treewide: switch to gomod and bump everything

This switches version resolution from fietsje to gomod and updates
all Go dependencies. It also bumps rules_go (required by gVisor) and
switches the Gazelle naming convention from go_default_xxx to the
standard Bazel convention of the default target having the package
name.

Since Kubernetes dropped upstream Bazel support and doesn't check in
all generated files I manually pregenerated the OpenAPI spec. This
should be fixed, but because of the already-huge scope of this CL
and the rebase complexity this is not in here.

Change-Id: Iec8ea613d06946882426c2f9fad5bda7e8aaf833
Reviewed-on: https://review.monogon.dev/c/monogon/+/639
Reviewed-by: Sergiusz Bazanski <serge@monogon.tech>
Reviewed-by: Leopold Schabel <leo@nexantic.com>
diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 893a481..d97cb60 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -6,7 +6,7 @@
 load("@rules_pkg//:pkg.bzl", "pkg_zip")
 
 go_library(
-    name = "go_default_library",
+    name = "node",
     srcs = [
         "ids.go",
         "ports.go",
@@ -70,8 +70,8 @@
         "@com_github_coredns_coredns//:coredns": "/kubernetes/bin/coredns",
 
         # runsc/gVisor
-        "@com_github_google_gvisor//runsc": "/containerd/bin/runsc",
-        "@com_github_google_gvisor//shim:containerd-shim-runsc-v1": "/containerd/bin/containerd-shim-runsc-v1",
+        "@dev_gvisor_gvisor//runsc": "/containerd/bin/runsc",
+        "@dev_gvisor_gvisor//shim": "/containerd/bin/containerd-shim-runsc-v1",
 
         # runc (runtime in files_cc because of cgo)
         "@com_github_containerd_containerd//cmd/containerd-shim-runc-v2": "/containerd/bin/containerd-shim-runc-v2",
@@ -85,8 +85,7 @@
         "//metropolis/node/kubernetes/containerd:cnispec.gojson": "/containerd/conf/cnispec.gojson",
 
         # Containerd preseed bundles
-        "//metropolis/test/e2e/preseedtest:preseedtest.tar": "/containerd/preseed/k8s.io/preseedtest.tar",
-        "//metropolis/test/e2e/k8s_cts:k8s_cts_image.tar": "/containerd/preseed/k8s.io/k8s_cts.tar",
+        "//metropolis/test/e2e/preseedtest:preseedtest_image.tar": "/containerd/preseed/k8s.io/preseedtest.tar",
         "//metropolis/vm/smoketest:smoketest_container.tar": "/containerd/preseed/k8s.io/smoketest.tar",
 
         # CNI Plugins
@@ -129,7 +128,7 @@
 # to the actual bundle format.
 # TODO(lorenz): Replace this
 pkg_zip(
-    name = "node",
+    name = "bundle",
     srcs = [
         ":kernel_efi",
         ":verity_rootfs",
diff --git a/metropolis/node/build/fsspec/BUILD.bazel b/metropolis/node/build/fsspec/BUILD.bazel
index e0ce66d..49ff9a0 100644
--- a/metropolis/node/build/fsspec/BUILD.bazel
+++ b/metropolis/node/build/fsspec/BUILD.bazel
@@ -9,7 +9,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "fsspec",
     srcs = ["utils.go"],
     embed = [":fsspec_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/build/fsspec",
diff --git a/metropolis/node/build/fwprune/BUILD.bazel b/metropolis/node/build/fwprune/BUILD.bazel
index 18e83b1..578b829 100644
--- a/metropolis/node/build/fwprune/BUILD.bazel
+++ b/metropolis/node/build/fwprune/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "fwprune_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/fwprune",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/fsspec:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
+        "//metropolis/node/build/fsspec",
+        "@org_golang_google_protobuf//encoding/prototext",
     ],
 )
 
 go_binary(
     name = "fwprune",
-    embed = [":go_default_library"],
+    embed = [":fwprune_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/genosrelease/BUILD.bazel b/metropolis/node/build/genosrelease/BUILD.bazel
index b48b602..5ac09d5 100644
--- a/metropolis/node/build/genosrelease/BUILD.bazel
+++ b/metropolis/node/build/genosrelease/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "genosrelease_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/genosrelease",
     visibility = ["//visibility:private"],
-    deps = ["@com_github_joho_godotenv//:go_default_library"],
+    deps = ["@com_github_joho_godotenv//:godotenv"],
 )
 
 go_binary(
     name = "genosrelease",
-    embed = [":go_default_library"],
+    embed = [":genosrelease_lib"],
     visibility = [
         "//metropolis/installer:__subpackages__",
         "//metropolis/node:__subpackages__",
diff --git a/metropolis/node/build/kconfig-patcher/BUILD.bazel b/metropolis/node/build/kconfig-patcher/BUILD.bazel
index ee97c39..e838f9e 100644
--- a/metropolis/node/build/kconfig-patcher/BUILD.bazel
+++ b/metropolis/node/build/kconfig-patcher/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "kconfig-patcher_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/kconfig-patcher",
     visibility = ["//visibility:private"],
@@ -9,7 +9,7 @@
 
 go_binary(
     name = "kconfig-patcher",
-    embed = [":go_default_library"],
+    embed = [":kconfig-patcher_lib"],
     visibility = [
         "//metropolis/node:__pkg__",
         "//metropolis/test/ktest:__pkg__",
@@ -17,7 +17,7 @@
 )
 
 go_test(
-    name = "go_default_test",
+    name = "kconfig-patcher_test",
     srcs = ["main_test.go"],
-    embed = [":go_default_library"],
+    embed = [":kconfig-patcher_lib"],
 )
diff --git a/metropolis/node/build/mkcpio/BUILD.bazel b/metropolis/node/build/mkcpio/BUILD.bazel
index 5a93d3a..f0bb779 100644
--- a/metropolis/node/build/mkcpio/BUILD.bazel
+++ b/metropolis/node/build/mkcpio/BUILD.bazel
@@ -1,20 +1,20 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkcpio_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkcpio",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/fsspec:go_default_library",
-        "@com_github_cavaliergopher_cpio//:go_default_library",
-        "@com_github_pierrec_lz4_v4//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/build/fsspec",
+        "@com_github_cavaliergopher_cpio//:cpio",
+        "@com_github_pierrec_lz4_v4//:lz4",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_binary(
     name = "mkcpio",
-    embed = [":go_default_library"],
+    embed = [":mkcpio_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/mkcpio/main.go b/metropolis/node/build/mkcpio/main.go
index 10deb5a..bde7082 100644
--- a/metropolis/node/build/mkcpio/main.go
+++ b/metropolis/node/build/mkcpio/main.go
@@ -174,7 +174,7 @@
 			inF.Close()
 		case *fsspec.Directory:
 			if err := cpioWriter.WriteHeader(&cpio.Header{
-				Mode: cpio.FileMode(i.Mode) | cpio.ModeDir,
+				Mode: cpio.FileMode(i.Mode) | cpio.TypeDir,
 				Name: strings.TrimPrefix(i.Path, "/"),
 			}); err != nil {
 				log.Fatalf("Failed to write cpio header for directory %q: %v", i.Path, err)
@@ -182,7 +182,7 @@
 		case *fsspec.SymbolicLink:
 			if err := cpioWriter.WriteHeader(&cpio.Header{
 				// Symlinks are 0777 by definition (from man 7 symlink on Linux)
-				Mode:     0777 | cpio.ModeSymlink,
+				Mode:     0777 | cpio.TypeSymlink,
 				Name:     strings.TrimPrefix(i.Path, "/"),
 				Linkname: i.TargetPath,
 			}); err != nil {
@@ -192,11 +192,11 @@
 			mode := cpio.FileMode(i.Mode)
 			switch i.Type {
 			case fsspec.SpecialFile_CHARACTER_DEV:
-				mode |= cpio.ModeCharDevice
+				mode |= cpio.TypeChar
 			case fsspec.SpecialFile_BLOCK_DEV:
-				mode |= cpio.ModeDevice
+				mode |= cpio.TypeBlock
 			case fsspec.SpecialFile_FIFO:
-				mode |= cpio.ModeNamedPipe
+				mode |= cpio.TypeFifo
 			}
 
