diff --git a/cluster/admitomatic/BUILD.bazel b/cluster/admitomatic/BUILD.bazel
index 5aa7c0e..e2ff90f 100644
--- a/cluster/admitomatic/BUILD.bazel
+++ b/cluster/admitomatic/BUILD.bazel
@@ -2,7 +2,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "admitomatic_lib",
     srcs = [
         "ingress.go",
         "main.go",
@@ -11,40 +11,40 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/admitomatic",
     visibility = ["//visibility:private"],
     deps = [
-        "//cluster/admitomatic/config:go_default_library",
-        "//go/mirko:go_default_library",
-        "@com_github_golang_glog//:go_default_library",
-        "@io_k8s_api//admission/v1beta1:go_default_library",
-        "@io_k8s_api//networking/v1beta1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
+        "//cluster/admitomatic/config",
+        "//go/mirko",
+        "@com_github_golang_glog//:glog",
+        "@io_k8s_api//admission/v1beta1",
+        "@io_k8s_api//networking/v1beta1",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@org_golang_google_protobuf//encoding/prototext",
     ],
 )
 
 go_binary(
     name = "admitomatic",
-    embed = [":go_default_library"],
+    embed = [":admitomatic_lib"],
     visibility = ["//visibility:public"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "admitomatic_test",
     srcs = ["ingress_test.go"],
-    embed = [":go_default_library"],
+    embed = [":admitomatic_lib"],
     deps = [
-        "@io_k8s_api//admission/v1beta1:go_default_library",
-        "@io_k8s_api//networking/v1beta1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
+        "@io_k8s_api//admission/v1beta1",
+        "@io_k8s_api//networking/v1beta1",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/runtime",
     ],
 )
 
 container_layer(
     name = "layer_bin",
+    directory = "/cluster/admitomatic/",
     files = [
         ":admitomatic",
     ],
-    directory = "/cluster/admitomatic/",
 )
 
 container_image(
@@ -57,8 +57,8 @@
 
 container_push(
     name = "push",
-    image = ":runtime",
     format = "Docker",
+    image = ":runtime",
     registry = "registry.k0.hswaw.net",
     repository = "cluster/admitomatic",
     tag = "{BUILD_TIMESTAMP}-{STABLE_GIT_COMMIT}",
diff --git a/cluster/admitomatic/config/BUILD.bazel b/cluster/admitomatic/config/BUILD.bazel
index 0344526..f74a0d1 100644
--- a/cluster/admitomatic/config/BUILD.bazel
+++ b/cluster/admitomatic/config/BUILD.bazel
@@ -16,7 +16,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "config",
     embed = [":config_go_proto"],
     importpath = "code.hackerspace.pl/hscloud/cluster/admitomatic/config",
     visibility = ["//visibility:public"],
diff --git a/cluster/certs/BUILD.bazel b/cluster/certs/BUILD.bazel
index ca15f0f..f16d6aa 100644
--- a/cluster/certs/BUILD.bazel
+++ b/cluster/certs/BUILD.bazel
@@ -4,15 +4,15 @@
 go_embed_data(
     name = "certs_data",
     srcs = glob(["*.crt"]),
-    package = "certs",
     flatten = True,
+    package = "certs",
 )
 
 go_library(
-    name = "go_default_library",
+    name = "certs",
     srcs = [
         ":certs_data",  # keep
     ],
-    importpath = "code.hackerspace.pl/cluster/certs",
+    importpath = "code.hackerspace.pl/hscloud/cluster/certs",  # keep
     visibility = ["//visibility:public"],
 )
diff --git a/cluster/clustercfg/BUILD b/cluster/clustercfg/BUILD
index e7b308e..d81a947 100644
--- a/cluster/clustercfg/BUILD
+++ b/cluster/clustercfg/BUILD
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "clustercfg_lib",
     srcs = [
         "cmd_admincreds.go",
         "cmd_gencerts.go",
@@ -10,16 +10,16 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/clustercfg",
     visibility = ["//visibility:private"],
     deps = [
-        "//cluster/clustercfg/certs:go_default_library",
-        "//go/workspace:go_default_library",
-        "@com_github_spf13_cobra//:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd/api:go_default_library",
+        "//cluster/clustercfg/certs",
+        "//go/workspace",
+        "@com_github_spf13_cobra//:cobra",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_client_go//tools/clientcmd/api",
     ],
 )
 
