go
@@ -99,12 +99,20 @@ func (s *SysctlLinuxPrivilegedTestSuite) TestDisableEnable(c *C) {
 			c.Assert(err, NotNil)
 		} else {
 			c.Assert(err, IsNil)
+
+			val, err := Read(tc.name)
+			c.Assert(err, IsNil)
+			c.Assert(val, Equals, "1")
 		}
 		err = Disable(tc.name)
 		if tc.expectedErr {
 			c.Assert(err, NotNil)
 		} else {
 			c.Assert(err, IsNil)
+
+			val, err := Read(tc.name)
+			c.Assert(err, IsNil)
+			c.Assert(val, Equals, "0")
 		}
 	}
 }
diff --git a/test/docker-compose.yml b/test/docker-compose.yml
index dd3381aac3..9074031673 100644
--- a/test/docker-compose.yml
+++ b/test/docker-compose.yml
@@ -15,7 +15,7 @@ services:
     command: "etcd -name etcd0 -advertise-client-urls http://0.0.0.0:4002 -listen-client-urls http://0.0.0.0:4002 -initial-cluster-token etcd-cluster-1 -initial-cluster-state new"
     privileged: true
   base_image:
-    image: "quay.io/cilium/cilium-builder:2020-02-13"
+    image: "quay.io/cilium/cilium-builder:2020-02-19"
     volumes:
       - "./../:/go/src/github.com/cilium/cilium/"
     privileged: true
diff --git a/test/helpers/cons.go b/test/helpers/cons.go
index 2042e2f9b4..7b5bd2f046 100644
--- a/test/helpers/cons.go
+++ b/test/helpers/cons.go
@@ -176,8 +176,8 @@ const (
 
 	// CiliumStableHelmChartVersion should be the chart version that points
 	// to the v1.X branch
-	CiliumStableHelmChartVersion = "1.6-dev"
-	CiliumStableVersion          = "v1.6"
+	CiliumStableHelmChartVersion = "1.7-dev"
+	CiliumStableVersion          = "v1.7"
 	CiliumLatestHelmChartVersion = "1.7.90"
 	CiliumLatestImageVersion     = "latest"
 
@@ -200,11 +200,12 @@ const (
 
 	// Logs messages that should not be in the cilium logs.
 	panicMessage      = "panic:"
-	deadLockHeader    = "POTENTIAL DEADLOCK:"       // from github.com/sasha-s/go-deadlock/deadlock.go:header
-	segmentationFault = "segmentation fault"        // from https://github.com/cilium/cilium/issues/3233
-	NACKreceived      = "NACK received for version" // from https://github.com/cilium/cilium/issues/4003
-	RunInitFailed     = "JoinEP: "                  // from https://github.com/cilium/cilium/pull/5052
-	sizeMismatch      = "size mismatch for BPF map" // from https://github.com/cilium/cilium/issues/7851
+	deadLockHeader    = "POTENTIAL DEADLOCK:"                  // from github.com/sasha-s/go-deadlock/deadlock.go:header
+	segmentationFault = "segmentation fault"                   // from https://github.com/cilium/cilium/issues/3233
+	NACKreceived      = "NACK received for version"            // from https://github.com/cilium/cilium/issues/4003
+	RunInitFailed     = "JoinEP: "                             // from https://github.com/cilium/cilium/pull/5052
+	sizeMismatch      = "size mismatch for BPF map"            // from https://github.com/cilium/cilium/issues/7851
+	emptyBPFInitArg   = "empty argument passed to bpf/init.sh" // from https://github.com/cilium/cilium/issues/10228
 
 	// HelmTemplate is the location of the Helm templates to install Cilium
 	HelmTemplate = "../install/kubernetes/cilium"
@@ -229,7 +230,7 @@ const (
 