 			if err := cpioWriter.WriteHeader(&cpio.Header{
diff --git a/metropolis/node/build/mkerofs/BUILD.bazel b/metropolis/node/build/mkerofs/BUILD.bazel
index 43e2f5c..73fda98 100644
--- a/metropolis/node/build/mkerofs/BUILD.bazel
+++ b/metropolis/node/build/mkerofs/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkerofs_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkerofs",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/build/fsspec:go_default_library",
-        "//metropolis/pkg/erofs:go_default_library",
+        "//metropolis/node/build/fsspec",
+        "//metropolis/pkg/erofs",
     ],
 )
 
 go_binary(
     name = "mkerofs",
-    embed = [":go_default_library"],
+    embed = [":mkerofs_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/mkimage/BUILD.bazel b/metropolis/node/build/mkimage/BUILD.bazel
index a18bb85..2bf8229 100644
--- a/metropolis/node/build/mkimage/BUILD.bazel
+++ b/metropolis/node/build/mkimage/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkimage_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkimage",
     visibility = ["//visibility:private"],
-    deps = ["//metropolis/node/build/mkimage/osimage:go_default_library"],
+    deps = ["//metropolis/node/build/mkimage/osimage"],
 )
 
 go_binary(
     name = "mkimage",
-    embed = [":go_default_library"],
+    embed = [":mkimage_lib"],
     visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/build/mkimage/osimage/BUILD.bazel b/metropolis/node/build/mkimage/osimage/BUILD.bazel
index 88f1dd8..35bfb9c 100644
--- a/metropolis/node/build/mkimage/osimage/BUILD.bazel
+++ b/metropolis/node/build/mkimage/osimage/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "osimage",
     srcs = ["osimage.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkimage/osimage",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/pkg/efivarfs:go_default_library",
-        "@com_github_diskfs_go_diskfs//:go_default_library",
-        "@com_github_diskfs_go_diskfs//disk:go_default_library",
-        "@com_github_diskfs_go_diskfs//filesystem:go_default_library",
-        "@com_github_diskfs_go_diskfs//partition/gpt:go_default_library",
-        "@com_github_google_uuid//:go_default_library",
+        "//metropolis/pkg/efivarfs",
+        "@com_github_diskfs_go_diskfs//:go-diskfs",
+        "@com_github_diskfs_go_diskfs//disk",
+        "@com_github_diskfs_go_diskfs//filesystem",
+        "@com_github_diskfs_go_diskfs//partition/gpt",
+        "@com_github_google_uuid//:uuid",
     ],
 )
diff --git a/metropolis/node/build/mkpayload/BUILD.bazel b/metropolis/node/build/mkpayload/BUILD.bazel
index 7716e60..b092791 100644
--- a/metropolis/node/build/mkpayload/BUILD.bazel
+++ b/metropolis/node/build/mkpayload/BUILD.bazel
@@ -2,12 +2,12 @@
 
 go_binary(
     name = "mkpayload",
-    embed = [":go_default_library"],
+    embed = [":mkpayload_lib"],
     visibility = ["//visibility:public"],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "mkpayload_lib",
     srcs = ["mkpayload.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkpayload",
     visibility = ["//visibility:private"],
diff --git a/metropolis/node/build/mkucode/BUILD.bazel b/metropolis/node/build/mkucode/BUILD.bazel
index 5f310c2..c1f5667 100644
--- a/metropolis/node/build/mkucode/BUILD.bazel
+++ b/metropolis/node/build/mkucode/BUILD.bazel
@@ -1,19 +1,19 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "mkucode_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkucode",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node/build/mkucode/spec:go_default_library",
-        "@com_github_cavaliergopher_cpio//:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
+        "//metropolis/node/build/mkucode/spec",
+        "@com_github_cavaliergopher_cpio//:cpio",
+        "@org_golang_google_protobuf//encoding/prototext",
     ],
 )
 
 go_binary(
     name = "mkucode",
-    embed = [":go_default_library"],
+    embed = [":mkucode_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/metropolis/node/build/mkucode/spec/BUILD.bazel b/metropolis/node/build/mkucode/spec/BUILD.bazel
index f41e2e9..84e7c7b 100644
--- a/metropolis/node/build/mkucode/spec/BUILD.bazel
+++ b/metropolis/node/build/mkucode/spec/BUILD.bazel
@@ -16,7 +16,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "spec",
     embed = [":spec_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/build/mkucode/spec",
     visibility = ["//visibility:public"],
diff --git a/metropolis/node/build/mkverity/BUILD.bazel b/metropolis/node/build/mkverity/BUILD.bazel
index 2fe6768..faf7908 100644
--- a/metropolis/node/build/mkverity/BUILD.bazel
+++ b/metropolis/node/build/mkverity/BUILD.bazel
@@ -2,7 +2,7 @@
 
