Repository: cilium/cilium
Pull request #14378 (2020-12-11 13:17:57)

hubble/peer: fix TLS server name for cluster names containing dots
Similarly to a node name, a cluster name may contain dots (.). In such a
case, dots need to be replaced by dashes (-) so that the TLS server name
matches the certificate server's identity.

This patch is similar to the way node names containing dots are treated.

```release-note
Handle cluster names with dots for TLS server names. This prevented Hubble Relay from connecting to peers with TLS enabled in such a scenario. 
```


Rolinh: test-me-please

Patch:
diff --git a/.github/workflows/go-check.yaml b/.github/workflows/go-check.yaml
index b96e2e1008..b32b207153 100644
--- a/.github/workflows/go-check.yaml
+++ b/.github/workflows/go-check.yaml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v1
         with:
           go-version: 1.15.6
       - name: Checkout code
diff --git a/Makefile b/Makefile
index 5a8c616bb5..938ab69f60 100644
--- a/Makefile
+++ b/Makefile
@@ -513,8 +513,6 @@ endif
 	$(QUIET) contrib/scripts/check-assert-deep-equals.sh
 	@$(ECHO_CHECK) contrib/scripts/lock-check.sh
 	$(QUIET) contrib/scripts/lock-check.sh
-	@$(ECHO_CHECK) contrib/scripts/custom-vet-check.sh
-	$(QUIET) contrib/scripts/custom-vet-check.sh
 	@$(ECHO_CHECK) contrib/scripts/rand-check.sh
 	$(QUIET) contrib/scripts/rand-check.sh
 
diff --git a/clustermesh-apiserver/main.go b/clustermesh-apiserver/main.go
index 4e3815c6f9..57232b851a 100644
--- a/clustermesh-apiserver/main.go
+++ b/clustermesh-apiserver/main.go
@@ -32,7 +32,6 @@ import (
 	"github.com/cilium/cilium/pkg/defaults"
 	"github.com/cilium/cilium/pkg/identity"
 	identityCache "github.com/cilium/cilium/pkg/identity/cache"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/ipcache"
 	"github.com/cilium/cilium/pkg/k8s"
 	ciliumv2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
@@ -544,8 +543,6 @@ func runServer(cmd *cobra.Command) {
 	}
 
 	go func() {
-		timer, timerDone := inctimer.New()
-		defer timerDone()
 		for {
 			ctx, cancel := context.WithTimeout(context.Background(), defaults.LockLeaseTTL)
 			err := kvstore.Client().Update(ctx, kvstore.HeartbeatPath, []byte(time.Now().Format(time.RFC3339)), true)
@@ -553,7 +550,7 @@ func runServer(cmd *cobra.Command) {
 				log.WithError(err).Warning("Unable to update heartbeat key")
 			}
 			cancel()
-			<-timer.After(kvstore.HeartbeatWriteInterval)
+			<-time.After(kvstore.HeartbeatWriteInterval)
 		}
 	}()
 
diff --git a/contrib/scripts/custom-vet-check.sh b/contrib/scripts/custom-vet-check.sh
deleted file mode 100755
index dd5147e59e..0000000000
--- a/contrib/scripts/custom-vet-check.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2020 Authors of Cilium
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Used to cause failure when pkg/lock is not used
-GO111MODULE=off go get github.com/cilium/customvet
-go vet --vettool=$(which customvet) -timeafter.ignore inctimer ./...
diff --git a/operator/identity_gc.go b/operator/identity_gc.go
index a7dac3873a..fb5389e05a 100644
--- a/operator/identity_gc.go
+++ b/operator/identity_gc.go
@@ -15,10 +15,11 @@
 package main
 
 import (
+	"time"
+
 	operatorOption "github.com/cilium/cilium/operator/option"
 	"github.com/cilium/cilium/pkg/allocator"
 	"github.com/cilium/cilium/pkg/identity/cache"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/kvstore"
 	kvstoreallocator "github.com/cilium/cilium/pkg/kvstore/allocator"
 
@@ -35,8 +36,6 @@ func startKvstoreIdentityGC() {
 
 	keysToDelete := map[string]uint64{}
 	go func() {
-		gcTimer, gcTimerDone := inctimer.New()
-		defer gcTimerDone()
 		for {
 			keysToDelete2, err := a.RunGC(identityRateLimiter, keysToDelete)
 			if err != nil {
@@ -44,7 +43,7 @@ func startKvstoreIdentityGC() {
 			} else {
 				keysToDelete = keysToDelete2
 			}
-			<-gcTimer.After(operatorOption.Config.IdentityGCInterval)
+			<-time.After(operatorOption.Config.IdentityGCInterval)
 			log.WithFields(logrus.Fields{
 				"identities-to-delete": keysToDelete,
 			}).Debug("Will delete identities if they are still unused")
diff --git a/operator/kvstore_watchdog.go b/operator/kvstore_watchdog.go
index cdf1fe90a7..40326e057b 100644
--- a/operator/kvstore_watchdog.go
+++ b/operator/kvstore_watchdog.go
@@ -22,7 +22,6 @@ import (
 	"github.com/cilium/cilium/pkg/allocator"
 	"github.com/cilium/cilium/pkg/defaults"
 	"github.com/cilium/cilium/pkg/identity/cache"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/kvstore"
 	kvstoreallocator "github.com/cilium/cilium/pkg/kvstore/allocator"
 )
@@ -75,8 +74,6 @@ func startKvstoreWatchdog() {
 
 	keysToDelete := map[string]kvstore.Value{}
 	go func() {
-		lockTimer, lockTimerDone := inctimer.New()
-		defer lockTimerDone()
 		for {
 			keysToDelete = getOldestLeases(keysToDelete)
 			ctx, cancel := context.WithTimeout(context.Background(), defaults.LockLeaseTTL)
@@ -88,13 +85,11 @@ func startKvstoreWatchdog() {
 			}
 			cancel()
 