 // NightlyStableUpgradesFrom maps the cilium image versions to the helm charts
 // that will be used to run update tests in the Nightly test.
-var NightlyStableUpgradesFrom = map[string]string{"1.6": "1.6-dev", "1.7": "1.7-dev"}
+var NightlyStableUpgradesFrom = map[string]string{"v1.6": "1.6-dev", "v1.7": "1.7-dev"}
 
 var (
 	IsCiliumV1_5 = versioncheck.MustCompile(">=1.4.90 <1.6.0")
@@ -257,6 +258,7 @@ var badLogMessages = map[string][]string{
 	NACKreceived:      nil,
 	RunInitFailed:     {"signal: terminated", "signal: killed"},
 	sizeMismatch:      nil,
+	emptyBPFInitArg:   nil,
 }
 
 var ciliumCLICommands = map[string]string{
diff --git a/test/helpers/kubectl.go b/test/helpers/kubectl.go
index 0c9b6a66d7..e49605baf7 100644
--- a/test/helpers/kubectl.go
+++ b/test/helpers/kubectl.go
@@ -17,8 +17,6 @@ package helpers
 import (
 	"bytes"
 	"context"
-	"crypto/md5"
-	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -840,9 +838,20 @@ func (kub *Kubectl) NamespaceCreate(name string) *CmdRes {
 
 // NamespaceDelete deletes a given Kubernetes namespace
 func (kub *Kubectl) NamespaceDelete(name string) *CmdRes {
+	res := kub.DeleteAllInNamespace(name)
+	if !res.WasSuccessful() {
+		kub.Logger().Infof("Error while deleting all objects from %s ns: %s", name, res.GetError().Error())
+	}
 	return kub.ExecShort(fmt.Sprintf("%s delete namespace %s", KubectlCmd, name))
 }
 
+// DeleteAllInNamespace deletes all k8s objects in a namespace
+func (kub *Kubectl) DeleteAllInNamespace(name string) *CmdRes {
+	// we are getting all namespaced resources from k8s apiserver, and delete all objects of these types in a provided namespace
+	return kub.ExecShort(fmt.Sprintf("%s delete $(%s api-resources --namespaced=true --verbs=delete -o name | tr '\n' ',' | sed -e 's/,$//') -n %s --all",
+		KubectlCmd, KubectlCmd, name))
+}
+
 // WaitforPods waits up until timeout seconds have elapsed for all pods in the
 // specified namespace that match the provided JSONPath filter to have their
 // containterStatuses equal to "ready". Returns true if all pods achieve
@@ -3182,25 +3191,20 @@ func addrsEqual(addr1, addr2 *models.BackendAddress) bool {
 // which is running.
 // Note: Namespaces can only be 63 characters long (to comply with DNS). We
 // ensure that the namespace here is shorter than that, but keep it unique by
-// hashing the complete name.
-func GenerateNamespaceForTest() string {
+// prefixing with timestamp
+func GenerateNamespaceForTest(seed string) string {
 	lowered := strings.ToLower(ginkgoext.CurrentGinkgoTestDescription().FullTestText)
 	// K8s namespaces cannot have spaces or underscores.
 	replaced := strings.Replace(lowered, " ", "", -1)
 	replaced = strings.Replace(replaced, "_", "", -1)
 
-	if len(replaced) <= 63 {
-		return replaced
+	timestamped := time.Now().Format("200601021504") + seed + replaced
+
+	if len(timestamped) <= 63 {
+		return timestamped
 	}
 
-	// We need to shorten the name to <=63 characters
-	// Hash the name, encode it as hex, then put it all together
-	h := md5.Sum(([]byte)(replaced[0:]))
-	hash := hex.EncodeToString(h[:])
-	out := []byte(replaced[:56])
-	out = append(out, []byte("-")...)
-	out = append(out, hash[:6]...)
-	return string(out)
+	return timestamped[:63]
 }
 
 // TimestampFilename appends a "timestamp" to the name. The goal is to make this
diff --git a/test/k8sT/Policies.go b/test/k8sT/Policies.go
index df48781fef..109c5d4d94 100644
--- a/test/k8sT/Policies.go
+++ b/test/k8sT/Policies.go
@@ -187,7 +187,7 @@ var _ = Describe("K8sPolicyTest", func() {
 		}
 