 go_binary(
     name = "mkverity",
-    embed = [":go_default_library"],
+    embed = [":mkverity_lib"],
     visibility = [
         "//metropolis/installer/test/testos:__pkg__",
         "//metropolis/node:__pkg__",
@@ -10,9 +10,9 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "mkverity_lib",
     srcs = ["mkverity.go"],
     importpath = "source.monogon.dev/metropolis/node/build/mkverity",
     visibility = ["//visibility:private"],
-    deps = ["//metropolis/pkg/verity:go_default_library"],
+    deps = ["//metropolis/pkg/verity"],
 )
diff --git a/metropolis/node/core/BUILD.bazel b/metropolis/node/core/BUILD.bazel
index 651e9df..6d2c9c3 100644
--- a/metropolis/node/core/BUILD.bazel
+++ b/metropolis/node/core/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "core_lib",
     # keep
     srcs = [
         "main.go",
@@ -19,30 +19,30 @@
     importpath = "source.monogon.dev/metropolis/node/core",
     visibility = ["//visibility:private"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/cluster:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/localstorage/declarative:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/network/hostsfile:go_default_library",
-        "//metropolis/node/core/roleserve:go_default_library",
-        "//metropolis/node/core/time:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/pkg/tpm:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_containerd_containerd//:go_default_library",
-        "@com_github_containerd_containerd//namespaces:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/cluster",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/localstorage/declarative",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/network/hostsfile",
+        "//metropolis/node/core/roleserve",
+        "//metropolis/node/core/time",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/pkg/tpm",
+        "//metropolis/proto/api",
+        "@com_github_containerd_containerd//:containerd",
+        "@com_github_containerd_containerd//namespaces",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_binary(
     name = "core",
-    embed = [":go_default_library"],
+    embed = [":core_lib"],
     pure = "on",  # keep
     visibility = ["//metropolis/node:__pkg__"],
 )
diff --git a/metropolis/node/core/cluster/BUILD.bazel b/metropolis/node/core/cluster/BUILD.bazel
index 93cc5de..78078bb 100644
--- a/metropolis/node/core/cluster/BUILD.bazel
+++ b/metropolis/node/core/cluster/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "cluster",
     srcs = [
         "cluster.go",
         "cluster_bootstrap.go",
@@ -11,20 +11,20 @@
     importpath = "source.monogon.dev/metropolis/node/core/cluster",
     visibility = ["//metropolis/node/core:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/roleserve:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/private:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/roleserve",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "//metropolis/proto/private",
+        "@com_github_cenkalti_backoff_v4//:backoff",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_protobuf//proto",
     ],
 )
diff --git a/metropolis/node/core/consensus/BUILD.bazel b/metropolis/node/core/consensus/BUILD.bazel
index c4f65ec..693f789 100644
--- a/metropolis/node/core/consensus/BUILD.bazel
+++ b/metropolis/node/core/consensus/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "consensus",
     srcs = [
         "configuration.go",
         "consensus.go",
@@ -12,30 +12,30 @@
     importpath = "source.monogon.dev/metropolis/node/core/consensus",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/logtree/unraw:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//embed:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/logtree/unraw",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_server_v3//embed",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "consensus_test",
     size = "small",
     srcs = [
         "consensus_test.go",
         "logparser_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":consensus"],
     tags = [
         # Enable network sandboxing by asking the Bazel executor to block any
         # network access. This is necessary as tests listen on static ports on
@@ -43,11 +43,11 @@
         "block-network",
     ],
     deps = [
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/localstorage/declarative:go_default_library",
-        "//metropolis/pkg/logbuffer:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_google_go_cmp//cmp:go_default_library",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/localstorage/declarative",
+        "//metropolis/pkg/logbuffer",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "@com_github_google_go_cmp//cmp",
     ],
 )
diff --git a/metropolis/node/core/consensus/client/BUILD.bazel b/metropolis/node/core/consensus/client/BUILD.bazel
index a98eaf5..23c6c14 100644
--- a/metropolis/node/core/consensus/client/BUILD.bazel
+++ b/metropolis/node/core/consensus/client/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "client",
     srcs = [
         "client.go",
         "unimplemented.go",
@@ -9,7 +9,7 @@
     importpath = "source.monogon.dev/metropolis/node/core/consensus/client",
     visibility = ["//visibility:public"],
     deps = [
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//clientv3/namespace:go_default_library",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_client_v3//namespace",
     ],
 )
diff --git a/metropolis/node/core/consensus/client/client.go b/metropolis/node/core/consensus/client/client.go
index 1304cf1..821919b 100644
--- a/metropolis/node/core/consensus/client/client.go
+++ b/metropolis/node/core/consensus/client/client.go
@@ -25,8 +25,8 @@
 	"fmt"
 	"strings"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/clientv3/namespace"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/client/v3/namespace"
 )
 
 // Namespaced etcd/consensus client. Each Namespaced client allows access to a
diff --git a/metropolis/node/core/consensus/client/unimplemented.go b/metropolis/node/core/consensus/client/unimplemented.go
index b0bb695..047e8ee 100644
--- a/metropolis/node/core/consensus/client/unimplemented.go
+++ b/metropolis/node/core/consensus/client/unimplemented.go
@@ -5,7 +5,7 @@
 	"errors"
 	"io"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 )
 
 var (
@@ -59,6 +59,10 @@
 	panic(UnimplementedInNamespaced)
 }
 
+func (c *unimplementedAuth) AuthStatus(ctx context.Context) (*clientv3.AuthStatusResponse, error) {
+	panic(UnimplementedInNamespaced)
+}
+
 func (c *unimplementedAuth) UserAdd(ctx context.Context, name string, password string) (*clientv3.AuthUserAddResponse, error) {
 	panic(UnimplementedInNamespaced)
 }
diff --git a/metropolis/node/core/consensus/configuration.go b/metropolis/node/core/consensus/configuration.go
index 1e7cff6..552b81d 100644
--- a/metropolis/node/core/consensus/configuration.go
+++ b/metropolis/node/core/consensus/configuration.go
@@ -9,8 +9,8 @@
 	"strconv"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/embed"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/server/v3/embed"
 
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/identity"
diff --git a/metropolis/node/core/consensus/consensus.go b/metropolis/node/core/consensus/consensus.go
index d4ab964..1137556 100644
--- a/metropolis/node/core/consensus/consensus.go
+++ b/metropolis/node/core/consensus/consensus.go
@@ -94,8 +94,8 @@
 	"math/big"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/embed"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/server/v3/embed"
 
 	"source.monogon.dev/metropolis/node/core/consensus/client"
 	"source.monogon.dev/metropolis/node/core/identity"
diff --git a/metropolis/node/core/consensus/status.go b/metropolis/node/core/consensus/status.go
index 43a70fd..e2b15f8 100644
--- a/metropolis/node/core/consensus/status.go
+++ b/metropolis/node/core/consensus/status.go
@@ -8,7 +8,7 @@
 	"net"
 	"strconv"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/consensus/client"
diff --git a/metropolis/node/core/consensus/testhelpers.go b/metropolis/node/core/consensus/testhelpers.go
index 627a278..32bbc46 100644
--- a/metropolis/node/core/consensus/testhelpers.go
+++ b/metropolis/node/core/consensus/testhelpers.go
@@ -4,7 +4,7 @@
 	"context"
 	"testing"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"source.monogon.dev/metropolis/pkg/event/memory"
 )
diff --git a/metropolis/node/core/curator/BUILD.bazel b/metropolis/node/core/curator/BUILD.bazel
index 90ae216..c13282e 100644
--- a/metropolis/node/core/curator/BUILD.bazel
+++ b/metropolis/node/core/curator/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "curator",
     srcs = [
         "bootstrap.go",
         "curator.go",
@@ -19,57 +19,58 @@
     importpath = "source.monogon.dev/metropolis/node/core/curator",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/curator/proto/private:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/combinectx:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/etcd:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/common:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//clientv3/concurrency:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/curator/proto/private",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/combinectx",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/etcd",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "//metropolis/proto/common",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_client_v3//concurrency",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//proto",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "curator_test",
     srcs = [
         "curator_test.go",
         "impl_leader_test.go",
         "listener_test.go",
         "state_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":curator"],
     deps = [
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/consensus/client:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/curator/proto/private:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/common:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_etcd_go_etcd//integration:go_default_library",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/consensus/client",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/curator/proto/private",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/rpc",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "//metropolis/proto/common",
+        "@io_etcd_go_etcd_client_pkg_v3//testutil",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_etcd_go_etcd_tests_v3//integration",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_grpc//test/bufconn:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_grpc//test/bufconn",
+        "@org_golang_google_protobuf//proto",
     ],
 )
diff --git a/metropolis/node/core/curator/bootstrap.go b/metropolis/node/core/curator/bootstrap.go
index d05a764..12b24fd 100644
--- a/metropolis/node/core/curator/bootstrap.go
+++ b/metropolis/node/core/curator/bootstrap.go
@@ -5,7 +5,7 @@
 	"crypto/x509"
 	"fmt"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/protobuf/proto"
 