 go_binary(
     name = "clustercfg",
-    embed = [":go_default_library"],
+    embed = [":clustercfg_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/cluster/clustercfg/certs/BUILD.bazel b/cluster/clustercfg/certs/BUILD.bazel
index c115680..c78b988 100644
--- a/cluster/clustercfg/certs/BUILD.bazel
+++ b/cluster/clustercfg/certs/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "certs",
     srcs = [
         "certs.go",
         "generator.go",
diff --git a/cluster/identd/BUILD.bazel b/cluster/identd/BUILD.bazel
index c49293f..689b922 100644
--- a/cluster/identd/BUILD.bazel
+++ b/cluster/identd/BUILD.bazel
@@ -2,46 +2,46 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "identd_lib",
     srcs = ["main.go"],
     importpath = "code.hackerspace.pl/hscloud/cluster/identd",
     visibility = ["//visibility:private"],
     deps = [
-        "//cluster/identd/ident:go_default_library",
-        "//cluster/identd/kubenat:go_default_library",
-        "//go/mirko:go_default_library",
-        "@com_github_golang_glog//:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
+        "//cluster/identd/ident",
+        "//cluster/identd/kubenat",
+        "//go/mirko",
+        "@com_github_golang_glog//:glog",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
     ],
 )
 
 go_binary(
     name = "identd",
-    embed = [":go_default_library"],
+    embed = [":identd_lib"],
     visibility = ["//visibility:public"],
 )
 
 container_layer(
     name = "layer_bin",
+    directory = "/cluster/identd/",
     files = [
         ":identd",
     ],
-    directory = "/cluster/identd/",
 )
 
 container_image(
     name = "runtime",
     base = "@prodimage-bionic//image",
+    entrypoint = "/cluster/identd/identd",
     layers = [
         ":layer_bin",
     ],
-    entrypoint = "/cluster/identd/identd",
 )
 
 container_push(
     name = "push",
-    image = ":runtime",
     format = "Docker",
+    image = ":runtime",
     registry = "registry.k0.hswaw.net",
     repository = "q3k/identd",
     tag = "{BUILD_TIMESTAMP}-{STABLE_GIT_COMMIT}",
diff --git a/cluster/identd/cri/BUILD.bazel b/cluster/identd/cri/BUILD.bazel
index 68a15aa..1fd00bd 100644
--- a/cluster/identd/cri/BUILD.bazel
+++ b/cluster/identd/cri/BUILD.bazel
@@ -17,7 +17,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "cri",
     embed = [":cri_go_proto"],
     importpath = "code.hackerspace.pl/hscloud/cluster/identd/cri",
     visibility = ["//visibility:public"],
diff --git a/cluster/identd/ident/BUILD.bazel b/cluster/identd/ident/BUILD.bazel
index 737b814..a1bf063 100644
--- a/cluster/identd/ident/BUILD.bazel
+++ b/cluster/identd/ident/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "ident",
     srcs = [
         "client.go",
         "errors.go",
@@ -11,17 +11,17 @@
     ],
     importpath = "code.hackerspace.pl/hscloud/cluster/identd/ident",
     visibility = ["//visibility:public"],
-    deps = ["@com_github_golang_glog//:go_default_library"],
+    deps = ["@com_github_golang_glog//:glog"],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "ident_test",
     srcs = [
         "e2e_test.go",
         "request_test.go",
         "response_test.go",
         "server_test.go",
     ],
-    embed = [":go_default_library"],
-    deps = ["@com_github_go_test_deep//:go_default_library"],
+    embed = [":ident"],
+    deps = ["@com_github_go_test_deep//:deep"],
 )
diff --git a/cluster/identd/kubenat/BUILD.bazel b/cluster/identd/kubenat/BUILD.bazel
index eeb97ef..02eea63 100644
--- a/cluster/identd/kubenat/BUILD.bazel
+++ b/cluster/identd/kubenat/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "kubenat",
     srcs = [
         "kubenat.go",
         "pods.go",
@@ -10,25 +10,25 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/identd/kubenat",
     visibility = ["//visibility:public"],
     deps = [
-        "//cluster/identd/cri:go_default_library",
-        "@com_github_cenkalti_backoff//:go_default_library",
-        "@com_github_golang_glog//:go_default_library",
+        "//cluster/identd/cri",
+        "@com_github_cenkalti_backoff//:backoff",
+        "@com_github_golang_glog//:glog",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "kubenat_test",
     srcs = [
         "kubenat_test.go",
         "pods_test.go",
         "translation_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":kubenat"],
     deps = [
-        "@com_github_go_test_deep//:go_default_library",
-        "@com_github_golang_glog//:go_default_library",
+        "@com_github_go_test_deep//:deep",
+        "@com_github_golang_glog//:glog",
     ],
 )
diff --git a/cluster/prodaccess/BUILD.bazel b/cluster/prodaccess/BUILD.bazel
index 4db48dd..9189010 100644
--- a/cluster/prodaccess/BUILD.bazel
+++ b/cluster/prodaccess/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "prodaccess_lib",
     srcs = [
         "hspki.go",
         "kubernetes.go",
@@ -10,19 +10,19 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/prodaccess",
     visibility = ["//visibility:private"],
     deps = [
-        "//cluster/certs:go_default_library",
-        "//cluster/prodvider/proto:go_default_library",
-        "//go/pki:go_default_library",
-        "//go/workspace:go_default_library",
-        "@com_github_golang_glog//:go_default_library",
+        "//cluster/certs",
+        "//cluster/prodvider/proto",
+        "//go/pki",
+        "//go/workspace",
+        "@com_github_golang_glog//:glog",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//credentials:go_default_library",
-        "@org_golang_x_crypto//ssh/terminal:go_default_library",
+        "@org_golang_google_grpc//credentials",
+        "@org_golang_x_crypto//ssh/terminal",
     ],
 )
 