-			<-lockTimer.After(defaults.LockLeaseTTL)
+			<-time.After(defaults.LockLeaseTTL)
 		}
 	}()
 
 	go func() {
-		hbTimer, hbTimerDone := inctimer.New()
-		defer hbTimerDone()
 		for {
 			ctx, cancel := context.WithTimeout(context.Background(), defaults.LockLeaseTTL)
 			err := kvstore.Client().Update(ctx, kvstore.HeartbeatPath, []byte(time.Now().Format(time.RFC3339)), true)
@@ -102,7 +97,7 @@ func startKvstoreWatchdog() {
 				log.WithError(err).Warning("Unable to update heartbeat key")
 			}
 			cancel()
-			<-hbTimer.After(kvstore.HeartbeatWriteInterval)
+			<-time.After(kvstore.HeartbeatWriteInterval)
 		}
 	}()
 }
diff --git a/pkg/allocator/allocator.go b/pkg/allocator/allocator.go
index 1d3ef1f3ab..49216eab93 100644
--- a/pkg/allocator/allocator.go
+++ b/pkg/allocator/allocator.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/backoff"
 	"github.com/cilium/cilium/pkg/idpool"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/kvstore"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/logging"
@@ -842,8 +841,6 @@ func (a *Allocator) syncLocalKeys() error {
 
 func (a *Allocator) startLocalKeySync() {
 	go func(a *Allocator) {
-		kvTimer, kvTimerDone := inctimer.New()
-		defer kvTimerDone()
 		for {
 			if err := a.syncLocalKeys(); err != nil {
 				log.WithError(err).Warning("Unable to run local key sync routine")
@@ -853,7 +850,7 @@ func (a *Allocator) startLocalKeySync() {
 			case <-a.stopGC:
 				log.Debug("Stopped master key sync routine")
 				return
-			case <-kvTimer.After(option.Config.KVstorePeriodicSync):
+			case <-time.After(option.Config.KVstorePeriodicSync):
 			}
 		}
 	}(a)
diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go
index 817052ca44..bae265b43e 100644
--- a/pkg/controller/controller.go
+++ b/pkg/controller/controller.go
@@ -21,7 +21,6 @@ import (
 	"time"
 
 	"github.com/cilium/cilium/api/v1/models"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/metrics"
 	"github.com/cilium/cilium/pkg/option"
@@ -196,8 +195,6 @@ func (c *Controller) runController() {
 	c.mutex.RUnlock()
 	runFunc := true
 	interval := 10 * time.Minute
-	runTimer, timerDone := inctimer.New()
-	defer timerDone()
 
 	for {
 		var err error
@@ -261,6 +258,7 @@ func (c *Controller) runController() {
 
 			c.mutex.Unlock()
 		}
+
 		select {
 		case <-c.stop:
 			goto shutdown
@@ -282,7 +280,7 @@ func (c *Controller) runController() {
 			c.mutex.RUnlock()
 			runFunc = true
 
-		case <-runTimer.After(interval):
+		case <-time.After(interval):
 		}
 
 	}
diff --git a/pkg/crypto/certloader/watcher.go b/pkg/crypto/certloader/watcher.go
index 4e729c9081..ddf848dc2a 100644
--- a/pkg/crypto/certloader/watcher.go
+++ b/pkg/crypto/certloader/watcher.go
@@ -21,7 +21,6 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/cilium/cilium/pkg/crypto/certloader/fswatcher"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/logging/logfields"
 )
 
@@ -160,11 +159,11 @@ func (w *Watcher) Watch() <-chan struct{} {
 
 				if keypairUpdated {
 					if keypairReload == nil {
-						keypairReload = inctimer.After(watcherEventCoalesceWindow)
+						keypairReload = time.After(watcherEventCoalesceWindow)
 					}
 				} else if caUpdated {
 					if caReload == nil {
-						caReload = inctimer.After(watcherEventCoalesceWindow)
+						caReload = time.After(watcherEventCoalesceWindow)
 					}
 				} else {
 					// fswatcher should never send events for unknown files
diff --git a/pkg/hubble/peer/handler.go b/pkg/hubble/peer/handler.go
index 984206957d..0f80559640 100644
--- a/pkg/hubble/peer/handler.go
+++ b/pkg/hubble/peer/handler.go
@@ -165,7 +165,8 @@ func nodeAddress(n types.Node) string {
 //
 // When nodeName is not provided, an empty string is returned. All Dot (.) in
 // nodeName are replaced by Hyphen (-). When clusterName is not provided, it
-// defaults to the default cluster name.
+// defaults to the default cluster name. All Dot (.) in clusterName are
+// replaced by Hypen (-).
 func tlsServerName(nodeName, clusterName string) string {
 	if nodeName == "" {
 		return ""
@@ -176,9 +177,11 @@ func tlsServerName(nodeName, clusterName string) string {
 	if clusterName == "" {
 		clusterName = ciliumDefaults.ClusterName
 	}
+	// The cluster name may also contain dots.
+	cn := strings.ReplaceAll(clusterName, ".", "-")
 	return strings.Join([]string{
 		nn,
-		clusterName,
+		cn,
 		defaults.GRPCServiceName,
 		defaults.DomainName,
 	}, ".")
diff --git a/pkg/hubble/relay/observer/observer.go b/pkg/hubble/relay/observer/observer.go
index f2c1c8b6d3..458d3aff57 100644
--- a/pkg/hubble/relay/observer/observer.go
+++ b/pkg/hubble/relay/observer/observer.go
@@ -23,7 +23,6 @@ import (
 	relaypb "github.com/cilium/cilium/api/v1/relay"
 	poolTypes "github.com/cilium/cilium/pkg/hubble/relay/pool/types"
 	"github.com/cilium/cilium/pkg/hubble/relay/queue"
-	"github.com/cilium/cilium/pkg/inctimer"
 	nodeTypes "github.com/cilium/cilium/pkg/node/types"
 