 	"source.monogon.dev/metropolis/node/core/consensus"
diff --git a/metropolis/node/core/curator/curator.go b/metropolis/node/core/curator/curator.go
index 5d6eedd..d6ec579 100644
--- a/metropolis/node/core/curator/curator.go
+++ b/metropolis/node/core/curator/curator.go
@@ -19,7 +19,7 @@
 	"fmt"
 	"time"
 
-	"go.etcd.io/etcd/clientv3/concurrency"
+	"go.etcd.io/etcd/client/v3/concurrency"
 	"google.golang.org/protobuf/proto"
 
 	"source.monogon.dev/metropolis/node/core/consensus"
diff --git a/metropolis/node/core/curator/curator_test.go b/metropolis/node/core/curator/curator_test.go
index cd5889b..3ea66a0 100644
--- a/metropolis/node/core/curator/curator_test.go
+++ b/metropolis/node/core/curator/curator_test.go
@@ -2,13 +2,15 @@
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"os"
 	"testing"
 	"time"
 
-	"go.etcd.io/etcd/clientv3"
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/client/pkg/v3/testutil"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/tests/v3/integration"
 
 	"source.monogon.dev/metropolis/node/core/consensus"
 	"source.monogon.dev/metropolis/node/core/identity"
@@ -29,14 +31,21 @@
 		Size:                 3,
 		GRPCKeepAliveMinTime: time.Millisecond,
 	}
-	cluster = integration.NewClusterV3(nil, &cfg)
+	t, cancel := testutil.NewTestingTBProthesis("curator")
+	defer cancel()
+
+	flag.Parse()
+
+	integration.BeforeTest(t)
+
+	cluster = integration.NewClusterV3(t, &cfg)
 	endpoints = make([]string, 3)
 	for i := range endpoints {
 		endpoints[i] = cluster.Client(i).Endpoints()[0]
 	}
 
 	v := m.Run()
-	cluster.Terminate(nil)
+	cluster.Terminate(t)
 	os.Exit(v)
 }
 
diff --git a/metropolis/node/core/curator/impl_leader.go b/metropolis/node/core/curator/impl_leader.go
index 75ede5d..d6894a2 100644
--- a/metropolis/node/core/curator/impl_leader.go
+++ b/metropolis/node/core/curator/impl_leader.go
@@ -7,7 +7,7 @@
 	"strings"
 	"sync"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
diff --git a/metropolis/node/core/curator/impl_leader_test.go b/metropolis/node/core/curator/impl_leader_test.go
index b07b49f..7254fab 100644
--- a/metropolis/node/core/curator/impl_leader_test.go
+++ b/metropolis/node/core/curator/impl_leader_test.go
@@ -11,7 +11,7 @@
 	"net"
 	"testing"
 
-	"go.etcd.io/etcd/integration"
+	"go.etcd.io/etcd/tests/v3/integration"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/test/bufconn"
 	"google.golang.org/protobuf/proto"
@@ -44,13 +44,14 @@
 	ctx, ctxC := context.WithCancel(context.Background())
 
 	// Start a single-node etcd cluster.
-	cluster := integration.NewClusterV3(nil, &integration.ClusterConfig{
+	integration.BeforeTest(t)
+	cluster := integration.NewClusterV3(t, &integration.ClusterConfig{
 		Size: 1,
 	})
 	// Terminate the etcd cluster on context cancel.
 	go func() {
 		<-ctx.Done()
-		cluster.Terminate(nil)
+		cluster.Terminate(t)
 	}()
 
 	// Create etcd client to test cluster.
diff --git a/metropolis/node/core/curator/proto/api/BUILD.bazel b/metropolis/node/core/curator/proto/api/BUILD.bazel
index 2cec346..dbc1cbf 100644
--- a/metropolis/node/core/curator/proto/api/BUILD.bazel
+++ b/metropolis/node/core/curator/proto/api/BUILD.bazel
@@ -19,13 +19,13 @@
     proto = ":api_proto",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/proto/common:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/proto/common",
+        "//metropolis/proto/ext",
     ],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "api",
     embed = [":api_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/core/curator/proto/api",
     visibility = ["//visibility:public"],
diff --git a/metropolis/node/core/curator/proto/private/BUILD.bazel b/metropolis/node/core/curator/proto/private/BUILD.bazel
index e3c032d..a731e06 100644
--- a/metropolis/node/core/curator/proto/private/BUILD.bazel
+++ b/metropolis/node/core/curator/proto/private/BUILD.bazel
@@ -17,11 +17,11 @@
     importpath = "source.monogon.dev/metropolis/node/core/curator/proto/private",
     proto = ":private_proto",
     visibility = ["//visibility:public"],
-    deps = ["//metropolis/proto/common:go_default_library"],
+    deps = ["//metropolis/proto/common"],
 )
 
 go_library(
-    name = "go_default_library",
+    name = "private",
     embed = [":private_go_proto"],
     importpath = "source.monogon.dev/metropolis/node/core/curator/proto/private",
     visibility = ["//visibility:public"],
diff --git a/metropolis/node/core/curator/state.go b/metropolis/node/core/curator/state.go
index 0db9af5..c1969d4 100644
--- a/metropolis/node/core/curator/state.go
+++ b/metropolis/node/core/curator/state.go
@@ -4,7 +4,7 @@
 	"fmt"
 	"strings"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 )
 