 go_binary(
     name = "prodaccess",
-    embed = [":go_default_library"],
+    embed = [":prodaccess_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/cluster/prodaccess/prodaccess.go b/cluster/prodaccess/prodaccess.go
index 1153bab..2d734f9 100644
--- a/cluster/prodaccess/prodaccess.go
+++ b/cluster/prodaccess/prodaccess.go
@@ -14,7 +14,7 @@
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 
-	"code.hackerspace.pl/cluster/certs"
+	"code.hackerspace.pl/hscloud/cluster/certs"
 	pb "code.hackerspace.pl/hscloud/cluster/prodvider/proto"
 )
 
diff --git a/cluster/prodvider/BUILD.bazel b/cluster/prodvider/BUILD.bazel
index c462541..ff7f64b 100644
--- a/cluster/prodvider/BUILD.bazel
+++ b/cluster/prodvider/BUILD.bazel
@@ -2,7 +2,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "prodvider_lib",
     srcs = [
         "certs.go",
         "crdb.go",
@@ -14,39 +14,39 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/prodvider",
     visibility = ["//visibility:private"],
     deps = [
-        "//cluster/prodvider/proto:go_default_library",
-        "@com_github_cloudflare_cfssl//config:go_default_library",
-        "@com_github_cloudflare_cfssl//csr:go_default_library",
-        "@com_github_cloudflare_cfssl//helpers:go_default_library",
-        "@com_github_cloudflare_cfssl//signer:go_default_library",
-        "@com_github_cloudflare_cfssl//signer/local:go_default_library",
-        "@com_github_golang_glog//:go_default_library",
-        "@in_gopkg_ldap_v3//:go_default_library",
-        "@io_k8s_api//core/v1:go_default_library",
-        "@io_k8s_api//rbac/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_client_go//kubernetes:go_default_library",
-        "@io_k8s_client_go//rest:go_default_library",
+        "//cluster/prodvider/proto",
+        "@com_github_cloudflare_cfssl//config",
+        "@com_github_cloudflare_cfssl//csr",
+        "@com_github_cloudflare_cfssl//helpers",
+        "@com_github_cloudflare_cfssl//signer",
+        "@com_github_cloudflare_cfssl//signer/local",
+        "@com_github_go_ldap_ldap_v3//:ldap",
+        "@com_github_golang_glog//:glog",
+        "@io_k8s_api//core/v1:core",
+        "@io_k8s_api//rbac/v1:rbac",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_client_go//kubernetes",
+        "@io_k8s_client_go//rest",
         "@org_golang_google_grpc//:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//credentials:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//credentials",
+        "@org_golang_google_grpc//status",
     ],
 )
 
 go_binary(
     name = "prodvider",
-    embed = [":go_default_library"],
+    embed = [":prodvider_lib"],
     visibility = ["//visibility:public"],
 )
 
 container_layer(
     name = "layer_bin",
+    directory = "/cluster/prodvider/",
     files = [
         ":prodvider",
     ],
-    directory = "/cluster/prodvider/",
 )
 