 	"github.com/golang/protobuf/ptypes"
@@ -84,8 +83,7 @@ func sortFlows(
 
 	go func() {
 		defer close(sortedFlows)
-		bufferTimer, bufferTimerDone := inctimer.New()
-		defer bufferTimerDone()
+
 	flowsLoop:
 		for {
 			select {
@@ -102,7 +100,7 @@ func sortFlows(
 					}
 				}
 				pq.Push(flow)
-			case t := <-bufferTimer.After(bufferDrainTimeout):
+			case t := <-time.After(bufferDrainTimeout):
 				// Make sure to drain old flows from the queue when no new
 				// flows are received. The bufferDrainTimeout duration is used
 				// as a sorting window.
@@ -214,7 +212,7 @@ func aggregateErrors(
 				}
 
 				pendingResponse = response
-				flushPending = inctimer.After(errorAggregationWindow)
+				flushPending = time.After(errorAggregationWindow)
 			case <-flushPending:
 				select {
 				case aggregated <- pendingResponse:
diff --git a/pkg/hubble/relay/pool/manager.go b/pkg/hubble/relay/pool/manager.go
index 9bd4210b4e..1d870936a5 100644
--- a/pkg/hubble/relay/pool/manager.go
+++ b/pkg/hubble/relay/pool/manager.go
@@ -23,7 +23,6 @@ import (
 	peerpb "github.com/cilium/cilium/api/v1/peer"
 	peerTypes "github.com/cilium/cilium/pkg/hubble/peer/types"
 	poolTypes "github.com/cilium/cilium/pkg/hubble/relay/pool/types"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 
 	"github.com/sirupsen/logrus"
@@ -81,8 +80,6 @@ func (m *PeerManager) Start() {
 
 func (m *PeerManager) watchNotifications() {
 	ctx, cancel := context.WithCancel(context.Background())
-	retryTimer, retryTimerDone := inctimer.New()
-	defer retryTimerDone()
 connect:
 	for {
 		cl, err := m.opts.peerClientBuilder.Client(m.opts.peerServiceAddress)
@@ -95,7 +92,7 @@ connect:
 			case <-m.stop:
 				cancel()
 				return
-			case <-retryTimer.After(m.opts.retryTimeout):
+			case <-time.After(m.opts.retryTimeout):
 				continue
 			}
 		}
@@ -110,7 +107,7 @@ connect:
 			case <-m.stop:
 				cancel()
 				return
-			case <-retryTimer.After(m.opts.retryTimeout):
+			case <-time.After(m.opts.retryTimeout):
 				continue
 			}
 		}
@@ -133,7 +130,7 @@ connect:
 				case <-m.stop:
 					cancel()
 					return
-				case <-retryTimer.After(m.opts.retryTimeout):
+				case <-time.After(m.opts.retryTimeout):
 					continue connect
 				}
 			}
@@ -152,8 +149,6 @@ connect:
 }
 
 func (m *PeerManager) manageConnections() {
-	connTimer, connTimerDone := inctimer.New()
-	defer connTimerDone()
 	for {
 		select {
 		case <-m.stop:
@@ -168,7 +163,7 @@ func (m *PeerManager) manageConnections() {
 				// a connection request has been made, make sure to attempt a connection
 				m.connect(p, true)
 			}()
-		case <-connTimer.After(m.opts.connCheckInterval):
+		case <-time.After(m.opts.connCheckInterval):
 			m.mu.RLock()
 			now := time.Now()
 			for _, p := range m.peers {
diff --git a/pkg/inctimer/inctimer.go b/pkg/inctimer/inctimer.go
deleted file mode 100644
index 9ae994855e..0000000000
--- a/pkg/inctimer/inctimer.go
+++ /dev/null
@@ -1,72 +0,0 @@
-// Copyright 2020 Authors of Cilium
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package inctimer
-
-import "time"
-
-// IncTimer should be the preferred mechanism over
-// calling `time.After` when wanting an `After`-like
-// function in a loop. This prevents memory build up
-// as the `time.After` method creates a new timer
-// instance every time it is called, and it is not
-// garbage collected until after it fires. Conversely,
-// IncTimer only uses one timer and correctly stops
-// the timer, clears its channel, and resets it
-// everytime that `After` is called.
-type IncTimer interface {
-	After(time.Duration) <-chan time.Time
-}
-
-type incTimer struct {
-	t *time.Timer
-}
-
-// New creates a new IncTimer and a done function.
-// IncTimer only uses one timer and correctly stops
-// the timer, clears the channel, and resets it every
-// time the `After` function is called.
-// WARNING: Concurrent use is not expected. The use
-// of this timer should be for only one goroutine.
-func New() (IncTimer, func() bool) {
-	t := time.NewTimer(time.Nanosecond)
-	return &incTimer{
-		t: t,
-	}, t.Stop
-}
-
-// After returns a channel that will fire after
-// the specified duration.
-func (it *incTimer) After(d time.Duration) <-chan time.Time {
-	// We cannot call reset on an expired timer,
-	// so we need to stop it and drain it first.
-	// See https://golang.org/pkg/time/#Timer.Reset for more details.
-	if !it.t.Stop() {
-		// It could be that the channel was read already
-		select {
-		case <-it.t.C:
-		default:
-		}
-	}
-	it.t.Reset(d)
-	return it.t.C
-}
-
-// After wraps the time.After function to get
-// around the customvet warning for cases
-// where it is inconvenient to use the instantiated
-// version.
-func After(d time.Duration) <-chan time.Time {
-	return time.After(d)
-}
diff --git a/pkg/k8s/cnpstatus.go b/pkg/k8s/cnpstatus.go
index f66b397006..a5217745fc 100644
--- a/pkg/k8s/cnpstatus.go
+++ b/pkg/k8s/cnpstatus.go
@@ -20,7 +20,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/cilium/cilium/pkg/inctimer"
 	cilium_v2 "github.com/cilium/cilium/pkg/k8s/apis/cilium.io/v2"
 	"github.com/cilium/cilium/pkg/k8s/types"
 	"github.com/cilium/cilium/pkg/kvstore"
@@ -227,14 +226,11 @@ func (c *CNPStatusEventHandler) runStatusHandler(cnpKey string, cnp *types.SlimC
 			nodeStatusMap[cnpns.Node] = cnpns.CiliumNetworkPolicyNodeStatus
 		}
 	}
-	updateTimer, updateDone := inctimer.New()
-	defer updateDone()
-
 	for {
 		// Allow for a bunch of different node status updates to come before
 		// we break out to avoid jitter in updates across the cluster
 		// to affect batching on our end.
-		limit := updateTimer.After(c.updateInterval)
+		limit := time.After(c.updateInterval)
 
