From 191dfca116a5a85de9b192dbc7f9b94e20771c00 Mon Sep 17 00:00:00 2001
From: Starnop <starnop@163.com>
Date: Fri, 28 Sep 2018 12:20:00 +0800
Subject: [PATCH] upgrade: upgrade CNI

Signed-off-by: Starnop <starnop@163.com>
---
 cri/ocicni/cni_manager.go                     |  20 +-
 .../cni/CODE-OF-CONDUCT.md                    |   4 +
 .../containernetworking/cni/CONTRIBUTING.md   | 125 +++
 .../containernetworking/cni/CONVENTIONS.md    | 114 +++
 vendor/github.com/containernetworking/cni/DCO |  36 +
 .../cni/Documentation/cnitool.md              |  16 +
 .../cni/Documentation/spec-upgrades.md        | 259 ++++++
 .../containernetworking/cni/GOVERNANCE.md     |  44 ++
 .../containernetworking/cni/MAINTAINERS       |   6 +
 .../containernetworking/cni/README.md         | 198 +++++
 .../containernetworking/cni/RELEASING.md      |  34 +
 .../containernetworking/cni/ROADMAP.md        |  23 +
 .../containernetworking/cni/SPEC.md           | 739 ++++++++++++++++++
 .../containernetworking/cni/Vagrantfile       |  22 +
 .../containernetworking/cni/cnitool/README.md |  47 ++
 .../cni/cnitool/cnitool.go                    | 135 ++++
 .../containernetworking/cni/libcni/api.go     | 315 +++++++-
 .../containernetworking/cni/logo.png          | Bin 0 -> 11604 bytes
 .../cni/pkg/invoke/delegate.go                |  42 +-
 .../cni/pkg/invoke/exec.go                    | 104 ++-
 .../cni/pkg/invoke/fakes/cni_args.go          |  27 +
 .../cni/pkg/invoke/fakes/raw_exec.go          |  52 ++
 .../cni/pkg/invoke/fakes/version_decoder.go   |  34 +
 .../cni/pkg/invoke/raw_exec.go                |   4 +
 .../containernetworking/cni/pkg/skel/skel.go  | 296 +++++++
 .../cni/pkg/types/current/types.go            |   6 +-
 .../cni/pkg/types/types.go                    |  10 +-
 .../legacy_examples/example_runtime.go        | 219 ++++++
 .../pkg/version/legacy_examples/examples.go   | 143 ++++
 .../cni/pkg/version/plugin.go                 |  59 ++
 .../pkg/version/testhelpers/testhelpers.go    | 156 ++++
 .../cni/pkg/version/version.go                |   4 +-
 .../cni/plugins/test/noop/debug/debug.go      |  71 ++
 .../cni/plugins/test/noop/main.go             | 216 +++++
 .../cni/scripts/docker-run.sh                 |  21 +
 .../cni/scripts/exec-plugins.sh               |  45 ++
 .../cni/scripts/priv-net-run.sh               |  20 +
 .../cni/scripts/release.sh                    |  38 +
 .../containernetworking/cni/test.sh           |  52 ++
 .../cri-o/ocicni/pkg/ocicni/ocicni.go         | 407 ++++++----
 .../cri-o/ocicni/pkg/ocicni/types.go          |  17 +-
 .../cri-o/ocicni/pkg/ocicni/types_unix.go     |  10 +
 .../cri-o/ocicni/pkg/ocicni/types_windows.go  |  10 +
 .../cri-o/ocicni/pkg/ocicni/util.go           |  34 +-
 .../cri-o/ocicni/pkg/ocicni/util_linux.go     |  71 ++
 .../ocicni/pkg/ocicni/util_unsupported.go     |  19 +
 vendor/vendor.json                            |  45 +-
 47 files changed, 4074 insertions(+), 295 deletions(-)
 create mode 100644 vendor/github.com/containernetworking/cni/CODE-OF-CONDUCT.md
 create mode 100644 vendor/github.com/containernetworking/cni/CONTRIBUTING.md
 create mode 100644 vendor/github.com/containernetworking/cni/CONVENTIONS.md
 create mode 100644 vendor/github.com/containernetworking/cni/DCO
 create mode 100644 vendor/github.com/containernetworking/cni/Documentation/cnitool.md
 create mode 100644 vendor/github.com/containernetworking/cni/Documentation/spec-upgrades.md
 create mode 100644 vendor/github.com/containernetworking/cni/GOVERNANCE.md
 create mode 100644 vendor/github.com/containernetworking/cni/MAINTAINERS
 create mode 100644 vendor/github.com/containernetworking/cni/README.md
 create mode 100644 vendor/github.com/containernetworking/cni/RELEASING.md
 create mode 100644 vendor/github.com/containernetworking/cni/ROADMAP.md
 create mode 100644 vendor/github.com/containernetworking/cni/SPEC.md
 create mode 100644 vendor/github.com/containernetworking/cni/Vagrantfile
 create mode 100644 vendor/github.com/containernetworking/cni/cnitool/README.md
 create mode 100644 vendor/github.com/containernetworking/cni/cnitool/cnitool.go
 create mode 100644 vendor/github.com/containernetworking/cni/logo.png
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/invoke/fakes/cni_args.go
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/invoke/fakes/raw_exec.go
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/invoke/fakes/version_decoder.go
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/skel/skel.go
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/example_runtime.go
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/examples.go
 create mode 100644 vendor/github.com/containernetworking/cni/pkg/version/testhelpers/testhelpers.go
 create mode 100644 vendor/github.com/containernetworking/cni/plugins/test/noop/debug/debug.go
 create mode 100644 vendor/github.com/containernetworking/cni/plugins/test/noop/main.go
 create mode 100644 vendor/github.com/containernetworking/cni/scripts/docker-run.sh
 create mode 100644 vendor/github.com/containernetworking/cni/scripts/exec-plugins.sh
 create mode 100644 vendor/github.com/containernetworking/cni/scripts/priv-net-run.sh
 create mode 100644 vendor/github.com/containernetworking/cni/scripts/release.sh
 create mode 100644 vendor/github.com/containernetworking/cni/test.sh
 create mode 100644 vendor/github.com/cri-o/ocicni/pkg/ocicni/types_unix.go
 create mode 100644 vendor/github.com/cri-o/ocicni/pkg/ocicni/types_windows.go
 create mode 100644 vendor/github.com/cri-o/ocicni/pkg/ocicni/util_linux.go
 create mode 100644 vendor/github.com/cri-o/ocicni/pkg/ocicni/util_unsupported.go

diff --git a/cri/ocicni/cni_manager.go b/cri/ocicni/cni_manager.go
index 8884aab167..b01b76ad96 100644
--- a/cri/ocicni/cni_manager.go
+++ b/cri/ocicni/cni_manager.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/alibaba/pouch/cri/config"
 
+	cnicurrent "github.com/containernetworking/cni/pkg/types/current"
 	"github.com/cri-o/ocicni/pkg/ocicni"
 	"github.com/sirupsen/logrus"
 )
@@ -32,7 +33,7 @@ func NewCniManager(cfg *config.Config) (CniMgr, error) {
 		}
 	}
 
-	plugin, err := ocicni.InitCNI(networkPluginConfDir, networkPluginBinDir)
+	plugin, err := ocicni.InitCNI("", networkPluginConfDir, networkPluginBinDir)
 	if err != nil {
 		return nil, err
 	}
@@ -87,12 +88,25 @@ func (c *CniManager) GetPodNetworkStatus(netnsPath string) (string, error) {
 		NetNS: netnsPath,
 	}
 
-	ip, err := c.plugin.GetPodNetworkStatus(podNetwork)
+	var err error
+	results, err := c.plugin.GetPodNetworkStatus(podNetwork)
 	if err != nil {
 		return "", fmt.Errorf("failed to get pod network status: %v", err)
 	}
 
-	return ip, nil
+	if len(results) > 0 {
+		// NOTE: only get the first IP of the first network at present
+		// TODO: support multiple network
+		if result, ok := results[0].(*cnicurrent.Result); ok {
+			if len(result.IPs) > 0 {
+				ip := result.IPs[0].Address.IP.String()
+				return ip, nil
+			}
+			return "", fmt.Errorf("failed to get pod network status for nil IP")
+		}
+		return "", fmt.Errorf("failed to get pod network status for wrong result: %+v", results[0])
+	}
+	return "", fmt.Errorf("failed to get pod network status for nil result")
 }
 