 container_image(
@@ -59,8 +59,8 @@
 
 container_push(
     name = "push",
-    image = ":runtime",
     format = "Docker",
+    image = ":runtime",
     registry = "registry.k0.hswaw.net",
     repository = "q3k/prodvider",
     tag = "1680303245",
diff --git a/cluster/prodvider/crdb.go b/cluster/prodvider/crdb.go
index 348754c..13ff199 100644
--- a/cluster/prodvider/crdb.go
+++ b/cluster/prodvider/crdb.go
@@ -62,7 +62,7 @@
 	signerCert, _ := s.Certificate("", "")
 	req := &csr.CertificateRequest{
 		CN: username,
-		KeyRequest: &csr.BasicKeyRequest{
+		KeyRequest: &csr.KeyRequest{
 			A: "rsa",
 			S: 4096,
 		},
diff --git a/cluster/prodvider/hspki.go b/cluster/prodvider/hspki.go
index fabf84d..e3019c6 100644
--- a/cluster/prodvider/hspki.go
+++ b/cluster/prodvider/hspki.go
@@ -60,7 +60,7 @@
 	signerCert, _ := s.Certificate("", "")
 	req := &csr.CertificateRequest{
 		CN: principal,
-		KeyRequest: &csr.BasicKeyRequest{
+		KeyRequest: &csr.KeyRequest{
 			A: "rsa",
 			S: 4096,
 		},
diff --git a/cluster/prodvider/proto/BUILD.bazel b/cluster/prodvider/proto/BUILD.bazel
index 0817dfb..4abcd01 100644
--- a/cluster/prodvider/proto/BUILD.bazel
+++ b/cluster/prodvider/proto/BUILD.bazel
@@ -17,7 +17,7 @@
 )
 
 go_library(
-    name = "go_default_library",
+    name = "proto",
     embed = [":proto_go_proto"],
     importpath = "code.hackerspace.pl/hscloud/cluster/prodvider/proto",
     visibility = ["//visibility:public"],
diff --git a/cluster/prodvider/service.go b/cluster/prodvider/service.go
index 19f70ed..21b5f57 100644
--- a/cluster/prodvider/service.go
+++ b/cluster/prodvider/service.go
@@ -7,10 +7,10 @@
 	"regexp"
 	"strings"
 
+	ldap "github.com/go-ldap/ldap/v3"
 	"github.com/golang/glog"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	ldap "gopkg.in/ldap.v3"
 
 	pb "code.hackerspace.pl/hscloud/cluster/prodvider/proto"
 )
diff --git a/cluster/tools/BUILD b/cluster/tools/BUILD
index f28be36..0fe5b98 100644
--- a/cluster/tools/BUILD
+++ b/cluster/tools/BUILD
@@ -3,7 +3,7 @@
 
 copy_go_binary(
     name = "kubectl",
-    src = "@io_k8s_kubernetes//cmd/kubectl:kubectl",
+    src = "@io_k8s_kubernetes//cmd/kubectl",
     visibility = ["//visibility:public"],
 )
 
@@ -30,7 +30,7 @@
 
 copy_go_binary(
     name = "cfssl",
-    src = "@com_github_cloudflare_cfssl//cmd/cfssl:cfssl",
+    src = "@com_github_cloudflare_cfssl//cmd/cfssl",
     visibility = ["//visibility:public"],
 )
 
@@ -38,8 +38,7 @@
     name = "rook-s3cmd-config",
     srcs = ["rook-s3cmd-config.sh"],
     data = [
-        "@bazel_tools//tools/bash/runfiles",
-        "@com_github_itchyny_gojq//cmd/gojq",
         ":kubectl",
+        "@bazel_tools//tools/bash/runfiles",
     ],
 )
diff --git a/cluster/tools/kartongips/BUILD.bazel b/cluster/tools/kartongips/BUILD.bazel
index 1a08ee2..fdec6d8 100644
--- a/cluster/tools/kartongips/BUILD.bazel
+++ b/cluster/tools/kartongips/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
 go_library(
-    name = "go_default_library",
+    name = "kartongips_lib",
     srcs = ["main.go"],
     importpath = "code.hackerspace.pl/hscloud/cluster/tools/kartongips",
     visibility = ["//visibility:private"],
@@ -9,14 +9,14 @@
         "code.hackerspace.pl/hscloud/cluster/tools/kartongips.Version": "{STABLE_GIT_VERSION}",
     },
     deps = [
-        "//cluster/tools/kartongips/cmd:go_default_library",
-        "//cluster/tools/kartongips/pkg/kubecfg:go_default_library",
-        "@com_github_sirupsen_logrus//:go_default_library",
+        "//cluster/tools/kartongips/cmd",
+        "//cluster/tools/kartongips/pkg/kubecfg",
+        "@com_github_sirupsen_logrus//:logrus",
     ],
 )
 