 // etcdPrefix is the location of some data in etcd, with each data element keyed
diff --git a/metropolis/node/core/curator/state_node.go b/metropolis/node/core/curator/state_node.go
index f20f981..ce87723 100644
--- a/metropolis/node/core/curator/state_node.go
+++ b/metropolis/node/core/curator/state_node.go
@@ -21,7 +21,7 @@
 	"crypto/x509"
 	"fmt"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
diff --git a/metropolis/node/core/curator/state_registerticket.go b/metropolis/node/core/curator/state_registerticket.go
index 4b674aa..8b8ea15 100644
--- a/metropolis/node/core/curator/state_registerticket.go
+++ b/metropolis/node/core/curator/state_registerticket.go
@@ -4,7 +4,7 @@
 	"context"
 	"crypto/rand"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
diff --git a/metropolis/node/core/identity/BUILD.bazel b/metropolis/node/core/identity/BUILD.bazel
index c5b481a..92e8943 100644
--- a/metropolis/node/core/identity/BUILD.bazel
+++ b/metropolis/node/core/identity/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "identity",
     srcs = [
         "certificates.go",
         "identity.go",
     ],
     importpath = "source.monogon.dev/metropolis/node/core/identity",
     visibility = ["//visibility:public"],
-    deps = ["//metropolis/node/core/localstorage:go_default_library"],
+    deps = ["//metropolis/node/core/localstorage"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "identity_test",
     srcs = ["certificates_test.go"],
-    embed = [":go_default_library"],
+    embed = [":identity"],
 )
diff --git a/metropolis/node/core/localstorage/BUILD.bazel b/metropolis/node/core/localstorage/BUILD.bazel
index 13cd8a9..b360e2c 100644
--- a/metropolis/node/core/localstorage/BUILD.bazel
+++ b/metropolis/node/core/localstorage/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "localstorage",
     srcs = [
         "directory_data.go",
         "directory_pki.go",
@@ -12,19 +12,19 @@
     importpath = "source.monogon.dev/metropolis/node/core/localstorage",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/node/core/localstorage/crypt:go_default_library",
-        "//metropolis/node/core/localstorage/declarative:go_default_library",
-        "//metropolis/pkg/tpm:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/private:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/core/localstorage/crypt",
+        "//metropolis/node/core/localstorage/declarative",
+        "//metropolis/pkg/tpm",
+        "//metropolis/proto/api",
+        "//metropolis/proto/private",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "localstorage_test",
     srcs = ["storage_test.go"],
-    embed = [":go_default_library"],
-    deps = ["//metropolis/node/core/localstorage/declarative:go_default_library"],
+    embed = [":localstorage"],
+    deps = ["//metropolis/node/core/localstorage/declarative"],
 )
diff --git a/metropolis/node/core/localstorage/crypt/BUILD.bazel b/metropolis/node/core/localstorage/crypt/BUILD.bazel
index 39afbb8..36e17bb 100644
--- a/metropolis/node/core/localstorage/crypt/BUILD.bazel
+++ b/metropolis/node/core/localstorage/crypt/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "crypt",
     # keep
     srcs = [
         "blockdev.go",
@@ -12,9 +12,9 @@
     importpath = "source.monogon.dev/metropolis/node/core/localstorage/crypt",
     visibility = ["//metropolis/node/core/localstorage:__subpackages__"],
     deps = [
-        "//metropolis/pkg/devicemapper:go_default_library",
-        "//metropolis/pkg/sysfs:go_default_library",
-        "@com_github_rekby_gpt//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/pkg/devicemapper",
+        "//metropolis/pkg/sysfs",
+        "@com_github_rekby_gpt//:gpt",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/core/localstorage/declarative/BUILD.bazel b/metropolis/node/core/localstorage/declarative/BUILD.bazel
index de35579..53d1608 100644
--- a/metropolis/node/core/localstorage/declarative/BUILD.bazel
+++ b/metropolis/node/core/localstorage/declarative/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "declarative",
     srcs = [
         "declarative.go",
         "placement.go",
@@ -9,5 +9,5 @@
     ],
     importpath = "source.monogon.dev/metropolis/node/core/localstorage/declarative",
     visibility = ["//metropolis/node:__subpackages__"],
-    deps = ["@org_golang_x_sys//unix:go_default_library"],
+    deps = ["@org_golang_x_sys//unix"],
 )
diff --git a/metropolis/node/core/network/BUILD.bazel b/metropolis/node/core/network/BUILD.bazel
index 489f1d4..86ffda8 100644
--- a/metropolis/node/core/network/BUILD.bazel
+++ b/metropolis/node/core/network/BUILD.bazel
@@ -1,20 +1,20 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "network",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/core/network",
     visibility = ["//:__subpackages__"],
     deps = [
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "//metropolis/node/core/network/dhcp4c/callback:go_default_library",
-        "//metropolis/node/core/network/dns:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_google_nftables//:go_default_library",
-        "@com_github_google_nftables//expr:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
+        "//metropolis/node/core/network/dhcp4c",
+        "//metropolis/node/core/network/dhcp4c/callback",
+        "//metropolis/node/core/network/dns",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/supervisor",
+        "@com_github_google_nftables//:nftables",
+        "@com_github_google_nftables//expr",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_vishvananda_netlink//:netlink",
     ],
 )
diff --git a/metropolis/node/core/network/dhcp4c/BUILD.bazel b/metropolis/node/core/network/dhcp4c/BUILD.bazel
index 72e16f6..d514f2d 100644
--- a/metropolis/node/core/network/dhcp4c/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "dhcp4c",
     srcs = [
         "dhcpc.go",
         "doc.go",
@@ -14,26 +14,26 @@
         "//metropolis/test/nanoswitch:__subpackages__",
     ],
     deps = [
-        "//metropolis/node/core/network/dhcp4c/transport:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_insomniacslk_dhcp//iana:go_default_library",
+        "//metropolis/node/core/network/dhcp4c/transport",
+        "//metropolis/pkg/supervisor",
+        "@com_github_cenkalti_backoff_v4//:backoff",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_insomniacslk_dhcp//iana",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "dhcp4c_test",
     srcs = [
         "dhcpc_test.go",
         "lease_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":dhcp4c"],
     pure = "on",
     deps = [
-        "//metropolis/node/core/network/dhcp4c/transport:go_default_library",
-        "@com_github_cenkalti_backoff_v4//:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_stretchr_testify//assert:go_default_library",
+        "//metropolis/node/core/network/dhcp4c/transport",
+        "@com_github_cenkalti_backoff_v4//:backoff",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_stretchr_testify//assert",
     ],
 )
diff --git a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
index 622fb48..d841c6e 100644
--- a/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/callback/BUILD.bazel
@@ -2,7 +2,7 @@
 load("//metropolis/test/ktest:ktest.bzl", "ktest")
 
 go_library(
-    name = "go_default_library",
+    name = "callback",
     srcs = ["callback.go"],
     importpath = "source.monogon.dev/metropolis/node/core/network/dhcp4c/callback",
     visibility = [
@@ -11,27 +11,27 @@
         "//metropolis/test/nanoswitch:__subpackages__",
     ],
     deps = [
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/core/network/dhcp4c",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "callback_test",
     srcs = ["callback_test.go"],
-    embed = [":go_default_library"],
+    embed = [":callback"],
     pure = "on",
     deps = [
-        "//metropolis/node/core/network/dhcp4c:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "//metropolis/node/core/network/dhcp4c",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_stretchr_testify//require",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@org_golang_x_sys//unix",
     ],
 )
 
 ktest(
-    tester = ":go_default_test",
+    tester = ":callback_test",
 )
diff --git a/metropolis/node/core/network/dhcp4c/callback/callback_test.go b/metropolis/node/core/network/dhcp4c/callback/callback_test.go
index 7f5b5d3..7b06713 100644
--- a/metropolis/node/core/network/dhcp4c/callback/callback_test.go
+++ b/metropolis/node/core/network/dhcp4c/callback/callback_test.go
@@ -128,6 +128,7 @@
 			// Associate dynamically-generated interface name for later comparison
 			for i := range test.expectedAddrs {
 				test.expectedAddrs[i].Label = testLink.Name
+				test.expectedAddrs[i].LinkIndex = testLink.Index
 			}
 			cb := ManageIP(testLink)
 			if err := cb(test.oldLease, test.newLease); err != nil {
diff --git a/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel b/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
index f9e3a74..8b8e02b 100644
--- a/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
+++ b/metropolis/node/core/network/dhcp4c/transport/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "transport",
     srcs = [
         "transport.go",
         "transport_broadcast.go",
@@ -10,11 +10,11 @@
     importpath = "source.monogon.dev/metropolis/node/core/network/dhcp4c/transport",
     visibility = ["//metropolis/node/core/network/dhcp4c:__subpackages__"],
     deps = [
-        "@com_github_google_gopacket//:go_default_library",
-        "@com_github_google_gopacket//layers:go_default_library",
-        "@com_github_insomniacslk_dhcp//dhcpv4:go_default_library",
-        "@com_github_mdlayher_raw//:go_default_library",
-        "@org_golang_x_net//bpf:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@com_github_google_gopacket//:gopacket",
+        "@com_github_google_gopacket//layers",
+        "@com_github_insomniacslk_dhcp//dhcpv4",
+        "@com_github_mdlayher_raw//:raw",
+        "@org_golang_x_net//bpf",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/core/network/dns/BUILD.bazel b/metropolis/node/core/network/dns/BUILD.bazel
index 1ef31f1..7d5419e 100644
--- a/metropolis/node/core/network/dns/BUILD.bazel
+++ b/metropolis/node/core/network/dns/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "dns",
     srcs = [
         "coredns.go",
         "directives.go",
@@ -9,8 +9,8 @@
     importpath = "source.monogon.dev/metropolis/node/core/network/dns",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/pkg/fileargs:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/pkg/fileargs",
+        "//metropolis/pkg/supervisor",
     ],
 )
 