 // Status returns error if the network plugin is in error state.
diff --git a/vendor/github.com/containernetworking/cni/CODE-OF-CONDUCT.md b/vendor/github.com/containernetworking/cni/CODE-OF-CONDUCT.md
new file mode 100644
index 0000000000..b6e32163ab
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/CODE-OF-CONDUCT.md
@@ -0,0 +1,4 @@
+## Community Code of Conduct
+
+CNI follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
diff --git a/vendor/github.com/containernetworking/cni/CONTRIBUTING.md b/vendor/github.com/containernetworking/cni/CONTRIBUTING.md
new file mode 100644
index 0000000000..817f072afa
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/CONTRIBUTING.md
@@ -0,0 +1,125 @@
+# How to Contribute
+
+CNI is [Apache 2.0 licensed](LICENSE) and accepts contributions via GitHub
+pull requests. This document outlines some of the conventions on development
+workflow, commit message formatting, contact points and other resources to make
+it easier to get your contribution accepted.
+
+We gratefully welcome improvements to documentation as well as to code.
+
+# Certificate of Origin
+
+By contributing to this project you agree to the Developer Certificate of
+Origin (DCO). This document was created by the Linux Kernel community and is a
+simple statement that you, as a contributor, have the legal right to make the
+contribution. See the [DCO](DCO) file for details.
+
+# Email and Chat
+
+The project uses the the cni-dev email list and IRC chat:
+- Email: [cni-dev](https://groups.google.com/forum/#!forum/cni-dev)
+- IRC: #[containernetworking](irc://irc.freenode.org:6667/#containernetworking) channel on freenode.org
+
+Please avoid emailing maintainers found in the MAINTAINERS file directly. They
+are very busy and read the mailing lists.
+
+## Getting Started
+
+- Fork the repository on GitHub
+- Read the [README](README.md) for build and test instructions
+- Play with the project, submit bugs, submit pull requests!
+
+## Contribution workflow
+
+This is a rough outline of how to prepare a contribution:
+
+- Create a topic branch from where you want to base your work (usually branched from master).
+- Make commits of logical units.
+- Make sure your commit messages are in the proper format (see below).
+- Push your changes to a topic branch in your fork of the repository.
+- If you changed code:
+   - add automated tests to cover your changes, using the [Ginkgo](http://onsi.github.io/ginkgo/) & [Gomega](http://onsi.github.io/gomega/) style
+   - if the package did not previously have any test coverage, add it to the list
+   of `TESTABLE` packages in the `test.sh` script.
+   - run the full test script and ensure it passes
+- Make sure any new code files have a license header (this is now enforced by automated tests)
+- Submit a pull request to the original repository.
+
+## How to run the test suite
+We generally require test coverage of any new features or bug fixes.
+
+Here's how you can run the test suite on any system (even Mac or Windows) using
+ [Vagrant](https://www.vagrantup.com/) and a hypervisor of your choice:
+
+```bash
+vagrant up
+vagrant ssh
+# you're now in a shell in a virtual machine
+sudo su
+cd /go/src/github.com/containernetworking/cni
+
+# to run the full test suite
+./test.sh
+
+# to focus on a particular test suite
+cd plugins/main/loopback
+go test
+```
+
+# Acceptance policy
+
+These things will make a PR more likely to be accepted:
+
+ * a well-described requirement
+ * tests for new code
+ * tests for old code!
+ * new code and tests follow the conventions in old code and tests
+ * a good commit message (see below)
+
+In general, we will merge a PR once two maintainers have endorsed it.
+Trivial changes (e.g., corrections to spelling) may get waved through.
+For substantial changes, more people may become involved, and you might get asked to resubmit the PR or divide the changes into more than one PR.
+
+### Format of the Commit Message
+
+We follow a rough convention for commit messages that is designed to answer two
+questions: what changed and why. The subject line should feature the what and
+the body of the commit should describe the why.
+
+```
+scripts: add the test-cluster command
+
+this uses tmux to setup a test cluster that you can easily kill and
+start for debugging.
+
+Fixes #38
+```
+
+The format can be described more formally as follows:
+
+```
+<subsystem>: <what changed>
+<BLANK LINE>
+<why this change was made>
+<BLANK LINE>
+<footer>
+```
+
+The first line is the subject and should be no longer than 70 characters, the
+second line is always blank, and other lines should be wrapped at 80 characters.
+This allows the message to be easier to read on GitHub as well as in various
+git tools.
+
+## 3rd party plugins
+So you've built a CNI plugin.  Where should it live?
+
+Short answer: We'd be happy to link to it from our [list of 3rd party plugins](README.md#3rd-party-plugins).
+But we'd rather you kept the code in your own repo.
+
+Long answer: An advantage of the CNI model is that independent plugins can be
+built, distributed and used without any code changes to this repository.  While
+some widely used plugins (and a few less-popular legacy ones) live in this repo,
+we're reluctant to add more.
+
+If you have a good reason why the CNI maintainers should take custody of your
+plugin, please open an issue or PR.
diff --git a/vendor/github.com/containernetworking/cni/CONVENTIONS.md b/vendor/github.com/containernetworking/cni/CONVENTIONS.md
new file mode 100644
index 0000000000..b9d5a3d9a7
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/CONVENTIONS.md
@@ -0,0 +1,114 @@
+# Extension conventions                                                        
+                                                                                 
+There are three ways of passing information to plugins using the Container Network Interface (CNI), none of which require the [spec](SPEC.md) to be updated. These are 
+- plugin specific fields in the JSON config
+- `args` field in the JSON config
+- `CNI_ARGS` environment variable 
+
+This document aims to provide guidance on which method should be used and to provide a convention for how common information should be passed.
+Establishing these conventions allows plugins to work across multiple runtimes. This helps both plugins and the runtimes.
+
+## Plugins
+* Plugin authors should aim to support these conventions where it makes sense for their plugin. This means they are more likely to "just work" with a wider range of runtimes.
+* Plugins should accept arguments according to these conventions if they implement the same basic functionality as other plugins. If plugins have shared functionality that isn't coverered by these conventions then a PR should be opened against this document.
+
+## Runtimes
+* Runtime authors should follow these conventions if they want to pass additional information to plugins. This will allow the extra information to be consumed by the widest range of plugins.
+* These conventions serve as an abstraction for the runtime. For example, port forwarding is highly implementation specific, but users should be able to select the plugin of their choice without changing the runtime.
+
+# Current conventions
+Additional conventions can be created by creating PRs which modify this document.
+
+## Dynamic Plugin specific fields (Capabilities / Runtime Configuration)
+[Plugin specific fields](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) formed part of the original CNI spec and have been present since the initial release.
+> Plugins may define additional fields that they accept and may generate an error if called with unknown fields. The exception to this is the args field may be used to pass arbitrary data which may be ignored by plugins.
+
+A plugin can define any additional fields it needs to work properly. It should return an error if it can't act on fields that were expected or where the field values were malformed.
+
+This method of passing information to a plugin is recommended when the following conditions hold:
+* The configuration has specific meaning to the plugin (i.e. it's not just general meta data)
+* the plugin is expected to act on the configuration or return an error if it can't
+
+Dynamic information (i.e. data that a runtime fills out) should be placed in a `runtimeConfig` section. Plugins can request
+that the runtime insert this dynamic configuration by explicitly listing their `capabilities` in the network configuration.
+
+For example, the configuration for a port mapping plugin might look like this to an operator (it should be included as part of a [network configuration list](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration-lists).
+```json
+{
+  "name" : "ExamplePlugin",
+  "type" : "port-mapper",
+  "capabilities": {"portMappings": true}
+}
+```
+
+But the runtime would fill in the mappings so the plugin itself would receive something like this.
+```json
+{
+  "name" : "ExamplePlugin",
+  "type" : "port-mapper",
+  "runtimeConfig": {
+    "portMappings": [
+      {"hostPort": 8080, "containerPort": 80, "protocol": "tcp"}
+    ]
+  }
+}
+```
+
+### Well-known Capabilities
+| Area  | Purpose | Capability | Spec and Example | Runtime implementations | Plugin Implementations |
+| ----- | ------- | -----------| ---------------- | ----------------------- | ---------------------  |
+| port mappings | Pass mapping from ports on the host to ports in the container network namespace. | `portMappings` | A list of portmapping entries.<br/>  <pre>[<br/>  { "hostPort": 8080, "containerPort": 80, "protocol": "tcp" },<br />  { "hostPort": 8000, "containerPort": 8001, "protocol": "udp" }<br />  ]<br /></pre> | kubernetes | CNI `portmap` plugin |
+| ip ranges | Dynamically configure the IP range(s) for address allocation. Runtimes that manage IP pools, but not individual IP addresses, can pass these to plugins. | `ipRanges` | The same as the `ranges` key for `host-local` - a list of lists of subnets. The outer list is the number of IPs to allocate, and the inner list is a pool of subnets for each allocation. <br/><pre>[<br/> [<br/>  { "subnet": "10.1.2.0/24", "rangeStart": "10.1.2.3", "rangeEnd": 10.1.2.99", "gateway": "10.1.2.254" } <br/>  ]<br/>]</pre> | none | cni `host-local` plugin |
+| bandwidth limits | Dynamically configure interface bandwidth limits | `bandwidth` | Desired bandwidth limits. Rates are in bits per second, burst values are in bits. <pre> { "ingressRate": 2048, "ingressBurst": 1600, "egressRate": 4096, "egressBurst": 1600 } </pre> | none | cni `bandwidth` plugin |
+
+
+## "args" in network config
+`args` in [network config](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) were introduced as an optional field into the `0.2.0` release of the CNI spec. The first CNI code release that it appeared in was `v0.4.0`. 
+> args (dictionary): Optional additional arguments provided by the container runtime. For example a dictionary of labels could be passed to CNI plugins by adding them to a labels field under args.
+
+`args` provide a way of providing more structured data than the flat strings that CNI_ARGS can support.
+
+`args` should be used for _optional_ meta-data. Runtimes can place additional data in `args` and plugins that don't understand that data should just ignore it. Runtimes should not require that a plugin understands or consumes that data provided, and so a runtime should not expect to receive an error if the data could not be acted on.
+
+This method of passing information to a plugin is recommended when the information is optional and the plugin can choose to ignore it. It's often that case that such information is passed to all plugins by the runtime without regard for whether the plugin can understand it.
+
+The conventions documented here are all namepaced under `cni` so they don't conflict with any existing `args`.
+
+For example:
+```json
+{  
+   "cniVersion":"0.2.0",
+   "name":"net",
+   "args":{  
+      "cni":{  
+         "labels": [{"key": "app", "value": "myapp"}]
+      }
+   },
+   <REST OF CNI CONFIG HERE>
+   "ipam":{  
+     <IPAM CONFIG HERE>
+   }
+}
+```
+
+| Area  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
+| ----- | ------ | ------------     | ----------------------- | ---------------------- |
+| labels | Pass`key=value` labels to plugins | <pre>"labels" : [<br />  { "key" : "app", "value" : "myapp" },<br />  { "key" : "env", "value" : "prod" }<br />] </pre> | none | none |
+| ips   | Request static IPs | <pre>"ips": ["10.2.2.42", "2001:db8::5"]</pre> | none | host-local |
+
+## CNI_ARGS
+CNI_ARGS formed part of the original CNI spec and have been present since the initial release.
+> `CNI_ARGS`: Extra arguments passed in by the user at invocation time. Alphanumeric key-value pairs separated by semicolons; for example, "FOO=BAR;ABC=123"
+
+The use of `CNI_ARGS` is deprecated and "args" should be used instead.
+
+| Field  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
+| ------ | ------ | ---------------- | ----------------------- | ---------------------- |
+| IP     | Request a specific IP from IPAM plugins | IP=192.168.10.4 | *rkt* supports passing additional arguments to plugins and the [documentation](https://coreos.com/rkt/docs/latest/networking/overriding-defaults.html) suggests IP can be used. | host-local (since version v0.2.0) supports the field for IPv4 only - [documentation](https://github.com/containernetworking/cni/blob/master/Documentation/host-local.md#supported-arguments).|
+
+## Chained Plugins
+If plugins are agnostic about the type of interface created, they SHOULD work in a chained mode and configure existing interfaces. Plugins MAY also create the desired interface when not run in a chain.
+
+For example, the `bridge` plugin adds the host-side interface to a bridge. So, it should accept any previous result that includes a host-side interface, including `tap` devices. If not called as a chained plugin, it creates a `veth` pair first.
+
+Plugins that meet this convention are usable by a larger set of runtimes and interfaces, including hypervisors and DPDK providers.
diff --git a/vendor/github.com/containernetworking/cni/DCO b/vendor/github.com/containernetworking/cni/DCO
new file mode 100644
index 0000000000..716561d5d2
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/DCO
@@ -0,0 +1,36 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
diff --git a/vendor/github.com/containernetworking/cni/Documentation/cnitool.md b/vendor/github.com/containernetworking/cni/Documentation/cnitool.md
new file mode 100644
index 0000000000..a4bc7d35de
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/Documentation/cnitool.md
@@ -0,0 +1,16 @@
+# Overview
+The `cnitool` is a utility that can be used to test a CNI plugin
+without the need for a container runtime. The `cnitool` takes a
+`network name` and a `network namespace` and a command to `ADD` or
+`DEL`,.i.e, attach or detach containers from a network. The `cnitool`
+relies on the following environment variables to operate properly:
+* `NETCONFPATH`: This environment variable needs to be set to a
+  directory. It defaults to `/etc/cni/net.d`. The `cnitool` searches
+  for CNI configuration files in this directory with the extension
+  `*.conf` or `*.json`. It loads all the CNI configuration files in
+  this directory and if it finds a CNI configuration with the `network
+  name` given to the cnitool it returns the corresponding CNI
+  configuration, else it returns `nil`.
+
+* `CNI_PATH`: For a given CNI configuration `cnitool` will search for
+  the corresponding CNI plugin in this path.
diff --git a/vendor/github.com/containernetworking/cni/Documentation/spec-upgrades.md b/vendor/github.com/containernetworking/cni/Documentation/spec-upgrades.md
new file mode 100644
index 0000000000..c9efc67a2c
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/Documentation/spec-upgrades.md
@@ -0,0 +1,259 @@
+# How to upgrade to CNI Specification v0.3.1
+
+The 0.3.0 specification contained a small error. The Result structure's `ip` field should have been renamed to `ips` to be consistent with the IPAM result structure definition; this rename was missed when updating the Result to accommodate multiple IP addresses and interfaces. All first-party CNI plugins (bridge, host-local, etc) were updated to use `ips` (and thus be inconsistent with the 0.3.0 specification) and most other plugins have not been updated to the 0.3.0 specification yet, so few (if any) users should be impacted by this change.
+
+The 0.3.1 specification corrects the Result structure to use the `ips` field name as originally intended.  This is the only change between 0.3.0 and 0.3.1.
+
+# How to upgrade to CNI Specification v0.3.0
+
+Version 0.3.0 of the [CNI Specification](../SPEC.md) provides rich information
+about container network configuration, including details of network interfaces
+and support for multiple IP addresses.
+
+To support this new data, the specification changed in a couple significant
+ways that will impact CNI users, plugin authors, and runtime authors.
+
+This document provides guidance for how to upgrade:
+
+- [For CNI Users](#for-cni-users)
+- [For Plugin Authors](#for-plugin-authors)
+- [For Runtime Authors](#for-runtime-authors)
+
+**Note**: the CNI Spec is versioned independently from the GitHub releases
+for this repo.  For example, Release v0.4.0 supports Spec version v0.2.0,
+and Release v0.5.0 supports Spec v0.3.0.
+
+----
+
+## For CNI Users
+If you maintain CNI configuration files for a container runtime that uses CNI,
+ensure that the configuration files specify a `cniVersion` field and that the
+version there is supported by your container runtime and CNI plugins.
+Configuration files without a version field should be given version 0.2.0. 
+The CNI spec includes example configuration files for 
+[single plugins](https://github.com/containernetworking/cni/blob/master/SPEC.md#example-configurations)
+and for [lists of chained plugins](https://github.com/containernetworking/cni/blob/master/SPEC.md#example-configurations).
+
+Consult the documentation for your runtime and plugins to determine what
+CNI spec versions they support. Test any plugin upgrades before deploying to 
+production. You may find [cnitool](https://github.com/containernetworking/cni/tree/master/cnitool)
+useful. Specifically, your configuration version should be the lowest common
+version supported by your plugins.
+
+## For Plugin Authors
+This section provides guidance for upgrading plugins to CNI Spec Version 0.3.0.
+
+### General guidance for all plugins (language agnostic)
+To provide the smoothest upgrade path, **existing plugins should support
+multiple versions of the CNI spec**.  In particular, plugins with existing
+installed bases should add support for CNI spec version 0.3.0 while maintaining
+compatibility with older versions.
+
+To do this, two changes are required.  First, a plugin should advertise which
+CNI spec versions it supports.  It does this by responding to the `VERSION`
+command with the following JSON data:
+
+```json
+{
+  "cniVersion": "0.3.0",
+  "supportedVersions": [ "0.1.0", "0.2.0", "0.3.0" ]
+}
+```
+
+Second, for the `ADD` command, a plugin must respect the `cniVersion` field
+provided in the [network configuration JSON](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration). 
+That field is a request for the plugin to return results of a particular format:
+
+- If the `cniVersion` field is not present, then spec v0.2.0 should be assumed
+	and v0.2.0 format result JSON returned.
+
+- If the plugin doesn't support the version, the plugin must error.
+
+- Otherwise, the plugin must return a [CNI Result](https://github.com/containernetworking/cni/blob/master/SPEC.md#result)
+	in the format requested.
+
+Result formats for older CNI spec versions are available in the
+[git history for SPEC.md](https://github.com/containernetworking/cni/commits/master/SPEC.md).
+
+For example, suppose a plugin, via its `VERSION` response, advertises CNI specification
+support for v0.2.0 and v0.3.0.  When it receives `cniVersion` key of `0.2.0`,
+the plugin must return result JSON conforming to CNI spec version 0.2.0.
+
+### Specific guidance for plugins written in Go
+Plugins written in Go may leverage the Go language packages in this repository
+to ease the process of upgrading and supporting multiple versions.  CNI 
+[Library and Plugins Release v0.5.0](https://github.com/containernetworking/cni/releases)
+includes important changes to the Golang APIs.  Plugins using these APIs will
+require some changes now, but should more-easily handle spec changes and
+new features going forward.
+
+For plugin authors, the biggest change is that `types.Result` is now an
+interface implemented by concrete struct types in the `types/current` and
+`types/020` subpackages.
+
+Internally, plugins should use the `types/current` structs, and convert
+to or from specific versions when required.  A typical plugin will only need
+to do a single conversion.  That is when it is about to complete and needs to
+print the result JSON in the correct format to stdout.  The library
+function `types.PrintResult()` simplifies this by converting and printing in
+a single call.
+
+Additionally, the plugin should advertise which CNI Spec versions it supports
+via the 3rd argument to `skel.PluginMain()`.
+
+Here is some example code
+
+```go
+import (
+	 "github.com/containernetworking/cni/pkg/skel"
+	 "github.com/containernetworking/cni/pkg/types"
+	 "github.com/containernetworking/cni/pkg/types/current"
+	 "github.com/containernetworking/cni/pkg/version"
+)
+
+func cmdAdd(args *skel.CmdArgs) error {
+	// determine spec version to use
+	var netConf struct {
+		types.NetConf
+		// other plugin-specific configuration goes here
+	}
+	err := json.Unmarshal(args.StdinData, &netConf)
+	cniVersion := netConf.CNIVersion
+
+	// plugin does its work...
+	//   set up interfaces
+	//   assign addresses, etc
+	
+	// construct the result
+	result := &current.Result{
+		Interfaces: []*current.Interface{ ... },
+		IPs: []*current.IPs{ ... },
+		...
+	}
+	
+	// print result to stdout, in the format defined by the requested cniVersion
+	return types.PrintResult(result, cniVersion)
+}
+
+func main() {
+	skel.PluginMain(cmdAdd, cmdDel, version.PluginSupports("0.1.0", "0.2.0", "0.3.0"))
+}
+```
+
+Alternately, to use the result from a delegated IPAM plugin, the `result`
+value might be formed like this:
+
+```go
+ipamResult, err := ipam.ExecAdd(netConf.IPAM.Type, args.StdinData)
+result, err := current.NewResultFromResult(ipamResult)
+```
+
+Other examples of spec v0.3.0-compatible plugins are the
+[main plugins in this repo](https://github.com/containernetworking/cni/tree/master/plugins/main)
+
+
+## For Runtime Authors
+
+This section provides guidance for upgrading container runtimes to support
+CNI Spec Version 0.3.0.
+
+### General guidance for all runtimes (language agnostic)
+
+#### Support multiple CNI spec versions
+To provide the smoothest upgrade path and support the broadest range of CNI
+plugins, **container runtimes should support multiple versions of the CNI spec**.
+In particular, runtimes with existing installed bases should add support for CNI
+spec version 0.3.0 while maintaining compatibility with older versions.
+
+To support multiple versions of the CNI spec, runtimes should be able to
+call both new and legacy plugins, and handle the results from either.
+
+When calling a plugin, the runtime must request that the plugin respond in a
+particular format by specifying the `cniVersion` field in the
+[Network Configuration](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration)
+JSON block.  The plugin will then respond with
+a [Result](https://github.com/containernetworking/cni/blob/master/SPEC.md#result)
+in the format defined by that CNI spec version, and the runtime must parse
+and handle this result.
+
+#### Handle errors due to version incompatibility
+Plugins may respond with error indicating that they don't support the requested
+CNI version (see [Well-known Error Codes](https://github.com/containernetworking/cni/blob/master/SPEC.md#well-known-error-codes)),
+e.g.
+```json
+{
+  "cniVersion": "0.2.0",
+  "code": 1,
+  "msg": "CNI version not supported"
+}
+```
+In that case, the runtime may retry with a lower CNI spec version, or take
+some other action.
+
+#### (optional) Discover plugin version support
+Runtimes may discover which CNI spec versions are supported by a plugin, by
+calling the plugin with the `VERSION` command.  The `VERSION` command was
+added in CNI spec v0.2.0, so older plugins may not respect it.  In the absence
+of a successful response to `VERSION`, assume that the plugin only supports
+CNI spec v0.1.0.
+
+#### Handle missing data in v0.3.0 results
+The Result for the `ADD` command in CNI spec version 0.3.0 includes a new field
+`interfaces`.  An IP address in the `ip` field may describe which interface
+it is assigned to, by placing a numeric index in the `interface` subfield.
+
+However, some plugins which are v0.3.0 compatible may nonetheless omit the
+`interfaces` field and/or set the `interface` index value to `-1`.  Runtimes
+should gracefully handle this situation, unless they have good reason to rely
+on the existence of the interface data.  In that case, provide the user an
+error message that helps diagnose the issue.
+
+### Specific guidance for container runtimes written in Go
+Container runtimes written in Go may leverage the Go language packages in this
+repository to ease the process of upgrading and supporting multiple versions.
+CNI [Library and Plugins Release v0.5.0](https://github.com/containernetworking/cni/releases)
+includes important changes to the Golang APIs.  Runtimes using these APIs will
+require some changes now, but should more-easily handle spec changes and
+new features going forward.
+
+For runtimes, the biggest changes to the Go libraries are in the `types` package.
+It has been refactored to make working with versioned results simpler. The top-level 
+`types.Result` is now an opaque interface instead of a struct, and APIs exposed by
+other packages, such as the high-level `libcni` package, have been updated to use 
+this interface.  Concrete types are now per-version subpackages. The `types/current`
+subpackage contains the latest (spec v0.3.0) types.
+
+When up-converting older result types to spec v0.3.0, fields new in
+spec v0.3.0 (like `interfaces`) may be empty.  Conversely, when
+down-converting v0.3.0 results to an older version, any data in those fields
+will be lost.
+
+| From   | 0.1 | 0.2 | 0.3 |
+|--------|-----|-----|-----|
+| To 0.1 |  ✔  |  ✔  |  x  |
+| To 0.2 |  ✔  |  ✔  |  x  |
+| To 0.3 |  ✴  |  ✴  |  ✔  |
+
+
+Key:
+> ✔ : lossless conversion <br>
+> ✴ : higher-version output may have empty fields <br>
+> x : lower-version output is missing some data <br>
+
+
+
+A container runtime should use `current.NewResultFromResult()` to convert the
+opaque  `types.Result` to a concrete `current.Result` struct.  It may then
+work with the fields exposed by that struct:
+
+```go
+// runtime invokes the plugin to get the opaque types.Result
+// this may conform to any CNI spec version
+resultInterface, err := libcni.AddNetwork(netConf, runtimeConf)
+
+// upconvert result to the current 0.3.0 spec
+result, err := current.NewResultFromResult(resultInterface)
+
+// use the result fields ....
+for _, ip := range result.IPs { ... }
+```
diff --git a/vendor/github.com/containernetworking/cni/GOVERNANCE.md b/vendor/github.com/containernetworking/cni/GOVERNANCE.md
new file mode 100644
index 0000000000..b517630a2f
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/GOVERNANCE.md
@@ -0,0 +1,44 @@
+# CNI Governance
+
+This document defines project governance for the project.
+
+## Voting
+
+The CNI project employs "organization voting" to ensure no single organization can dominate the project.
+
+Individuals not associated with or employed by a company or organization are allowed one organization vote.
+Each company or organization (regardless of the number of maintainers associated with or employed by that company/organization) receives one organization vote.
+
+In other words, if two maintainers are employed by Company X, two by Company Y, two by Company Z, and one maintainer is an un-affiliated individual, a total of four "organization votes" are possible; one for X, one for Y, one for Z, and one for the un-affiliated individual.
+
+Any maintainer from an organization may cast the vote for that organization.
+
+For formal votes, a specific statement of what is being voted on should be added to the relevant github issue or PR, and a link to that issue or PR added to the maintainers meeting agenda document.
+Maintainers should indicate their yes/no vote on that issue or PR, and after a suitable period of time, the votes will be tallied and the outcome noted.
+
+## Changes in Maintainership
+
+New maintainers are proposed by an existing maintainer and are elected by a 2/3 majority organization vote.
+
+Maintainers can be removed by a 2/3 majority organization vote.
+
+## Approving PRs
+
+Non-specification-related PRs may be merged after receiving at least two organization votes.
+
+Changes to the CNI Specification also follow the normal PR approval process (eg, 2 organization votes), but any maintainer can request that the approval require a 2/3 majority organization vote.
+
+## Github Project Administration
+
+Maintainers will be added to the containernetworking GitHub organization and added to the GitHub cni-maintainers team, and made a GitHub maintainer of that team.
+
+After 6 months a maintainer will be made an "owner" of the GitHub organization.
+
+## Changes in Governance
+
+All changes in Governance require a 2/3 majority organization vote.
+
+## Other Changes
+
+Unless specified above, all other changes to the project require a 2/3 majority organization vote.
+Additionally, any maintainer may request that any change require a 2/3 majority organization vote.
diff --git a/vendor/github.com/containernetworking/cni/MAINTAINERS b/vendor/github.com/containernetworking/cni/MAINTAINERS
new file mode 100644
index 0000000000..ca7962afd7
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/MAINTAINERS
@@ -0,0 +1,6 @@
+Bryan Boreham <bryan@weave.works> (@bboreham)
+Casey Callendrello <casey.callendrello@coreos.com> (@squeed)
+Dan Williams <dcbw@redhat.com> (@dcbw)
+Gabe Rosenhouse <grosenhouse@pivotal.io> (@rosenhouse)
+Matt Dupre <matt@tigera.io> (@matthewdupre)
+Stefan Junker <stefan.junker@coreos.com> (@steveeJ)
diff --git a/vendor/github.com/containernetworking/cni/README.md b/vendor/github.com/containernetworking/cni/README.md
new file mode 100644
index 0000000000..65ccda9f9f
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/README.md
@@ -0,0 +1,198 @@
+[![Linux Build Status](https://travis-ci.org/containernetworking/cni.svg?branch=master)](https://travis-ci.org/containernetworking/cni)
+[![Windows Build Status](https://ci.appveyor.com/api/projects/status/wtrkou8oow7x533e/branch/master?svg=true)](https://ci.appveyor.com/project/cni-bot/cni/branch/master)
+[![Coverage Status](https://coveralls.io/repos/github/containernetworking/cni/badge.svg?branch=master)](https://coveralls.io/github/containernetworking/cni?branch=master)
+[![Slack Status](https://cryptic-tundra-43194.herokuapp.com/badge.svg)](https://cryptic-tundra-43194.herokuapp.com/)
+
+![CNI Logo](logo.png)
+
+---
+
+# Community Sync Meeting
+
+There is a community sync meeting for users and developers every 1-2 months. The next meeting will help on a Google Hangout and the link is in the [agenda](https://docs.google.com/document/d/10ECyT2mBGewsJUcmYmS8QNo1AcNgy2ZIe2xS7lShYhE/edit?usp=sharing) (Notes from previous meeting are also in this doc). 
+
+The next meeting will be held on *Wednesday, October 4th* at *3:00pm UTC / 11:00am EDT / 8:00am PDT* [Add to Calendar](https://www.worldtimebuddy.com/?qm=1&lid=100,5,2643743,5391959&h=100&date=2017-10-04&sln=15-16).
+
+---
+
+# CNI - the Container Network Interface
+
+## What is CNI?
+
+CNI (_Container Network Interface_), a [Cloud Native Computing Foundation](https://cncf.io) project, consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins.
+CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
+Because of this focus, CNI has a wide range of support and the specification is simple to implement.
+
+As well as the [specification](SPEC.md), this repository contains the Go source code of a [library for integrating CNI into applications](libcni) and an [example command-line tool](cnitool) for executing CNI plugins.  A [separate repository contains reference plugins](https://github.com/containernetworking/plugins) and a template for making new plugins.
+
+The template code makes it straight-forward to create a CNI plugin for an existing container networking project.
+CNI also makes a good framework for creating a new container networking project from scratch.
+
+## Why develop CNI?
+
+Application containers on Linux are a rapidly evolving area, and within this area networking is not well addressed as it is highly environment-specific.
+We believe that many container runtimes and orchestrators will seek to solve the same problem of making the network layer pluggable.
+
+To avoid duplication, we think it is prudent to define a common interface between the network plugins and container execution: hence we put forward this specification, along with libraries for Go and a set of plugins.
+
+## Who is using CNI?
+### Container runtimes
+- [rkt - container engine](https://coreos.com/blog/rkt-cni-networking.html)
+- [Kubernetes - a system to simplify container operations](http://kubernetes.io/docs/admin/network-plugins/)
+- [OpenShift - Kubernetes with additional enterprise features](https://github.com/openshift/origin/blob/master/docs/openshift_networking_requirements.md)
+- [Cloud Foundry - a platform for cloud applications](https://github.com/cloudfoundry-incubator/cf-networking-release)
+- [Apache Mesos - a distributed systems kernel](https://github.com/apache/mesos/blob/master/docs/cni.md)
+- [Amazon ECS - a highly scalable, high performance container management service](https://aws.amazon.com/ecs/)
+
+### 3rd party plugins
+- [Project Calico - a layer 3 virtual network](https://github.com/projectcalico/calico-cni)
+- [Weave - a multi-host Docker network](https://github.com/weaveworks/weave)
+- [Contiv Networking - policy networking for various use cases](https://github.com/contiv/netplugin)
+- [SR-IOV](https://github.com/hustcat/sriov-cni)
+- [Cilium - BPF & XDP for containers](https://github.com/cilium/cilium)
+- [Infoblox - enterprise IP address management for containers](https://github.com/infobloxopen/cni-infoblox)
+- [Multus - a Multi plugin](https://github.com/Intel-Corp/multus-cni)
+- [Romana - Layer 3 CNI plugin supporting network policy for Kubernetes](https://github.com/romana/kube)
+- [CNI-Genie - generic CNI network plugin](https://github.com/Huawei-PaaS/CNI-Genie)
+- [Nuage CNI - Nuage Networks SDN plugin for network policy kubernetes support ](https://github.com/nuagenetworks/nuage-cni)
+- [Silk - a CNI plugin designed for Cloud Foundry](https://github.com/cloudfoundry-incubator/silk)
+- [Linen - a CNI plugin designed for overlay networks with Open vSwitch and fit in SDN/OpenFlow network environment](https://github.com/John-Lin/linen-cni)
+- [Vhostuser - a Dataplane network plugin - Supports OVS-DPDK & VPP](https://github.com/intel/vhost-user-net-plugin)
+- [Amazon ECS CNI Plugins - a collection of CNI Plugins to configure containers with Amazon EC2 elastic network interfaces (ENIs)](https://github.com/aws/amazon-ecs-cni-plugins)
+- [Bonding CNI - a Link aggregating plugin to address failover and high availability network](https://github.com/Intel-Corp/bond-cni)
+- [ovn-kubernetes - an container network plugin built on Open vSwitch (OVS) and Open Virtual Networking (OVN) with support for both Linux and Windows](https://github.com/openvswitch/ovn-kubernetes)
+
+The CNI team also maintains some [core plugins in a separate repository](https://github.com/containernetworking/plugins).
+
+
+## Contributing to CNI
+
+We welcome contributions, including [bug reports](https://github.com/containernetworking/cni/issues), and code and documentation improvements.
+If you intend to contribute to code or documentation, please read [CONTRIBUTING.md](CONTRIBUTING.md). Also see the [contact section](#contact) in this README.
+
+## How do I use CNI?
+
+### Requirements
+
+The CNI spec is language agnostic.  To use the Go language libraries in this repository, you'll need a recent version of Go.  Our [automated tests](https://travis-ci.org/containernetworking/cni/builds) cover Go versions 1.7 and 1.8.
+
+### Reference Plugins
+
+The CNI project maintains a set of [reference plugins](https://github.com/containernetworking/plugins) that implement the CNI specification.
+NOTE: the reference plugins used to live in this repository but have been split out into a [separate repository](https://github.com/containernetworking/plugins) as of May 2017.
+
+### Running the plugins
+
+After building and installing the [reference plugins](https://github.com/containernetworking/plugins), you can use the `priv-net-run.sh` and `docker-run.sh` scripts in the `scripts/` directory to exercise the plugins.
+
+**note - priv-net-run.sh depends on `jq`**
+
+Start out by creating a netconf file to describe a network:
+
+```bash
+$ mkdir -p /etc/cni/net.d
+$ cat >/etc/cni/net.d/10-mynet.conf <<EOF
+{
+	"cniVersion": "0.2.0",
+	"name": "mynet",
+	"type": "bridge",
+	"bridge": "cni0",
+	"isGateway": true,
+	"ipMasq": true,
+	"ipam": {
+		"type": "host-local",
+		"subnet": "10.22.0.0/16",
+		"routes": [
+			{ "dst": "0.0.0.0/0" }
+		]
+	}
+}
+EOF
+$ cat >/etc/cni/net.d/99-loopback.conf <<EOF
+{
+	"cniVersion": "0.2.0",
+	"type": "loopback"
+}
+EOF
+```
+
+The directory `/etc/cni/net.d` is the default location in which the scripts will look for net configurations.
+
+Next, build the plugins:
+
+```bash
+$ cd $GOPATH/src/github.com/containernetworking/plugins
+$ ./build.sh
+```
+
+Finally, execute a command (`ifconfig` in this example) in a private network namespace that has joined the `mynet` network:
+
+```bash
+$ CNI_PATH=$GOPATH/src/github.com/containernetworking/plugins/bin
+$ cd $GOPATH/src/github.com/containernetworking/cni/scripts
+$ sudo CNI_PATH=$CNI_PATH ./priv-net-run.sh ifconfig
+eth0      Link encap:Ethernet  HWaddr f2:c2:6f:54:b8:2b  
+          inet addr:10.22.0.2  Bcast:0.0.0.0  Mask:255.255.0.0
+          inet6 addr: fe80::f0c2:6fff:fe54:b82b/64 Scope:Link
+          UP BROADCAST MULTICAST  MTU:1500  Metric:1
+          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
+          TX packets:0 errors:0 dropped:1 overruns:0 carrier:0
+          collisions:0 txqueuelen:0
+          RX bytes:90 (90.0 B)  TX bytes:0 (0.0 B)
+
+lo        Link encap:Local Loopback  
+          inet addr:127.0.0.1  Mask:255.0.0.0
+          inet6 addr: ::1/128 Scope:Host
+          UP LOOPBACK RUNNING  MTU:65536  Metric:1
+          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
+          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
+          collisions:0 txqueuelen:0
+          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
+```
+
+The environment variable `CNI_PATH` tells the scripts and library where to look for plugin executables.
+
+## Running a Docker container with network namespace set up by CNI plugins
+
+Use the instructions in the previous section to define a netconf and build the plugins.
+Next, docker-run.sh script wraps `docker run`, to execute the plugins prior to entering the container:
+
+```bash
+$ CNI_PATH=$GOPATH/src/github.com/containernetworking/plugins/bin
+$ cd $GOPATH/src/github.com/containernetworking/cni/scripts
+$ sudo CNI_PATH=$CNI_PATH ./docker-run.sh --rm busybox:latest ifconfig
+eth0      Link encap:Ethernet  HWaddr fa:60:70:aa:07:d1  
+          inet addr:10.22.0.2  Bcast:0.0.0.0  Mask:255.255.0.0
+          inet6 addr: fe80::f860:70ff:feaa:7d1/64 Scope:Link
+          UP BROADCAST MULTICAST  MTU:1500  Metric:1
+          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
+          TX packets:0 errors:0 dropped:1 overruns:0 carrier:0
+          collisions:0 txqueuelen:0
+          RX bytes:90 (90.0 B)  TX bytes:0 (0.0 B)
+
+lo        Link encap:Local Loopback  
+          inet addr:127.0.0.1  Mask:255.0.0.0
+          inet6 addr: ::1/128 Scope:Host
+          UP LOOPBACK RUNNING  MTU:65536  Metric:1
+          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
+          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
+          collisions:0 txqueuelen:0
+          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
+```
+
+## What might CNI do in the future?
+
+CNI currently covers a wide range of needs for network configuration due to it simple model and API.
+However, in the future CNI might want to branch out into other directions:
+
+- Dynamic updates to existing network configuration
+- Dynamic policies for network bandwidth and firewall rules
+
+If these topics of are interest, please contact the team via the mailing list or IRC and find some like-minded people in the community to put a proposal together.
+
+## Contact
+
+For any questions about CNI, please reach out on the mailing list:
+- Email: [cni-dev](https://groups.google.com/forum/#!forum/cni-dev)
+- IRC: #[containernetworking](irc://irc.freenode.org:6667/#containernetworking) channel on freenode.org
+- Slack: [containernetworking.slack.com](https://cryptic-tundra-43194.herokuapp.com)
diff --git a/vendor/github.com/containernetworking/cni/RELEASING.md b/vendor/github.com/containernetworking/cni/RELEASING.md
new file mode 100644
index 0000000000..dd1b7a94f8
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/RELEASING.md
@@ -0,0 +1,34 @@
+# Release process
+
+## Resulting artifacts
+Creating a new release produces the following artifacts:
+
+- Binaries (stored in the `release-<TAG>` directory) :
+  - `cni-<PLATFORM>-<VERSION>.tgz` binaries
+  - `cni-<VERSION>.tgz` binary (copy of amd64 platform binary)
+  - `sha1`, `sha256` and `sha512` files for the above files.
+
+## Preparing for a release
+1. Releases are performed by maintainers and should usually be discussed and planned at a maintainer meeting.
+  - Choose the version number. It should be prefixed with `v`, e.g. `v1.2.3`
+  - Take a quick scan through the PRs and issues to make sure there isn't anything crucial that _must_ be in the next release.
+  - Create a draft of the release note
+  - Discuss the level of testing that's needed and create a test plan if sensible