 go_binary(
     name = "kartongips",
-    embed = [":go_default_library"],
+    embed = [":kartongips_lib"],
     visibility = ["//visibility:public"],
 )
diff --git a/cluster/tools/kartongips/cmd/BUILD.bazel b/cluster/tools/kartongips/cmd/BUILD.bazel
index a75ee83..e7d3cbf 100644
--- a/cluster/tools/kartongips/cmd/BUILD.bazel
+++ b/cluster/tools/kartongips/cmd/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "cmd",
     srcs = [
         "completion.go",
         "delete.go",
@@ -15,37 +15,36 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/tools/kartongips/cmd",
     visibility = ["//visibility:public"],
     deps = [
-        "//cluster/tools/kartongips/pkg/kubecfg:go_default_library",
-        "//cluster/tools/kartongips/utils:go_default_library",
-        "@com_github_genuinetools_reg//registry:go_default_library",
-        "@com_github_google_go_jsonnet//:go_default_library",
-        "@com_github_mattn_go_isatty//:go_default_library",
-        "@com_github_sirupsen_logrus//:go_default_library",
-        "@com_github_spf13_cobra//:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/meta:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured:go_default_library",
-        "@io_k8s_client_go//discovery:go_default_library",
-        "@io_k8s_client_go//dynamic:go_default_library",
-        "@io_k8s_client_go//pkg/version:go_default_library",
-        "@io_k8s_client_go//plugin/pkg/client/auth:go_default_library",
-        "@io_k8s_client_go//restmapper:go_default_library",
-        "@io_k8s_client_go//tools/clientcmd:go_default_library",
-        "@io_k8s_klog//:go_default_library",
-        "@org_golang_x_crypto//ssh/terminal:go_default_library",
+        "//cluster/tools/kartongips/pkg/kubecfg",
+        "//cluster/tools/kartongips/utils",
+        "@com_github_genuinetools_reg//registry",
+        "@com_github_google_go_jsonnet//:go-jsonnet",
+        "@com_github_mattn_go_isatty//:go-isatty",
+        "@com_github_sirupsen_logrus//:logrus",
+        "@com_github_spf13_cobra//:cobra",
+        "@io_k8s_apimachinery//pkg/api/meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_client_go//discovery",
+        "@io_k8s_client_go//dynamic",
+        "@io_k8s_client_go//plugin/pkg/client/auth",
+        "@io_k8s_client_go//restmapper",
+        "@io_k8s_client_go//tools/clientcmd",
+        "@io_k8s_klog//:klog",
+        "@org_golang_x_crypto//ssh/terminal",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "cmd_test",
     srcs = [
         "completion_test.go",
         "show_test.go",
         "version_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":cmd"],
     deps = [
-        "@com_github_spf13_cobra//:go_default_library",
-        "@com_github_spf13_pflag//:go_default_library",
-        "@in_gopkg_yaml_v2//:go_default_library",
+        "@com_github_spf13_cobra//:cobra",
+        "@com_github_spf13_pflag//:pflag",
+        "@in_gopkg_yaml_v2//:yaml_v2",
     ],
 )
diff --git a/cluster/tools/kartongips/pkg/kubecfg/BUILD.bazel b/cluster/tools/kartongips/pkg/kubecfg/BUILD.bazel
index 6a112b3..234b6f1 100644
--- a/cluster/tools/kartongips/pkg/kubecfg/BUILD.bazel
+++ b/cluster/tools/kartongips/pkg/kubecfg/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "kubecfg",
     srcs = [
         "delete.go",
         "diff.go",
@@ -12,52 +12,52 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/tools/kartongips/pkg/kubecfg",
     visibility = ["//visibility:public"],
     deps = [
-        "//cluster/tools/kartongips/utils:go_default_library",