 		// Collect any other events that have come in, but bail out after the
 		// above limit is hit so that we can send the updates we have received.
diff --git a/pkg/k8s/factory_functions.go b/pkg/k8s/factory_functions.go
index cec9af9d38..c997c40924 100644
--- a/pkg/k8s/factory_functions.go
+++ b/pkg/k8s/factory_functions.go
@@ -483,10 +483,12 @@ func ConvertToCCNP(obj interface{}) interface{} {
 			CiliumNetworkPolicy: &cilium_v2.CiliumNetworkPolicy{
 				TypeMeta:   concreteObj.TypeMeta,
 				ObjectMeta: concreteObj.ObjectMeta,
-				Spec:       concreteObj.Spec,
-				Specs:      concreteObj.Specs,
 			},
 		}
+		if concreteObj.CiliumNetworkPolicy != nil {
+			cnp.Spec = concreteObj.Spec
+			cnp.Specs = concreteObj.Specs
+		}
 		*concreteObj = cilium_v2.CiliumClusterwideNetworkPolicy{}
 		return cnp
 
@@ -495,16 +497,19 @@ func ConvertToCCNP(obj interface{}) interface{} {
 		if !ok {
 			return obj
 		}
+		slimCNP := &types.SlimCNP{
+			CiliumNetworkPolicy: &cilium_v2.CiliumNetworkPolicy{
+				TypeMeta:   cnp.TypeMeta,
+				ObjectMeta: cnp.ObjectMeta,
+			},
+		}
+		if cnp.CiliumNetworkPolicy != nil {
+			slimCNP.Spec = cnp.Spec
+			slimCNP.Specs = cnp.Specs
+		}
 		dfsu := cache.DeletedFinalStateUnknown{
 			Key: concreteObj.Key,
-			Obj: &types.SlimCNP{
-				CiliumNetworkPolicy: &cilium_v2.CiliumNetworkPolicy{
-					TypeMeta:   cnp.TypeMeta,
-					ObjectMeta: cnp.ObjectMeta,
-					Spec:       cnp.Spec,
-					Specs:      cnp.Specs,
-				},
-			},
+			Obj: slimCNP,
 		}
 		*cnp = cilium_v2.CiliumClusterwideNetworkPolicy{}
 		return dfsu
diff --git a/pkg/kvstore/consul.go b/pkg/kvstore/consul.go
index 3deb2f818c..f63d2b1071 100644
--- a/pkg/kvstore/consul.go
+++ b/pkg/kvstore/consul.go
@@ -25,7 +25,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/backoff"
 	"github.com/cilium/cilium/pkg/controller"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/option"
@@ -315,9 +314,6 @@ func (c *consulClient) Watch(ctx context.Context, w *Watcher) {
 
 	qo := q.WithContext(ctx)
 
-	sleepTimer, sleepTimerDone := inctimer.New()
-	defer sleepTimerDone()
-
 	for {
 		// Initialize sleep time to a millisecond as we don't
 		// want to sleep in between successful watch cycles
@@ -395,7 +391,7 @@ func (c *consulClient) Watch(ctx context.Context, w *Watcher) {
 
 	wait:
 		select {
-		case <-sleepTimer.After(sleepTime):
+		case <-time.After(sleepTime):
 		case <-w.stopWatch:
 			close(w.Events)
 			w.stopWait.Done()
diff --git a/pkg/kvstore/etcd.go b/pkg/kvstore/etcd.go
index 55c91f4d0f..1bd84e140a 100644
--- a/pkg/kvstore/etcd.go
+++ b/pkg/kvstore/etcd.go
@@ -30,7 +30,6 @@ import (
 	"github.com/cilium/cilium/pkg/contexthelpers"
 	"github.com/cilium/cilium/pkg/controller"
 	"github.com/cilium/cilium/pkg/defaults"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/option"
 	"github.com/cilium/cilium/pkg/rand"
@@ -1106,9 +1105,6 @@ func (e *etcdClient) statusChecker() {
 
 	consecutiveQuorumErrors := 0
 
-	statusTimer, statusTimerDone := inctimer.New()
-	defer statusTimerDone()
-
 	for {
 		newStatus := []string{}
 		ok := 0
@@ -1172,7 +1168,7 @@ func (e *etcdClient) statusChecker() {
 		case <-e.stopStatusChecker:
 			close(e.statusCheckErrors)
 			return
-		case <-statusTimer.After(e.extraOptions.StatusCheckInterval(allConnected)):
+		case <-time.After(e.extraOptions.StatusCheckInterval(allConnected)):
 		}
 	}
 }
diff --git a/pkg/kvstore/lock.go b/pkg/kvstore/lock.go
index 1fce3abbdc..1a680d2549 100644
--- a/pkg/kvstore/lock.go
+++ b/pkg/kvstore/lock.go
@@ -21,7 +21,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/debug"
 	"github.com/cilium/cilium/pkg/defaults"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 
 	"github.com/davecgh/go-spew/spew"
@@ -90,8 +89,6 @@ func (pl *pathLocks) runGC() {
 }
 
 func (pl *pathLocks) lock(ctx context.Context, path string) (id uuid.UUID, err error) {
-	lockTimer, lockTimerDone := inctimer.New()
-	defer lockTimerDone()
 	for {
 		pl.mutex.Lock()
 		if _, ok := pl.lockPaths[path]; !ok {
@@ -106,7 +103,7 @@ func (pl *pathLocks) lock(ctx context.Context, path string) (id uuid.UUID, err e
 		pl.mutex.Unlock()
 