+  - Check what version of `go` is used in the build container, updating it if there's a new stable release.
+
+## Creating the release artifacts
+1. Make sure you are on the master branch and don't have any local uncommitted changes.
+1. Create a signed tag for the release `git tag -s $VERSION` (Ensure that GPG keys are created and added to GitHub)
+1. Run the release script from the root of the repository
+  - `scripts/release.sh`
+  - The script requires Docker and ensures that a consistent environment is used.
+  - The artifacts will now be present in the `release-<TAG>` directory.
+1. Test these binaries according to the test plan.
+
+## Publishing the release
+1. Push the tag to git `git push origin <TAG>`
+1. Create a release on Github, using the tag which was just pushed.
+1. Attach all the artifacts from the release directory.
+1. Add the release note to the release.
+1. Announce the release on at least the CNI mailing, IRC and Slack.
+
diff --git a/vendor/github.com/containernetworking/cni/ROADMAP.md b/vendor/github.com/containernetworking/cni/ROADMAP.md
new file mode 100644
index 0000000000..ec5f3c1508
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/ROADMAP.md
@@ -0,0 +1,23 @@
+# CNI Roadmap
+
+This document defines a high level roadmap for CNI development.
+The list below is not complete, and we advise to get the current project state from the [milestones defined in GitHub](https://github.com/containernetworking/cni/milestones).
+
+## CNI Milestones
+
+### [v0.6.0](https://github.com/containernetworking/cni/milestones/v0.6.0)
+
+- Plugin composition functionality
+- IPv6 support
+- Strategy and tooling for backwards compatibility
+- Integrate build artefact generation with CI
+
+### [v1.0.0](https://github.com/containernetworking/cni/milestones/v1.0.0)
+
+- More precise specification language
+- GET action
+- Conformance test suite for CNI plugins (both reference and 3rd party)
+- Stable SPEC
+- Complete test coverage
+- Signed release binaries
+
diff --git a/vendor/github.com/containernetworking/cni/SPEC.md b/vendor/github.com/containernetworking/cni/SPEC.md
new file mode 100644
index 0000000000..d27d859ea5
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/SPEC.md
@@ -0,0 +1,739 @@
+# Container Network Interface Specification
+
+## Version
+This is CNI **spec** version **0.4.0-dev**. This spec contains **unreleased** changes.
+
+Note that this is **independent from the version of the CNI library and plugins** in this repository (e.g. the versions of [releases](https://github.com/containernetworking/cni/releases)).
+
+#### Released versions
+Released versions of the spec are available as Git tags.
+
+| tag                                                                                  | spec permalink                                                                        | major changes                     |
+| ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | --------------------------------- |
+| [`spec-v0.3.1`](https://github.com/containernetworking/cni/releases/tag/spec-v0.3.1) | [spec at v0.3.1](https://github.com/containernetworking/cni/blob/spec-v0.3.1/SPEC.md) | none (typo fix only)              |
+| [`spec-v0.3.0`](https://github.com/containernetworking/cni/releases/tag/spec-v0.3.0) | [spec at v0.3.0](https://github.com/containernetworking/cni/blob/spec-v0.3.0/SPEC.md) | rich result type, plugin chaining |
+| [`spec-v0.2.0`](https://github.com/containernetworking/cni/releases/tag/spec-v0.2.0) | [spec at v0.2.0](https://github.com/containernetworking/cni/blob/spec-v0.2.0/SPEC.md) | VERSION command                   |
+| [`spec-v0.1.0`](https://github.com/containernetworking/cni/releases/tag/spec-v0.1.0) | [spec at v0.1.0](https://github.com/containernetworking/cni/blob/spec-v0.1.0/SPEC.md) | initial version                   |
+
+*Do not rely on these tags being stable.  In the future, we may change our mind about which particular commit is the right marker for a given historical spec version.*
+
+
+## Overview
+
+This document proposes a generic plugin-based networking solution for application containers on Linux, the _Container Networking Interface_, or _CNI_.
+It is derived from the [rkt Networking Proposal][rkt-networking-proposal], which aimed to satisfy many of the [design considerations][rkt-networking-design] for networking in [rkt][rkt-github].
+
+For the purposes of this proposal, we define two terms very specifically:
+- _container_ can be considered synonymous with a [Linux _network namespace_][namespaces]. What unit this corresponds to depends on a particular container runtime implementation: for example, in implementations of the [App Container Spec][appc-github] like rkt, each _pod_ runs in a unique network namespace. In [Docker][docker], on the other hand, network namespaces generally exist for each separate Docker container.
+- _network_ refers to a group of entities that are uniquely addressable that can communicate amongst each other. This could be either an individual container (as specified above), a machine, or some other network device (e.g. a router). Containers can be conceptually _added to_ or _removed from_ one or more networks.
+
+This document aims to specify the interface between "runtimes" and "plugins". Whilst there are certain well known fields, runtimes may wish to pass additional information to plugins. These extentions are not part of this specification but are documented as [conventions](CONVENTIONS.md). The key words "must", "must not", "required", "shall", "shall not", "should", "should not", "recommended", "may" and "optional" are used as specified in [RFC 2119][rfc-2119].
+
+[rkt-networking-proposal]: https://docs.google.com/a/coreos.com/document/d/1PUeV68q9muEmkHmRuW10HQ6cHgd4819_67pIxDRVNlM/edit#heading=h.ievko3xsjwxd
+[rkt-networking-design]: 
+https://docs.google.com/a/coreos.com/document/d/1CTAL4gwqRofjxyp4tTkbgHtAwb2YCcP14UEbHNizd8g
+[rkt-github]: https://github.com/coreos/rkt
+[namespaces]: http://man7.org/linux/man-pages/man7/namespaces.7.html 
+[appc-github]: https://github.com/appc/spec
+[docker]: https://docker.com
+[rfc-2119]: https://www.ietf.org/rfc/rfc2119.txt
+
+## General considerations
+
+- The container runtime must create a new network namespace for the container before invoking any plugins.
+- The runtime must then determine which networks this container should belong to, and for each network, which plugins must be executed.
+- The network configuration is in JSON format and can easily be stored in a file. The network configuration includes mandatory fields such as "name" and "type" as well as plugin (type) specific ones. The network configuration allows for fields to change values between invocations. For this purpose there is an optional field "args" which must contain the varying information.
+- The container runtime must add the container to each network by executing the corresponding plugins for each network sequentially.
+- Upon completion of the container lifecycle, the runtime must execute the plugins in reverse order (relative to the order in which they were executed to add the container) to disconnect the container from the networks.
+- The container runtime must not invoke parallel operations for the same container, but is allowed to invoke parallel operations for different containers.
+- The container runtime must order ADD and DEL operations for a container, such that ADD is always eventually followed by a corresponding DEL. DEL may be followed by additional DELs but plugins should handle multiple DELs permissively (i.e. plugin DEL should be idempotent).
+- A container must be uniquely identified by a ContainerID. Plugins that store state should do so using a primary key of `(network name, CNI_CONTAINERID, CNI_IFNAME)`.
+- A runtime must not call ADD twice (without a corresponding DEL) for the same `(network name, container id, name of the interface inside the container)`. This implies that a given container ID may be added to a specific network more than once only if each addition is done with a different interface name.
+
+## CNI Plugin
+
+### Overview
+
+Each CNI plugin must be implemented as an executable that is invoked by the container management system (e.g. rkt or Kubernetes).
+
+A CNI plugin is responsible for inserting a network interface into the container network namespace (e.g. one end of a veth pair) and making any necessary changes on the host (e.g. attaching the other end of the veth into a bridge).
+It should then assign the IP to the interface and setup the routes consistent with the IP Address Management section by invoking appropriate IPAM plugin.
+
+### Parameters
+
+The operations that CNI plugins must support are:
+
+- `ADD`: Add container to network
+  - Parameters:
+    - **Container ID**. A unique plaintext identifier for a container, allocated by the runtime. Must not be empty.
+    - **Network namespace path**. This represents the path to the network namespace to be added, i.e. /proc/[pid]/ns/net or a bind-mount/link to it.
+    - **Network configuration**. This is a JSON document describing a network to which a container can be joined. The schema is described below.
+    - **Extra arguments**. This provides an alternative mechanism to allow simple configuration of CNI plugins on a per-container basis.
+    - **Name of the interface inside the container**. This is the name that should be assigned to the interface created inside the container (network namespace); consequently it must comply with the standard Linux restrictions on interface names.
+  - Result:
+    - **Interfaces list**. Depending on the plugin, this can include the sandbox (eg, container or hypervisor) interface name and/or the host interface name, the hardware addresses of each interface, and details about the sandbox (if any) the interface is in.
+    - **IP configuration assigned to each interface**. The IPv4 and/or IPv6 addresses, gateways, and routes assigned to sandbox and/or host interfaces.
+    - **DNS information**. Dictionary that includes DNS information for nameservers, domain, search domains and options.
+
+- `DEL`: Delete container from network
+  - Parameters:
+    - **Container ID**, as defined above.
+    - **Network namespace path**, as defined above.
+    - **Network configuration**, as defined above.
+    - **Extra arguments**, as defined above.
+    - **Name of the interface inside the container**, as defined above.
+  - All parameters should be the same as those passed to the corresponding add operation.
+  - A delete operation should release all resources held by the supplied containerid in the configured network.
+  - If there was a known previous `ADD` or `GET` action for the container, the runtime MUST add a `prevResult` field to the configuration JSON of the plugin (or all plugins in a chain), which MUST be the `Result` of the immediately previous `ADD` or `GET` action in JSON format ([see below](#network-configuration-list-runtime-examples)).
+  - When `CNI_NETNS` and/or `prevResult` are not provided, the plugin should clean up as many resources as possible (e.g. releasing IPAM allocations) and return a successful response.
+  - If the runtime cached the `Result` of a previous `ADD` or `GET` response for a given container, it must delete that cached response on a successful `DEL` for that container.
+
+- `GET`: Get container network configuration
+  - Parameters:
+    - **Container ID**, as defined for `ADD`.
+    - **Network namespace path**, as defined for `ADD`.
+    - **Network configuration**, as defined for `ADD`.
+    - **Extra arguments**, as defined for `ADD`.
+    - **Name of the interface inside the container**, as defined for `ADD`.
+  - Result:
+    - The plugin should return the same result as an `ADD` action for the same inputs.
+    - **Interfaces list**, as defined for `ADD`
+    - **IP configuration assigned to each interface**, as defined for `ADD`
+    - **DNS information**, as defined for `ADD`
+  - This action should return the same `Result` object as an `ADD` action for the same inputs. The result should not change over the lifetime of the container.
+  - The plugin should return an error if any general internal state is unexpected. For example, if the plugin's data storage is missing or corrupt, or its control plane is unavailable, it should return an error.
+  - The plugin should NOT return an error if its expected sandbox state (eg interfaces, IP addresses, routes, etc) is not found, as subsequent elements in the plugin's chain may alter sandbox state.
+  - A runtime may call `GET` at any time; but if `GET` is called for a container before an `ADD` or after a `DEL` for that container, the plugin should return error 3 to indicate the container is unknown (see [Well-known Error Codes](#well-known-error-codes) section).
+  - If the previous action for the container was `ADD` or `GET`, the runtime must add a `prevResult` field to the configuration JSON of the plugin (or all plugins in the chain), which must be the `Result` of that previous `ADD` or `GET` action in JSON format ([see below](#network-configuration-list-runtime-examples)).
+
+- `VERSION`: Report version
+  - Parameters: NONE.
+  - Result: information about the CNI spec versions supported by the plugin
+
+      ```
+      {
+        "cniVersion": "0.4.0", // the version of the CNI spec in use for this output
+        "supportedVersions": [ "0.1.0", "0.2.0", "0.3.0", "0.3.1", "0.4.0" ] // the list of CNI spec versions that this plugin supports
+      }
+      ```
+
+Runtimes must use the type of network (see [Network Configuration](#network-configuration) below) as the name of the executable to invoke.
+Runtimes should then look for this executable in a list of predefined directories (the list of directories is not prescribed by this specification). Once found, it must invoke the executable using the following environment variables for argument passing:
+- `CNI_COMMAND`: indicates the desired operation; `ADD`, `DEL`, `GET`, or `VERSION`.
+- `CNI_CONTAINERID`: Container ID
+- `CNI_NETNS`: Path to network namespace file
+- `CNI_IFNAME`: Interface name to set up; if the plugin is unable to use this interface name it must return an error
+- `CNI_ARGS`: Extra arguments passed in by the user at invocation time. Alphanumeric key-value pairs separated by semicolons; for example, "FOO=BAR;ABC=123"
+- `CNI_PATH`: List of paths to search for CNI plugin executables. Paths are separated by an OS-specific list separator; for example ':' on Linux and ';' on Windows
+
+Network configuration in JSON format must be streamed to the plugin through stdin. This means it is not tied to a particular file on disk and may contain information which changes between invocations.
+
+
+### Result
+
+Note that IPAM plugins should return an abbreviated `Result` structure as described in [IP Allocation](#ip-allocation).
+
+Plugins must indicate success with a return code of zero and the following JSON printed to stdout in the case of the ADD command. The `ips` and `dns` items should be the same output as was returned by the IPAM plugin (see [IP Allocation](#ip-allocation) for details) except that the plugin should fill in the `interface` indexes appropriately, which are missing from IPAM plugin output since IPAM plugins should be unaware of interfaces.
+
+```
+{
+  "cniVersion": "0.4.0",
+  "interfaces": [                                            (this key omitted by IPAM plugins)
+      {
+          "name": "<name>",
+          "mac": "<MAC address>",                            (required if L2 addresses are meaningful)
+          "sandbox": "<netns path or hypervisor identifier>" (required for container/hypervisor interfaces, empty/omitted for host interfaces)
+      }
+  ],
+  "ips": [
+      {
+          "version": "<4-or-6>",
+          "address": "<ip-and-prefix-in-CIDR>",
+          "gateway": "<ip-address-of-the-gateway>",          (optional)
+          "interface": <numeric index into 'interfaces' list>
+      },
+      ...
+  ],
+  "routes": [                                                (optional)
+      {
+          "dst": "<ip-and-prefix-in-cidr>",
+          "gw": "<ip-of-next-hop>"                           (optional)
+      },
+      ...
+  ]
+  "dns": {
+    "nameservers": <list-of-nameservers>                     (optional)
+    "domain": <name-of-local-domain>                         (optional)
+    "search": <list-of-additional-search-domains>            (optional)
+    "options": <list-of-options>                             (optional)
+  }
+}
+```
+
+`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the plugin. A plugin may support multiple CNI spec versions (as it reports via the `VERSION` command), here the `cniVersion` returned by the plugin in the result must be consistent with the `cniVersion` specified in [Network Configuration](#network-configuration). If the `cniVersion` in the network configuration is not supported by the plugin, the plugin should return an error code 1 (see [Well-known Error Codes](#well-known-error-codes) for details).
+
+`interfaces` describes specific network interfaces the plugin created.
+If the `CNI_IFNAME` variable exists the plugin must use that name for the sandbox/hypervisor interface or return an error if it cannot.
+- `mac` (string): the hardware address of the interface.
+   If L2 addresses are not meaningful for the plugin then this field is optional.
+- `sandbox` (string): container/namespace-based environments should return the full filesystem path to the network namespace of that sandbox.
+   Hypervisor/VM-based plugins should return an ID unique to the virtualized sandbox the interface was created in.
+   This item must be provided for interfaces created or moved into a sandbox like a network namespace or a hypervisor/VM.
+
+The `ips` field is a list of IP configuration information.
+See the [IP well-known structure](#ips) section for more information.
+
+The `dns` field contains a dictionary consisting of common DNS information.
+See the [DNS well-known structure](#dns) section for more information.
+
+The specification does not declare how this information must be processed by CNI consumers.
+Examples include generating an `/etc/resolv.conf` file to be injected into the container filesystem or running a DNS forwarder on the host.
+
+Errors must be indicated by a non-zero return code and the following JSON being printed to stdout:
+```
+{
+  "cniVersion": "0.4.0",
+  "code": <numeric-error-code>,
+  "msg": <short-error-message>,
+  "details": <long-error-message> (optional)
+}
+```
+
+`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the plugin.
+Error codes 0-99 are reserved for well-known errors (see [Well-known Error Codes](#well-known-error-codes) section).
+Values of 100+ can be freely used for plugin specific errors. 
+
+In addition, stderr can be used for unstructured output such as logs.
+
+### Network Configuration
+
+The network configuration is described in JSON form. The configuration may be stored on disk or generated from other sources by the container runtime. The following fields are well-known and have the following meaning:
+- `cniVersion` (string): [Semantic Version 2.0](http://semver.org) of CNI specification to which this configuration conforms.
+- `name` (string): Network name. This should be unique across all containers on the host (or other administrative domain).
+- `type` (string): Refers to the filename of the CNI plugin executable.
+- `args` (dictionary): Optional additional arguments provided by the container runtime. For example a dictionary of labels could be passed to CNI plugins by adding them to a labels field under `args`.
+- `ipMasq` (boolean): Optional (if supported by the plugin). Set up an IP masquerade on the host for this network. This is necessary if the host will act as a gateway to subnets that are not able to route to the IP assigned to the container.
+- `ipam`: Dictionary with IPAM specific values:
+  - `type` (string): Refers to the filename of the IPAM plugin executable.
+- `dns`: Dictionary with DNS specific values:
+  - `nameservers` (list of strings): list of a priority-ordered list of DNS nameservers that this network is aware of. Each entry in the list is a string containing either an IPv4 or an IPv6 address.
+  - `domain` (string): the local domain used for short hostname lookups.
+  - `search` (list of strings): list of priority ordered search domains for short hostname lookups. Will be preferred over `domain` by most resolvers.
+  - `options` (list of strings): list of options that can be passed to the resolver
+
+Plugins may define additional fields that they accept and may generate an error if called with unknown fields. The exception to this is the `args` field may be used to pass arbitrary data which should be ignored by plugins if not understood.
+
+### Example configurations
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "bridge",
+  // type (plugin) specific
+  "bridge": "cni0",
+  "ipam": {
+    "type": "host-local",
+    // ipam specific
+    "subnet": "10.1.0.0/16",
+    "gateway": "10.1.0.1"
+  },
+  "dns": {
+    "nameservers": [ "10.1.0.1" ]
+  }
+}
+```
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "pci",
+  "type": "ovs",
+  // type (plugin) specific
+  "bridge": "ovs0",
+  "vxlanID": 42,
+  "ipam": {
+    "type": "dhcp",
+    "routes": [ { "dst": "10.3.0.0/16" }, { "dst": "10.4.0.0/16" } ]
+  }
+  // args may be ignored by plugins
+  "args": {
+    "labels" : {
+        "appVersion" : "1.0"
+    }
+  }
+}
+```
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "wan",
+  "type": "macvlan",
+  // ipam specific
+  "ipam": {
+    "type": "dhcp",
+    "routes": [ { "dst": "10.0.0.0/8", "gw": "10.0.0.1" } ]
+  },
+  "dns": {
+    "nameservers": [ "10.0.0.1" ]
+  }
+}
+```
+
+### Network Configuration Lists
+
+Network configuration lists provide a mechanism to run multiple CNI plugins for a single container in a defined order, passing the result of each plugin to the next plugin.
+The list is composed of well-known fields and list of one or more standard CNI network configurations (see above).
+
+The list is described in JSON form, and can be stored on disk or generated from other sources by the container runtime. The following fields are well-known and have the following meaning:
+- `cniVersion` (string): [Semantic Version 2.0](http://semver.org) of CNI specification to which this configuration list and all the individual configurations conform.
+- `name` (string): Network name. This should be unique across all containers on the host (or other administrative domain).
+- `plugins` (list): A list of standard CNI network configuration dictionaries (see above).
+
+When executing a plugin list, the runtime MUST replace the `name` and `cniVersion` fields in each individual network configuration in the list with the `name` and `cniVersion` field of the list itself. This ensures that the name and CNI version is the same for all plugin executions in the list, preventing versioning conflicts between plugins.
+The runtime may also pass capability-based keys as a map in the top-level `runtimeConfig` key of the plugin's config JSON if a plugin advertises it supports a specific capability via the `capabilities` key of its network configuration.  The key passed in `runtimeConfig` MUST match the name of the specific capability from the `capabilities` key of the plugins network configuration. See CONVENTIONS.md for more information on capabilities and how they are sent to plugins via the `runtimeConfig` key.
+
+For the `ADD` action, the runtime MUST also add a `prevResult` field to the configuration JSON of any plugin after the first one, which MUST be the `Result` of the previous plugin (if any) in JSON format ([see below](#network-configuration-list-runtime-examples)).
+For the `GET` and `DEL` actions, the runtime MUST (if available) add a `prevResult` field to the configuration JSON of each plugin, which MUST be the `Result` of the immediately previous `ADD` or `GET` action in JSON format ([see below](#network-configuration-list-runtime-examples)).
+For the `ADD` and `GET` actions, plugins SHOULD echo the contents of the `prevResult` field to their stdout to allow subsequent plugins (and the runtime) to receive the result, unless they wish to modify or suppress a previous result.
+Plugins are allowed to modify or suppress all or part of a `prevResult`.
+However, plugins that support a version of the CNI specification that includes the `prevResult` field MUST handle `prevResult` by either passing it through, modifying it, or suppressing it explicitly.
+It is a violation of this specification to be unaware of the `prevResult` field.
+
+The runtime MUST also execute each plugin in the list with the same environment.
+
+For the DEL action, the runtime MUST execute the plugins in reverse-order.
+
+#### Network Configuration List Error Handling
+
+When an error occurs while executing an action on a plugin list (eg, either ADD or DEL) the runtime MUST stop execution of the list.
+
+If an ADD action fails, when the runtime decides to handle the failure it should execute the DEL action (in reverse order from the ADD as specified above) for all plugins in the list, even if some were not called during the ADD action.
+
+Plugins should generally complete a DEL action without error even if some resources are missing.  For example, an IPAM plugin should generally release an IP allocation and return success even if the container network namespace no longer exists, unless that network namespace is critical for IPAM management. While DHCP may usually send a 'release' message on the container network interface, since DHCP leases have a lifetime this release action would not be considered critical and no error should be returned. For another example, the `bridge` plugin should delegate the DEL action to the IPAM plugin and clean up its own resources (if present) even if the container network namespace and/or container network interface no longer exist.
+
+#### Example network configuration lists
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "plugins": [
+    {
+      "type": "bridge",
+      // type (plugin) specific
+      "bridge": "cni0",
+      // args may be ignored by plugins
+      "args": {
+        "labels" : {
+            "appVersion" : "1.0"
+        }
+      },
+      "ipam": {
+        "type": "host-local",
+        // ipam specific
+        "subnet": "10.1.0.0/16",
+        "gateway": "10.1.0.1"
+      },
+      "dns": {
+        "nameservers": [ "10.1.0.1" ]
+      }
+    },
+    {
+      "type": "tuning",
+      "sysctl": {
+        "net.core.somaxconn": "500"
+      }
+    }
+  ]
+}
+```
+
+#### Network configuration list runtime examples
+
+Given the network configuration list JSON [shown above](#example-network-configuration-lists) the container runtime would perform the following steps for the `ADD` action.
+Note that the runtime adds the `cniVersion` and `name` fields from configuration list to the configuration JSON passed to each plugin, to ensure consistent versioning and names for all plugins in the list.
+
+1) first call the `bridge` plugin with the following JSON:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "bridge",
+  "bridge": "cni0",
+  "args": {
+    "labels" : {
+        "appVersion" : "1.0"
+    }
+  },
+  "ipam": {
+    "type": "host-local",
+    // ipam specific
+    "subnet": "10.1.0.0/16",
+    "gateway": "10.1.0.1"
+  },
+  "dns": {
+    "nameservers": [ "10.1.0.1" ]
+  }
+}
+```
+
+2) next call the `tuning` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `bridge` plugin:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "tuning",
+  "sysctl": {
+    "net.core.somaxconn": "500"
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+Given the same network configuration JSON list, the container runtime would perform the following steps for the `GET` action.
+
+1) first call the `bridge` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `ADD` operation:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "bridge",
+  "bridge": "cni0",
+  "args": {
+    "labels" : {
+        "appVersion" : "1.0"
+    }
+  },
+  "ipam": {
+    "type": "host-local",
+    // ipam specific
+    "subnet": "10.1.0.0/16",
+    "gateway": "10.1.0.1"
+  },
+  "dns": {
+    "nameservers": [ "10.1.0.1" ]
+  }
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+2) next call the `tuning` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `bridge` plugin:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "tuning",
+  "sysctl": {
+    "net.core.somaxconn": "500"
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+Given the same network configuration JSON list, the container runtime would perform the following steps for the DEL action.
+Note that plugins are executed in reverse order from the `ADD` and `GET` actions.
+
+1) first call the `tuning` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `GET` action:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "tuning",
+  "sysctl": {
+    "net.core.somaxconn": "500"
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+2) next call the `bridge` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `GET` action:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "bridge",
+  "bridge": "cni0",
+  "args": {
+    "labels" : {
+        "appVersion" : "1.0"
+    }
+  },
+  "ipam": {
+    "type": "host-local",
+    // ipam specific
+    "subnet": "10.1.0.0/16",
+    "gateway": "10.1.0.1"
+  },
+  "dns": {
+    "nameservers": [ "10.1.0.1" ]
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+### IP Allocation
+
+As part of its operation, a CNI plugin is expected to assign (and maintain) an IP address to the interface and install any necessary routes relevant for that interface. This gives the CNI plugin great flexibility but also places a large burden on it. Many CNI plugins would need to have the same code to support several IP management schemes that users may desire (e.g. dhcp, host-local). 
+
+To lessen the burden and make IP management strategy be orthogonal to the type of CNI plugin, we define a second type of plugin -- IP Address Management Plugin (IPAM plugin). It is however the responsibility of the CNI plugin to invoke the IPAM plugin at the proper moment in its execution. The IPAM plugin must determine the interface IP/subnet, Gateway and Routes and return this information to the "main" plugin to apply. The IPAM plugin may obtain the information via a protocol (e.g. dhcp), data stored on a local filesystem, the "ipam" section of the Network Configuration file or a combination of the above.
+
+#### IP Address Management (IPAM) Interface
+
+Like CNI plugins, the IPAM plugins are invoked by running an executable. The executable is searched for in a predefined list of paths, indicated to the CNI plugin via `CNI_PATH`. The IPAM Plugin must receive all the same environment variables that were passed in to the CNI plugin. Just like the CNI plugin, IPAM plugins receive the network configuration via stdin.
+
+Success must be indicated by a zero return code and the following JSON being printed to stdout (in the case of the ADD command):
+
+```
+{
+  "cniVersion": "0.4.0",
+  "ips": [
+      {
+          "version": "<4-or-6>",
+          "address": "<ip-and-prefix-in-CIDR>",
+          "gateway": "<ip-address-of-the-gateway>"  (optional)
+      },
+      ...
+  ],
+  "routes": [                                       (optional)
+      {
+          "dst": "<ip-and-prefix-in-cidr>",
+          "gw": "<ip-of-next-hop>"                  (optional)
+      },
+      ...
+  ]
+  "dns": {
+    "nameservers": <list-of-nameservers>            (optional)
+    "domain": <name-of-local-domain>                (optional)
+    "search": <list-of-search-domains>              (optional)
+    "options": <list-of-options>                    (optional)
+  }
+}
+```
+
+Note that unlike regular CNI plugins, IPAM plugins should return an abbreviated `Result` structure that does not include the `interfaces` key, since IPAM plugins should be unaware of interfaces configured by their parent plugin except those specifically required for IPAM (eg, like the `dhcp` IPAM plugin).
+
+`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the IPAM plugin. An IPAM plugin may support multiple CNI spec versions (as it reports via the `VERSION` command), here the `cniVersion` returned by the IPAM plugin in the result must be consistent with the `cniVersion` specified in [Network Configuration](#network-configuration). If the `cniVersion` in the network configuration is not supported by the IPAM plugin, the plugin should return an error code 1 (see [Well-known Error Codes](#well-known-error-codes) for details).
+
+The `ips` field is a list of IP configuration information.
+See the [IP well-known structure](#ips) section for more information.
+
+The `dns` field contains a dictionary consisting of common DNS information.
+See the [DNS well-known structure](#dns) section for more information.
+
+Errors and logs are communicated in the same way as the CNI plugin. See [CNI Plugin Result](#result) section for details.
+
+IPAM plugin examples:
+ - **host-local**: Select an unused (by other containers on the same host) IP within the specified range.
+ - **dhcp**: Use DHCP protocol to acquire and maintain a lease. The DHCP requests will be sent via the created container interface; therefore, the associated network must support broadcast.
+
+#### Notes
+ - Routes are expected to be added with a 0 metric.
+ - A default route may be specified via "0.0.0.0/0". Since another network might have already configured the default route, the CNI plugin should be prepared to skip over its default route definition.
+
+### Well-known Structures
+
+#### IPs
+
+```
+  "ips": [
+      {
+          "version": "<4-or-6>",
+          "address": "<ip-and-prefix-in-CIDR>",
+          "gateway": "<ip-address-of-the-gateway>",      (optional)
+          "interface": <numeric index into 'interfaces' list> (not required for IPAM plugins)
+      },
+      ...
+  ]
+```
+
+The `ips` field is a list of IP configuration information determined by the plugin. Each item is a dictionary describing of IP configuration for a network interface.
+IP configuration for multiple network interfaces and multiple IP configurations for a single interface may be returned as separate items in the `ips` list.
+All properties known to the plugin should be provided, even if not strictly required.
+- `version` (string): either "4" or "6" and corresponds to the IP version of the addresses in the entry.
+   All IP addresses and gateways provided must be valid for the given `version`.
+- `address` (string): an IP address in CIDR notation (eg "192.168.1.3/24").
+- `gateway` (string): the default gateway for this subnet, if one exists.
+   It does not instruct the CNI plugin to add any routes with this gateway: routes to add are specified separately via the `routes` field.
+   An example use of this value is for the CNI `bridge` plugin to add this IP address to the Linux bridge to make it a gateway.
+- `interface` (uint): the index into the `interfaces` list for a [CNI Plugin Result](#result) indicating which interface this IP configuration should be applied to.
+   IPAM plugins should not return this key since they have no information about network interfaces.
+
+#### Routes
+
+```
+  "routes": [
+      {
+          "dst": "<ip-and-prefix-in-cidr>",
+          "gw": "<ip-of-next-hop>"               (optional)
+      },
+      ...
+  ]
+```
+
+- Each `routes` entry is a dictionary with the following fields.  All IP addresses in the `routes` entry must be the same IP version, either 4 or 6.
+  - `dst` (string): destination subnet specified in CIDR notation.
+  - `gw` (string): IP of the gateway. If omitted, a default gateway is assumed (as determined by the CNI plugin).
+
+#### DNS
+
+```
+  "dns": {
+    "nameservers": <list-of-nameservers>                 (optional)
+    "domain": <name-of-local-domain>                     (optional)
+    "search": <list-of-additional-search-domains>        (optional)
+    "options": <list-of-options>                         (optional)
+  }
+```
+
+The `dns` field contains a dictionary consisting of common DNS information.
+- `nameservers` (list of strings): list of a priority-ordered list of DNS nameservers that this network is aware of. Each entry in the list is a string containing either an IPv4 or an IPv6 address.
+- `domain` (string): the local domain used for short hostname lookups.
+- `search` (list of strings): list of priority ordered search domains for short hostname lookups. Will be preferred over `domain` by most resolvers.
+- `options` (list of strings): list of options that can be passed to the resolver.
+  See [CNI Plugin Result](#result) section for more information.
+  
+## Well-known Error Codes
+
+Error codes 1-99 must not be used other than as specified here.
+
+- `1` - Incompatible CNI version
+- `2` - Unsupported field in network configuration. The error message must contain the key and value of the unsupported field.
+- `3` - Container unknown or does not exist. This error implies the runtime does not need to perform any container network cleanup (for example, calling the `DEL` action on the container).
diff --git a/vendor/github.com/containernetworking/cni/Vagrantfile b/vendor/github.com/containernetworking/cni/Vagrantfile
new file mode 100644
index 0000000000..210e4567ec
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/Vagrantfile
@@ -0,0 +1,22 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+Vagrant.configure(2) do |config|
+  config.vm.box = "bento/ubuntu-16.04"
+
+  config.vm.synced_folder ".", "/go/src/github.com/containernetworking/cni"
+
+  config.vm.provision "shell", inline: <<-SHELL
+    set -e -x -u
+
+    apt-get update -y || (sleep 40 && apt-get update -y)
+    apt-get install -y git
+
+    wget -qO- https://storage.googleapis.com/golang/go1.10.linux-amd64.tar.gz | tar -C /usr/local -xz
+
+    echo 'export GOPATH=/go; export PATH=/usr/local/go/bin:$GOPATH/bin:$PATH' >> /root/.bashrc
+    eval `tail -n1 /root/.bashrc`
+
+    cd /go/src/github.com/containernetworking/cni
+  SHELL
+end
diff --git a/vendor/github.com/containernetworking/cni/cnitool/README.md b/vendor/github.com/containernetworking/cni/cnitool/README.md
new file mode 100644
index 0000000000..0b1956054d
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/cnitool/README.md
@@ -0,0 +1,47 @@
+# cnitool
+
+`cnitool` is a simple program that executes a CNI configuration. It will
+add or remove an interface in an already-created network namespace.
+
+## Example invocation
+First, install cnitool:
+
+```
+go install github.com/containernetworking/cni/cnitool
+```
+
+Then, check out and build the plugins. All commands should be run from this directory.
+```
+git clone https://github.com/containernetworking/plugins.git
+cd plugins
+./build.sh
+```
+
+Create a network configuration
+```
+echo '{"cniVersion":"0.3.1","name":"myptp","type":"ptp","ipMasq":true,"ipam":{"type":"host-local","subnet":"172.16.29.0/24","routes":[{"dst":"0.0.0.0/0"}]}}' | sudo tee /etc/cni/net.d/10-myptp.conf
+```
+
+Create a network namespace. This will be called `testing`:
+
+```
+sudo ip netns add testing
+```
+
+Add the container to the network:
+```
+sudo CNI_PATH=./bin cnitool add myptp /var/run/netns/testing
+```
+
+Test that it works:
+```
+sudo ip -n testing addr
+sudo ip netns exec testing ping -c 1 4.2.2.2
+```
+
+And clean up:
+```
+sudo CNI_PATH=./bin cnitool del myptp /var/run/netns/testing
+sudo ip netns del testing
+```
+
diff --git a/vendor/github.com/containernetworking/cni/cnitool/cnitool.go b/vendor/github.com/containernetworking/cni/cnitool/cnitool.go
new file mode 100644
index 0000000000..f899e0257a
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/cnitool/cnitool.go
@@ -0,0 +1,135 @@
+// Copyright 2015 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"crypto/sha512"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/containernetworking/cni/libcni"
+)
+
+const (
+	EnvCNIPath        = "CNI_PATH"
+	EnvNetDir         = "NETCONFPATH"
+	EnvCapabilityArgs = "CAP_ARGS"
+	EnvCNIArgs        = "CNI_ARGS"
+
+	DefaultNetDir = "/etc/cni/net.d"
+
+	CmdAdd = "add"
+	CmdDel = "del"
+)
+
+func parseArgs(args string) ([][2]string, error) {
+	var result [][2]string
+
+	pairs := strings.Split(args, ";")
+	for _, pair := range pairs {
+		kv := strings.Split(pair, "=")
+		if len(kv) != 2 || kv[0] == "" || kv[1] == "" {
+			return nil, fmt.Errorf("invalid CNI_ARGS pair %q", pair)
+		}
+
+		result = append(result, [2]string{kv[0], kv[1]})
+	}
+
+	return result, nil
+}
+
+func main() {
+	if len(os.Args) < 3 {
+		usage()
+		return
+	}
+
+	netdir := os.Getenv(EnvNetDir)
+	if netdir == "" {
+		netdir = DefaultNetDir
+	}
+	netconf, err := libcni.LoadConfList(netdir, os.Args[2])
+	if err != nil {
+		exit(err)
+	}
+
+	var capabilityArgs map[string]interface{}
+	capabilityArgsValue := os.Getenv(EnvCapabilityArgs)
+	if len(capabilityArgsValue) > 0 {
+		if err = json.Unmarshal([]byte(capabilityArgsValue), &capabilityArgs); err != nil {
+			exit(err)
+		}
+	}
+
+	var cniArgs [][2]string
+	args := os.Getenv(EnvCNIArgs)
+	if len(args) > 0 {
+		cniArgs, err = parseArgs(args)
+		if err != nil {
+			exit(err)
+		}
+	}
+
+	netns := os.Args[3]
+	netns, err = filepath.Abs(netns)
+	if err != nil {
+		exit(err)
+	}
+
+	// Generate the containerid by hashing the netns path
+	s := sha512.Sum512([]byte(netns))
+	containerID := fmt.Sprintf("cnitool-%x", s[:10])
+
+	cninet := libcni.NewCNIConfig(filepath.SplitList(os.Getenv(EnvCNIPath)), nil)
+
+	rt := &libcni.RuntimeConf{
+		ContainerID:    containerID,
+		NetNS:          netns,
+		IfName:         "eth0",
+		Args:           cniArgs,
+		CapabilityArgs: capabilityArgs,
+	}
+
+	switch os.Args[1] {
+	case CmdAdd:
+		result, err := cninet.AddNetworkList(netconf, rt)
+		if result != nil {
+			_ = result.Print()
+		}
+		exit(err)
+	case CmdDel:
+		exit(cninet.DelNetworkList(netconf, rt))
+	}
+}
+
+func usage() {
+	exe := filepath.Base(os.Args[0])
+
+	fmt.Fprintf(os.Stderr, "%s: Add or remove network interfaces from a network namespace\n", exe)
+	fmt.Fprintf(os.Stderr, "  %s %s <net> <netns>\n", exe, CmdAdd)
+	fmt.Fprintf(os.Stderr, "  %s %s <net> <netns>\n", exe, CmdDel)
+	os.Exit(1)
+}
+
+func exit(err error) {
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%s\n", err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
diff --git a/vendor/github.com/containernetworking/cni/libcni/api.go b/vendor/github.com/containernetworking/cni/libcni/api.go
index a23cbb2c57..39f9c9cc8c 100644
--- a/vendor/github.com/containernetworking/cni/libcni/api.go
+++ b/vendor/github.com/containernetworking/cni/libcni/api.go
@@ -15,7 +15,11 @@
 package libcni
 