-        "@com_github_evanphx_json_patch//:go_default_library",
-        "@com_github_mattn_go_isatty//:go_default_library",
-        "@com_github_sergi_go_diff//diffmatchpatch:go_default_library",
-        "@com_github_sirupsen_logrus//:go_default_library",
-        "@in_gopkg_yaml_v2//:go_default_library",
-        "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/equality:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/meta:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/diff:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/jsonmergepatch:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/sets:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/strategicpatch:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/wait:go_default_library",
-        "@io_k8s_client_go//discovery:go_default_library",
-        "@io_k8s_client_go//dynamic:go_default_library",
-        "@io_k8s_client_go//util/retry:go_default_library",
-        "@io_k8s_kube_openapi//pkg/util/proto:go_default_library",
-        "@io_k8s_kubectl//pkg/util/openapi:go_default_library",
+        "//cluster/tools/kartongips/utils",
+        "@com_github_evanphx_json_patch//:json-patch",
+        "@com_github_mattn_go_isatty//:go-isatty",
+        "@com_github_sergi_go_diff//diffmatchpatch",
+        "@com_github_sirupsen_logrus//:logrus",
+        "@in_gopkg_yaml_v2//:yaml_v2",
+        "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1",
+        "@io_k8s_apimachinery//pkg/api/equality",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/api/meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_apimachinery//pkg/util/diff",
+        "@io_k8s_apimachinery//pkg/util/jsonmergepatch",
+        "@io_k8s_apimachinery//pkg/util/sets",
+        "@io_k8s_apimachinery//pkg/util/strategicpatch",
+        "@io_k8s_apimachinery//pkg/util/wait",
+        "@io_k8s_client_go//discovery",
+        "@io_k8s_client_go//dynamic",
+        "@io_k8s_client_go//util/retry",
+        "@io_k8s_kube_openapi//pkg/util/proto",
+        "@io_k8s_kubectl//pkg/util/openapi",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "kubecfg_test",
     srcs = [
         "diff_test.go",
         "update_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":kubecfg"],
     deps = [
-        "//cluster/tools/kartongips/utils:go_default_library",
+        "//cluster/tools/kartongips/utils",
         "@com_github_golang_protobuf//proto:go_default_library",
-        "@com_github_googleapis_gnostic//openapiv2:go_default_library",
-        "@com_github_stretchr_testify//require:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/equality:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/diff:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/strategicpatch:go_default_library",
-        "@io_k8s_kube_openapi//pkg/util/proto:go_default_library",
-        "@io_k8s_kubectl//pkg/util/openapi:go_default_library",
+        "@com_github_google_gnostic//openapiv2",
+        "@com_github_stretchr_testify//require",
+        "@io_k8s_apimachinery//pkg/api/equality",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_apimachinery//pkg/util/diff",
+        "@io_k8s_apimachinery//pkg/util/strategicpatch",
+        "@io_k8s_kube_openapi//pkg/util/proto",
+        "@io_k8s_kubectl//pkg/util/openapi",
     ],
 )
diff --git a/cluster/tools/kartongips/pkg/kubecfg/update.go b/cluster/tools/kartongips/pkg/kubecfg/update.go
index d035c2e..0627fcd 100644
--- a/cluster/tools/kartongips/pkg/kubecfg/update.go
+++ b/cluster/tools/kartongips/pkg/kubecfg/update.go
@@ -442,7 +442,7 @@
 }
 