 		BeforeAll(func() {
-			namespaceForTest = helpers.GenerateNamespaceForTest()
+			namespaceForTest = helpers.GenerateNamespaceForTest("")
 			kubectl.NamespaceDelete(namespaceForTest)
 			kubectl.NamespaceCreate(namespaceForTest).ExpectSuccess("could not create namespace")
 			kubectl.Apply(helpers.ApplyOptions{FilePath: demoPath, Namespace: namespaceForTest}).ExpectSuccess("could not create resource")
@@ -1132,11 +1132,12 @@ EOF`, k, v)
 
 		var (
 			err               error
-			secondNS          = "second"
+			secondNS          string
 			appPods           map[string]string
 			appPodsNS         map[string]string
 			clusterIP         string
 			secondNSclusterIP string
+			nsLabel           = "second"
 
 			demoPath           string
 			l3L4Policy         string
@@ -1147,18 +1148,26 @@ EOF`, k, v)
 		)
 
 		BeforeAll(func() {
+			secondNS = helpers.GenerateNamespaceForTest("2")
+
+			cnpSecondNSChart := helpers.ManifestGet(kubectl.BasePath(), "cnp-second-namespaces")
+			cnpSecondNS = helpers.ManifestGet(kubectl.BasePath(), "cnp-second-namespaces.yaml")
+			res := kubectl.HelmTemplate(cnpSecondNSChart, "", cnpSecondNS, map[string]string{
+				"Namespace": secondNS,
+			})
+			res.ExpectSuccess("Unable to render cnp-second-namespace chart")
+
 			demoPath = helpers.ManifestGet(kubectl.BasePath(), "demo.yaml")
 			l3L4Policy = helpers.ManifestGet(kubectl.BasePath(), "l3-l4-policy.yaml")
-			cnpSecondNS = helpers.ManifestGet(kubectl.BasePath(), "cnp-second-namespaces.yaml")
 			netpolNsSelector = fmt.Sprintf("%s -n %s", helpers.ManifestGet(kubectl.BasePath(), "netpol-namespace-selector.yaml"), secondNS)
 			l3l4PolicySecondNS = fmt.Sprintf("%s -n %s", l3L4Policy, secondNS)
 			demoManifest = fmt.Sprintf("%s -n %s", demoPath, secondNS)
 
 			kubectl.NamespaceDelete(secondNS)
-			res := kubectl.NamespaceCreate(secondNS)
+			res = kubectl.NamespaceCreate(secondNS)
 			res.ExpectSuccess("unable to create namespace %q", secondNS)
 
-			res = kubectl.Exec(fmt.Sprintf("kubectl label namespaces/%[1]s nslabel=%[1]s", secondNS))
+			res = kubectl.Exec(fmt.Sprintf("kubectl label namespaces/%s nslabel=%s", secondNS, nsLabel))
 			res.ExpectSuccess("cannot create namespace labels")
 
 			res = kubectl.ApplyDefault(demoManifest)
@@ -1336,8 +1345,8 @@ EOF`, k, v)
 			demoPath        string
 			demoManifestNS1 string
 			demoManifestNS2 string
-			firstNS         = "first"
-			secondNS        = "second"
+			firstNS         string
+			secondNS        string
 
 			appPodsFirstNS  map[string]string
 			appPodsSecondNS map[string]string
@@ -1352,6 +1361,8 @@ EOF`, k, v)
 		)
 
 		BeforeAll(func() {
+			firstNS = helpers.GenerateNamespaceForTest("1")
+			secondNS = helpers.GenerateNamespaceForTest("2")
 			demoPath = helpers.ManifestGet(kubectl.BasePath(), "demo.yaml")
 			egressDenyAllPolicy = helpers.ManifestGet(kubectl.BasePath(), "ccnp-default-deny-egress.yaml")
 			ingressDenyAllPolicy = helpers.ManifestGet(kubectl.BasePath(), "ccnp-default-deny-ingress.yaml")
diff --git a/test/k8sT/Updates.go b/test/k8sT/Updates.go
index 6883cfd82f..d6acd2b30f 100644
--- a/test/k8sT/Updates.go
+++ b/test/k8sT/Updates.go
@@ -395,23 +395,27 @@ func InstallAndValidateCiliumUpgrades(kubectl *helpers.Kubectl, oldHelmChartVers
 		cmd = kubectl.ExecMiddle("helm delete cilium-preflight --namespace=" + helpers.CiliumNamespace)
 		ExpectWithOffset(1, cmd).To(helpers.CMDSuccess(), "Unable to delete preflight")
 