 		select {
-		case <-lockTimer.After(time.Duration(10) * time.Millisecond):
+		case <-time.After(time.Duration(10) * time.Millisecond):
 		case <-ctx.Done():
 			err = fmt.Errorf("lock was cancelled: %s", ctx.Err())
 			return
diff --git a/pkg/maps/ctmap/gc/gc.go b/pkg/maps/ctmap/gc/gc.go
index bb69a1881a..1ffc2075f7 100644
--- a/pkg/maps/ctmap/gc/gc.go
+++ b/pkg/maps/ctmap/gc/gc.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/bpf"
 	"github.com/cilium/cilium/pkg/endpoint"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/logging"
 	"github.com/cilium/cilium/pkg/logging/logfields"
 	"github.com/cilium/cilium/pkg/maps/ctmap"
@@ -51,8 +50,6 @@ func Enable(ipv4, ipv6 bool, restoredEndpoints []*endpoint.Endpoint, mgr Endpoin
 		ipv4Orig := ipv4
 		ipv6Orig := ipv6
 		triggeredBySignal := false
-		ctTimer, ctTimerDone := inctimer.New()
-		defer ctTimerDone()
 		for {
 			var (
 				maxDeleteRatio float64
@@ -136,7 +133,7 @@ func Enable(ipv4, ipv6 bool, restoredEndpoints []*endpoint.Endpoint, mgr Endpoin
 						ipv6 = true
 					}
 				}
-			case <-ctTimer.After(ctmap.GetInterval(mapType, maxDeleteRatio)):
+			case <-time.After(ctmap.GetInterval(mapType, maxDeleteRatio)):
 				ipv4 = ipv4Orig
 				ipv6 = ipv6Orig
 			}
diff --git a/pkg/node/manager/manager.go b/pkg/node/manager/manager.go
index a8d19a5732..3fa06855c7 100644
--- a/pkg/node/manager/manager.go
+++ b/pkg/node/manager/manager.go
@@ -21,7 +21,6 @@ import (
 
 	"github.com/cilium/cilium/pkg/datapath"
 	"github.com/cilium/cilium/pkg/identity"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/ipcache"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/metrics"
@@ -276,8 +275,6 @@ func (m *Manager) backgroundSyncInterval() time.Duration {
 }
 
 func (m *Manager) backgroundSync() {
-	syncTimer, syncTimerDone := inctimer.New()
-	defer syncTimerDone()
 	for {
 		syncInterval := m.backgroundSyncInterval()
 		log.WithField("syncInterval", syncInterval.String()).Debug("Performing regular background work")
@@ -308,7 +305,7 @@ func (m *Manager) backgroundSync() {
 		select {
 		case <-m.closeChan:
 			return
-		case <-syncTimer.After(syncInterval):
+		case <-time.After(syncInterval):
 		}
 	}
 }
diff --git a/pkg/policy/mapstate.go b/pkg/policy/mapstate.go
index 88f6550b2a..063272607b 100644
--- a/pkg/policy/mapstate.go
+++ b/pkg/policy/mapstate.go
@@ -174,10 +174,6 @@ func (keys MapState) addKeyWithChanges(key Key, entry MapStateEntry, adds, delet
 	} else if len(entry.selectors) > 0 {
 		// create a new selectors map
 		updatedEntry.selectors = make(map[CachedSelector]struct{}, len(entry.selectors))
-	} else {
-		// Keep the map as nil when empty. This makes a difference for unit testing only.
-		// MergeSelectors below becomes a no-op as 'entry' is empty.
-		updatedEntry.selectors = nil
 	}
 
 	// TODO: Do we need to merge labels as well?
@@ -188,8 +184,7 @@ func (keys MapState) addKeyWithChanges(key Key, entry MapStateEntry, adds, delet
 
 	// Record an incremental Add if desired and entry is new or changed
 	if adds != nil && (!exists || !oldEntry.DatapathEqual(&entry)) {
-		updatedEntry.selectors = nil
-		adds[key] = updatedEntry // copy w/o selectors
+		adds[key] = updatedEntry
 		// Key add overrides any previous delete of the same key
 		if deletes != nil {
 			delete(deletes, key)
@@ -210,11 +205,13 @@ func (keys MapState) deleteKeyWithChanges(key Key, cs CachedSelector, adds, dele
 				if len(entry.selectors) > 0 {
 					return
 				}
+			} else {
+				// 'cs' was not found, do not change anything
+				return
 			}
 		}
 		if deletes != nil {
-			entry.selectors = nil
-			deletes[key] = entry // copy w/o selectors
+			deletes[key] = entry
 			// Remove a potential previously added key
 			if adds != nil {
 				delete(adds, key)
@@ -333,8 +330,7 @@ func (keys MapState) RedirectPreferredInsert(key Key, entry MapStateEntry, adds,
 		// insertion to the bpf map.
 		// TODO: Remove this hack when not needed any more.
 		if adds != nil && entry.IsRedirectEntry() && oldEntry.IsRedirectEntry() {
-			entry.selectors = nil
-			adds[key] = entry // copy w/o selectors
+			adds[key] = entry
 		}
 		return
 	}
diff --git a/pkg/service/service.go b/pkg/service/service.go
index 8f0a948c3d..8a2fb39285 100644
--- a/pkg/service/service.go
+++ b/pkg/service/service.go
@@ -262,6 +262,20 @@ func (s *Service) UpsertService(params *lb.SVC) (bool, lb.ID, error) {
 			option.EnableSVCSourceRangeCheck)
 	}
 