diff --git a/metropolis/node/core/network/hostsfile/BUILD.bazel b/metropolis/node/core/network/hostsfile/BUILD.bazel
index 5cfffc9..7c0b117 100644
--- a/metropolis/node/core/network/hostsfile/BUILD.bazel
+++ b/metropolis/node/core/network/hostsfile/BUILD.bazel
@@ -1,17 +1,17 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "hostsfile",
     srcs = ["hostsfile.go"],
     importpath = "source.monogon.dev/metropolis/node/core/network/hostsfile",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/roleserve:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/roleserve",
+        "//metropolis/pkg/supervisor",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/core/roleserve/BUILD.bazel b/metropolis/node/core/roleserve/BUILD.bazel
index ec1d443..4188202 100644
--- a/metropolis/node/core/roleserve/BUILD.bazel
+++ b/metropolis/node/core/roleserve/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "roleserve",
     srcs = [
         "roleserve.go",
         "value_bootstrapdata.go",
@@ -16,22 +16,22 @@
     importpath = "source.monogon.dev/metropolis/node/core/roleserve",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/consensus:go_default_library",
-        "//metropolis/node/core/curator:go_default_library",
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/rpc:go_default_library",
-        "//metropolis/node/kubernetes:go_default_library",
-        "//metropolis/node/kubernetes/containerd:go_default_library",
-        "//metropolis/node/kubernetes/pki:go_default_library",
-        "//metropolis/pkg/event:go_default_library",
-        "//metropolis/pkg/event/memory:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/common:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/consensus",
+        "//metropolis/node/core/curator",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/rpc",
+        "//metropolis/node/kubernetes",
+        "//metropolis/node/kubernetes/containerd",
+        "//metropolis/node/kubernetes/pki",
+        "//metropolis/pkg/event",
+        "//metropolis/pkg/event/memory",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/common",
         "@org_golang_google_grpc//:go_default_library",
     ],
 )
diff --git a/metropolis/node/core/rpc/BUILD.bazel b/metropolis/node/core/rpc/BUILD.bazel
index 8ec88c0..9b171e3 100644
--- a/metropolis/node/core/rpc/BUILD.bazel
+++ b/metropolis/node/core/rpc/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "rpc",
     srcs = [
         "client.go",
         "methodinfo.go",
@@ -14,39 +14,39 @@
     importpath = "source.monogon.dev/metropolis/node/core/rpc",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/node/core/identity",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/pki",
+        "//metropolis/proto/api",
+        "//metropolis/proto/ext",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//credentials:go_default_library",
-        "@org_golang_google_grpc//peer:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
-        "@org_golang_google_protobuf//proto:go_default_library",
-        "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
-        "@org_golang_google_protobuf//reflect/protoregistry:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//credentials",
+        "@org_golang_google_grpc//peer",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//encoding/prototext",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_google_protobuf//reflect/protoreflect",
+        "@org_golang_google_protobuf//reflect/protoregistry",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "rpc_test",
     srcs = [
         "server_authentication_test.go",
         "trace_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":rpc"],
     deps = [
-        "//metropolis/node/core/curator/proto/api:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "//metropolis/proto/ext:go_default_library",
+        "//metropolis/node/core/curator/proto/api",
+        "//metropolis/pkg/logtree",
+        "//metropolis/proto/api",
+        "//metropolis/proto/ext",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_google_grpc//test/bufconn:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_grpc//test/bufconn",
     ],
 )
diff --git a/metropolis/node/core/time/BUILD.bazel b/metropolis/node/core/time/BUILD.bazel
index 05a938a..fb9af73 100644
--- a/metropolis/node/core/time/BUILD.bazel
+++ b/metropolis/node/core/time/BUILD.bazel
@@ -1,13 +1,13 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "time",
     srcs = ["time.go"],
     importpath = "source.monogon.dev/metropolis/node/core/time",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/pkg/fileargs:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
+        "//metropolis/node",
+        "//metropolis/pkg/fileargs",
+        "//metropolis/pkg/supervisor",
     ],
 )
diff --git a/metropolis/node/kubernetes/BUILD.bazel b/metropolis/node/kubernetes/BUILD.bazel
index 2a35c4b..c92ca06 100644
--- a/metropolis/node/kubernetes/BUILD.bazel
+++ b/metropolis/node/kubernetes/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "kubernetes",
     srcs = [
         "apiserver.go",
         "controller-manager.go",
@@ -14,46 +14,46 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/node/core/network:go_default_library",
-        "//metropolis/node/core/network/dns:go_default_library",
-        "//metropolis/node/kubernetes/authproxy:go_default_library",
-        "//metropolis/node/kubernetes/clusternet:go_default_library",
-        "//metropolis/node/kubernetes/nfproxy:go_default_library",
-        "//metropolis/node/kubernetes/pki:go_default_library",
-        "//metropolis/node/kubernetes/plugins/kvmdevice:go_default_library",
-        "//metropolis/node/kubernetes/reconciler:go_default_library",
-        "//metropolis/pkg/fileargs:go_default_library",
-        "//metropolis/pkg/fsquota:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/loop:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "//metropolis/proto/api:go_default_library",
-        "@com_github_container_storage_interface_spec//lib/go/csi:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/node/core/network",
+        "//metropolis/node/core/network/dns",
+        "//metropolis/node/kubernetes/authproxy",
+        "//metropolis/node/kubernetes/clusternet",
+        "//metropolis/node/kubernetes/nfproxy",
+        "//metropolis/node/kubernetes/pki",
+        "//metropolis/node/kubernetes/plugins/kvmdevice",
+        "//metropolis/node/kubernetes/reconciler",
+        "//metropolis/pkg/fileargs",
+        "//metropolis/pkg/fsquota",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/loop",
+        "//metropolis/pkg/pki",
+        "//metropolis/pkg/supervisor",
+        "//metropolis/proto/api",
+        "@com_github_container_storage_interface_spec//lib/go/csi",
         "@io_bazel_rules_go//proto/wkt:wrappers_go_proto",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_api//storage/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_client_go//informers:go_default_library",
-        "@io_k8s_client_go//informers/core/v1:go_default_library",
-        "@io_k8s_client_go//informers/storage/v1:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//kubernetes/scheme:go_default_library",
-        "@io_k8s_client_go//kubernetes/typed/core/v1:go_default_library",
-        "@io_k8s_client_go//tools/cache:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd:go_default_library",
-        "@io_k8s_client_go//tools/record:go_default_library",
-        "@io_k8s_client_go//tools/reference:go_default_library",
-        "@io_k8s_client_go//util/workqueue:go_default_library",
-        "@io_k8s_kubelet//config/v1beta1:go_default_library",
-        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:go_default_library",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_api//storage/v1:storage",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_client_go//informers",
+        "@io_k8s_client_go//informers/core/v1:core",
+        "@io_k8s_client_go//informers/storage/v1:storage",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//kubernetes/scheme",
+        "@io_k8s_client_go//kubernetes/typed/core/v1:core",
+        "@io_k8s_client_go//tools/cache",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_client_go//tools/record",
+        "@io_k8s_client_go//tools/reference",
+        "@io_k8s_client_go//util/workqueue",
+        "@io_k8s_kubelet//config/v1beta1",
+        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:pluginregistration",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/kubernetes/apiserver.go b/metropolis/node/kubernetes/apiserver.go
index cd4ff60..aeaa80e 100644
--- a/metropolis/node/kubernetes/apiserver.go
+++ b/metropolis/node/kubernetes/apiserver.go
@@ -97,7 +97,6 @@
 			pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: s.idCA})),
 		"--enable-admission-plugins=NodeRestriction,PodSecurityPolicy",
 		"--enable-aggregator-routing=true",
-		"--insecure-port=0",
 		fmt.Sprintf("--secure-port=%d", common.KubernetesAPIPort),
 		fmt.Sprintf("--etcd-servers=unix:///%s:0", s.EphemeralConsensusDirectory.ClientSocket.FullPath()),
 		args.FileOpt("--kubelet-client-certificate", "kubelet-client-cert.pem",
@@ -117,6 +116,9 @@
 		"--requestheader-username-headers=X-Remote-User",
 		args.FileOpt("--service-account-key-file", "service-account-pubkey.pem",
 			pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: s.serviceAccountPrivKey})),
+		args.FileOpt("--service-account-signing-key-file", "service-account-signing-key.pem",
+			pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: s.serviceAccountPrivKey})),
+		"--service-account-issuer", "https://metropolis.internal", // TODO: Figure out federation
 		fmt.Sprintf("--service-cluster-ip-range=%v", s.ServiceIPRange.String()),
 		args.FileOpt("--tls-cert-file", "server-cert.pem",
 			pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: s.serverCert})),
diff --git a/metropolis/node/kubernetes/authproxy/BUILD.bazel b/metropolis/node/kubernetes/authproxy/BUILD.bazel
index 965e8ad..9cf57cb 100644
--- a/metropolis/node/kubernetes/authproxy/BUILD.bazel
+++ b/metropolis/node/kubernetes/authproxy/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "authproxy",
     srcs = ["authproxy.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/authproxy",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/identity:go_default_library",
-        "//metropolis/node/kubernetes/pki:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/identity",
+        "//metropolis/node/kubernetes/pki",
+        "//metropolis/pkg/supervisor",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
     ],
 )
diff --git a/metropolis/node/kubernetes/clusternet/BUILD.bazel b/metropolis/node/kubernetes/clusternet/BUILD.bazel
index b2f0687..8e8f820 100644
--- a/metropolis/node/kubernetes/clusternet/BUILD.bazel
+++ b/metropolis/node/kubernetes/clusternet/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "clusternet",
     srcs = [
         "clusternet.go",
         "netlink_compat.go",
@@ -9,19 +9,19 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes/clusternet",
     visibility = ["//metropolis/node/kubernetes:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/jsonpatch:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_vishvananda_netlink//:go_default_library",
-        "@com_zx2c4_golang_wireguard_wgctrl//:go_default_library",
-        "@com_zx2c4_golang_wireguard_wgctrl//wgtypes:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/types:go_default_library",
-        "@io_k8s_client_go//informers:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//tools/cache:go_default_library",
+        "//metropolis/node",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/jsonpatch",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "@com_github_vishvananda_netlink//:netlink",
+        "@com_zx2c4_golang_wireguard_wgctrl//:wgctrl",
+        "@com_zx2c4_golang_wireguard_wgctrl//wgtypes",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/types",
+        "@io_k8s_client_go//informers",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//tools/cache",
     ],
 )
diff --git a/metropolis/node/kubernetes/containerd/BUILD.bazel b/metropolis/node/kubernetes/containerd/BUILD.bazel
index 58534d7..ef6606d 100644
--- a/metropolis/node/kubernetes/containerd/BUILD.bazel
+++ b/metropolis/node/kubernetes/containerd/BUILD.bazel
@@ -1,15 +1,15 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "containerd",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/containerd",
     visibility = ["//metropolis/node/core:__subpackages__"],
     deps = [
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_containerd_containerd//:go_default_library",
-        "@com_github_containerd_containerd//namespaces:go_default_library",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/supervisor",
+        "@com_github_containerd_containerd//:containerd",
+        "@com_github_containerd_containerd//namespaces",
     ],
 )
 