 import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/containernetworking/cni/pkg/invoke"
@@ -23,6 +27,14 @@ import (
 	"github.com/containernetworking/cni/pkg/version"
 )
 
+var (
+	CacheDir = "/var/lib/cni"
+)
+
+// A RuntimeConf holds the arguments to one invocation of a CNI plugin
+// excepting the network configuration, with the nested exception that
+// the `runtimeConfig` from the network configuration is included
+// here.
 type RuntimeConf struct {
 	ContainerID string
 	NetNS       string
@@ -34,6 +46,9 @@ type RuntimeConf struct {
 	// in this map which match the capabilities of the plugin are passed
 	// to the plugin
 	CapabilityArgs map[string]interface{}
+
+	// A cache directory in which to library data.  Defaults to CacheDir
+	CacheDir string
 }
 
 type NetworkConfig struct {
@@ -50,25 +65,41 @@ type NetworkConfigList struct {
 
 type CNI interface {
 	AddNetworkList(net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
+	GetNetworkList(net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
 	DelNetworkList(net *NetworkConfigList, rt *RuntimeConf) error
 
 	AddNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error)
+	GetNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error)
 	DelNetwork(net *NetworkConfig, rt *RuntimeConf) error
+
+	ValidateNetworkList(net *NetworkConfigList) ([]string, error)
+	ValidateNetwork(net *NetworkConfig) ([]string, error)
 }
 
 type CNIConfig struct {
 	Path []string
+	exec invoke.Exec
 }
 
 // CNIConfig implements the CNI interface
 var _ CNI = &CNIConfig{}
 
-func buildOneConfig(list *NetworkConfigList, orig *NetworkConfig, prevResult types.Result, rt *RuntimeConf) (*NetworkConfig, error) {
+// NewCNIConfig returns a new CNIConfig object that will search for plugins
+// in the given paths and use the given exec interface to run those plugins,
+// or if the exec interface is not given, will use a default exec handler.
+func NewCNIConfig(path []string, exec invoke.Exec) *CNIConfig {
+	return &CNIConfig{
+		Path: path,
+		exec: exec,
+	}
+}
+
+func buildOneConfig(name, cniVersion string, orig *NetworkConfig, prevResult types.Result, rt *RuntimeConf) (*NetworkConfig, error) {
 	var err error
 
 	inject := map[string]interface{}{
-		"name":       list.Name,
-		"cniVersion": list.CNIVersion,
+		"name":       name,
+		"cniVersion": cniVersion,
 	}
 	// Add previous plugin result
 	if prevResult != nil {
@@ -119,21 +150,37 @@ func injectRuntimeConfig(orig *NetworkConfig, rt *RuntimeConf) (*NetworkConfig,
 	return orig, nil
 }
 
-// AddNetworkList executes a sequence of plugins with the ADD command
-func (c *CNIConfig) AddNetworkList(list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
-	var prevResult types.Result
-	for _, net := range list.Plugins {
-		pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
-		if err != nil {
-			return nil, err
+// ensure we have a usable exec if the CNIConfig was not given one
+func (c *CNIConfig) ensureExec() invoke.Exec {
+	if c.exec == nil {
+		c.exec = &invoke.DefaultExec{
+			RawExec:       &invoke.RawExec{Stderr: os.Stderr},
+			PluginDecoder: version.PluginDecoder{},
 		}
+	}
+	return c.exec
+}
 
-		newConf, err := buildOneConfig(list, net, prevResult, rt)
-		if err != nil {
-			return nil, err
-		}
+func (c *CNIConfig) addOrGetNetwork(command, name, cniVersion string, net *NetworkConfig, prevResult types.Result, rt *RuntimeConf) (types.Result, error) {
+	c.ensureExec()
+	pluginPath, err := c.exec.FindInPath(net.Network.Type, c.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	newConf, err := buildOneConfig(name, cniVersion, net, prevResult, rt)
+	if err != nil {
+		return nil, err
+	}
+
+	return invoke.ExecPluginWithResult(pluginPath, newConf.Bytes, c.args(command, rt), c.exec)
+}
 
-		prevResult, err = invoke.ExecPluginWithResult(pluginPath, newConf.Bytes, c.args("ADD", rt))
+// Note that only GET requests should pass an initial prevResult
+func (c *CNIConfig) addOrGetNetworkList(command string, prevResult types.Result, list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
+	var err error
+	for _, net := range list.Plugins {
+		prevResult, err = c.addOrGetNetwork(command, list.Name, list.CNIVersion, net, prevResult, rt)
 		if err != nil {
 			return nil, err
 		}
@@ -142,68 +189,266 @@ func (c *CNIConfig) AddNetworkList(list *NetworkConfigList, rt *RuntimeConf) (ty
 	return prevResult, nil
 }
 
+func getResultCacheFilePath(netName string, rt *RuntimeConf) string {
+	cacheDir := rt.CacheDir
+	if cacheDir == "" {
+		cacheDir = CacheDir
+	}
+	return filepath.Join(cacheDir, "results", fmt.Sprintf("%s-%s", netName, rt.ContainerID))
+}
+
+func setCachedResult(result types.Result, netName string, rt *RuntimeConf) error {
+	data, err := json.Marshal(result)
+	if err != nil {
+		return err
+	}
+	fname := getResultCacheFilePath(netName, rt)
+	if err := os.MkdirAll(filepath.Dir(fname), 0700); err != nil {
+		return err
+	}
+	return ioutil.WriteFile(fname, data, 0600)
+}
+
+func delCachedResult(netName string, rt *RuntimeConf) error {
+	fname := getResultCacheFilePath(netName, rt)
+	return os.Remove(fname)
+}
+
+func getCachedResult(netName, cniVersion string, rt *RuntimeConf) (types.Result, error) {
+	fname := getResultCacheFilePath(netName, rt)
+	data, err := ioutil.ReadFile(fname)
+	if err != nil {
+		// Ignore read errors; the cached result may not exist on-disk
+		return nil, nil
+	}
+
+	// Read the version of the cached result
+	decoder := version.ConfigDecoder{}
+	resultCniVersion, err := decoder.Decode(data)
+	if err != nil {
+		return nil, err
+	}
+
+	// Ensure we can understand the result
+	result, err := version.NewResult(resultCniVersion, data)
+	if err != nil {
+		return nil, err
+	}
+
+	// Convert to the config version to ensure plugins get prevResult
+	// in the same version as the config.  The cached result version
+	// should match the config version unless the config was changed
+	// while the container was running.
+	result, err = result.GetAsVersion(cniVersion)
+	if err != nil && resultCniVersion != cniVersion {
+		return nil, fmt.Errorf("failed to convert cached result version %q to config version %q: %v", resultCniVersion, cniVersion, err)
+	}
+	return result, err
+}
+
+// AddNetworkList executes a sequence of plugins with the ADD command
+func (c *CNIConfig) AddNetworkList(list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
+	result, err := c.addOrGetNetworkList("ADD", nil, list, rt)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = setCachedResult(result, list.Name, rt); err != nil {
+		return nil, fmt.Errorf("failed to set network '%s' cached result: %v", list.Name, err)
+	}
+
+	return result, nil
+}
+
+// GetNetworkList executes a sequence of plugins with the GET command
+func (c *CNIConfig) GetNetworkList(list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
+	// GET was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(list.CNIVersion, "0.4.0"); err != nil {
+		return nil, err
+	} else if !gtet {
+		return nil, fmt.Errorf("configuration version %q does not support the GET command", list.CNIVersion)
+	}
+
+	cachedResult, err := getCachedResult(list.Name, list.CNIVersion, rt)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get network '%s' cached result: %v", list.Name, err)
+	}
+	return c.addOrGetNetworkList("GET", cachedResult, list, rt)
+}
+
+func (c *CNIConfig) delNetwork(name, cniVersion string, net *NetworkConfig, prevResult types.Result, rt *RuntimeConf) error {
+	c.ensureExec()
+	pluginPath, err := c.exec.FindInPath(net.Network.Type, c.Path)
+	if err != nil {
+		return err
+	}
+
+	newConf, err := buildOneConfig(name, cniVersion, net, prevResult, rt)
+	if err != nil {
+		return err
+	}
+
+	return invoke.ExecPluginWithoutResult(pluginPath, newConf.Bytes, c.args("DEL", rt), c.exec)
+}
+
 // DelNetworkList executes a sequence of plugins with the DEL command
 func (c *CNIConfig) DelNetworkList(list *NetworkConfigList, rt *RuntimeConf) error {
-	for i := len(list.Plugins) - 1; i >= 0; i-- {
-		net := list.Plugins[i]
+	var cachedResult types.Result
 
-		pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
-		if err != nil {
-			return err
-		}
-
-		newConf, err := buildOneConfig(list, net, nil, rt)
+	// Cached result on DEL was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(list.CNIVersion, "0.4.0"); err != nil {
+		return err
+	} else if gtet {
+		cachedResult, err = getCachedResult(list.Name, list.CNIVersion, rt)
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to get network '%s' cached result: %v", list.Name, err)
 		}
+	}
 
-		if err := invoke.ExecPluginWithoutResult(pluginPath, newConf.Bytes, c.args("DEL", rt)); err != nil {
+	for i := len(list.Plugins) - 1; i >= 0; i-- {
+		net := list.Plugins[i]
+		if err := c.delNetwork(list.Name, list.CNIVersion, net, cachedResult, rt); err != nil {
 			return err
 		}
 	}
+	_ = delCachedResult(list.Name, rt)
 
 	return nil
 }
 
 // AddNetwork executes the plugin with the ADD command
 func (c *CNIConfig) AddNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error) {
-	pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
+	result, err := c.addOrGetNetwork("ADD", net.Network.Name, net.Network.CNIVersion, net, nil, rt)
 	if err != nil {
 		return nil, err
 	}
 
-	net, err = injectRuntimeConfig(net, rt)
-	if err != nil {
+	if err = setCachedResult(result, net.Network.Name, rt); err != nil {
+		return nil, fmt.Errorf("failed to set network '%s' cached result: %v", net.Network.Name, err)
+	}
+
+	return result, nil
+}
+
+// GetNetwork executes the plugin with the GET command
+func (c *CNIConfig) GetNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error) {
+	// GET was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(net.Network.CNIVersion, "0.4.0"); err != nil {
 		return nil, err
+	} else if !gtet {
+		return nil, fmt.Errorf("configuration version %q does not support the GET command", net.Network.CNIVersion)
 	}
 
-	return invoke.ExecPluginWithResult(pluginPath, net.Bytes, c.args("ADD", rt))
+	cachedResult, err := getCachedResult(net.Network.Name, net.Network.CNIVersion, rt)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get network '%s' cached result: %v", net.Network.Name, err)
+	}
+	return c.addOrGetNetwork("GET", net.Network.Name, net.Network.CNIVersion, net, cachedResult, rt)
 }
 
 // DelNetwork executes the plugin with the DEL command
 func (c *CNIConfig) DelNetwork(net *NetworkConfig, rt *RuntimeConf) error {
-	pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
-	if err != nil {
+	var cachedResult types.Result
+
+	// Cached result on DEL was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(net.Network.CNIVersion, "0.4.0"); err != nil {
 		return err
+	} else if gtet {
+		cachedResult, err = getCachedResult(net.Network.Name, net.Network.CNIVersion, rt)
+		if err != nil {
+			return fmt.Errorf("failed to get network '%s' cached result: %v", net.Network.Name, err)
+		}
 	}
 
-	net, err = injectRuntimeConfig(net, rt)
+	if err := c.delNetwork(net.Network.Name, net.Network.CNIVersion, net, cachedResult, rt); err != nil {
+		return err
+	}
+	_ = delCachedResult(net.Network.Name, rt)
+	return nil
+}
+
+// ValidateNetworkList checks that a configuration is reasonably valid.
+// - all the specified plugins exist on disk
+// - every plugin supports the desired version.
+//
+// Returns a list of all capabilities supported by the configuration, or error
+func (c *CNIConfig) ValidateNetworkList(list *NetworkConfigList) ([]string, error) {
+	version := list.CNIVersion
+
+	// holding map for seen caps (in case of duplicates)
+	caps := map[string]interface{}{}
+
+	errs := []error{}
+	for _, net := range list.Plugins {
+		if err := c.validatePlugin(net.Network.Type, version); err != nil {
+			errs = append(errs, err)
+		}
+		for c, enabled := range net.Network.Capabilities {
+			if !enabled {
+				continue
+			}
+			caps[c] = struct{}{}
+		}
+	}
+
+	if len(errs) > 0 {
+		return nil, fmt.Errorf("%v", errs)
+	}
+
+	// make caps list
+	cc := make([]string, 0, len(caps))
+	for c := range caps {
+		cc = append(cc, c)
+	}
+
+	return cc, nil
+}
+
+// ValidateNetwork checks that a configuration is reasonably valid.
+// It uses the same logic as ValidateNetworkList)
+// Returns a list of capabilities
+func (c *CNIConfig) ValidateNetwork(net *NetworkConfig) ([]string, error) {
+	caps := []string{}
+	for c, ok := range net.Network.Capabilities {
+		if ok {
+			caps = append(caps, c)
+		}
+	}
+	if err := c.validatePlugin(net.Network.Type, net.Network.CNIVersion); err != nil {
+		return nil, err
+	}
+	return caps, nil
+}
+
+// validatePlugin checks that an individual plugin's configuration is sane
+func (c *CNIConfig) validatePlugin(pluginName, expectedVersion string) error {
+	pluginPath, err := invoke.FindInPath(pluginName, c.Path)
 	if err != nil {
 		return err
 	}
 
-	return invoke.ExecPluginWithoutResult(pluginPath, net.Bytes, c.args("DEL", rt))
+	vi, err := invoke.GetVersionInfo(pluginPath, c.exec)
+	if err != nil {
+		return err
+	}
+	for _, vers := range vi.SupportedVersions() {
+		if vers == expectedVersion {
+			return nil
+		}
+	}
+	return fmt.Errorf("plugin %s does not support config version %q", pluginName, expectedVersion)
 }
 
 // GetVersionInfo reports which versions of the CNI spec are supported by
 // the given plugin.
 func (c *CNIConfig) GetVersionInfo(pluginType string) (version.PluginInfo, error) {
-	pluginPath, err := invoke.FindInPath(pluginType, c.Path)
+	c.ensureExec()
+	pluginPath, err := c.exec.FindInPath(pluginType, c.Path)
 	if err != nil {
 		return nil, err
 	}
 
-	return invoke.GetVersionInfo(pluginPath)
+	return invoke.GetVersionInfo(pluginPath, c.exec)
 }
 