+	// In case we do DSR + IPIP, then it's required that the backends use
+	// the same destination port as the frontend service.
+	if option.Config.NodePortMode == option.NodePortModeDSR &&
+		option.Config.LoadBalancerDSRDispatch == option.DSRDispatchIPIP &&
+		params.Type != lb.SVCTypeClusterIP {
+		for _, b := range params.Backends {
+			if b.Port != params.Frontend.L3n4Addr.Port {
+				err := fmt.Errorf("Unable to upsert service due to frontend/backend port mismatch under DSR with IPIP: %d vs %d",
+					params.Frontend.L3n4Addr.Port, b.Port)
+				return false, lb.ID(0), err
+			}
+		}
+	}
+
 	// If needed, create svcInfo and allocate service ID
 	svc, new, prevSessionAffinity, prevLoadBalancerSourceRanges, err :=
 		s.createSVCInfoIfNotExist(params)
diff --git a/pkg/status/status.go b/pkg/status/status.go
index 88eac2474d..f0a5d7cb3e 100644
--- a/pkg/status/status.go
+++ b/pkg/status/status.go
@@ -22,7 +22,6 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/cilium/cilium/pkg/defaults"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 	"github.com/cilium/cilium/pkg/logging"
 	"github.com/cilium/cilium/pkg/logging/logfields"
@@ -142,8 +141,6 @@ func (c *Collector) GetStaleProbes() map[string]time.Time {
 // spawnProbe starts a goroutine which invokes the probe at the particular interval.
 func (c *Collector) spawnProbe(p *Probe) {
 	go func() {
-		timer, stopTimer := inctimer.New()
-		defer stopTimer()
 		for {
 			c.runProbe(p)
 
@@ -151,11 +148,12 @@ func (c *Collector) spawnProbe(p *Probe) {
 			if p.Interval != nil {
 				interval = p.Interval(p.consecutiveFailures)
 			}
+
 			select {
 			case <-c.stop:
 				// collector is closed, stop looping
 				return
-			case <-timer.After(interval):
+			case <-time.After(interval):
 				// keep looping
 			}
 		}
diff --git a/pkg/trigger/trigger.go b/pkg/trigger/trigger.go
index 19000133d3..3bf047da69 100644
--- a/pkg/trigger/trigger.go
+++ b/pkg/trigger/trigger.go
@@ -18,7 +18,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/lock"
 )
 
@@ -181,8 +180,6 @@ func (t *Trigger) Shutdown() {
 }
 
 func (t *Trigger) waiter() {
-	sleepTimer, sleepTimerDone := inctimer.New()
-	defer sleepTimerDone()
 	for {
 		// keep critical section as small as possible
 		t.mutex.Lock()
@@ -216,7 +213,7 @@ func (t *Trigger) waiter() {
 
 		select {
 		case <-t.wakeupChan:
-		case <-sleepTimer.After(t.params.sleepInterval):
+		case <-time.After(t.params.sleepInterval):
 
 		case <-t.closeChan:
 			return


Test patch:
diff --git a/pkg/hubble/peer/handler_test.go b/pkg/hubble/peer/handler_test.go
index 4ec653ed45..cdb5f56195 100644
--- a/pkg/hubble/peer/handler_test.go
+++ b/pkg/hubble/peer/handler_test.go
@@ -135,6 +135,20 @@ func TestNodeAdd(t *testing.T) {
 					ServerName: "my-very-long-node-name.cluster.hubble-grpc.cilium.io",
 				},
 			},
+		}, {
+			name: "node name with dots in the cluster name section",
+			arg: types.Node{
+				Name:    "my.very.long.node.name",
+				Cluster: "cluster.name.with.dots",
+			},
+			want: &peerpb.ChangeNotification{
+				Name:    "cluster.name.with.dots/my.very.long.node.name",
+				Address: "",
+				Type:    peerpb.ChangeNotificationType_PEER_ADDED,
+				Tls: &peerpb.TLS{
+					ServerName: "my-very-long-node-name.cluster-name-with-dots.hubble-grpc.cilium.io",
+				},
+			},
 		},
 	}
 	for _, tt := range tests {
diff --git a/pkg/identity/cache/allocation_test.go b/pkg/identity/cache/allocation_test.go
index e747f42051..67306540eb 100644
--- a/pkg/identity/cache/allocation_test.go
+++ b/pkg/identity/cache/allocation_test.go
@@ -24,7 +24,6 @@ import (
 	"github.com/cilium/cilium/pkg/checker"
 	"github.com/cilium/cilium/pkg/identity"
 	"github.com/cilium/cilium/pkg/idpool"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/kvstore"
 	"github.com/cilium/cilium/pkg/labels"
 	"github.com/cilium/cilium/pkg/lock"
@@ -161,8 +160,6 @@ func (d *dummyOwner) GetNodeSuffix() string {
 // nothing is received from that channel in 60 seconds.
 func (d *dummyOwner) WaitUntilID(target identity.NumericIdentity) int {
 	rounds := 0
-	timer, timerDone := inctimer.New()
-	defer timerDone()
 	for {
 		select {
 		case nid, ok := <-d.updated:
@@ -174,7 +171,7 @@ func (d *dummyOwner) WaitUntilID(target identity.NumericIdentity) int {
 			if nid == target {
 				return rounds
 			}
-		case <-timer.After(60 * time.Second):
+		case <-time.After(60 * time.Second):
 			// Timed out waiting for KV-store events
 			return 0
 		}
diff --git a/pkg/inctimer/inctimer_test.go b/pkg/inctimer/inctimer_test.go
deleted file mode 100644
index 5cc2b8268c..0000000000
--- a/pkg/inctimer/inctimer_test.go
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2020 Authors of Cilium
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build !privileged_tests
-
-package inctimer
-
-import (
-	"testing"
-	"time"
-)
-
-func TestTimerHardReset(t *testing.T) {
-	tr, done := New()
-	defer done()
-	for i := 0; i < 100; i++ {
-		select {
-		case <-tr.After(time.Millisecond):
-		case <-time.After(time.Millisecond * 2):
-			t.Fatal("`IncTimer`, after being reset, did not fire")
-		}
-	}
-}
diff --git a/pkg/k8s/factory_functions_test.go b/pkg/k8s/factory_functions_test.go
index ccb13a8b2a..8b3ba99582 100644
--- a/pkg/k8s/factory_functions_test.go
+++ b/pkg/k8s/factory_functions_test.go
@@ -1173,6 +1173,15 @@ func (s *K8sSuite) Test_ConvertToCCNP(c *C) {
 				CiliumNetworkPolicy: &v2.CiliumNetworkPolicy{},
 			},
 		},
+		{
+			name: "A CCNP where it doesn't contain neither a spec nor specs",
+			args: args{
+				obj: &v2.CiliumClusterwideNetworkPolicy{},
+			},
+			want: &types.SlimCNP{
+				CiliumNetworkPolicy: &v2.CiliumNetworkPolicy{},
+			},
+		},
 		{
 			name: "delete final state unknown conversion",
 			args: args{
diff --git a/pkg/node/manager/manager_test.go b/pkg/node/manager/manager_test.go
index 57c6cdd986..2906b17a5f 100644
--- a/pkg/node/manager/manager_test.go
+++ b/pkg/node/manager/manager_test.go
@@ -26,7 +26,6 @@ import (
 	"github.com/cilium/cilium/pkg/checker"
 	"github.com/cilium/cilium/pkg/datapath"
 	"github.com/cilium/cilium/pkg/datapath/fake"
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/pkg/ipcache"
 	"github.com/cilium/cilium/pkg/node/addressing"
 	nodeTypes "github.com/cilium/cilium/pkg/node/types"
@@ -330,8 +329,6 @@ func (s *managerTestSuite) TestBackgroundSync(c *check.C) {
 