diff --git a/metropolis/node/kubernetes/containerd/config.toml b/metropolis/node/kubernetes/containerd/config.toml
index da2bed7..98a11fe 100644
--- a/metropolis/node/kubernetes/containerd/config.toml
+++ b/metropolis/node/kubernetes/containerd/config.toml
@@ -58,6 +58,7 @@
     systemd_cgroup = false
     enable_tls_streaming = false
     ignore_image_defined_volumes = true
+    netns_mounts_under_state_dir = true
     max_container_log_line_size = 16384
     disable_cgroup = false
     disable_apparmor = true
diff --git a/metropolis/node/kubernetes/hyperkube/BUILD b/metropolis/node/kubernetes/hyperkube/BUILD
index 3b5deb3..ed27296 100644
--- a/metropolis/node/kubernetes/hyperkube/BUILD
+++ b/metropolis/node/kubernetes/hyperkube/BUILD
@@ -2,27 +2,27 @@
 load("@//third_party/go:kubernetes_version_def.bzl", "version_x_defs")
 
 go_library(
-    name = "go_default_library",
+    name = "hyperkube_lib",
     srcs = ["main.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/hyperkube",
     visibility = ["//visibility:private"],
     deps = [
-        "@com_github_spf13_cobra//:go_default_library",
-        "@com_github_spf13_pflag//:go_default_library",
-        "@io_k8s_component_base//cli/flag:go_default_library",
-        "@io_k8s_component_base//logs:go_default_library",
-        "@io_k8s_component_base//metrics/prometheus/restclient:go_default_library",
-        "@io_k8s_component_base//metrics/prometheus/version:go_default_library",
-        "@io_k8s_kubernetes//cmd/kube-apiserver/app:go_default_library",
-        "@io_k8s_kubernetes//cmd/kube-controller-manager/app:go_default_library",
-        "@io_k8s_kubernetes//cmd/kube-scheduler/app:go_default_library",
-        "@io_k8s_kubernetes//cmd/kubelet/app:go_default_library",
+        "@com_github_spf13_cobra//:cobra",
+        "@com_github_spf13_pflag//:pflag",
+        "@io_k8s_component_base//cli/flag",
+        "@io_k8s_component_base//logs",
+        "@io_k8s_component_base//metrics/prometheus/restclient",
+        "@io_k8s_component_base//metrics/prometheus/version",
+        "@io_k8s_kubernetes//cmd/kube-apiserver/app",
+        "@io_k8s_kubernetes//cmd/kube-controller-manager/app",
+        "@io_k8s_kubernetes//cmd/kube-scheduler/app",
+        "@io_k8s_kubernetes//cmd/kubelet/app",
     ],
 )
 