 // =====
diff --git a/vendor/github.com/containernetworking/cni/logo.png b/vendor/github.com/containernetworking/cni/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..50c54d2f524e76475b01bd8fbbc2b5b7a57fec4a
GIT binary patch
literal 11604
zcmY+qV{~RgyDj?0wr$&bW2a*$9ox3ej@_|svt!$~*|C$;-`@M~drpl}nl)?AdTRYy
zqpBhm<s}hdabW=f0D`oXnDW0`^<Q>}hWuA%tC(y3tH8~L<%9u%`Z%}`Lx_KUVq+;~
zIRL<m5&#GY0RZ0qK>?=#fGaZqaBctq@TLO*SPoeoO2B^uFb+~$&Hw--*?%&KN3ozA
z005$8sjBIsDJRQoY;VhGXku?<%IIP1@Q)1u06lpBHEm5@42eB#ZS0(RJ@`rgi^2P^
z{U4Z#l=#0WF4p{{nsSQ7qV`Uv#2k$5jLf70u*Af~KqnJ3US%<f|C#=;$4_eE;^M%|
z#N_Vo&gjm@Xzygs#KObF!^F(W#LCL>kHO&VY3E|-!C>c1_TM7^pN^QRv$2z<gNvoT
z9r1s34UOzwUHC~!|6}yO>A%<MVrlmOJJ~t^Pgwr~Wctqt6AL3V)BkG!n+p67%B$dH
zY5LFkKl%bJ!2e?YKiL2H0Ga+{{(mjzza#xG^k1j~ut28&-8KPO*?y{jUyaUGT1;5g
z1LR5<$^%1f{mbll+Lp%UvOD?@ot&6<JRxd@!B6*<CI2OHC6u#K2y}G5)lUX%QBmpk
za%3qfi}|WHYu&}>ppeAF<&4*zo5^gG02h(9lRaR2Qaf9z&k6s|>pBlx+UbitDh38m
zh1BFkhEV&L6YZ#92CKdt^2)+IIxBoR?F@?mj~z4*I8?4eiB@9-xpe8}rL*+>NfLd`
zkUOas<$M92qb(`|p^`Sl<!b#p$s_&|+z3_PWQy;*1O#UL7fR9Sy_Bnt$R2bc-X98G
zzTmD~+R&g*Ddpq2?N7MKKK2QgvSFp+`ik}gIK`Zfp`j=M8y8msHE$AmN3;$j7eo-R
zgI5B6&RS7;EtPKW4?=g+(0=$k*2EYZc8`~pLDJp(8HBsn`0vxw11Lqv{@)F2XW7!O
zf)Y`SY3QNUs9&k<#=Hp9p0%)~-*?xCZv3!_R}e}8z&R$VIQc@7fwXAg(^~~B!E4e1
z*z7qCqmuma7IGpR%g}~0Gde|h7kaOJq42;LLQT@y{0|DN6?s&htn95Q{CRqZiye>}
znLY#Tq)%~H6QbgxWEhnA<Ral~LJkxM8<1wYoS<K9Qp!Y>a(^=L6)*SdB<xy6@_P@G
zfkvnv6Wl@)>PVnU^2?gaDeXnvj3GWpS=Q7>vL*SVg52wyu&$oJP!*(8ovViK8^V=T
z^#ad)*$yd6>`lN>0uVw!7F)K&#%J^-GcwZPY93z6M`d~37^Cm=2j=4iA@H+>dDG|i
zPJ?BfXqYYp=J<XX_L*_dck}Nf;Ln4o1AnBBis<!xx{)?pvp{%WQ!Zg30a%7ou*$1^
z5U+2FxORROx>ZvqE}W6c(Uq3@AyJfeQJyzBm$_cw^OSk7bb{QmD=)R|ItfuTl~_1H
z7XSKEkAR;*=L@MjZg+42F|EO83u~VbaNN!)SVuecAPSH|hxbS7yc4EQ@sFq}F6IHD
zMHap@FABOK47_Vc-+YHv3oC`|#gY0Uv7Vx6hsmw#mz))ASK!0^z|rQ<n*6)Gt_lR1
zEA!c*36RoD032FtNv7WM=lhxhKgpI+GPE;ODsy5j)_Z4iz*-=OQTjXogZA^Iky1?b
zxWN#>5xm}<Qf4zFiT-O_d?36Q%|X*(eWIkexdii;jRqG-fiMpK8YypC9DS7|S7N*2
zL@Gl=l2Ea8pJq%jl$JCOq$x8mMN9n}Mdy6$ll!ro!Xse5UdU+huHj1r@zK$+Mv_>A
zU|MMw82LAqa=v6wAtCNTQ)>aI&N)x;o{}5VdGrd1Wn16yQz7a?50};C9weBg2mc1@
zIz8o%EnL}edPFtdK0-lw8k0J+XW6!o<s-CxlJ<F;uez-F8@`%>)xz`|k-Aox^pC%%
z0`2H$I%jgjsZ=4nCbXHB*63L9%;yiLJdE~<a^jIZH3-P{Pn_d5?n92V#&xt5{5UAc
zP@Z2Z+P|R)JklH3f||S_cn{)~?T#m!Y}RP%-|1mxt%JWCAy1N%{2-2Ax#plQ;K!$A
zN*{*Iqc4^oTZTV1EUs`DGw%6iOVJ&3k<<w>2{0|_lkPuMX8mw5u#AWSc7D^|s)`1P
zkZJX&Wfi9$+~wEsO2_kz0B4A{iNjwy-$=VvnH8f=&S9TGs!uZ)4<d|X5ZUh{T18oh
z3Z8Vj@yBnN%~nYVy&8YS?uSH;Mf-WfD0V)%*R^hd4U8#c^svyD{MQ2t$GocRt!DPB
zFwJNW#`>#<b|}qsz_ICxBB6~motnEcD0D?zR_bz)6KgJp3UKF}z_b{tzG0(nx@$1Y
zhL)t@qY4pVNnjfSJ$heTa5TY$mT`$cW2=dOs_#a22N80r1@qRhFaU5Dc>O#!a1gBO
zsD!pymA<E@pj>RY`LHxk9N^0&KbT>jr>KBePgKcJxS++1M>0c3v*vQ8XQL%M@E<+!
ziPUa6mG>T>FZa3eWq&KVsSqloS?$Yiv02wZA>wb}VvmZ;1daLP3!*%raUJXg4P*GJ
zdOi=4Pg?~1_RxfjgY8t0?t&?g7jeABBGn7f{G}(R1g@p5!WG#CJXQA**5Sqtw~_~|
zSH$&P%bk^xRZ|yu{i=@7E+IA4ruQ5^akG13`UA1xR-3->`BmO#jo8GGlvd8Lc7J4w
zDB3BgJZ1&v^e9ey*NQQe%D_j!dM~F<WpeE{KGiLwGc(nOPHZmRJ~XI&T#Nj}U7f@9
zMt^B&T>&v%R4X+jzon_k<F13UFSiG&#kA|MBK#S`e6e(LR+oyb23^sxj%n!WDw@^K
zv0>ExwrF54V#w)r(O%&lM0?B;qH`*CzonG_4e*W<D9)f=q^z~3o&JNV*QFy@yX8{M
z`?*`r^qq1(hU-fPl3P&(KV`!Tg$qW9593$|v@H`1G@7PtswjcX9bd@*N|SJyfU-A{
zg(tlNf(JsR_rydf%+wDe!_8Uk>ItPK*PQVRx<-?!$wOG4_jN(O5_CS%RV{^me{i~b
z?TpQE0JjOZM49o+yi~(ECuK%n<@(NAXaP#(8t#7l8>f1bNPDS+-+pNbOhFdysMp%n
z-&jPmrtUpG?U8Gc?0$C{0i7@oighcV*04*%o7s3cJ)ezoI8hS5Z9_NcRMCCC{ojAi
zst-YN?59!$$h1mQS5+qMJtLBna^l+d-H|OZ-Aovhf-24`U8<Z(F<lUSY1E{&bVvNm
zCSlrvA4QzDoS`wbcoP;1EIacCZ|{Ovt`i#}NLmZ>gR?+%hE-lUi%O0y@7HPa>$UWu
z<s&lqYxSWjg_uVHbSDX7`3(rlf?Qy2Tw(seHma?*Okkvp*dV{a7hy#&dYr_UglKpz
zy60uUijYNj+T<O6F;`x7XOfCnsCLt(koR+!NZ={yUBv+n%Pr@6=krg14^|9*64kj$
zK-CfEdppr_I-H~0kR#&T0OE*DR2bFVYywd}zGRmJxC%isE+lnagc>)MGqc2}qm$u-
z%WSPB-`uGQF7u145*HM!&U7d`mOJMalYatjkh8_ZX)enaZ*Y=+-g0&4{B;BU%l<R;
z>!6d(lOdxPK0xe^zmAa*iUAVR29yHHpL5w9hV#M}dJqUReKeXH=ePDqy#<=Kl0)w}
z@T-ya9d#a>4r*LcIeYhEJllW}yf&PlDQeZR+-guy%l1UQ&*xh=ofl510?HuF;fv%;
zA&;aSZ;-t%S#G+aQOZ$34knV!Vy8!0HlLolx|12%T$z|X$?wAxWXsQ6OqMO0&&s;9
z=0Y~jl(V?Fxe)xuc#-sWrpf=C3cUs!ilspv-Mp7Ug<)q0#>kRH9o!4B2)t`6ndb-=
z6z;LI3$`lUPwzLC+`C+$+I`B_4CBE#a;V_{F=tPueD@N6+B#(8I;ZU#7kS*|WD1uq
zwqXe&TaYCS9{O2KsyFuR<g8m@Bw)T@ot(r2c8t7#QkjR$N^5vZ75x*)|LV*=rYFEx
zh?Trg)zlM05YcM!D!3j|k@3#(mT{jhFOL&F6M*&1wEhHwz8qyVJFl(N+NR>uXUMmy
zMtAgj5;Q<|8h+MNGuke)*{~1@_o(0*%?Ag!p~$TWeSZL(A7J8%74=6r(O3Y1u&Wc6
zctUX|=y^Xm7ewPpSoMr6U6m@|`9?XUq~GC7>9AFnCi*n&>qK6ah8vuR9OH`kj%bN_
zNM(w~4h!s3?bcTw$I^j#ACnl74;#M&H`kKg=b?l)!EDYT<>U+NSUzknu9qWQMvtqn
z$_sA-)O|Kj7z4`Lf`dy7W9exp)O6Fr24G@JRU*U3&Ww_M3c2EhiXgSEskWF45?FKB
zWCdc&6Vo*AAJ29x91*Zl?&FU%u7wzi(a6QnUkSV7*q_~4^77L@TjWZ6rZD8?kD~ai
zx#o`!3<En<f<s^`wV}C4;$$6RE&tfObDj5wviOk*>(g`*ivOm@(9mX6U*K=8Du;sP
zG<QzfvR7o36;UeUO>D-2?Ep!sq@4UiVGjA{FlP%+5zFaR>p>As^6@7f{Q$Q{X33zw
z9g?<_+3QcsMOa8DoqpeV;~iu2n><4@Iot6;Gp294RNfqkZE);w=Q5v-0rqA0JihT)
zE16~4J#WvioU#K7O}MmqKkRdFIwHWx7irt}Z<4HB06pIIvGTYJ`0vt!t*!Wj=h?pr
zyR78z0qZjwhcO|3>2U&j;0_sdt)NnFs_M~BZeD{B_p=U&#h5@V$T9GCBOke76}@nu
z4{TBc+K&@XRS^AdwN2gKb-1#weTMa)EEw4zO27PWZ9G&XmP>zmA*k4~dG2E=WpW}V
z9*o-o3_;t@oP}e3X*VJU%PmczXDXH$EDlH(>A)r(*{P2pHn}Rg2pP@CL?GF$Eukz<
z&CBI3$UWqWku?qg$E5`ymum)amx?I6(VWQIgS=^tS0?EJ&xT&!#Hj4>+xMq4IuGXN
zu3Ic9{Z|~c88LyKb&x%*H^$J82ttTe6~?A|3bL;;O^_@SPmE5ibY*qBZx!#rbF&J>
zP8McQt^27qlPAWPO)k|Vb8#n!il~JCOGBb;GR=t{E)8}brj2&>2D-?qhq=EK{unYW
zT=z6G{@ul+X7eV~^4?zs7`hhX)3~(SmWnj%dwEY4A6B)s9Zc%h;UBHM-lH+NOw2Hs
zKhJCeNF8V0dgGg+(-4YN&s}sz-eNZ3{5(U|Puz>U1KW24_=CKq=%>Ypn(+BrK#NO7
zQtil>8Y55-wnHJWAc^plD(X$4WOe6|tqzO8Q&k|c;aS*1f!i6-ZkMGonfho6<ky#J
z`ZBu((Bot+yIFx5Y#Aa6thBXVFo=Vl1&ENdiM2XmGZ}^6dY^xG7qt$bvPj`Q<wg>l
zSW_V3Sy$RGowQU{@B8qJf8S(iFlhDRpQ}e1qU(p{^$}Y<iOe}#V?mwhWjK>Hy#Yrn
z8bc_MVXLXsI&$A&Lx+@noL|%VdijJjRhWLdG4g(+!+#kzc|UU|cP1%I{vIF7IzQgk
za&h2;$N<Y*%MFL;C(7?}7n%Xb<v8c+5&tU2N?N$b2PIiiT)Te!n>gGT_%g~_Etj@n
z^@sY|<q}2{Q0@rk$*<{)a0QX4Fq?BHDXc$m*lDo}WRDfq8fy%2OP5hmH5?~qqa>ET
zQT98gj4GS`_11hC(}}CilC6$8Incij7lcP&v)g~nQ=1l-U)izAu%C?Bj%{QN%6kvX
z-qBo$_ylp-%7GlbTf?Zg31vH3s9yag`~Kt}=sSwP3|aH{8zh}m6UR643BoKt$BE^y
zW+CJ&6yq@lW>EkLA!V8oWX}MKUR$OVSke!%oy$#n#zlV%{JiGdM$3Z?)&~2XT9O63
zqK53B(y)R6t_PD}ZzA+uPk9AhG=L@eaL3sYIW)?39e@9z2DVm1riFXJ8AQjC0{>ZD
zAtlMT0_Y2eb$TPc(txR-$nzJdRu|#pWU%6HT`pS9o_&-3P0ZhRtmx~^#}QECp=0!u
zQJ)}dNXU0T<%4YIaMB3zF5xiNq&FlHO(fVjj8xN$<v3%tSP2kVJTc}nF~szuaB@)x
zV)x!(v4SGjurkRGhtgvQXJ**LuFBj_p<Px(iw=JR&kCA`s+Y7|BDQ_Gq#fiY27i|0
z&*fj59w^%9kJ@8L=*#?Gt+4>XK&*j$_E(66ArQ~`e0PtpN{e!y9+(FEK5>c|tE`0M
z#fv&n5>0)VzO`cw>Lc270p?L4FhdCqN{Q<!i5nxufG$qqN72lDTLBhrHekc+k#E>6
zx=Zs6(j@|+b}ctyZVpLh7oPW{;Bw2MEgM15y>Y9SrugM4d;jde+iK!`0<3Qp68Y>X
z#Cm1lW|&qxsO$U7x0Mnz9SLa8NoDWdm={ru0bt(UNp;PRXq!5EpjuX_ri2G8=-V~o
zh0cGgyV2pT035n($y$4QpA}P_oXv=284a}{7`?C*YGEj_LY^nG*)VsEktrC;uX)0M
z+FgA!ql@C<ykj;Q(^Oo!2`!G?UN({s^=Y`nkI0-+CXBykXgpu&Ry|jsQU`cf<DJj4
z78Xz@x}+kYavHkWuVVa>jtHP3z995a-8K+%;R`=0e{qxkjr?&Klm%h4*sAsCylL4Q
zcE<txA!y^k@&-0sO8jMtO!^!C`G%?Ya<W7Nt)wk)$;|>i&rb0?Z0m41xt61TKLDN<
zlH0tWmAl<#>7e4$V~gO#5`lgq8`AbKw%6*B<Fl)U%yfCN_<@-2sVu5<*&2-sVQK7k
z81e?O#kaWuB|_+mve4I&J0RwH4_kI1ag6uU`COD{6=}#R4$9c#ymNZ|uBR=nnr<A-
zk*ax2NmM)R-0gcUX0`gqN^3{<^|uG=K1MkG6tKL>;?**g2g|M*^R^14x;fZ&$AURe
z2SLHJ$~dtyRhlI%(r^fb!qv^vl56Z@(rtYFQ?GX9D9Y;FEy1VqZDQIlihRaFP4)WO
zgWr}QtmSVNN98t8BlEisA$a~6LT-D0D#+JDE^Tl1^L$T(YRD8SGLi?#wKeSL+eTxP
zw>@nP_HDVMb`|!XTaK>kAz~c%yXVCC>{i6E&nB%v50aTUmOHT!qMWx@?5x4ktR&CC
z9)g}two7GfLR7(VuCB5PFWGYMa?H<a_X~q&(FyJ$iqToo(k}38<x~Ljaf5!*Y4&fF
z3=&WNt2IK7f;VLbO_r;Tz;gW|E8okm{(c50?vIE|7v0D;cQS!&#;rQH{*x{5<AgX1
zc#{iMHyWPX-yKys(Sb5zb*5A`@&Jt<hU;5m^=MdM$(^1)L~(HqF@kv@1A3RN@X*UU
zBCG$Cdv}eeZZgTbtDBcs!+Ot@sx;gVooDySY2Pd!R!Y@5WoS$|bKM^{XL?H!_NqSo
zan?nMR~iA9ia|kHN1`TnXN?ip%IP=Vc}%*7hS>whR(EmIPBjMBqo%*-c;M-ij`iiQ
za^GL#@)W>9l(`)D(Ec#4Y3F);7^d#3HV5I>nD)pYnsf&Td#+z>3S)UKw#WsAQxWtC
z!!3iYN=Qs2(2{{rN)fQ5`x8;>TO@Q6u@hJL`*Ko>Sz!q`#J;Dk(qMX6rft6P%drV$
z&pu0q&nDsW{;Hx0wLm+rkj{I(@L(q<CdSL=5OE~4%yieMuVv?L1EF@p*y+3E)>SVl
zpRQoMN5c+R-A1QmdYbn5m=&*VTAu#Bm?+_amS>z73l=B|diniwoJ{qNTEZ@G@7f~A
z3Y!n<7>S;z4&C(7X{e?$s>Ywvdq+*ctKWHae$`p=>9U>AKsmlY1hR#-J7JtW<WwEQ
z1jl`sI?7HmE3QMeJf>h#Bd)ZNjj}MIgvqr2ZBO?(D>hV+*=VgZ!KR>e{yB^Gk@(O^
zPNxaaS=#6Y>(0d$ys2)wDjwgja9ADKnk)td4xdm-6&-g&Iz2hXYt`^~n0OBS&59m>
zp`<^D_O;_CC&4d8a>~UEo+}(3D^L)_3w}RYk<(7CueaVX5<x%TE}F{uIqb{VgTx4*
z)w?~4kNz#H;!fOSNq~HJFlSyox7OVVj^7}cA$W|Xo(2n+hfOe8PhG4uIa18d)o|ir
zN~<3)hXBnLnNiT$Dcpf&Br9QZ)<KBu+XvYL3TDke5sIgljx%a(SU}SOJ#<FmAI8c~
z@OpMYrX%8@ieeY3h16&Wd%Erf0ZsnWxqg-Jsa4m3H%LFC3gfEs$oh5>rCnvUx2mxQ
z^<@!<d3EU!u<KZ$+yA0Vo@_?k?U4PLM<2^?S|mlGXAje8k+JYC{PQDCck|Va&pj&8
zaQduA00C}=N-)oQoqX*gmaR@0giAl>8tz2~3h7JB!O*7H$~N~5T+=A(pljtVk<L($
zpQKVoVYNIWSfVF6=5(?@XQjxIU>We&Q?9%(01+bm92TrXuRsG5k_UL6F&F>TG;m>S
zX`ml(c8W7Me)^zhv%;cb>=b#Xrc%kF)97wBJG|eMo~%HP*i6>Df4Y2vxRri=v&A()
z%WI@NhoLFz0l&Ga9~d!5OXnYy@vs|J`QA0|d4AERrm*C{(fc&u6gN;ksfZu@N4nxX
zMqSkcG2A$zmGtr_t3j`x@I`t(J|4HpG6(4FygH)vPq1vy4036_-V_b$cu#HdA-w>g
zy~6f5RdoH)PnSV$!>WRoK&mPeZeeiplf$e_n-$cb9fkgB^&47n;9yarTF9@qGmYcY
z)lhhIr({tJp18fkxe1lw!77bj&nHV0VBE2PxG2}4j9!KltxbcErR7f`AY0KQYa~09
z8ocxy<ri_#!k^wQAkYQ4|0exn*;r{^_D8~yk#8<UiRpC-(u*&i%9nC+QlBXzty!El
zeUiZSw!2vzMX>&&zhKvR^qPqPr|m<3Kv~@fUBbh{VqmJBHGLi1BC#brH27Nwxgb##
z|IVVs;x!coM^2TqN=BomjGjKVE-<<#edB)dnpiEhWEl+7onKZ~eVx2qa3~JcZaCM`
zt8ctC^S81(O2693{=wLdPQ8-nQSsYqGm@uzl1f6NR(GrK%*j#AG95lNR5&cA))zcB
z<HIjbK;(86D&LV|Dd*kZK~g`~Q*p&!hifGwjEbynsuIjlYlW8~?2)*)m8QaLiqfHU
zb}l-<9wU*f*EE<=S!%8s?q`cN%dau5`Fv6CNG=|B<A!8#ux9uW$!@{egr-v)VA<a!
z!bp0~I;hA#lU-kAjH>d?dQX-OdS-iCnzMZDH#KGh46dNr(^D#?(uYoqIG(lC^CQIs
zE=oGP^|pWe(4S-)?p3?*<VA*o0Uql)M-yt+vsrw@c&!8Ffpuz-T@qUT37NevS9HNy
z)n4SZ(sMI7X<$Eo7%Q4A8cbV5gZ4H)*$0*k?){vV9QZ6jHkUEo)+UBfl5BT+6HZ5}
zvMs8!f*Ss0_3vOMtqx{)gR@p{nf(AJe8QFG8T@$43{3karqT;`V-c$6j)QFk+1tco
z0=Fu-6xWWxZJ*aXzqE?YZn(F+;f{H5Rq7#$6eFcGU(l!4^{giX50s!mJi2=?3~W4Q
z6;DUSA$Eg65D#_FEEKN_{!$}*x_v!0F2@h&J$1g9-*}4K{N7RF7o@&zY*4p(3{XMT
zz|)2v(`%$9rjR5TD^LHVp=-Ht{kH`-`(rbqG+x_!N3wk(0E2zK1l<3R^F$aQ@yc--
zp?xPcyd!nA&FF8M8QnE!K846N#kfaLtb%Q07X#c8QtWBg_nya#pBm$D_|ggAD=;ep
zI!ZVRrX&5`o#V${Nm*SAlU-i2{lj3m7j3@D*8%SN9a%^d4Vy%R@tCof0VnLA8L?a2
zN0*Xf;Oql{Rnz+yxy%~MArJVH-KE4T19OE3XOB6g9uKt})0i{SBoK_xzSDl9q>+Bx
zkjOpPi@h}m!r=ik7YR_|<&JMG*o#KJ%eezCNLNgWv?CQZ1IIQssXR$To|#{c<2>e@
zNW_%ogzk9x9_+sDMbgiLTix%7n9dO&2?|!}1^hrE<E@6c2j5K2BH9X81to&C`VSTt
z+rk=gO2N5uNf>jihGv29FNeK~!mf0!`cH-DY9?O&M@nE7-nu3f=OU?HfKZ?Sm!bV%
z2uMB{Sw)>0biuZAGmvDuN5hr%CyF!~`e;h~H7CjzBtg(nSFlt<YJB+XK)BZ4D`}5@
zs7$qp00~qt<~_Mr#`PF2B9#`q4tcf$B)+Yjd*WvrR9IUf@~f{AKG#Z(+r=ffMi5+U
zF;FO26lODc8Z7w@7e1lvGlvfO;Zx@(asrSPn)^=I_e5gG;lX5KU2x73eon_0<5Fm(
zr{wv0b*munu#yXR!@BG_1L9u<p>WN<fu3;>=W4_FKHM!X&S11}_8OWhtv07&;<qFC
zjOI)@gzDVLFNiVI=^L-K^&yT$;sM#I8ANv1ASe&qm*bVIV80-P^#?#R1zMfmQGPc%
zJE%b2MF40c>S?MvZxKscN?UTxu-~>2TQ~4R;p5?7Q+9jC+wZ-fw=*DXu)*4wH(@70
zBYf``FpRTEeyE_U@ka)aL|hh$(}^q)p3fcNsoV<Ltohs>AkAWntCzl1+Fz6?CE857
zxASA&LH1Zscj44r4C17@N6}PS9dwivpk4`G+UPfk$=<gAT+XH{pMG`lA1;%}5(n$s
zab+c(t37=q2g5FmD}0?Y^2O&tY$h>!uJif1oO9;nc}!yDnuG=mH@@pWx*+NQ=6KRC
zJ~oy=@K|>V#%;fGY)zr&C8d;&<+zDH!ERmed>Dw6U5mQ0a<$(pac!7Qh#|xP>no8k
zK=l~&<|B^yJlf`nI<}x1SII9F>S=0%i|Dz(h?xDyZXDet4(ftYgoIHHnQGT{a=u{Q
zL!oO01O`nE`RzziHRobL85RjQRrj~<po3r>ZQdsF#6<mUi_h1KIg#7Y?{(vbss|K8
zb@Dq3pHnTQkNipxip=Z{ZhzacnpMJ$Ct>%sVgXQy)yxzFaQndo6VLTe0^TTBM(^$Q
zbH1z#NdiSm^_Lgug!)@x?o_(ij7zv^JKFjRUKRC9z2AKoN~+oRO8o&L<nH}iqctLo
z5yMhAR8!UHvP!P62UAXB*4f=)b8JY^r7ArayYKm@hRb^cjm{3bK^#mTX1*Ju&ckas
z8M~bRu8Z+!7=Kk+4<|nSO#1BEI7imE!E^)I!{PGd$$)KEw9!hr$C+>&t0HCj-9RVP
zv{#g_#N4!!6L~C69y~f28=UL}<w6h=m)@>h84?e=C;bSqXi6Y|#M@-gXLd0hO28tH
zYO3##ziq!Tth`?<<HAD+-i)EAb)c8S-?7*7LP=FdR#=fYj}v4^@D=BHGN+<$=A*wq
zPHQa0GOuEvTa1w4@H;1=B}=|Pk#zqUIQH!dKJJAx=vJ_xIo%;T6mx0n)zHYVGzJPS
znny;F6?>fH#{au}#twb5{M?lM>1FgLNX~aC01eka0PB09xFp@G=dsqH@#nQEns6>R
zg!O{LxRG|hPQRc0Zp%@Nsvd5QQRe*oBcaV*2V|VU1hI<Mzh^xiyVTQ+Oxv}Ui$n<q
zBFN*H;shsodnX>>F)^xvo|TpokkoUenBdPo06|cF6`xQ+rBC1*(9COe(y;Q?e5Ea}
zeo`U-XtbKtMFc<;_TZX6N#pa=VgCv`oSjnzV#a*Cerp*98uz)1MSp+JG=AUC#HDpV
z4wWWweLs$swDzoSPn;vyLTQ~)eXWE8!~o7j=HB-QaR=LP`$;I#f4&~zzorA6En;UB
ziX=#T2~)eF>6qW2(N5%q0x&SaJcH;m0o#$JRLI<cy)fYN#15c=XwX?gyWpVz1AWn<
z?9T2u;(hU{M{uGe!^{+DNV=xd*YhXu4s>6c@&Dj8corXcQd(Xx^qXI;S~xi%Ao#Eh
z3mHvjQkQEK&_t<Rspxc*;V~{8FoySYmJGt>{oCw*M7>oWqnJeY+AW<mO|)N-gimmL
zUMQb_cw&%U!0!>ZlOCu$?u3JV3YA!_AdRpaI$Jq;;_g9=JEJQbCoC;}TQrg#h^2g1
z1o<a_-)I}bcH7wNcPhCIt`BDDqlce3&Q;8JU<*^<#03(c^rH9fnn%c3aPx)*LIA7e
zaLL*d*v5e?`pSN`1Xmtkn&A~mAbHme$OeA}ni<&>f}w^m1mXTG2-EgNZ^7G7)!*hl
zmc!u7l%y3u2%Uzrrh-?!M}=J8)D~B81)2XMryNg1$t}4MDA!HH9SgY-9gwsG!5)x$
z7aTHa@VjF<k8dKDHkjWKZHBAdcYC>Exf=n!YI*Ky1UM#GV$Mg9k1_-?t++M4Yt9~E
z#tMlksoWa992hS?!MdNh`}Yb!kRT29yok$)fuugH!b@~OPn1`&Y=8SJA}VAvi?lm;
zU;I_yqu$~p@uM^j%=$|<X-wtFw%G<TAYS`m1^X5|;1^fK!5OT)fFrOgn7p~aM0eJz
z3F`-(nJo)5-!Dhy%5l#&Po%Su_sKvB3SNx}AJ0{zM;68u6u%PmmAc^Nh>-=f6Jrim
zm;z!5vD{D}s$euih%((<%!S+ZH^Bp3_dLTa;(KUm5_tSS8JGp)eyLt1K5*Bc*!#UG
zXdq=ZD3)n>wdYm6g%0sX4S~MAt3}&BV^wKI0Wf783^<dVfmnabZuRR|W5RI2EFrcR
zAF0Oz6M1>>P*@p@x62g(i+q3=TL9id3Z$Yc55lt_r2FlLCEgr_4a>1RD~?BT=P!*%
z+~LN>c7IsCgmw*T{vSPDO~VTbx03WPw_;1T`dBj$Tum;%uYlxu04vxyWfYHgHSNh@
zFZ+rW#YfH0Aq6(e3-!Ec6U!S!<~X01>D;T-F>sZN!Ebw=3|am#^x&jiNMeQgf2W@P
z%70&FA;RGiWKel0Ri#mxdOBH(y_CDm32T0#IdLurLoT_Zv+;!J?9W}N0C82ULAlXX
zz~FXJ{n%;-zvJ_Uvdpxr$UHu{hb?=8sZDzq=3gjiJQw+o(B3@%6yM?rcK`K(JH-D(
zMfARtqP{z;^zxDIRpKXX{RvljDi9H3{HcaX{D>F1l6<hDhoB2V1&}@Bp&jGwGl`dN
zEcR3MFnH->#3aFM@Gl}5`k41s!Q*Tx{jiep6HX@ij9Rf4$+_4mv|B8gD$WsohwI>T
zKQ>>9t2D9dP&|#xJ4YhUaYf!%z|UYPYnn_SPNeTb4p>)ZZs&(4a3IfZD%tP)Hh9_u
z+Y3J#OA#AA39b8_MlKjd71b%}89Z<dNrD&N0Tqiy^&$5%pbtW5Px5%cqkBOjUN--&
z52a&0jujc>RiG?*`O`9%SSgXQFZuve>G?VbJBHGDQN#DsxvB^EygQBytb=jH<($+>
z<^d<iXA1q~XDg?C<l=^E5}PKol<MzpKyw$`!RB63OAdvVDO`URf-9GkD)%DEV~EWi
ztQUNF$a3uqL&+4L8Qbz!=y98M|Lm(hVq?Q7SbWXKV7sAgQDyj-l7pqPvhxViZ!x}-
zDEM!Dc0BYjx1HG{?N}R<B+=HK3Yfy4rd{(7An!(pps*^<3(te(?vg8NR3ppX1N7V^
z(=wleEQ#*OK>Bc60Rc)Fp9lkIyEYLByWC_B$Jf-~$r2$|;U1YwZlJ<eST;HLBX%%s
zoUouYHTf9z$jrmX^5GY!d*AQeN-hBI`vYwClrNl$e?oat86MB$h!Ci^ar|eqhj1#p
zot?Jrqv1H7hbJGE2f2sC3{cQ6j$Q$T7OEj(pOg(Gf2T?D)NBxuGU~#3c)98^E=pPC
zK?GTt`J94`^2PVK*w}MWz7zL%+%2{&>+w7Wok5z!NbrwuiiZGlxl+A>u;FCYDkhFa
zCvc`QMX^qnV|*wX;sMJqMYPvggQO`{4h7pi)RP;bUA#QfDk;cqyh?^5!eAy|b(yHr
zVRs`JjG@rn3~ou66>T!Bk{+UZt5pg!#g)SvF(R{!J5>QJ#tYK(tn(O}^7AvIgBvml
zBw7h$&5qqcCcsKr68E<~Z{6{UYT`Y(&b-E8`>!$|AV2vu59{!m;L9Sp*x=ML-{{Lw
zO>@L)dbP9!s-x_p3s0QL{nR`P*>ME&6+><a0O>m!!mP)S=~2FiAP|?EI=&UZUXT{Q
z0_SJ_;H_4bwQjj-T`sqvJTMMY*luhgF6!B!V<&W%<(FRwvFnF~RGe@(vi+jPpAC3M
zuCo3T^TabSF(;S8-YSu(0jJ^Y2>c1NQF*anzqQ}zjvRjEq?-6bAGrt~(xloRF2C?h
znnz&aZ72b<ya%^bR17W>xR}-aP@-+S7?YbGYe9#KjCyv!4F-kqLt)%zH8bzfg_H4t
z_V&O)q@<k${F>00F#`;Jlw4a8cSNg_n%ahV!3&LD4XC}IJq**oS>#=cuS(|`KyEWH
zcC$uNn<TJ_>H%2}Z<$9mSa4rTqm)0B5W&0I|L)&TR}wI}Fx=cGk1-R@-_EV(ePdTM
zvy#i4E$HL)J!4aZR}1IyH0`8NV51=TGO6$*u~GxE%_xCSeXg8Mp6~Dzjn_1#O1X;~
z)RtnXcdE7GkxU4{MVnQwJZ1}1Z4UxjWy-u>b7=WOg$P*`*S<>3+Zi9;T96bDUN|rl
z)cCY;_nQ#A@XJ@^31W){?no1_%s2RKNCRzHI}BX3*P*)T*TLXEoqP?D9V%C7^@Fsa
z4g28w?g+0^9pdYH9RckzW#ujl>N9^y{c!_jPhrchJX``kWtdSCEpYVO7my!)g~Gj=
zMkz`w+CuRM#YG7TZC?ULh;*aD)hr&iBmgt#&>wV7ja~d_v6Uo@H6!N45pe^M&|$cE
znC#A5BjH&emL9C;@&oro=}9T*&gY2~#eZ*0^NE=9^vl@Pt2e7I?$nxo2e8sCfq!In
zAmPRm`Sm9@JZSg;Ukoa+b$cCEXv+NL65qYgIhum}5PQF=E}awqy(8qs*>C_5quNu(
zAIh?VqFLDPwF)I3IT#;Vxt@p@%W<c7g7eIOlVU#A^j_@Qb6Fn5pw}NZ%Ktv_S7Rnu
z$8oOUspxb(V(jpe!t{%M=5)~Y2Q0#F*b@Idlesm7P)}hF_4s?MOfLKQXb|K-Yxlg-
zv^7&}yi0L*j;NYaejo<5GSNi_aZoKjC0s$~P0%WY9*vtTjN*&x$Ml8o)B(BQ`kUp`
zxDSg+=KjPXF))IF$@AiODJEVJ4=e+-21~D?nu}O+7t!jq6|xfyKmfyi3lQti@ahiu
z#P}jRt;8~N-+)|gc?b7B-mSx1o*jI^c0owi9z2Dx9uSouDOJsChFF>MMyMXknJFlA
z{${)NCiyh5PD_ydNmHOESG!Uap5i*l1~6$2N3HtsPsxu6`^og<KhLBA(&F-BH6jK<
F{|Dyf41fRt

literal 0
HcmV?d00001

diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/delegate.go b/vendor/github.com/containernetworking/cni/pkg/invoke/delegate.go
index c78a69eebc..21efdf802b 100644
--- a/vendor/github.com/containernetworking/cni/pkg/invoke/delegate.go
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/delegate.go
@@ -22,32 +22,54 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 )
 
-func DelegateAdd(delegatePlugin string, netconf []byte) (types.Result, error) {
-	if os.Getenv("CNI_COMMAND") != "ADD" {
-		return nil, fmt.Errorf("CNI_COMMAND is not ADD")
+func delegateAddOrGet(command, delegatePlugin string, netconf []byte, exec Exec) (types.Result, error) {
+	if exec == nil {
+		exec = defaultExec
 	}
 
 	paths := filepath.SplitList(os.Getenv("CNI_PATH"))
-
-	pluginPath, err := FindInPath(delegatePlugin, paths)
+	pluginPath, err := exec.FindInPath(delegatePlugin, paths)
 	if err != nil {
 		return nil, err
 	}
 