 	go func() {
 		nodeValidationsReceived := 0
-		timer, timerDone := inctimer.New()
-		defer timerDone()
 		for {
 			select {
 			case <-signalNodeHandler.NodeValidateImplementationEvent:
@@ -340,7 +337,7 @@ func (s *managerTestSuite) TestBackgroundSync(c *check.C) {
 					allNodeValidateCallsReceived.Done()
 					return
 				}
-			case <-timer.After(time.Second * 5):
+			case <-time.After(time.Second * 5):
 				c.Errorf("Timeout while waiting for NodeValidateImplementation() to be called")
 			}
 		}
diff --git a/pkg/policy/distillery_test.go b/pkg/policy/distillery_test.go
index ade82d7ec3..a364b0f774 100644
--- a/pkg/policy/distillery_test.go
+++ b/pkg/policy/distillery_test.go
@@ -425,7 +425,7 @@ func (d *policyDistillery) distillPolicy(owner PolicyOwner, epLabels labels.Labe
 // cache at the time when the expectations are created.
 func (m MapState) clearCachedSelectors() {
 	for k, v := range m {
-		v.selectors = nil
+		v.selectors = make(map[CachedSelector]struct{})
 		m[k] = v
 	}
 }
diff --git a/pkg/policy/mapstate_test.go b/pkg/policy/mapstate_test.go
index 50691b69f4..515c14ea6a 100644
--- a/pkg/policy/mapstate_test.go
+++ b/pkg/policy/mapstate_test.go
@@ -27,13 +27,9 @@ import (
 // No selectors is represented with a 'nil' map.
 func (e MapStateEntry) WithSelectors(selectors ...CachedSelector) MapStateEntry {
 	mse := e
-	if len(selectors) > 0 {
-		mse.selectors = make(map[CachedSelector]struct{}, len(selectors))
-		for _, cs := range selectors {
-			mse.selectors[cs] = struct{}{}
-		}
-	} else {
-		mse.selectors = nil
+	mse.selectors = make(map[CachedSelector]struct{}, len(selectors))
+	for _, cs := range selectors {
+		mse.selectors[cs] = struct{}{}
 	}
 	return mse
 }
@@ -776,11 +772,9 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 			ProxyPort: proxyPort,
 			IsDeny:    deny,
 		}
-		if len(selectors) > 0 {
-			entry.selectors = make(map[CachedSelector]struct{}, len(selectors))
-			for _, cs := range selectors {
-				entry.selectors[cs] = struct{}{}
-			}
+		entry.selectors = make(map[CachedSelector]struct{}, len(selectors))
+		for _, cs := range selectors {
+			entry.selectors[cs] = struct{}{}
 		}
 		return entry
 	}
@@ -811,7 +805,7 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 			HttpIngressKey(42): TestEntry(0, false, csFoo),
 		},
 		adds: MapState{
-			HttpIngressKey(42): TestEntry(0, false),
+			HttpIngressKey(42): TestEntry(0, false, csFoo),
 		},
 		deletes: MapState{},
 	}, {
@@ -835,8 +829,8 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 			HttpIngressKey(43): TestEntry(0, false, csFoo),
 		},
 		adds: MapState{
-			HttpIngressKey(42): TestEntry(0, false),
-			HttpIngressKey(43): TestEntry(0, false),
+			HttpIngressKey(42): TestEntry(0, false, csFoo),
+			HttpIngressKey(43): TestEntry(0, false, csFoo),
 		},
 		deletes: MapState{},
 	}, {
@@ -851,7 +845,7 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 			HttpIngressKey(44): TestEntry(0, false, csBar),
 		},
 		adds: MapState{
-			HttpIngressKey(44): TestEntry(0, false),
+			HttpIngressKey(44): TestEntry(0, false, csBar),
 		},
 		deletes: MapState{},
 	}, {
@@ -869,10 +863,23 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 		deletes: MapState{},
 	}, {
 		continued: true,
-		name:      "test-6 - Deleting 42 from Bar, deleted",
+		name:      "test-5b - Deleting 42 from Foo again, not deleted",
 		args: []args{
 			{cs: csFoo, adds: []int{}, deletes: []int{42}, port: 80, proto: 6, ingress: true, redirect: false, deny: false},
 		},
+		state: MapState{
+			HttpIngressKey(42): TestEntry(0, false, csBar),
+			HttpIngressKey(43): TestEntry(0, false, csFoo),
+			HttpIngressKey(44): TestEntry(0, false, csBar),
+		},
+		adds:    MapState{},
+		deletes: MapState{},
+	}, {
+		continued: true,
+		name:      "test-6 - Deleting 42 from Bar, deleted",
+		args: []args{
+			{cs: csBar, adds: []int{}, deletes: []int{42}, port: 80, proto: 6, ingress: true, redirect: false, deny: false},
+		},
 		state: MapState{
 			HttpIngressKey(43): TestEntry(0, false, csFoo),
 			HttpIngressKey(44): TestEntry(0, false, csBar),
@@ -909,10 +916,10 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 			DNSTCPEgressKey(42): TestEntry(0, false, csBar),
 		},
 		adds: MapState{
-			AnyIngressKey():     TestEntry(0, false),
-			HostIngressKey():    TestEntry(0, false),
-			DNSUDPEgressKey(42): TestEntry(0, false),
-			DNSTCPEgressKey(42): TestEntry(0, false),
+			AnyIngressKey():     TestEntry(0, false, nil),
+			HostIngressKey():    TestEntry(0, false, nil),
+			DNSUDPEgressKey(42): TestEntry(0, false, csBar),
+			DNSTCPEgressKey(42): TestEntry(0, false, csBar),
 		},
 		deletes: MapState{},
 	}, {
@@ -929,7 +936,7 @@ func (ds *PolicyTestSuite) TestMapState_AccumulateMapChanges(c *check.C) {
 			HttpEgressKey(43):   TestEntry(1, false, csFoo),
 		},
 		adds: MapState{
-			HttpEgressKey(43): TestEntry(1, false),
+			HttpEgressKey(43): TestEntry(1, false, csFoo),
 		},
 		deletes: MapState{},
 	}, {
diff --git a/pkg/policy/resolve_deny_test.go b/pkg/policy/resolve_deny_test.go
index db8c6dde7f..1db359158a 100644
--- a/pkg/policy/resolve_deny_test.go
+++ b/pkg/policy/resolve_deny_test.go
@@ -490,8 +490,8 @@ func (ds *PolicyTestSuite) TestMapStateWithIngressDeny(c *C) {
 	// maps on the policy got cleared
 