 go_binary(
     name = "hyperkube",
-    embed = [":go_default_library"],
+    embed = [":hyperkube_lib"],
     pure = "on",
     visibility = ["//metropolis/node:__pkg__"],
     x_defs = version_x_defs(),
diff --git a/metropolis/node/kubernetes/nfproxy/BUILD.bazel b/metropolis/node/kubernetes/nfproxy/BUILD.bazel
index 1dc5bbc..e8dce41 100644
--- a/metropolis/node/kubernetes/nfproxy/BUILD.bazel
+++ b/metropolis/node/kubernetes/nfproxy/BUILD.bazel
@@ -1,22 +1,22 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "nfproxy",
     srcs = ["nfproxy.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/nfproxy",
     visibility = ["//metropolis/node/kubernetes:__subpackages__"],
     deps = [
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@com_github_sbezverk_nfproxy//pkg/controller:go_default_library",
-        "@com_github_sbezverk_nfproxy//pkg/nftables:go_default_library",
-        "@com_github_sbezverk_nfproxy//pkg/proxy:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/labels:go_default_library",
-        "@io_k8s_apimachinery//pkg/selection:go_default_library",
-        "@io_k8s_client_go//informers:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//kubernetes/scheme:go_default_library",
-        "@io_k8s_client_go//tools/record:go_default_library",
+        "//metropolis/pkg/supervisor",
+        "@com_github_sbezverk_nfproxy//pkg/controller",
+        "@com_github_sbezverk_nfproxy//pkg/nftables",
+        "@com_github_sbezverk_nfproxy//pkg/proxy",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/labels",
+        "@io_k8s_apimachinery//pkg/selection",
+        "@io_k8s_client_go//informers",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//kubernetes/scheme",
+        "@io_k8s_client_go//tools/record",
     ],
 )
diff --git a/metropolis/node/kubernetes/pki/BUILD.bazel b/metropolis/node/kubernetes/pki/BUILD.bazel
index cfbba0c..f2e4e3c 100644
--- a/metropolis/node/kubernetes/pki/BUILD.bazel
+++ b/metropolis/node/kubernetes/pki/BUILD.bazel
@@ -1,16 +1,16 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "pki",
     srcs = ["kubernetes.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/pki",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/node:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/pki:go_default_library",
-        "@io_etcd_go_etcd//clientv3:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd/api:go_default_library",
+        "//metropolis/node",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/pki",
+        "@io_etcd_go_etcd_client_v3//:client",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_client_go//tools/clientcmd/api",
     ],
 )
diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index 542c614..1a14f99 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -32,7 +32,7 @@
 	"fmt"
 	"net"
 
-	"go.etcd.io/etcd/clientv3"
+	clientv3 "go.etcd.io/etcd/client/v3"
 	"k8s.io/client-go/tools/clientcmd"
 	configapi "k8s.io/client-go/tools/clientcmd/api"
 
diff --git a/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel b/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel
index a4e0f93..7d9b43f 100644
--- a/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel
+++ b/metropolis/node/kubernetes/plugins/kvmdevice/BUILD.bazel
@@ -1,18 +1,18 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "kvmdevice",
     srcs = ["kvmdevice.go"],
     importpath = "source.monogon.dev/metropolis/node/kubernetes/plugins/kvmdevice",
     visibility = ["//visibility:public"],
     deps = [
-        "//metropolis/node/core/localstorage:go_default_library",
-        "//metropolis/pkg/logtree:go_default_library",
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_kubelet//pkg/apis/deviceplugin/v1beta1:go_default_library",
-        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:go_default_library",
+        "//metropolis/node/core/localstorage",
+        "//metropolis/pkg/logtree",
+        "//metropolis/pkg/supervisor",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_kubelet//pkg/apis/deviceplugin/v1beta1",
+        "@io_k8s_kubelet//pkg/apis/pluginregistration/v1:pluginregistration",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_x_sys//unix:go_default_library",
+        "@org_golang_x_sys//unix",
     ],
 )
diff --git a/metropolis/node/kubernetes/reconciler/BUILD.bazel b/metropolis/node/kubernetes/reconciler/BUILD.bazel
index fadcd96..bba9f4c 100644
--- a/metropolis/node/kubernetes/reconciler/BUILD.bazel
+++ b/metropolis/node/kubernetes/reconciler/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "reconciler",
     srcs = [
         "reconciler.go",
         "resources_csi.go",
@@ -13,26 +13,26 @@
     importpath = "source.monogon.dev/metropolis/node/kubernetes/reconciler",
     visibility = ["//metropolis/node:__subpackages__"],
     deps = [
-        "//metropolis/pkg/supervisor:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_api//node/v1beta1:go_default_library",
-        "@io_k8s_api//policy/v1beta1:go_default_library",
-        "@io_k8s_api//rbac/v1:go_default_library",
-        "@io_k8s_api//storage/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
+        "//metropolis/pkg/supervisor",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_api//node/v1beta1",
+        "@io_k8s_api//policy/v1beta1",
+        "@io_k8s_api//rbac/v1:rbac",
+        "@io_k8s_api//storage/v1:storage",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_client_go//kubernetes",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "reconciler_test",
     srcs = ["reconciler_test.go"],
-    embed = [":go_default_library"],
+    embed = [":reconciler"],
     deps = [
-        "@io_k8s_api//node/v1beta1:go_default_library",
-        "@io_k8s_api//policy/v1beta1:go_default_library",
-        "@io_k8s_api//rbac/v1:go_default_library",
-        "@io_k8s_api//storage/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "@io_k8s_api//node/v1beta1",
+        "@io_k8s_api//policy/v1beta1",
+        "@io_k8s_api//rbac/v1:rbac",
+        "@io_k8s_api//storage/v1:storage",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
     ],
 )
diff --git a/metropolis/node/tools.go b/metropolis/node/tools.go
new file mode 100644
index 0000000..9dcb15c
--- /dev/null
+++ b/metropolis/node/tools.go
@@ -0,0 +1,15 @@
+//go:build tools
+// +build tools
+
+package node
+
+import (
+	_ "github.com/containerd/containerd"
+	_ "github.com/containernetworking/plugins/plugins/ipam/host-local"
+	_ "github.com/containernetworking/plugins/plugins/main/loopback"
+	_ "github.com/containernetworking/plugins/plugins/main/ptp"
+	_ "github.com/coredns/coredns"
+	_ "github.com/go-delve/delve/cmd/dlv"
+	_ "github.com/opencontainers/runc"
+	_ "gvisor.dev/gvisor/runsc"
+)