-	return ExecPluginWithResult(pluginPath, netconf, ArgsFromEnv())
+	return ExecPluginWithResult(pluginPath, netconf, ArgsFromEnv(), exec)
+}
+
+// DelegateAdd calls the given delegate plugin with the CNI ADD action and
+// JSON configuration
+func DelegateAdd(delegatePlugin string, netconf []byte, exec Exec) (types.Result, error) {
+	if os.Getenv("CNI_COMMAND") != "ADD" {
+		return nil, fmt.Errorf("CNI_COMMAND is not ADD")
+	}
+	return delegateAddOrGet("ADD", delegatePlugin, netconf, exec)
+}
+
+// DelegateGet calls the given delegate plugin with the CNI GET action and
+// JSON configuration
+func DelegateGet(delegatePlugin string, netconf []byte, exec Exec) (types.Result, error) {
+	if os.Getenv("CNI_COMMAND") != "GET" {
+		return nil, fmt.Errorf("CNI_COMMAND is not GET")
+	}
+	return delegateAddOrGet("GET", delegatePlugin, netconf, exec)
 }
 
-func DelegateDel(delegatePlugin string, netconf []byte) error {
+// DelegateDel calls the given delegate plugin with the CNI DEL action and
+// JSON configuration
+func DelegateDel(delegatePlugin string, netconf []byte, exec Exec) error {
+	if exec == nil {
+		exec = defaultExec
+	}
+
 	if os.Getenv("CNI_COMMAND") != "DEL" {
 		return fmt.Errorf("CNI_COMMAND is not DEL")
 	}
 
 	paths := filepath.SplitList(os.Getenv("CNI_PATH"))
-
-	pluginPath, err := FindInPath(delegatePlugin, paths)
+	pluginPath, err := exec.FindInPath(delegatePlugin, paths)
 	if err != nil {
 		return err
 	}
 
-	return ExecPluginWithoutResult(pluginPath, netconf, ArgsFromEnv())
+	return ExecPluginWithoutResult(pluginPath, netconf, ArgsFromEnv(), exec)
 }
diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/exec.go b/vendor/github.com/containernetworking/cni/pkg/invoke/exec.go
index fc47e7c825..cf019d3a04 100644
--- a/vendor/github.com/containernetworking/cni/pkg/invoke/exec.go
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/exec.go
@@ -22,34 +22,62 @@ import (
 	"github.com/containernetworking/cni/pkg/version"
 )
 
-func ExecPluginWithResult(pluginPath string, netconf []byte, args CNIArgs) (types.Result, error) {
-	return defaultPluginExec.WithResult(pluginPath, netconf, args)
+// Exec is an interface encapsulates all operations that deal with finding
+// and executing a CNI plugin. Tests may provide a fake implementation
+// to avoid writing fake plugins to temporary directories during the test.
+type Exec interface {
+	ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error)
+	FindInPath(plugin string, paths []string) (string, error)
+	Decode(jsonBytes []byte) (version.PluginInfo, error)
 }
 
-func ExecPluginWithoutResult(pluginPath string, netconf []byte, args CNIArgs) error {
-	return defaultPluginExec.WithoutResult(pluginPath, netconf, args)
-}
-
-func GetVersionInfo(pluginPath string) (version.PluginInfo, error) {
-	return defaultPluginExec.GetVersionInfo(pluginPath)
-}
-
-var defaultPluginExec = &PluginExec{
-	RawExec:        &RawExec{Stderr: os.Stderr},
-	VersionDecoder: &version.PluginDecoder{},
-}
+// For example, a testcase could pass an instance of the following fakeExec
+// object to ExecPluginWithResult() to verify the incoming stdin and environment
+// and provide a tailored response:
+//
+//import (
+//	"encoding/json"
+//	"path"
+//	"strings"
+//)
+//
+//type fakeExec struct {
+//	version.PluginDecoder
+//}
+//
+//func (f *fakeExec) ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error) {
+//	net := &types.NetConf{}
+//	err := json.Unmarshal(stdinData, net)
+//	if err != nil {
+//		return nil, fmt.Errorf("failed to unmarshal configuration: %v", err)
+//	}
+//	pluginName := path.Base(pluginPath)
+//	if pluginName != net.Type {
+//		return nil, fmt.Errorf("plugin name %q did not match config type %q", pluginName, net.Type)
+//	}
+//	for _, e := range environ {
+//		// Check environment for forced failure request
+//		parts := strings.Split(e, "=")
+//		if len(parts) > 0 && parts[0] == "FAIL" {
+//			return nil, fmt.Errorf("failed to execute plugin %s", pluginName)
+//		}
+//	}
+//	return []byte("{\"CNIVersion\":\"0.4.0\"}"), nil
+//}
+//
+//func (f *fakeExec) FindInPath(plugin string, paths []string) (string, error) {
+//	if len(paths) > 0 {
+//		return path.Join(paths[0], plugin), nil
+//	}
+//	return "", fmt.Errorf("failed to find plugin %s in paths %v", plugin, paths)
+//}
 
-type PluginExec struct {
-	RawExec interface {
-		ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error)
+func ExecPluginWithResult(pluginPath string, netconf []byte, args CNIArgs, exec Exec) (types.Result, error) {
+	if exec == nil {
+		exec = defaultExec
 	}
-	VersionDecoder interface {
-		Decode(jsonBytes []byte) (version.PluginInfo, error)
-	}
-}
 
-func (e *PluginExec) WithResult(pluginPath string, netconf []byte, args CNIArgs) (types.Result, error) {
-	stdoutBytes, err := e.RawExec.ExecPlugin(pluginPath, netconf, args.AsEnv())
+	stdoutBytes, err := exec.ExecPlugin(pluginPath, netconf, args.AsEnv())
 	if err != nil {
 		return nil, err
 	}
@@ -64,8 +92,11 @@ func (e *PluginExec) WithResult(pluginPath string, netconf []byte, args CNIArgs)
 	return version.NewResult(confVersion, stdoutBytes)
 }
 
-func (e *PluginExec) WithoutResult(pluginPath string, netconf []byte, args CNIArgs) error {
-	_, err := e.RawExec.ExecPlugin(pluginPath, netconf, args.AsEnv())
+func ExecPluginWithoutResult(pluginPath string, netconf []byte, args CNIArgs, exec Exec) error {
+	if exec == nil {
+		exec = defaultExec
+	}
+	_, err := exec.ExecPlugin(pluginPath, netconf, args.AsEnv())
 	return err
 }
 
@@ -73,7 +104,10 @@ func (e *PluginExec) WithoutResult(pluginPath string, netconf []byte, args CNIAr
 // For recent-enough plugins, it uses the information returned by the VERSION
 // command.  For older plugins which do not recognize that command, it reports
 // version 0.1.0
-func (e *PluginExec) GetVersionInfo(pluginPath string) (version.PluginInfo, error) {
+func GetVersionInfo(pluginPath string, exec Exec) (version.PluginInfo, error) {
+	if exec == nil {
+		exec = defaultExec
+	}
 	args := &Args{
 		Command: "VERSION",
 
@@ -83,7 +117,7 @@ func (e *PluginExec) GetVersionInfo(pluginPath string) (version.PluginInfo, erro
 		Path:   "dummy",
 	}
 	stdin := []byte(fmt.Sprintf(`{"cniVersion":%q}`, version.Current()))
-	stdoutBytes, err := e.RawExec.ExecPlugin(pluginPath, stdin, args.AsEnv())
+	stdoutBytes, err := exec.ExecPlugin(pluginPath, stdin, args.AsEnv())
 	if err != nil {
 		if err.Error() == "unknown CNI_COMMAND: VERSION" {
 			return version.PluginSupports("0.1.0"), nil
@@ -91,5 +125,19 @@ func (e *PluginExec) GetVersionInfo(pluginPath string) (version.PluginInfo, erro
 		return nil, err
 	}
 
-	return e.VersionDecoder.Decode(stdoutBytes)
+	return exec.Decode(stdoutBytes)
+}
+
+// DefaultExec is an object that implements the Exec interface which looks
+// for and executes plugins from disk.
+type DefaultExec struct {
+	*RawExec
+	version.PluginDecoder
+}
+
+// DefaultExec implements the Exec interface
+var _ Exec = &DefaultExec{}
+
+var defaultExec = &DefaultExec{
+	RawExec: &RawExec{Stderr: os.Stderr},
 }
diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/cni_args.go b/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/cni_args.go
new file mode 100644
index 0000000000..5b1ba29e7c
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/cni_args.go
@@ -0,0 +1,27 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fakes
+
+type CNIArgs struct {
+	AsEnvCall struct {
+		Returns struct {
+			Env []string
+		}
+	}
+}
+
+func (a *CNIArgs) AsEnv() []string {
+	return a.AsEnvCall.Returns.Env
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/raw_exec.go b/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/raw_exec.go
new file mode 100644
index 0000000000..4a30ec1e70
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/raw_exec.go
@@ -0,0 +1,52 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fakes
+
+type RawExec struct {
+	ExecPluginCall struct {
+		Received struct {
+			PluginPath string
+			StdinData  []byte
+			Environ    []string
+		}
+		Returns struct {
+			ResultBytes []byte
+			Error       error
+		}
+	}
+	FindInPathCall struct {
+		Received struct {
+			Plugin string
+			Paths  []string
+		}
+		Returns struct {
+			Path  string
+			Error error
+		}
+	}
+}
+
+func (e *RawExec) ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error) {
+	e.ExecPluginCall.Received.PluginPath = pluginPath
+	e.ExecPluginCall.Received.StdinData = stdinData
+	e.ExecPluginCall.Received.Environ = environ
+	return e.ExecPluginCall.Returns.ResultBytes, e.ExecPluginCall.Returns.Error
+}
+
+func (e *RawExec) FindInPath(plugin string, paths []string) (string, error) {
+	e.FindInPathCall.Received.Plugin = plugin
+	e.FindInPathCall.Received.Paths = paths
+	return e.FindInPathCall.Returns.Path, e.FindInPathCall.Returns.Error
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/version_decoder.go b/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/version_decoder.go
new file mode 100644
index 0000000000..72d29733a3
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/fakes/version_decoder.go
@@ -0,0 +1,34 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fakes
+
+import "github.com/containernetworking/cni/pkg/version"
+
+type VersionDecoder struct {
+	DecodeCall struct {
+		Received struct {
+			JSONBytes []byte
+		}
+		Returns struct {
+			PluginInfo version.PluginInfo
+			Error      error
+		}
+	}
+}
+
+func (e *VersionDecoder) Decode(jsonData []byte) (version.PluginInfo, error) {
+	e.DecodeCall.Received.JSONBytes = jsonData
+	return e.DecodeCall.Returns.PluginInfo, e.DecodeCall.Returns.Error
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go b/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go
index 93f1e75d9f..a598f09c2b 100644
--- a/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go
@@ -57,3 +57,7 @@ func pluginErr(err error, output []byte) error {
 
 	return err
 }
+
+func (e *RawExec) FindInPath(plugin string, paths []string) (string, error) {
+	return FindInPath(plugin, paths)
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/skel/skel.go b/vendor/github.com/containernetworking/cni/pkg/skel/skel.go
new file mode 100644
index 0000000000..e565c85d0d
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/skel/skel.go
@@ -0,0 +1,296 @@
+// Copyright 2014-2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package skel provides skeleton code for a CNI plugin.
+// In particular, it implements argument parsing and validation.
+package skel
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"os"
+
+	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/version"
+)
+
+// CmdArgs captures all the arguments passed in to the plugin
+// via both env vars and stdin
+type CmdArgs struct {
+	ContainerID string
+	Netns       string
+	IfName      string
+	Args        string
+	Path        string
+	StdinData   []byte
+}
+
+type dispatcher struct {
+	Getenv func(string) string
+	Stdin  io.Reader
+	Stdout io.Writer
+	Stderr io.Writer
+
+	ConfVersionDecoder version.ConfigDecoder
+	VersionReconciler  version.Reconciler
+}
+
+type reqForCmdEntry map[string]bool
+
+func (t *dispatcher) getCmdArgsFromEnv() (string, *CmdArgs, error) {
+	var cmd, contID, netns, ifName, args, path string
+
+	vars := []struct {
+		name      string
+		val       *string
+		reqForCmd reqForCmdEntry
+	}{
+		{
+			"CNI_COMMAND",
+			&cmd,
+			reqForCmdEntry{
+				"ADD": true,
+				"GET": true,
+				"DEL": true,
+			},
+		},
+		{
+			"CNI_CONTAINERID",
+			&contID,
+			reqForCmdEntry{
+				"ADD": true,
+				"GET": true,
+				"DEL": true,
+			},
+		},
+		{
+			"CNI_NETNS",
+			&netns,
+			reqForCmdEntry{
+				"ADD": true,
+				"GET": true,
+				"DEL": false,
+			},
+		},
+		{
+			"CNI_IFNAME",
+			&ifName,
+			reqForCmdEntry{
+				"ADD": true,
+				"GET": true,
+				"DEL": true,
+			},
+		},
+		{
+			"CNI_ARGS",
+			&args,
+			reqForCmdEntry{
+				"ADD": false,
+				"GET": false,
+				"DEL": false,
+			},
+		},
+		{
+			"CNI_PATH",
+			&path,
+			reqForCmdEntry{
+				"ADD": true,
+				"GET": true,
+				"DEL": true,
+			},
+		},
+	}
+
+	argsMissing := false
+	for _, v := range vars {
+		*v.val = t.Getenv(v.name)
+		if *v.val == "" {
+			if v.reqForCmd[cmd] || v.name == "CNI_COMMAND" {
+				fmt.Fprintf(t.Stderr, "%v env variable missing\n", v.name)
+				argsMissing = true
+			}
+		}
+	}
+
+	if argsMissing {
+		return "", nil, fmt.Errorf("required env variables missing")
+	}
+
+	if cmd == "VERSION" {
+		t.Stdin = bytes.NewReader(nil)
+	}
+
+	stdinData, err := ioutil.ReadAll(t.Stdin)
+	if err != nil {
+		return "", nil, fmt.Errorf("error reading from stdin: %v", err)
+	}
+
+	cmdArgs := &CmdArgs{
+		ContainerID: contID,
+		Netns:       netns,
+		IfName:      ifName,
+		Args:        args,
+		Path:        path,
+		StdinData:   stdinData,
+	}
+	return cmd, cmdArgs, nil
+}
+
+func createTypedError(f string, args ...interface{}) *types.Error {
+	return &types.Error{
+		Code: 100,
+		Msg:  fmt.Sprintf(f, args...),
+	}
+}
+
+func (t *dispatcher) checkVersionAndCall(cmdArgs *CmdArgs, pluginVersionInfo version.PluginInfo, toCall func(*CmdArgs) error) error {
+	configVersion, err := t.ConfVersionDecoder.Decode(cmdArgs.StdinData)
+	if err != nil {
+		return err
+	}
+	verErr := t.VersionReconciler.Check(configVersion, pluginVersionInfo)
+	if verErr != nil {
+		return &types.Error{
+			Code:    types.ErrIncompatibleCNIVersion,
+			Msg:     "incompatible CNI versions",
+			Details: verErr.Details(),
+		}
+	}
+
+	return toCall(cmdArgs)
+}
+
+func validateConfig(jsonBytes []byte) error {
+	var conf struct {
+		Name string `json:"name"`
+	}
+	if err := json.Unmarshal(jsonBytes, &conf); err != nil {
+		return fmt.Errorf("error reading network config: %s", err)
+	}
+	if conf.Name == "" {
+		return fmt.Errorf("missing network name")
+	}
+	return nil
+}
+
+func (t *dispatcher) pluginMain(cmdAdd, cmdGet, cmdDel func(_ *CmdArgs) error, versionInfo version.PluginInfo, about string) *types.Error {
+	cmd, cmdArgs, err := t.getCmdArgsFromEnv()
+	if err != nil {
+		// Print the about string to stderr when no command is set
+		if t.Getenv("CNI_COMMAND") == "" && about != "" {
+			fmt.Fprintln(t.Stderr, about)
+		}
+		return createTypedError(err.Error())
+	}
+
+	if cmd != "VERSION" {
+		err = validateConfig(cmdArgs.StdinData)
+		if err != nil {
+			return createTypedError(err.Error())
+		}
+	}
+
+	switch cmd {
+	case "ADD":
+		err = t.checkVersionAndCall(cmdArgs, versionInfo, cmdAdd)
+	case "GET":
+		configVersion, err := t.ConfVersionDecoder.Decode(cmdArgs.StdinData)
+		if err != nil {
+			return createTypedError(err.Error())
+		}
+		if gtet, err := version.GreaterThanOrEqualTo(configVersion, "0.4.0"); err != nil {
+			return createTypedError(err.Error())
+		} else if !gtet {
+			return &types.Error{
+				Code: types.ErrIncompatibleCNIVersion,
+				Msg:  "config version does not allow GET",
+			}
+		}
+		for _, pluginVersion := range versionInfo.SupportedVersions() {
+			gtet, err := version.GreaterThanOrEqualTo(pluginVersion, configVersion)
+			if err != nil {
+				return createTypedError(err.Error())
+			} else if gtet {
+				if err := t.checkVersionAndCall(cmdArgs, versionInfo, cmdGet); err != nil {
+					return createTypedError(err.Error())
+				}
+				return nil
+			}
+		}
+		return &types.Error{
+			Code: types.ErrIncompatibleCNIVersion,
+			Msg:  "plugin version does not allow GET",
+		}
+	case "DEL":
+		err = t.checkVersionAndCall(cmdArgs, versionInfo, cmdDel)
+	case "VERSION":
+		err = versionInfo.Encode(t.Stdout)
+	default:
+		return createTypedError("unknown CNI_COMMAND: %v", cmd)
+	}
+
+	if err != nil {
+		if e, ok := err.(*types.Error); ok {
+			// don't wrap Error in Error
+			return e
+		}
+		return createTypedError(err.Error())
+	}
+	return nil
+}
+
+// PluginMainWithError is the core "main" for a plugin. It accepts
+// callback functions for add, get, and del CNI commands and returns an error.
+//
+// The caller must also specify what CNI spec versions the plugin supports.
+//
+// It is the responsibility of the caller to check for non-nil error return.
+//
+// For a plugin to comply with the CNI spec, it must print any error to stdout
+// as JSON and then exit with nonzero status code.
+//
+// To let this package automatically handle errors and call os.Exit(1) for you,
+// use PluginMain() instead.
+func PluginMainWithError(cmdAdd, cmdGet, cmdDel func(_ *CmdArgs) error, versionInfo version.PluginInfo, about string) *types.Error {
+	return (&dispatcher{
+		Getenv: os.Getenv,
+		Stdin:  os.Stdin,
+		Stdout: os.Stdout,
+		Stderr: os.Stderr,
+	}).pluginMain(cmdAdd, cmdGet, cmdDel, versionInfo, about)
+}
+
+// PluginMain is the core "main" for a plugin which includes automatic error handling.
+//
+// The caller must also specify what CNI spec versions the plugin supports.
+//
+// The caller can specify an "about" string, which is printed on stderr
+// when no CNI_COMMAND is specified. The reccomended output is "CNI plugin <foo> v<version>"
+//
+// When an error occurs in either cmdAdd, cmdGet, or cmdDel, PluginMain will print the error
+// as JSON to stdout and call os.Exit(1).
+//
+// To have more control over error handling, use PluginMainWithError() instead.
+func PluginMain(cmdAdd, cmdGet, cmdDel func(_ *CmdArgs) error, versionInfo version.PluginInfo, about string) {
+	if e := PluginMainWithError(cmdAdd, cmdGet, cmdDel, versionInfo, about); e != nil {
+		if err := e.Print(); err != nil {
+			log.Print("Error writing error JSON to stdout: ", err)
+		}
+		os.Exit(1)
+	}
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/types/current/types.go b/vendor/github.com/containernetworking/cni/pkg/types/current/types.go
index caac92ba77..92980c1a79 100644
--- a/vendor/github.com/containernetworking/cni/pkg/types/current/types.go
+++ b/vendor/github.com/containernetworking/cni/pkg/types/current/types.go
@@ -24,9 +24,9 @@ import (
 	"github.com/containernetworking/cni/pkg/types/020"
 )
 
-const ImplementedSpecVersion string = "0.3.1"
+const ImplementedSpecVersion string = "0.4.0"
 
-var SupportedVersions = []string{"0.3.0", ImplementedSpecVersion}
+var SupportedVersions = []string{"0.3.0", "0.3.1", ImplementedSpecVersion}
 
 func NewResult(data []byte) (types.Result, error) {
 	result := &Result{}
@@ -196,7 +196,7 @@ func (r *Result) Version() string {
 
 func (r *Result) GetAsVersion(version string) (types.Result, error) {
 	switch version {
-	case "0.3.0", ImplementedSpecVersion:
+	case "0.3.0", "0.3.1", ImplementedSpecVersion:
 		r.CNIVersion = version
 		return r, nil
 	case types020.SupportedVersions[0], types020.SupportedVersions[1], types020.SupportedVersions[2]:
diff --git a/vendor/github.com/containernetworking/cni/pkg/types/types.go b/vendor/github.com/containernetworking/cni/pkg/types/types.go
index 81175d4eae..4684a32076 100644
--- a/vendor/github.com/containernetworking/cni/pkg/types/types.go
+++ b/vendor/github.com/containernetworking/cni/pkg/types/types.go
@@ -63,10 +63,12 @@ type NetConf struct {
 	Name         string          `json:"name,omitempty"`
 	Type         string          `json:"type,omitempty"`
 	Capabilities map[string]bool `json:"capabilities,omitempty"`
-	IPAM         struct {
-		Type string `json:"type,omitempty"`
-	} `json:"ipam,omitempty"`
-	DNS DNS `json:"dns"`
+	IPAM         IPAM            `json:"ipam,omitempty"`
+	DNS          DNS             `json:"dns"`
+}
+
+type IPAM struct {
+	Type string `json:"type,omitempty"`
 }
 
 // NetConfList describes an ordered list of networks.
diff --git a/vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/example_runtime.go b/vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/example_runtime.go
new file mode 100644
index 0000000000..055d7930fd
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/example_runtime.go
@@ -0,0 +1,219 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package legacy_examples
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	noop_debug "github.com/containernetworking/cni/plugins/test/noop/debug"
+)
+
+// An ExampleRuntime is a small program that uses libcni to invoke a network plugin.
+// It should call ADD and DELETE, verifying all intermediate steps
+// and data structures.
+type ExampleRuntime struct {
+	Example
+	NetConfs []string // The network configuration names to pass
+}
+
+type exampleNetConfTemplate struct {
+	conf   string
+	result string
+}
+
+// NetConfs are various versioned network configuration files. Examples should
+// specify which version they expect
+var netConfTemplates = map[string]exampleNetConfTemplate{
+	"unversioned": {
+		conf: `{
+	"name": "default",
+	"type": "noop",
+	"debugFile": "%s"
+}`,
+		result: `{
+	"ip4": {
+		"ip": "1.2.3.30/24",
+		"gateway": "1.2.3.1",
+		"routes": [
+			{
+				"dst": "15.5.6.0/24",
+				"gw": "15.5.6.8"
+			}
+		]
+	},
+	"ip6": {
+		"ip": "abcd:1234:ffff::cdde/64",
+		"gateway": "abcd:1234:ffff::1",
+		"routes": [
+			{
+				"dst": "1111:dddd::/80",
+				"gw": "1111:dddd::aaaa"
+			}
+		]
+	},
+	"dns":{}
+}`,
+	},
+	"0.1.0": {
+		conf: `{
+	"cniVersion": "0.1.0",
+	"name": "default",
+	"type": "noop",
+	"debugFile": "%s"
+}`,
+		result: `{
+	"cniVersion": "0.1.0",
+	"ip4": {
+		"ip": "1.2.3.30/24",
+		"gateway": "1.2.3.1",
+		"routes": [
+			{
+				"dst": "15.5.6.0/24",
+				"gw": "15.5.6.8"
+			}
+		]
+	},
+	"ip6": {
+		"ip": "abcd:1234:ffff::cdde/64",
+		"gateway": "abcd:1234:ffff::1",
+		"routes": [
+			{
+				"dst": "1111:dddd::/80",
+				"gw": "1111:dddd::aaaa"
+			}
+		]
+	},
+	"dns":{}
+}`,
+	},
+}
+
+func (e *ExampleRuntime) GenerateNetConf(name string) (*ExampleNetConf, error) {
+	template, ok := netConfTemplates[name]
+	if !ok {
+		return nil, fmt.Errorf("unknown example net config template %q", name)
+	}
+
+	debugFile, err := ioutil.TempFile("", "cni_debug")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create noop plugin debug file: %v", err)
+	}
+	debugFilePath := debugFile.Name()
+
+	debug := &noop_debug.Debug{
+		ReportResult: template.result,
+	}
+	if err := debug.WriteDebug(debugFilePath); err != nil {
+		os.Remove(debugFilePath)
+		return nil, fmt.Errorf("failed to write noop plugin debug file %q: %v", debugFilePath, err)
+	}
+	conf := &ExampleNetConf{
+		Config:        fmt.Sprintf(template.conf, debugFilePath),
+		debugFilePath: debugFilePath,
+	}
+
+	return conf, nil
+}
+
+type ExampleNetConf struct {
+	Config        string
+	debugFilePath string
+}
+
+func (c *ExampleNetConf) Cleanup() {
+	os.Remove(c.debugFilePath)
+}
+
+// V010_Runtime creates a simple noop network configuration, then
+// executes libcni against the the noop test plugin.
+var V010_Runtime = ExampleRuntime{
+	NetConfs: []string{"unversioned", "0.1.0"},
+	Example: Example{
+		Name:          "example_invoker_v010",
+		CNIRepoGitRef: "c0d34c69", //version with ns.Do
+		PluginSource: `package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"github.com/containernetworking/cni/libcni"
+)
+
+func main(){
+	code :=	exec()
+	os.Exit(code)
+}
+
+func exec() int {
+	confBytes, err := ioutil.ReadAll(os.Stdin)
+	if err != nil {
+		fmt.Printf("could not read netconfig from stdin: %+v", err)
+		return 1
+	}
+
+	netConf, err := libcni.ConfFromBytes(confBytes)
+	if err != nil {
+		fmt.Printf("could not parse netconfig: %+v", err)
+		return 1
+	}
+	fmt.Printf("Parsed network configuration: %+v\n", netConf.Network)
+
+	if len(os.Args) == 1 {
+		fmt.Printf("Expect CNI plugin paths in argv")
+		return 1
+	}
+
+	runtimeConf := &libcni.RuntimeConf{
+		ContainerID: "some-container-id",
+		NetNS:       "/some/netns/path",
+		IfName:      "eth0",
+	}
+
+	cniConfig := &libcni.CNIConfig{Path: os.Args[1:]}
+
+	result, err := cniConfig.AddNetwork(netConf, runtimeConf)
+	if err != nil {
+		fmt.Printf("AddNetwork failed: %+v", err)
+		return 2
+	}
+	fmt.Printf("AddNetwork result: %+v", result)
+
+	// Validate expected results
+	const expectedIP4 string = "1.2.3.30/24"
+	if result.IP4.IP.String() != expectedIP4 {
+		fmt.Printf("Expected IPv4 address %q, got %q", expectedIP4, result.IP4.IP.String())
+		return 3
+	}
+	const expectedIP6 string = "abcd:1234:ffff::cdde/64"
+	if result.IP6.IP.String() != expectedIP6 {
+		fmt.Printf("Expected IPv6 address %q, got %q", expectedIP6, result.IP6.IP.String())
+		return 4
+	}
+
+	err = cniConfig.DelNetwork(netConf, runtimeConf)
+	if err != nil {
+		fmt.Printf("DelNetwork failed: %v", err)
+		return 5
+	}
+
+	return 0
+}
+`,
+	},
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/examples.go b/vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/examples.go
new file mode 100644
index 0000000000..787d83dc6b
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/version/legacy_examples/examples.go
@@ -0,0 +1,143 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package legacy_examples contains sample code from prior versions of
+// the CNI library, for use in verifying backwards compatibility.
+package legacy_examples
+
+import (
+	"io/ioutil"
+	"net"
+	"path/filepath"
+	"runtime"
+	"sync"
+
+	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/020"
+	"github.com/containernetworking/cni/pkg/version/testhelpers"
+)
+
+// An Example is a Git reference to the CNI repo and a Golang CNI plugin that
+// builds against that version of the repo.
+//
+// By convention, every Example plugin returns an ADD result that is
+// semantically equivalent to the ExpectedResult.
+type Example struct {
+	Name          string
+	CNIRepoGitRef string
+	PluginSource  string
+}
+
+var buildDir = ""
+var buildDirLock sync.Mutex
+
+func ensureBuildDirExists() error {
+	buildDirLock.Lock()
+	defer buildDirLock.Unlock()
+
+	if buildDir != "" {
+		return nil
+	}
+
+	var err error
+	buildDir, err = ioutil.TempDir("", "cni-example-plugins")
+	return err
+}
+
+// Build builds the example, returning the path to the binary
+func (e Example) Build() (string, error) {
+	if err := ensureBuildDirExists(); err != nil {
+		return "", err
+	}
+
+	outBinPath := filepath.Join(buildDir, e.Name)
+	if runtime.GOOS == "windows" {
+		outBinPath += ".exe"
+	}
+
+	if err := testhelpers.BuildAt([]byte(e.PluginSource), e.CNIRepoGitRef, outBinPath); err != nil {
+		return "", err
+	}
+	return outBinPath, nil
+}
+
+// V010 acts like a CNI plugin from the v0.1.0 era
+var V010 = Example{
+	Name:          "example_v010",
+	CNIRepoGitRef: "2c482f4",
+	PluginSource: `package main
+
+import (
+	"net"
+
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/types"
+)
+
+var result = types.Result{
+	IP4: &types.IPConfig{
+		IP: net.IPNet{
+			IP:   net.ParseIP("10.1.2.3"),
+			Mask: net.CIDRMask(24, 32),
+		},
+		Gateway: net.ParseIP("10.1.2.1"),
+		Routes: []types.Route{
+			types.Route{
+				Dst: net.IPNet{
+					IP:   net.ParseIP("0.0.0.0"),
+					Mask: net.CIDRMask(0, 32),
+				},
+				GW: net.ParseIP("10.1.0.1"),
+			},
+		},
+	},
+	DNS: types.DNS{
+		Nameservers: []string{"8.8.8.8"},
+		Domain:      "example.com",
+	},
+}
+
+func c(_ *skel.CmdArgs) error { result.Print(); return nil }
+
+func main() { skel.PluginMain(c, c) }
+`,
+}
+
+// ExpectedResult is the current representation of the plugin result
+// that is expected from each of the examples.
+//
+// As we change the CNI spec, the Result type and this value may change.
+// The text of the example plugins should not.
+var ExpectedResult = &types020.Result{
+	IP4: &types020.IPConfig{
+		IP: net.IPNet{
+			IP:   net.ParseIP("10.1.2.3"),
+			Mask: net.CIDRMask(24, 32),
+		},
+		Gateway: net.ParseIP("10.1.2.1"),
+		Routes: []types.Route{
+			types.Route{
+				Dst: net.IPNet{
+					IP:   net.ParseIP("0.0.0.0"),
+					Mask: net.CIDRMask(0, 32),
+				},
+				GW: net.ParseIP("10.1.0.1"),
+			},
+		},
+	},
+	DNS: types.DNS{
+		Nameservers: []string{"8.8.8.8"},
+		Domain:      "example.com",
+	},
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/version/plugin.go b/vendor/github.com/containernetworking/cni/pkg/version/plugin.go
index 8a46728105..612335a81d 100644
--- a/vendor/github.com/containernetworking/cni/pkg/version/plugin.go
+++ b/vendor/github.com/containernetworking/cni/pkg/version/plugin.go
@@ -18,6 +18,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"strconv"
+	"strings"
 )
 