 func walkObjects(ctx context.Context, client dynamic.Interface, disco discovery.DiscoveryInterface, listopts metav1.ListOptions, callback func(runtime.Object) error) error {
-	rsrclists, err := disco.ServerResources()
+	rsrclists, err := disco.ServerPreferredResources()
 	if err != nil {
 		return err
 	}
diff --git a/cluster/tools/kartongips/pkg/kubecfg/update_test.go b/cluster/tools/kartongips/pkg/kubecfg/update_test.go
index cf6e745..575ba66 100644
--- a/cluster/tools/kartongips/pkg/kubecfg/update_test.go
+++ b/cluster/tools/kartongips/pkg/kubecfg/update_test.go
@@ -7,7 +7,7 @@
 	"testing"
 
 	pb_proto "github.com/golang/protobuf/proto"
-	openapi_v2 "github.com/googleapis/gnostic/openapiv2"
+	openapi_v2 "github.com/google/gnostic/openapiv2"
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
diff --git a/cluster/tools/kartongips/utils/BUILD.bazel b/cluster/tools/kartongips/utils/BUILD.bazel
index d8724f0..c3a7d29 100644
--- a/cluster/tools/kartongips/utils/BUILD.bazel
+++ b/cluster/tools/kartongips/utils/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
-    name = "go_default_library",
+    name = "utils",
     srcs = [
         "acquire.go",
         "bindata.go",
@@ -16,34 +16,36 @@
     importpath = "code.hackerspace.pl/hscloud/cluster/tools/kartongips/utils",
     visibility = ["//visibility:public"],
     deps = [
-        "@com_github_elazarl_go_bindata_assetfs//:go_default_library",
-        "@com_github_genuinetools_reg//registry:go_default_library",
-        "@com_github_genuinetools_reg//repoutils:go_default_library",
-        "@com_github_ghodss_yaml//:go_default_library",
-        "@com_github_google_go_jsonnet//:go_default_library",
-        "@com_github_google_go_jsonnet//ast:go_default_library",
-        "@com_github_googleapis_gnostic//openapiv2:go_default_library",
-        "@com_github_sirupsen_logrus//:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/meta:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/runtime:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/yaml:go_default_library",
-        "@io_k8s_apimachinery//pkg/version:go_default_library",
-        "@io_k8s_client_go//discovery:go_default_library",
-        "@io_k8s_client_go//dynamic:go_default_library",
-        "@io_k8s_client_go//rest:go_default_library",
-        "@io_k8s_kube_openapi//pkg/util/proto:go_default_library",
-        "@io_k8s_kube_openapi//pkg/util/proto/validation:go_default_library",
-        "@io_k8s_kubectl//pkg/util/openapi:go_default_library",
+        "@com_github_elazarl_go_bindata_assetfs//:go-bindata-assetfs",
+        "@com_github_genuinetools_reg//registry",
+        "@com_github_genuinetools_reg//repoutils",
+        "@com_github_ghodss_yaml//:yaml",
+        "@com_github_google_gnostic//openapiv2",
+        "@com_github_google_go_jsonnet//:go-jsonnet",
+        "@com_github_google_go_jsonnet//ast",
+        "@com_github_sirupsen_logrus//:logrus",
+        "@io_k8s_apimachinery//pkg/api/errors",
+        "@io_k8s_apimachinery//pkg/api/meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_apimachinery//pkg/util/runtime",
+        "@io_k8s_apimachinery//pkg/util/yaml",
+        "@io_k8s_apimachinery//pkg/version",
+        "@io_k8s_client_go//discovery",
+        "@io_k8s_client_go//dynamic",
+        "@io_k8s_client_go//openapi",
+        "@io_k8s_client_go//openapi/cached",
+        "@io_k8s_client_go//rest",
+        "@io_k8s_kube_openapi//pkg/util/proto",
+        "@io_k8s_kube_openapi//pkg/util/proto/validation",
+        "@io_k8s_kubectl//pkg/util/openapi",
     ],
 )
 
 go_test(
-    name = "go_default_test",
+    name = "utils_test",
     srcs = [
         "acquire_test.go",
         "importer_test.go",
@@ -52,23 +54,23 @@
         "openapi_test.go",
         "sort_test.go",
     ],
-    embed = [":go_default_library"],
+    embed = [":utils"],
     deps = [
         "@com_github_golang_protobuf//proto:go_default_library",
-        "@com_github_google_go_jsonnet//:go_default_library",
-        "@com_github_googleapis_gnostic//openapiv2:go_default_library",
-        "@com_github_sirupsen_logrus//:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/equality:go_default_library",
-        "@io_k8s_apimachinery//pkg/api/meta:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
-        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured:go_default_library",
-        "@io_k8s_apimachinery//pkg/runtime/schema:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/diff:go_default_library",
-        "@io_k8s_apimachinery//pkg/util/errors:go_default_library",
-        "@io_k8s_apimachinery//pkg/version:go_default_library",
-        "@io_k8s_client_go//discovery:go_default_library",
-        "@io_k8s_client_go//discovery/fake:go_default_library",
-        "@io_k8s_client_go//restmapper:go_default_library",
-        "@io_k8s_client_go//testing:go_default_library",
+        "@com_github_google_gnostic//openapiv2",
+        "@com_github_google_go_jsonnet//:go-jsonnet",
+        "@com_github_sirupsen_logrus//:logrus",
+        "@io_k8s_apimachinery//pkg/api/equality",
+        "@io_k8s_apimachinery//pkg/api/meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1:meta",
+        "@io_k8s_apimachinery//pkg/apis/meta/v1/unstructured",
+        "@io_k8s_apimachinery//pkg/runtime/schema",
+        "@io_k8s_apimachinery//pkg/util/diff",
+        "@io_k8s_apimachinery//pkg/util/errors",
+        "@io_k8s_apimachinery//pkg/version",
+        "@io_k8s_client_go//discovery",
+        "@io_k8s_client_go//discovery/fake",
+        "@io_k8s_client_go//restmapper",
+        "@io_k8s_client_go//testing",
     ],
 )
diff --git a/cluster/tools/kartongips/utils/client.go b/cluster/tools/kartongips/utils/client.go
index 07cf254..df9bdb8 100644
--- a/cluster/tools/kartongips/utils/client.go
+++ b/cluster/tools/kartongips/utils/client.go
@@ -27,7 +27,7 @@
 	"sync"
 	"syscall"
 