 	c.Assert(adds, checker.Equals, MapState{
-		{Identity: 192, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry.WithoutSelectors(),
-		{Identity: 194, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry.WithoutSelectors(),
+		{Identity: 192, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry,
+		{Identity: 194, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry,
 	})
 	c.Assert(deletes, checker.Equals, MapState{
 		{Identity: 193, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry.WithoutSelectors(),
diff --git a/pkg/policy/resolve_test.go b/pkg/policy/resolve_test.go
index 27b1590f40..6d2c944365 100644
--- a/pkg/policy/resolve_test.go
+++ b/pkg/policy/resolve_test.go
@@ -664,8 +664,8 @@ func (ds *PolicyTestSuite) TestMapStateWithIngress(c *C) {
 	c.Assert(policy.policyMapChanges.changes, IsNil)
 
 	c.Assert(adds, checker.Equals, MapState{
-		{Identity: 192, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry.WithoutSelectors(),
-		{Identity: 194, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry.WithoutSelectors(),
+		{Identity: 192, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry,
+		{Identity: 194, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry,
 	})
 	c.Assert(deletes, checker.Equals, MapState{
 		{Identity: 193, DestPort: 80, Nexthdr: 6}: rule1MapStateEntry.WithoutSelectors(),
diff --git a/proxylib/proxylib_test.go b/proxylib/proxylib_test.go
index 27553e1c72..0b243411ac 100644
--- a/proxylib/proxylib_test.go
+++ b/proxylib/proxylib_test.go
@@ -23,12 +23,11 @@ import (
 
 	_ "gopkg.in/check.v1"
 
-	"github.com/cilium/cilium/pkg/inctimer"
 	"github.com/cilium/cilium/proxylib/proxylib"
 	"github.com/cilium/cilium/proxylib/test"
 	_ "github.com/cilium/cilium/proxylib/testparsers"
 
-	cilium "github.com/cilium/proxy/go/cilium/api"
+	"github.com/cilium/proxy/go/cilium/api"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -126,8 +125,6 @@ func checkAccessLogs(t *testing.T, logServer *test.AccessLogServer, expPasses, e
 	passes, drops := 0, 0
 	nWaits := 0
 	done := false
-	timer, timerDone := inctimer.New()
-	defer timerDone()
 	// Loop until done or when the timeout has ticked 100 times without any logs being received
 	for !done && nWaits < 100 {
 		select {
@@ -139,7 +136,7 @@ func checkAccessLogs(t *testing.T, logServer *test.AccessLogServer, expPasses, e
 			}
 			// Start the timeout again (for upto 5 seconds)
 			nWaits = 0
-		case <-timer.After(50 * time.Millisecond):
+		case <-time.After(50 * time.Millisecond):
 			// Count the number of times we have waited since the last log was received
 			nWaits++
 			// Finish when expected number of passes and drops have been collected
diff --git a/proxylib/test/accesslog_server.go b/proxylib/test/accesslog_server.go
index d1fc694a26..7d00d443df 100644
--- a/proxylib/test/accesslog_server.go
+++ b/proxylib/test/accesslog_server.go
@@ -23,8 +23,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/cilium/cilium/pkg/inctimer"
-	cilium "github.com/cilium/proxy/go/cilium/api"
+	"github.com/cilium/proxy/go/cilium/api"
 
 	"github.com/golang/protobuf/proto"
 	log "github.com/sirupsen/logrus"
@@ -63,7 +62,7 @@ func (s *AccessLogServer) Clear() (passed, drops int) {
 			} else {
 				passes++
 			}
-		case <-inctimer.After(10 * time.Millisecond):
+		case <-time.After(10 * time.Millisecond):
 			empty = true
 		}
 	}