 // PluginInfo reports information about CNI versioning
@@ -79,3 +81,60 @@ func (*PluginDecoder) Decode(jsonBytes []byte) (PluginInfo, error) {
 	}
 	return &info, nil
 }
+
+// ParseVersion parses a version string like "3.0.1" or "0.4.5" into major,
+// minor, and micro numbers or returns an error
+func ParseVersion(version string) (int, int, int, error) {
+	var major, minor, micro int
+	parts := strings.Split(version, ".")
+	if len(parts) == 0 || len(parts) >= 4 {
+		return -1, -1, -1, fmt.Errorf("invalid version %q: too many or too few parts", version)
+	}
+
+	major, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return -1, -1, -1, fmt.Errorf("failed to convert major version part %q: %v", parts[0], err)
+	}
+
+	if len(parts) >= 2 {
+		minor, err = strconv.Atoi(parts[1])
+		if err != nil {
+			return -1, -1, -1, fmt.Errorf("failed to convert minor version part %q: %v", parts[1], err)
+		}
+	}
+
+	if len(parts) >= 3 {
+		micro, err = strconv.Atoi(parts[2])
+		if err != nil {
+			return -1, -1, -1, fmt.Errorf("failed to convert micro version part %q: %v", parts[2], err)
+		}
+	}
+
+	return major, minor, micro, nil
+}
+
+// GreaterThanOrEqualTo takes two string versions, parses them into major/minor/micro
+// nubmers, and compares them to determine whether the first version is greater
+// than or equal to the second
+func GreaterThanOrEqualTo(version, otherVersion string) (bool, error) {
+	firstMajor, firstMinor, firstMicro, err := ParseVersion(version)
+	if err != nil {
+		return false, err
+	}
+
+	secondMajor, secondMinor, secondMicro, err := ParseVersion(otherVersion)
+	if err != nil {
+		return false, err
+	}
+
+	if firstMajor > secondMajor {
+		return true, nil
+	} else if firstMajor == secondMajor {
+		if firstMinor > secondMinor {
+			return true, nil
+		} else if firstMinor == secondMinor && firstMicro >= secondMicro {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/version/testhelpers/testhelpers.go b/vendor/github.com/containernetworking/cni/pkg/version/testhelpers/testhelpers.go
new file mode 100644
index 0000000000..773d012007
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/pkg/version/testhelpers/testhelpers.go
@@ -0,0 +1,156 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package testhelpers supports testing of CNI components of different versions
+//
+// For example, to build a plugin against an old version of the CNI library,
+// we can pass the plugin's source and the old git commit reference to BuildAt.
+// We could then test how the built binary responds when called by the latest
+// version of this library.
+package testhelpers
+
+import (
+	"fmt"
+	"io/ioutil"
+	"math/rand"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const packageBaseName = "github.com/containernetworking/cni"
+
+func run(cmd *exec.Cmd) error {
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		command := strings.Join(cmd.Args, " ")
+		return fmt.Errorf("running %q: %s", command, out)
+	}
+	return nil
+}
+
+func goBuildEnviron(gopath string) []string {
+	environ := os.Environ()
+	for i, kvp := range environ {
+		if strings.HasPrefix(kvp, "GOPATH=") {
+			environ[i] = "GOPATH=" + gopath
+			return environ
+		}
+	}
+	environ = append(environ, "GOPATH="+gopath)
+	return environ
+}
+
+func buildGoProgram(gopath, packageName, outputFilePath string) error {
+	cmd := exec.Command("go", "build", "-o", outputFilePath, packageName)
+	cmd.Env = goBuildEnviron(gopath)
+	return run(cmd)
+}
+
+func createSingleFilePackage(gopath, packageName string, fileContents []byte) error {
+	dirName := filepath.Join(gopath, "src", packageName)
+	err := os.MkdirAll(dirName, 0700)
+	if err != nil {
+		return err
+	}
+
+	return ioutil.WriteFile(filepath.Join(dirName, "main.go"), fileContents, 0600)
+}
+
+func removePackage(gopath, packageName string) error {
+	dirName := filepath.Join(gopath, "src", packageName)
+	return os.RemoveAll(dirName)
+}
+
+func isRepoRoot(path string) bool {
+	_, err := ioutil.ReadDir(filepath.Join(path, ".git"))
+	return (err == nil) && (filepath.Base(path) == "cni")
+}
+
+func LocateCurrentGitRepo() (string, error) {
+	dir, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+
+	for i := 0; i < 5; i++ {
+		if isRepoRoot(dir) {
+			return dir, nil
+		}
+
+		dir, err = filepath.Abs(filepath.Dir(dir))
+		if err != nil {
+			return "", fmt.Errorf("abs(dir(%q)): %s", dir, err)
+		}
+	}
+
+	return "", fmt.Errorf("unable to find cni repo root, landed at %q", dir)
+}
+
+func gitCloneThisRepo(cloneDestination string) error {
+	err := os.MkdirAll(cloneDestination, 0700)
+	if err != nil {
+		return err
+	}
+
+	currentGitRepo, err := LocateCurrentGitRepo()
+	if err != nil {
+		return err
+	}
+
+	return run(exec.Command("git", "clone", currentGitRepo, cloneDestination))
+}
+
+func gitCheckout(localRepo string, gitRef string) error {
+	return run(exec.Command("git", "-C", localRepo, "checkout", gitRef))
+}
+
+// BuildAt builds the go programSource using the version of the CNI library
+// at gitRef, and saves the resulting binary file at outputFilePath
+func BuildAt(programSource []byte, gitRef string, outputFilePath string) error {
+	tempGoPath, err := ioutil.TempDir("", "cni-git-")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(tempGoPath)
+
+	cloneDestination := filepath.Join(tempGoPath, "src", packageBaseName)
+	err = gitCloneThisRepo(cloneDestination)
+	if err != nil {
+		return err
+	}
+
+	err = gitCheckout(cloneDestination, gitRef)
+	if err != nil {
+		return err
+	}
+
+	rand.Seed(time.Now().UnixNano())
+	testPackageName := fmt.Sprintf("test-package-%x", rand.Int31())
+
+	err = createSingleFilePackage(tempGoPath, testPackageName, programSource)
+	if err != nil {
+		return err
+	}
+	defer removePackage(tempGoPath, testPackageName)
+
+	err = buildGoProgram(tempGoPath, testPackageName, outputFilePath)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/vendor/github.com/containernetworking/cni/pkg/version/version.go b/vendor/github.com/containernetworking/cni/pkg/version/version.go
index efe8ea8716..c8e46d55b3 100644
--- a/vendor/github.com/containernetworking/cni/pkg/version/version.go
+++ b/vendor/github.com/containernetworking/cni/pkg/version/version.go
@@ -24,7 +24,7 @@ import (
 
 // Current reports the version of the CNI spec implemented by this library
 func Current() string {
-	return "0.3.1"
+	return "0.4.0"
 }
 
 // Legacy PluginInfo describes a plugin that is backwards compatible with the
@@ -35,7 +35,7 @@ func Current() string {
 // Any future CNI spec versions which meet this definition should be added to
 // this list.
 var Legacy = PluginSupports("0.1.0", "0.2.0")
-var All = PluginSupports("0.1.0", "0.2.0", "0.3.0", "0.3.1")
+var All = PluginSupports("0.1.0", "0.2.0", "0.3.0", "0.3.1", "0.4.0")
 
 var resultFactories = []struct {
 	supportedVersions []string
diff --git a/vendor/github.com/containernetworking/cni/plugins/test/noop/debug/debug.go b/vendor/github.com/containernetworking/cni/plugins/test/noop/debug/debug.go
new file mode 100644
index 0000000000..f400800f6f
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/plugins/test/noop/debug/debug.go
@@ -0,0 +1,71 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// debug supports tests that use the noop plugin
+package debug
+
+import (
+	"encoding/json"
+	"io/ioutil"
+
+	"github.com/containernetworking/cni/pkg/skel"
+)
+
+const EmptyReportResultMessage = "set debug.ReportResult and call debug.WriteDebug() before calling this plugin"
+
+// Debug is used to control and record the behavior of the noop plugin
+type Debug struct {
+	// Report* fields allow the test to control the behavior of the no-op plugin
+	ReportResult         string
+	ReportError          string
+	ReportStderr         string
+	ReportVersionSupport []string
+
+	// Command stores the CNI command that the plugin received
+	Command string
+
+	// CmdArgs stores the CNI Args and Env Vars that the plugin recieved
+	CmdArgs skel.CmdArgs
+}
+
+// ReadDebug will return a debug file recorded by the noop plugin
+func ReadDebug(debugFilePath string) (*Debug, error) {
+	debugBytes, err := ioutil.ReadFile(debugFilePath)
+	if err != nil {
+		return nil, err
+	}
+
+	var debug Debug
+	err = json.Unmarshal(debugBytes, &debug)
+	if err != nil {
+		return nil, err
+	}
+
+	return &debug, nil
+}
+
+// WriteDebug will create a debug file to control the noop plugin
+func (debug *Debug) WriteDebug(debugFilePath string) error {
+	debugBytes, err := json.Marshal(debug)
+	if err != nil {
+		return err
+	}
+
+	err = ioutil.WriteFile(debugFilePath, debugBytes, 0600)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/vendor/github.com/containernetworking/cni/plugins/test/noop/main.go b/vendor/github.com/containernetworking/cni/plugins/test/noop/main.go
new file mode 100644
index 0000000000..f2da357b61
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/plugins/test/noop/main.go
@@ -0,0 +1,216 @@
+// Copyright 2016 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Noop plugin is a CNI plugin designed for use as a test-double.
+
+When calling, set the CNI_ARGS env var equal to the path of a file containing
+the JSON encoding of a Debug.
+*/
+
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/current"
+	"github.com/containernetworking/cni/pkg/version"
+	noop_debug "github.com/containernetworking/cni/plugins/test/noop/debug"
+)
+
+type NetConf struct {
+	types.NetConf
+	DebugFile  string          `json:"debugFile"`
+	PrevResult *current.Result `json:"prevResult,omitempty"`
+}
+
+func loadConf(bytes []byte) (*NetConf, error) {
+	n := &NetConf{}
+	if err := json.Unmarshal(bytes, n); err != nil {
+		return nil, fmt.Errorf("failed to load netconf: %v %q", err, string(bytes))
+	}
+	return n, nil
+}
+
+// parse extra args i.e. FOO=BAR;ABC=123
+func parseExtraArgs(args string) (map[string]string, error) {
+	m := make(map[string]string)
+	if len(args) == 0 {
+		return m, nil
+	}
+
+	items := strings.Split(args, ";")
+	for _, item := range items {
+		kv := strings.Split(item, "=")
+		if len(kv) != 2 {
+			return nil, fmt.Errorf("CNI_ARGS invalid key/value pair: %s\n", kv)
+		}
+		m[kv[0]] = kv[1]
+	}
+	return m, nil
+}
+
+func getConfig(stdinData []byte, args string) (string, *NetConf, error) {
+	netConf, err := loadConf(stdinData)
+	if err != nil {
+		return "", nil, err
+	}
+
+	extraArgs, err := parseExtraArgs(args)
+	if err != nil {
+		return "", nil, err
+	}
+
+	debugFilePath, ok := extraArgs["DEBUG"]
+	if !ok {
+		debugFilePath = netConf.DebugFile
+	}
+
+	return debugFilePath, netConf, nil
+}
+
+func debugBehavior(args *skel.CmdArgs, command string) error {
+	debugFilePath, netConf, err := getConfig(args.StdinData, args.Args)
+	if err != nil {
+		return err
+	}
+
+	if debugFilePath == "" {
+		fmt.Printf(`{}`)
+		os.Stderr.WriteString("CNI_ARGS or config empty, no debug behavior\n")
+		return nil
+	}
+
+	debug, err := noop_debug.ReadDebug(debugFilePath)
+	if err != nil {
+		return err
+	}
+
+	debug.CmdArgs = *args
+	debug.Command = command
+
+	if debug.ReportResult == "" {
+		debug.ReportResult = fmt.Sprintf(` { "result": %q }`, noop_debug.EmptyReportResultMessage)
+	}
+
+	err = debug.WriteDebug(debugFilePath)
+	if err != nil {
+		return err
+	}
+
+	os.Stderr.WriteString(debug.ReportStderr)
+
+	if debug.ReportError != "" {
+		return errors.New(debug.ReportError)
+	} else if debug.ReportResult == "PASSTHROUGH" || debug.ReportResult == "INJECT-DNS" {
+		prevResult := netConf.PrevResult
+		if debug.ReportResult == "INJECT-DNS" {
+			prevResult, err = current.NewResultFromResult(netConf.PrevResult)
+			if err != nil {
+				return err
+			}
+			prevResult.DNS.Nameservers = []string{"1.2.3.4"}
+		}
+
+		// Must print the prevResult as the CNIVersion of the config
+		newResult, err := prevResult.GetAsVersion(netConf.CNIVersion)
+		if err != nil {
+			return fmt.Errorf("failed to convert result to config %q: %v", netConf.CNIVersion, err)
+		}
+		resultBytes, err := json.Marshal(newResult)
+		if err != nil {
+			return fmt.Errorf("failed to marshal new result: %v", err)
+		}
+		os.Stdout.WriteString(string(resultBytes))
+	} else {
+		os.Stdout.WriteString(debug.ReportResult)
+	}
+
+	return nil
+}
+
+func debugGetSupportedVersions(stdinData []byte) []string {
+	vers := []string{"0.-42.0", "0.1.0", "0.2.0", "0.3.0", "0.3.1", "0.4.0"}
+	cniArgs := os.Getenv("CNI_ARGS")
+	if cniArgs == "" {
+		return vers
+	}
+
+	debugFilePath, _, err := getConfig(stdinData, cniArgs)
+	if err != nil {
+		panic("test setup error: unable to get debug file path: " + err.Error())
+	}
+
+	debug, err := noop_debug.ReadDebug(debugFilePath)
+	if err != nil {
+		panic("test setup error: unable to read debug file: " + err.Error())
+	}
+	if debug.ReportVersionSupport == nil {
+		return vers
+	}
+	return debug.ReportVersionSupport
+}
+
+func cmdAdd(args *skel.CmdArgs) error {
+	return debugBehavior(args, "ADD")
+}
+
+func cmdGet(args *skel.CmdArgs) error {
+	return debugBehavior(args, "GET")
+}
+
+func cmdDel(args *skel.CmdArgs) error {
+	return debugBehavior(args, "DEL")
+}
+
+func saveStdin() ([]byte, error) {
+	// Read original stdin
+	stdinData, err := ioutil.ReadAll(os.Stdin)
+	if err != nil {
+		return nil, err
+	}
+
+	// Make a new pipe for stdin, and write original stdin data to it
+	r, w, err := os.Pipe()
+	if err != nil {
+		return nil, err
+	}
+	if _, err := w.Write(stdinData); err != nil {
+		return nil, err
+	}
+	if err := w.Close(); err != nil {
+		return nil, err
+	}
+
+	os.Stdin = r
+	return stdinData, nil
+}
+
+func main() {
+	// Grab and read stdin before pkg/skel gets it
+	stdinData, err := saveStdin()
+	if err != nil {
+		panic("test setup error: unable to read stdin: " + err.Error())
+	}
+
+	supportedVersions := debugGetSupportedVersions(stdinData)
+	skel.PluginMain(cmdAdd, cmdGet, cmdDel, version.PluginSupports(supportedVersions...), "CNI nnop plugin v0.7.0")
+}
diff --git a/vendor/github.com/containernetworking/cni/scripts/docker-run.sh b/vendor/github.com/containernetworking/cni/scripts/docker-run.sh
new file mode 100644
index 0000000000..a8e12795fc
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/scripts/docker-run.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Run a docker container with network namespace set up by the
+# CNI plugins.
+
+# Example usage: ./docker-run.sh --rm busybox /sbin/ifconfig
+
+contid=$(docker run -d --net=none busybox:latest /bin/sleep 10000000)
+pid=$(docker inspect -f '{{ .State.Pid }}' $contid)
+netnspath=/proc/$pid/ns/net
+
+./exec-plugins.sh add $contid $netnspath
+
+function cleanup() {
+	./exec-plugins.sh del $contid $netnspath
+	docker rm -f $contid >/dev/null
+}
+trap cleanup EXIT
+
+docker run --net=container:$contid $@
+
diff --git a/vendor/github.com/containernetworking/cni/scripts/exec-plugins.sh b/vendor/github.com/containernetworking/cni/scripts/exec-plugins.sh
new file mode 100644
index 0000000000..0cf6a6dc3e
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/scripts/exec-plugins.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+if [[ ${DEBUG} -gt 0 ]]; then set -x; fi
+
+NETCONFPATH=${NETCONFPATH-/etc/cni/net.d}
+
+function exec_plugins() {
+	i=0
+	contid=$2
+	netns=$3
+	export CNI_COMMAND=$(echo $1 | tr '[:lower:]' '[:upper:]')
+	export PATH=$CNI_PATH:$PATH
+	export CNI_CONTAINERID=$contid
+	export CNI_NETNS=$netns
+
+	for netconf in $(echo $NETCONFPATH/*.conf | sort); do
+		name=$(jq -r '.name' <$netconf)
+		plugin=$(jq -r '.type' <$netconf)
+		export CNI_IFNAME=$(printf eth%d $i)
+
+		res=$($plugin <$netconf)
+		if [ $? -ne 0 ]; then
+			errmsg=$(echo $res | jq -r '.msg')
+			if [ -z "$errmsg" ]; then
+				errmsg=$res
+			fi
+
+			echo "${name} : error executing $CNI_COMMAND: $errmsg"
+			exit 1
+		elif [[ ${DEBUG} -gt 0 ]]; then
+			echo ${res} | jq -r .
+		fi
+
+		let "i=i+1"
+	done
+}
+
+if [ $# -ne 3 ]; then
+	echo "Usage: $0 add|del CONTAINER-ID NETNS-PATH"
+	echo "  Adds or deletes the container specified by NETNS-PATH to the networks"
+	echo "  specified in \$NETCONFPATH directory"
+	exit 1
+fi
+
+exec_plugins $1 $2 $3
diff --git a/vendor/github.com/containernetworking/cni/scripts/priv-net-run.sh b/vendor/github.com/containernetworking/cni/scripts/priv-net-run.sh
new file mode 100644
index 0000000000..607a3524e2
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/scripts/priv-net-run.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -e
+if [[ ${DEBUG} -gt 0 ]]; then set -x; fi
+
+# Run a command in a private network namespace
+# set up by CNI plugins
+contid=$(printf '%x%x%x%x' $RANDOM $RANDOM $RANDOM $RANDOM)
+netnspath=/var/run/netns/$contid
+
+ip netns add $contid
+./exec-plugins.sh add $contid $netnspath
+
+
+function cleanup() {
+	./exec-plugins.sh del $contid $netnspath
+	ip netns delete $contid
+}
+trap cleanup EXIT
+
+ip netns exec $contid "$@"
diff --git a/vendor/github.com/containernetworking/cni/scripts/release.sh b/vendor/github.com/containernetworking/cni/scripts/release.sh
new file mode 100644
index 0000000000..d3cef56716
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/scripts/release.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -xe
+
+SRC_DIR="${SRC_DIR:-$PWD}"
+BUILDFLAGS="-a --ldflags '-extldflags \"-static\"'"
+
+TAG=$(git describe --tags --dirty)
+RELEASE_DIR=release-${TAG}
+
+OUTPUT_DIR=bin
+
+# Always clean first
+rm -Rf ${SRC_DIR}/${RELEASE_DIR}
+mkdir -p ${SRC_DIR}/${RELEASE_DIR}
+mkdir -p ${OUTPUT_DIR}
+
+docker run -i -v ${SRC_DIR}:/opt/src --rm golang:1.8-alpine \
+/bin/sh -xe -c "\
+    apk --no-cache add bash tar;
+    cd /opt/src; umask 0022;
+    for arch in amd64 arm arm64 ppc64le s390x; do \
+        rm -f ${OUTPUT_DIR}/* ; \
+        CGO_ENABLED=0 GOARCH=\$arch ./build.sh ${BUILDFLAGS}; \
+        for format in tgz; do \
+            FILENAME=cni-\$arch-${TAG}.\$format; \
+            FILEPATH=${RELEASE_DIR}/\$FILENAME; \
+            tar -C ${OUTPUT_DIR} --owner=0 --group=0 -caf \$FILEPATH .; \
+            if [ \"\$arch\" == \"amd64\" ]; then \
+                cp \$FILEPATH ${RELEASE_DIR}/cni-${TAG}.\$format; \
+            fi; \
+        done; \
+    done;
+    cd ${RELEASE_DIR};
+      for f in *.tgz; do sha1sum \$f > \$f.sha1; done;
+      for f in *.tgz; do sha256sum \$f > \$f.sha256; done;
+      for f in *.tgz; do sha512sum \$f > \$f.sha512; done;
+    cd ..
+    chown -R ${UID} ${OUTPUT_DIR} ${RELEASE_DIR}"
diff --git a/vendor/github.com/containernetworking/cni/test.sh b/vendor/github.com/containernetworking/cni/test.sh
new file mode 100644
index 0000000000..ba27e0bed2
--- /dev/null
+++ b/vendor/github.com/containernetworking/cni/test.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# switch into the repo root directory
+cd "$(dirname $0)"
+
+echo -n "Running tests "
+function testrun {
+    bash -c "umask 0; PATH=$PATH go test $@"
+}
+if [ ! -z "${COVERALLS:-""}" ]; then
+    # coverage profile only works per-package
+    PKGS="$(go list ./... | xargs echo)"
+    echo "with coverage profile generation..."
+    i=0
+    for t in ${PKGS}; do
+        testrun "-covermode set -coverprofile ${i}.coverprofile ${t}"
+        i=$((i+1))
+    done
+    gover
+    goveralls -service=travis-ci -coverprofile=gover.coverprofile
+else
+    echo "without coverage profile generation..."
+    testrun "./..."
+fi
+
+echo "Checking gofmt..."
+fmtRes=$(go fmt ./...)
+if [ -n "${fmtRes}" ]; then
+	echo -e "go fmt checking failed:\n${fmtRes}"
+	exit 255
+fi
+
+echo "Checking govet..."
+vetRes=$(go vet ./...)
+if [ -n "${vetRes}" ]; then
+	echo -e "go vet checking failed:\n${vetRes}"
+	exit 255
+fi
+
+echo "Checking license header..."
+licRes=$(
+       for file in $(find . -type f -iname '*.go'); do
+               head -n1 "${file}" | grep -Eq "(Copyright|generated)" || echo -e "  ${file}"
+       done
+)
+if [ -n "${licRes}" ]; then
+       echo -e "license header checking failed:\n${licRes}"
+       exit 255
+fi
+
+echo "Success"
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/ocicni.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/ocicni.go
index fbd50fcff5..33a3ae0634 100644
--- a/vendor/github.com/cri-o/ocicni/pkg/ocicni/ocicni.go
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/ocicni.go
@@ -4,13 +4,16 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"os/exec"
+	"path"
 	"sort"
 	"strings"
 	"sync"
 