-	openapi_v2 "github.com/googleapis/gnostic/openapiv2"
+	openapi_v2 "github.com/google/gnostic/openapiv2"
 
 	log "github.com/sirupsen/logrus"
 	errorsutil "k8s.io/apimachinery/pkg/api/errors"
@@ -38,6 +38,8 @@
 	"k8s.io/apimachinery/pkg/version"
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/dynamic"
+	openapi_v3 "k8s.io/client-go/openapi"
+	cachedopenapi_v3 "k8s.io/client-go/openapi/cached"
 	restclient "k8s.io/client-go/rest"
 )
 
@@ -57,7 +59,9 @@
 	lock                   sync.RWMutex
 	groupToServerResources map[string]*cacheEntry
 	groupList              *metav1.APIGroupList
+	openAPISchema          *openapi_v2.Document
 	cacheValid             bool
+	openapiV3Client        openapi_v3.Client
 }
 
 // Error Constants
@@ -124,12 +128,6 @@
 	return cachedVal.resourceList, cachedVal.err
 }
 
-// ServerResources returns the supported resources for all groups and versions.
-// Deprecated: use ServerGroupsAndResources instead.
-func (d *memcachedDiscoveryClient) ServerResources() ([]*metav1.APIResourceList, error) {
-	return discovery.ServerResources(d)
-}
-
 // ServerGroupsAndResources returns the groups and supported resources for all groups and versions.
 func (d *memcachedDiscoveryClient) ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
 	return discovery.ServerGroupsAndResources(d)
@@ -163,7 +161,18 @@
 }
 
 func (d *memcachedDiscoveryClient) OpenAPISchema() (*openapi_v2.Document, error) {
-	return d.delegate.OpenAPISchema()
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	if d.openAPISchema == nil {
+		schema, err := d.delegate.OpenAPISchema()
+		if err != nil {
+			return nil, err
+		}
+		d.openAPISchema = schema
+	}
+
+	return d.openAPISchema, nil
 }
 
 func (d *memcachedDiscoveryClient) Fresh() bool {
@@ -183,6 +192,28 @@
 	d.cacheValid = false
 	d.groupToServerResources = nil
 	d.groupList = nil
+	d.openAPISchema = nil
+}
+
+// OpenAPIV3 retrieves and parses the OpenAPIV3 specs exposed by the server
+func (d *memcachedDiscoveryClient) OpenAPIV3() openapi_v3.Client {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	if d.openapiV3Client == nil {
+		// Delegate is discovery client created with special HTTP client which
+		// respects E-Tag cache responses to serve cache from disk.
+		d.openapiV3Client = cachedopenapi_v3.NewClient(d.delegate.OpenAPIV3())
+	}
+
+	return d.openapiV3Client
+}
+
+// taken from: https://github.com/kubernetes/client-go/commit/3ac73ea2c834b1268732024766f1e55a5d0327d2#diff-46edd694bf30a54d9f6e202e010134bedfce438de77f57830155b0762eda7bf6R280-R285
+// WithLegacy returns current cached discovery client;
+// current client does not support legacy-only discovery.
+func (d *memcachedDiscoveryClient) WithLegacy() discovery.DiscoveryInterface {
+	return d
 }
 
 // refreshLocked refreshes the state of cache. The caller must hold d.lock for
diff --git a/cluster/tools/kartongips/utils/openapi_test.go b/cluster/tools/kartongips/utils/openapi_test.go
index 80355c3..a0af770 100644
--- a/cluster/tools/kartongips/utils/openapi_test.go
+++ b/cluster/tools/kartongips/utils/openapi_test.go
@@ -22,7 +22,7 @@
 	"testing"
 
 	"github.com/golang/protobuf/proto"
-	openapi_v2 "github.com/googleapis/gnostic/openapiv2"
+	openapi_v2 "github.com/google/gnostic/openapiv2"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
diff --git a/cluster/tools/kartongips/utils/sort_test.go b/cluster/tools/kartongips/utils/sort_test.go
index ffdfdd4..5a4eea6 100644
--- a/cluster/tools/kartongips/utils/sort_test.go
+++ b/cluster/tools/kartongips/utils/sort_test.go
@@ -21,7 +21,7 @@
 	"sort"
 	"testing"
 
-	openapi_v2 "github.com/googleapis/gnostic/openapiv2"
+	openapi_v2 "github.com/google/gnostic/openapiv2"
 	log "github.com/sirupsen/logrus"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
diff --git a/cluster/tools/tools.go b/cluster/tools/tools.go
new file mode 100644
index 0000000..22784c6
--- /dev/null
+++ b/cluster/tools/tools.go
@@ -0,0 +1,8 @@
+//go:build tools
+
+// +tools
+package tools
+
+import (
+	_ "k8s.io/kubernetes/cmd/kubectl"
+)