-		err = kubectl.WaitforPods(
-			helpers.CiliumNamespace, "-l k8s-app=cilium", timeout)
+		err = kubectl.WaitforPods(helpers.CiliumNamespace, "-l k8s-app=cilium", timeout)
 		ExpectWithOffset(1, err).Should(BeNil(), "Cilium is not ready after timeout")
 		// Need to run using the kvstore-based allocator because upgrading from
 		// kvstore-based allocator to CRD-based allocator is not currently
 		// supported at this time.
 		By("Upgrading Cilium to %s", newHelmChartVersion)
+		opts := map[string]string{
+			"global.tag": newImageVersion,
+		}
+		// We have removed the labels since >= 1.7 and we are only testing
+		// starting from 1.6.
+		if oldHelmChartVersion == "1.6-dev" {
+			opts["agent.keepDeprecatedLabels"] = "true"
+		}
 		cmd, err = kubectl.RunHelm(
 			"upgrade",
 			filepath.Join(kubectl.BasePath(), helpers.HelmTemplate),
 			"cilium",
 			newHelmChartVersion,
 			helpers.CiliumNamespace,
-			map[string]string{
-				"global.tag":                 newImageVersion,
-				"agent.keepDeprecatedLabels": "true",
-			})
+			opts)
 		ExpectWithOffset(1, err).To(BeNil(), "Cilium %q was not able to be deployed", newHelmChartVersion)
 		ExpectWithOffset(1, cmd).To(helpers.CMDSuccess(), "Cilium %q was not able to be deployed", newHelmChartVersion)
 
diff --git a/test/k8sT/manifests/cnp-second-namespaces/.helmignore b/test/k8sT/manifests/cnp-second-namespaces/.helmignore
new file mode 100644
index 0000000000..50af031725
--- /dev/null
+++ b/test/k8sT/manifests/cnp-second-namespaces/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/test/k8sT/manifests/cnp-second-namespaces/Chart.yaml b/test/k8sT/manifests/cnp-second-namespaces/Chart.yaml
new file mode 100644
index 0000000000..54c29dc496
--- /dev/null
+++ b/test/k8sT/manifests/cnp-second-namespaces/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+appVersion: "1.0"
+description: A Helm chart for Kubernetes
+name: cnp-second-namespaces
+version: 0.1.0
diff --git a/test/k8sT/manifests/cnp-second-namespaces.yaml b/test/k8sT/manifests/cnp-second-namespaces/templates/policy.yaml
similarity index 85%
rename from test/k8sT/manifests/cnp-second-namespaces.yaml
rename to test/k8sT/manifests/cnp-second-namespaces/templates/policy.yaml
index 8ac06fbfbe..22d71e921c 100644
--- a/test/k8sT/manifests/cnp-second-namespaces.yaml
+++ b/test/k8sT/manifests/cnp-second-namespaces/templates/policy.yaml
@@ -10,7 +10,7 @@ spec:
   ingress:
   - fromEndpoints:
     - matchLabels:
-        "k8s:io.kubernetes.pod.namespace": second
+        "k8s:io.kubernetes.pod.namespace": {{ .Values.Namespace }}
     toPorts:
     - ports:
       - port: "80"
diff --git a/test/k8sT/manifests/cnp-second-namespaces/values.yaml b/test/k8sT/manifests/cnp-second-namespaces/values.yaml
new file mode 100644
index 0000000000..4463cb0ef8
--- /dev/null
+++ b/test/k8sT/manifests/cnp-second-namespaces/values.yaml
@@ -0,0 +1,5 @@
+# Default values for registry-adder.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+Namespace: second
diff --git a/test/packet/scripts/install.sh b/test/packet/scripts/install.sh
index d5181b0e10..ffd1038e20 100644
--- a/test/packet/scripts/install.sh
+++ b/test/packet/scripts/install.sh
@@ -65,7 +65,6 @@ sudo ln -s /usr/local/go/bin/* /usr/local/bin/
 go version
 sudo mkdir /go/
 export GOPATH=/go/
-go get -u github.com/cilium/go-bindata/...
 go get -u github.com/google/gops
 go get -u github.com/onsi/ginkgo/ginkgo
 go get -u github.com/onsi/gomega/...