 	"github.com/containernetworking/cni/libcni"
+	cniinvoke "github.com/containernetworking/cni/pkg/invoke"
 	cnitypes "github.com/containernetworking/cni/pkg/types"
+	cnicurrent "github.com/containernetworking/cni/pkg/types/current"
+	cniversion "github.com/containernetworking/cni/pkg/version"
 	"github.com/fsnotify/fsnotify"
 	"github.com/sirupsen/logrus"
 )
@@ -19,14 +22,16 @@ type cniNetworkPlugin struct {
 	loNetwork *cniNetwork
 
 	sync.RWMutex
-	defaultNetwork *cniNetwork
+	defaultNetName string
+	networks       map[string]*cniNetwork
 
-	nsenterPath        string
-	pluginDir          string
-	cniDirs            []string
-	vendorCNIDirPrefix string
+	nsManager *nsManager
+	confDir   string
+	binDirs   []string
 
-	monitorNetDirChan chan struct{}
+	shutdownChan chan struct{}
+	watcher      *fsnotify.Watcher
+	done         *sync.WaitGroup
 
 	// The pod map provides synchronization for a given pod's network
 	// operations.  Each pod's setup/teardown/status operations
@@ -34,12 +39,17 @@ type cniNetworkPlugin struct {
 	// pods can proceed in parallel.
 	podsLock sync.Mutex
 	pods     map[string]*podLock
+
+	// For testcases
+	exec     cniinvoke.Exec
+	cacheDir string
 }
 
 type cniNetwork struct {
 	name          string
+	filePath      string
 	NetworkConfig *libcni.NetworkConfigList
-	CNIConfig     libcni.CNI
+	CNIConfig     *libcni.CNIConfig
 }
 
 var errMissingDefaultNetwork = errors.New("Missing CNI default network")
@@ -99,107 +109,150 @@ func (plugin *cniNetworkPlugin) podUnlock(podNetwork PodNetwork) {
 	}
 }
 
-func (plugin *cniNetworkPlugin) monitorNetDir() {
+func newWatcher(confDir string) (*fsnotify.Watcher, error) {
+	// Ensure plugin directory exists, because the following monitoring logic
+	// relies on that.
+	if err := os.MkdirAll(confDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create %q: %v", confDir, err)
+	}
+
 	watcher, err := fsnotify.NewWatcher()
 	if err != nil {
-		logrus.Errorf("could not create new watcher %v", err)
-		return
+		return nil, fmt.Errorf("could not create new watcher %v", err)
 	}
-	defer watcher.Close()
+	defer func() {
+		// Close watcher on error
+		if err != nil {
+			watcher.Close()
+		}
+	}()
 
-	if err = watcher.Add(plugin.pluginDir); err != nil {
-		logrus.Errorf("Failed to add watch on %q: %v", plugin.pluginDir, err)
-		return
+	if err = watcher.Add(confDir); err != nil {
+		return nil, fmt.Errorf("failed to add watch on %q: %v", confDir, err)
 	}
 
-	// Now that `watcher` is running and watching the `pluginDir`
-	// gather the initial configuration, before starting the
-	// goroutine which will actually process events. It has to be
-	// done in this order to avoid missing any updates which might
-	// otherwise occur between gathering the initial configuration
-	// and starting the watcher.
-	if err := plugin.syncNetworkConfig(); err != nil {
-		logrus.Infof("Initial CNI setting failed, continue monitoring: %v", err)
-	} else {
-		logrus.Infof("Initial CNI setting succeeded")
-	}
-
-	go func() {
-		for {
-			select {
-			case event := <-watcher.Events:
-				logrus.Debugf("CNI monitoring event %v", event)
-				if event.Op&fsnotify.Create != fsnotify.Create &&
-					event.Op&fsnotify.Write != fsnotify.Write {
-					continue
-				}
+	return watcher, nil
+}
 
-				if err = plugin.syncNetworkConfig(); err == nil {
-					logrus.Infof("CNI asynchronous setting succeeded")
-					continue
+func (plugin *cniNetworkPlugin) monitorConfDir(start *sync.WaitGroup) {
+	start.Done()
+	plugin.done.Add(1)
+	defer plugin.done.Done()
+	for {
+		select {
+		case event := <-plugin.watcher.Events:
+			logrus.Warningf("CNI monitoring event %v", event)
+
+			var defaultDeleted bool
+			createWrite := (event.Op&fsnotify.Create == fsnotify.Create ||
+				event.Op&fsnotify.Write == fsnotify.Write)
+			if event.Op&fsnotify.Remove == fsnotify.Remove {
+				// Care about the event if the default network
+				// was just deleted
+				defNet := plugin.getDefaultNetwork()
+				if defNet != nil && event.Name == defNet.filePath {
+					defaultDeleted = true
 				}
 
-				logrus.Errorf("CNI setting failed, continue monitoring: %v", err)
+			}
+			if !createWrite && !defaultDeleted {
+				continue
+			}
+
+			if err := plugin.syncNetworkConfig(); err != nil {
+				logrus.Errorf("CNI config loading failed, continue monitoring: %v", err)
+				continue
+			}
 
-			case err := <-watcher.Errors:
-				logrus.Errorf("CNI monitoring error %v", err)
-				close(plugin.monitorNetDirChan)
-				return
+		case err := <-plugin.watcher.Errors:
+			if err == nil {
+				continue
 			}
+			logrus.Errorf("CNI monitoring error %v", err)
+			return
+
+		case <-plugin.shutdownChan:
+			return
 		}
-	}()
+	}
+}
 
-	<-plugin.monitorNetDirChan
+// InitCNI takes a binary directory in which to search for CNI plugins, and
+// a configuration directory in which to search for CNI JSON config files.
+// If no valid CNI configs exist, network requests will fail until valid CNI
+// config files are present in the config directory.
+// If defaultNetName is not empty, a CNI config with that network name will
+// be used as the default CNI network, and container network operations will
+// fail until that network config is present and valid.
+func InitCNI(defaultNetName string, confDir string, binDirs ...string) (CNIPlugin, error) {
+	return initCNI(nil, "", defaultNetName, confDir, binDirs...)
 }
 
-// InitCNI takes the plugin directory and CNI directories where the CNI config
-// files should be searched for.  If no valid CNI configs exist, network requests
-// will fail until valid CNI config files are present in the config directory.
-func InitCNI(pluginDir string, cniDirs ...string) (CNIPlugin, error) {
-	vendorCNIDirPrefix := ""
+// Internal function to allow faking out exec functions for testing
+func initCNI(exec cniinvoke.Exec, cacheDir, defaultNetName string, confDir string, binDirs ...string) (CNIPlugin, error) {
+	if confDir == "" {
+		confDir = DefaultConfDir
+	}
+	if len(binDirs) == 0 {
+		binDirs = []string{DefaultBinDir}
+	}
 	plugin := &cniNetworkPlugin{
-		defaultNetwork:     nil,
-		loNetwork:          getLoNetwork(cniDirs, vendorCNIDirPrefix),
-		pluginDir:          pluginDir,
-		cniDirs:            cniDirs,
-		vendorCNIDirPrefix: vendorCNIDirPrefix,
-		monitorNetDirChan:  make(chan struct{}),
-		pods:               make(map[string]*podLock),
+		defaultNetName: defaultNetName,
+		networks:       make(map[string]*cniNetwork),
+		loNetwork:      getLoNetwork(exec, binDirs),
+		confDir:        confDir,
+		binDirs:        binDirs,
+		shutdownChan:   make(chan struct{}),
+		done:           &sync.WaitGroup{},
+		pods:           make(map[string]*podLock),
+		exec:           exec,
+		cacheDir:       cacheDir,
+	}
+
+	if exec == nil {
+		exec = &cniinvoke.DefaultExec{
+			RawExec:       &cniinvoke.RawExec{Stderr: os.Stderr},
+			PluginDecoder: cniversion.PluginDecoder{},
+		}
 	}
 
-	var err error
-	plugin.nsenterPath, err = exec.LookPath("nsenter")
+	nsm, err := newNSManager()
 	if err != nil {
 		return nil, err
 	}
+	plugin.nsManager = nsm
 
-	// Fail loudly if plugin directory doesn't exist, because fsnotify watcher
-	// won't be able to watch it.
-	if _, err := os.Stat(pluginDir); err != nil {
+	plugin.syncNetworkConfig()
+
+	plugin.watcher, err = newWatcher(plugin.confDir)
+	if err != nil {
 		return nil, err
 	}
 
-	go plugin.monitorNetDir()
+	startWg := sync.WaitGroup{}
+	startWg.Add(1)
+	go plugin.monitorConfDir(&startWg)
+	startWg.Wait()
 
 	return plugin, nil
 }
 
-func getDefaultCNINetwork(pluginDir string, cniDirs []string, vendorCNIDirPrefix string) (*cniNetwork, error) {
-	if pluginDir == "" {
-		pluginDir = DefaultNetDir
-	}
-	if len(cniDirs) == 0 {
-		cniDirs = []string{DefaultCNIDir}
-	}
+func (plugin *cniNetworkPlugin) Shutdown() error {
+	close(plugin.shutdownChan)
+	plugin.watcher.Close()
+	plugin.done.Wait()
+	return nil
+}
 
-	files, err := libcni.ConfFiles(pluginDir, []string{".conf", ".conflist", ".json"})
-	switch {
-	case err != nil:
-		return nil, err
-	case len(files) == 0:
-		return nil, errMissingDefaultNetwork
+func loadNetworks(exec cniinvoke.Exec, confDir string, binDirs []string) (map[string]*cniNetwork, string, error) {
+	files, err := libcni.ConfFiles(confDir, []string{".conf", ".conflist", ".json"})
+	if err != nil {
+		return nil, "", err
 	}
 
+	networks := make(map[string]*cniNetwork)
+	defaultNetName := ""
+
 	sort.Strings(files)
 	for _, confFile := range files {
 		var confList *libcni.NetworkConfigList
@@ -229,27 +282,28 @@ func getDefaultCNINetwork(pluginDir string, cniDirs []string, vendorCNIDirPrefix
 			logrus.Warningf("CNI config list %s has no networks, skipping", confFile)
 			continue
 		}
-		logrus.Infof("CNI network %s (type=%v) is used from %s", confList.Name, confList.Plugins[0].Network.Type, confFile)
-		// Search for vendor-specific plugins as well as default plugins in the CNI codebase.
-		vendorDir := vendorCNIDir(vendorCNIDirPrefix, confList.Plugins[0].Network.Type)
-		cninet := &libcni.CNIConfig{
-			Path: append(cniDirs, vendorDir),
+		if confList.Name == "" {
+			confList.Name = path.Base(confFile)
 		}
-		network := &cniNetwork{name: confList.Name, NetworkConfig: confList, CNIConfig: cninet}
-		return network, nil
-	}
-	return nil, fmt.Errorf("No valid networks found in %s", pluginDir)
-}
 
-func vendorCNIDir(prefix, pluginType string) string {
-	return fmt.Sprintf(VendorCNIDirTemplate, prefix, pluginType)
-}
+		logrus.Infof("Found CNI network %s (type=%v) at %s", confList.Name, confList.Plugins[0].Network.Type, confFile)
 
-func getLoNetwork(cniDirs []string, vendorDirPrefix string) *cniNetwork {
-	if len(cniDirs) == 0 {
-		cniDirs = []string{DefaultCNIDir}
+		networks[confList.Name] = &cniNetwork{
+			name:          confList.Name,
+			filePath:      confFile,
+			NetworkConfig: confList,
+			CNIConfig:     libcni.NewCNIConfig(binDirs, exec),
+		}
+
+		if defaultNetName == "" {
+			defaultNetName = confList.Name
+		}
 	}
 
+	return networks, defaultNetName, nil
+}
+
+func getLoNetwork(exec cniinvoke.Exec, binDirs []string) *cniNetwork {
 	loConfig, err := libcni.ConfListFromBytes([]byte(`{
   "cniVersion": "0.2.0",
   "name": "cni-loopback",
@@ -262,45 +316,62 @@ func getLoNetwork(cniDirs []string, vendorDirPrefix string) *cniNetwork {
 		// catch this
 		panic(err)
 	}
-	vendorDir := vendorCNIDir(vendorDirPrefix, loConfig.Plugins[0].Network.Type)
-	cninet := &libcni.CNIConfig{
-		Path: append(cniDirs, vendorDir),
-	}
 	loNetwork := &cniNetwork{
 		name:          "lo",
 		NetworkConfig: loConfig,
-		CNIConfig:     cninet,
+		CNIConfig:     libcni.NewCNIConfig(binDirs, exec),
 	}
 
 	return loNetwork
 }
 
 func (plugin *cniNetworkPlugin) syncNetworkConfig() error {
-	network, err := getDefaultCNINetwork(plugin.pluginDir, plugin.cniDirs, plugin.vendorCNIDirPrefix)
+	networks, defaultNetName, err := loadNetworks(plugin.exec, plugin.confDir, plugin.binDirs)
 	if err != nil {
-		logrus.Errorf("error updating cni config: %s", err)
 		return err
 	}
-	plugin.setDefaultNetwork(network)
+
+	plugin.Lock()
+	defer plugin.Unlock()
+	if plugin.defaultNetName == "" {
+		plugin.defaultNetName = defaultNetName
+	}
+	plugin.networks = networks
 
 	return nil
 }
 
-func (plugin *cniNetworkPlugin) getDefaultNetwork() *cniNetwork {
+func (plugin *cniNetworkPlugin) getNetwork(name string) (*cniNetwork, error) {
 	plugin.RLock()
 	defer plugin.RUnlock()
-	return plugin.defaultNetwork
+	net, ok := plugin.networks[name]
+	if !ok {
+		return nil, fmt.Errorf("CNI network %q not found", name)
+	}
+	return net, nil
 }
 
-func (plugin *cniNetworkPlugin) setDefaultNetwork(n *cniNetwork) {
-	plugin.Lock()
-	defer plugin.Unlock()
-	plugin.defaultNetwork = n
+func (plugin *cniNetworkPlugin) getDefaultNetworkName() string {
+	plugin.RLock()
+	defer plugin.RUnlock()
+	return plugin.defaultNetName
 }
 
-func (plugin *cniNetworkPlugin) checkInitialized() error {
-	if plugin.getDefaultNetwork() == nil {
-		return errors.New("cni config uninitialized")
+func (plugin *cniNetworkPlugin) getDefaultNetwork() *cniNetwork {
+	defaultNetName := plugin.getDefaultNetworkName()
+	if defaultNetName == "" {
+		return nil
+	}
+	network, _ := plugin.getNetwork(defaultNetName)
+	return network
+}
+
+// networksAvailable returns an error if the pod requests no networks and the
+// plugin has no default network, and thus the plugin has no idea what network
+// to attach the pod to.
+func (plugin *cniNetworkPlugin) networksAvailable(podNetwork *PodNetwork) error {
+	if len(podNetwork.Networks) == 0 && plugin.getDefaultNetwork() == nil {
+		return errMissingDefaultNetwork
 	}
 	return nil
 }
@@ -309,59 +380,119 @@ func (plugin *cniNetworkPlugin) Name() string {
 	return CNIPluginName
 }
 
-func (plugin *cniNetworkPlugin) SetUpPod(podNetwork PodNetwork) (cnitypes.Result, error) {
-	if err := plugin.checkInitialized(); err != nil {
+func (plugin *cniNetworkPlugin) forEachNetwork(podNetwork *PodNetwork, forEachFunc func(*cniNetwork, string, *PodNetwork) error) error {
+	networks := podNetwork.Networks
+	if len(networks) == 0 {
+		networks = append(networks, plugin.getDefaultNetworkName())
+	}
+	for i, netName := range networks {
+		// Interface names start at "eth0" and count up for each network
+		ifName := fmt.Sprintf("eth%d", i)
+		network, err := plugin.getNetwork(netName)
+		if err != nil {
+			logrus.Errorf(err.Error())
+			return err
+		}
+		if err := forEachFunc(network, ifName, podNetwork); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (plugin *cniNetworkPlugin) SetUpPod(podNetwork PodNetwork) ([]cnitypes.Result, error) {
+	if err := plugin.networksAvailable(&podNetwork); err != nil {
 		return nil, err
 	}
 
 	plugin.podLock(podNetwork).Lock()
 	defer plugin.podUnlock(podNetwork)
 
-	_, err := plugin.loNetwork.addToNetwork(podNetwork)
+	_, err := plugin.loNetwork.addToNetwork(plugin.cacheDir, &podNetwork, "lo")
 	if err != nil {
 		logrus.Errorf("Error while adding to cni lo network: %s", err)
 		return nil, err
 	}
 
-	result, err := plugin.getDefaultNetwork().addToNetwork(podNetwork)
-	if err != nil {
-		logrus.Errorf("Error while adding to cni network: %s", err)
+	results := make([]cnitypes.Result, 0)
+	if err := plugin.forEachNetwork(&podNetwork, func(network *cniNetwork, ifName string, podNetwork *PodNetwork) error {
+		result, err := network.addToNetwork(plugin.cacheDir, podNetwork, ifName)
+		if err != nil {
+			logrus.Errorf("Error while adding pod to CNI network %q: %s", network.name, err)
+			return err
+		}
+		results = append(results, result)
+		return nil
+	}); err != nil {
 		return nil, err
 	}
 
-	return result, err
+	return results, nil
 }
 
 func (plugin *cniNetworkPlugin) TearDownPod(podNetwork PodNetwork) error {
-	if err := plugin.checkInitialized(); err != nil {
+	if err := plugin.networksAvailable(&podNetwork); err != nil {
 		return err
 	}
 
 	plugin.podLock(podNetwork).Lock()
 	defer plugin.podUnlock(podNetwork)
 
-	return plugin.getDefaultNetwork().deleteFromNetwork(podNetwork)
+	return plugin.forEachNetwork(&podNetwork, func(network *cniNetwork, ifName string, podNetwork *PodNetwork) error {
+		if err := network.deleteFromNetwork(plugin.cacheDir, podNetwork, ifName); err != nil {
+			logrus.Errorf("Error while removing pod from CNI network %q: %s", network.name, err)
+			return err
+		}
+		return nil
+	})
 }
 
-// TODO: Use the addToNetwork function to obtain the IP of the Pod. That will assume idempotent ADD call to the plugin.
-// Also fix the runtime's call to Status function to be done only in the case that the IP is lost, no need to do periodic calls
-func (plugin *cniNetworkPlugin) GetPodNetworkStatus(podNetwork PodNetwork) (string, error) {
+// GetPodNetworkStatus returns IP addressing and interface details for all
+// networks attached to the pod.
+func (plugin *cniNetworkPlugin) GetPodNetworkStatus(podNetwork PodNetwork) ([]cnitypes.Result, error) {
 	plugin.podLock(podNetwork).Lock()
 	defer plugin.podUnlock(podNetwork)
 
-	ip, err := getContainerIP(plugin.nsenterPath, podNetwork.NetNS, DefaultInterfaceName, "-4")
-	if err != nil {
-		ip, err = getContainerIP(plugin.nsenterPath, podNetwork.NetNS, DefaultInterfaceName, "-6")
-	}
-	if err != nil {
-		return "", err
+	results := make([]cnitypes.Result, 0)
+	if err := plugin.forEachNetwork(&podNetwork, func(network *cniNetwork, ifName string, podNetwork *PodNetwork) error {
+		version := "4"
+		ip, mac, err := getContainerDetails(plugin.nsManager, podNetwork.NetNS, ifName, "-4")
+		if err != nil {
+			ip, mac, err = getContainerDetails(plugin.nsManager, podNetwork.NetNS, ifName, "-6")
+			if err != nil {
+				return err
+			}
+			version = "6"
+		}
+
+		// Until CNI's GET request lands, construct the Result manually
+		results = append(results, &cnicurrent.Result{
+			CNIVersion: "0.3.1",
+			Interfaces: []*cnicurrent.Interface{
+				{
+					Name:    ifName,
+					Mac:     mac.String(),
+					Sandbox: podNetwork.NetNS,
+				},
+			},
+			IPs: []*cnicurrent.IPConfig{
+				{
+					Version:   version,
+					Interface: cnicurrent.Int(0),
+					Address:   *ip,
+				},
+			},
+		})
+		return nil
+	}); err != nil {
+		return nil, err
 	}
 
-	return ip.String(), nil
+	return results, nil
 }
 
-func (network *cniNetwork) addToNetwork(podNetwork PodNetwork) (cnitypes.Result, error) {
-	rt, err := buildCNIRuntimeConf(podNetwork)
+func (network *cniNetwork) addToNetwork(cacheDir string, podNetwork *PodNetwork, ifName string) (cnitypes.Result, error) {
+	rt, err := buildCNIRuntimeConf(cacheDir, podNetwork, ifName)
 	if err != nil {
 		logrus.Errorf("Error adding network: %v", err)
 		return nil, err
@@ -378,8 +509,8 @@ func (network *cniNetwork) addToNetwork(podNetwork PodNetwork) (cnitypes.Result,
 	return res, nil
 }
 
-func (network *cniNetwork) deleteFromNetwork(podNetwork PodNetwork) error {
-	rt, err := buildCNIRuntimeConf(podNetwork)
+func (network *cniNetwork) deleteFromNetwork(cacheDir string, podNetwork *PodNetwork, ifName string) error {
+	rt, err := buildCNIRuntimeConf(cacheDir, podNetwork, ifName)
 	if err != nil {
 		logrus.Errorf("Error deleting network: %v", err)
 		return err
@@ -395,13 +526,14 @@ func (network *cniNetwork) deleteFromNetwork(podNetwork PodNetwork) error {
 	return nil
 }
 
-func buildCNIRuntimeConf(podNetwork PodNetwork) (*libcni.RuntimeConf, error) {
+func buildCNIRuntimeConf(cacheDir string, podNetwork *PodNetwork, ifName string) (*libcni.RuntimeConf, error) {
 	logrus.Infof("Got pod network %+v", podNetwork)
 
 	rt := &libcni.RuntimeConf{
 		ContainerID: podNetwork.ID,
 		NetNS:       podNetwork.NetNS,
-		IfName:      DefaultInterfaceName,
+		CacheDir:    cacheDir,
+		IfName:      ifName,
 		Args: [][2]string{
 			{"IgnoreUnknown", "1"},
 			{"K8S_POD_NAMESPACE", podNetwork.Namespace},
@@ -421,5 +553,8 @@ func buildCNIRuntimeConf(podNetwork PodNetwork) (*libcni.RuntimeConf, error) {
 }
 
 func (plugin *cniNetworkPlugin) Status() error {
-	return plugin.checkInitialized()
+	if plugin.getDefaultNetwork() == nil {
+		return errMissingDefaultNetwork
+	}
+	return nil
 }
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/types.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/types.go
index 60816d1799..8ca61657af 100644
--- a/vendor/github.com/cri-o/ocicni/pkg/ocicni/types.go
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/types.go
@@ -9,12 +9,6 @@ const (
 	DefaultInterfaceName = "eth0"
 	// CNIPluginName is the default name of the plugin
 	CNIPluginName = "cni"
-	// DefaultNetDir is the place to look for CNI Network
-	DefaultNetDir = "/etc/cni/net.d"
-	// DefaultCNIDir is the place to look for cni config files
-	DefaultCNIDir = "/opt/cni/bin"
-	// VendorCNIDirTemplate is the template for looking up vendor specific cni config/executable files
-	VendorCNIDirTemplate = "%s/opt/%s/bin"
 )
 
 // PortMapping maps to the standard CNI portmapping Capability
@@ -42,6 +36,10 @@ type PodNetwork struct {
 	NetNS string
 	// PortMappings is the port mapping of the sandbox.
 	PortMappings []PortMapping
+
+	// Networks is a list of CNI network names to attach to the sandbox
+	// Leave this list empty to attach the default network to the sandbox
+	Networks []string
 }
 
 // CNIPlugin is the interface that needs to be implemented by a plugin
@@ -53,14 +51,17 @@ type CNIPlugin interface {
 	// SetUpPod is the method called after the sandbox container of
 	// the pod has been created but before the other containers of the
 	// pod are launched.
-	SetUpPod(network PodNetwork) (types.Result, error)
+	SetUpPod(network PodNetwork) ([]types.Result, error)
 
 	// TearDownPod is the method called before a pod's sandbox container will be deleted
 	TearDownPod(network PodNetwork) error
 
 	// Status is the method called to obtain the ipv4 or ipv6 addresses of the pod sandbox
-	GetPodNetworkStatus(network PodNetwork) (string, error)
+	GetPodNetworkStatus(network PodNetwork) ([]types.Result, error)
 
 	// NetworkStatus returns error if the network plugin is in error state
 	Status() error
+
+	// Shutdown terminates all driver operations
+	Shutdown() error
 }
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/types_unix.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/types_unix.go
new file mode 100644
index 0000000000..88010f737c
--- /dev/null
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/types_unix.go
@@ -0,0 +1,10 @@
+// +build !windows
+
+package ocicni
+
+const (
+	// DefaultConfDir is the default place to look for CNI Network
+	DefaultConfDir = "/etc/cni/net.d"
+	// DefaultBinDir is the default place to look for CNI config files
+	DefaultBinDir = "/opt/cni/bin"
+)
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/types_windows.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/types_windows.go
new file mode 100644
index 0000000000..061ecae5cd
--- /dev/null
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/types_windows.go
@@ -0,0 +1,10 @@
+// +build windows
+
+package ocicni
+
+const (
+	// DefaultConfDir is the default place to look for CNI Network
+	DefaultConfDir = "C:\\cni\\etc\\net.d"
+	// DefaultBinDir is the default place to look for cni config files
+	DefaultBinDir = "C:\\cni\\bin"
+)
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/util.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/util.go
index 547e959721..2af7865939 100644
--- a/vendor/github.com/cri-o/ocicni/pkg/ocicni/util.go
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/util.go
@@ -1,32 +1,8 @@
 package ocicni
 
-import (
-	"fmt"
-	"net"
-	"os/exec"
-	"strings"
-)
-
-func getContainerIP(nsenterPath, netnsPath, interfaceName, addrType string) (net.IP, error) {
-	// Try to retrieve ip inside container network namespace
-	output, err := exec.Command(nsenterPath, fmt.Sprintf("--net=%s", netnsPath), "-F", "--",
-		"ip", "-o", addrType, "addr", "show", "dev", interfaceName, "scope", "global").CombinedOutput()
-	if err != nil {
-		return nil, fmt.Errorf("Unexpected command output %s with error: %v", output, err)
-	}
-
-	lines := strings.Split(string(output), "\n")
-	if len(lines) < 1 {
-		return nil, fmt.Errorf("Unexpected command output %s", output)
-	}
-	fields := strings.Fields(lines[0])
-	if len(fields) < 4 {
-		return nil, fmt.Errorf("Unexpected address output %s ", lines[0])
-	}
-	ip, _, err := net.ParseCIDR(fields[3])
-	if err != nil {
-		return nil, fmt.Errorf("CNI failed to parse ip from output %s due to %v", output, err)
-	}
-
-	return ip, nil
+// newNSManager initializes a new namespace manager, which is a platform dependent struct.
+func newNSManager() (*nsManager, error) {
+	nsm := &nsManager{}
+	err := nsm.init()
+	return nsm, err
 }
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/util_linux.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/util_linux.go
new file mode 100644
index 0000000000..d263ae4dfd
--- /dev/null
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/util_linux.go
@@ -0,0 +1,71 @@
+// +build linux
+
+package ocicni
+
+import (
+	"fmt"
+	"net"
+	"os/exec"
+	"strings"
+)
+
+var defaultNamespaceEnterCommandName = "nsenter"
+
+type nsManager struct {
+	nsenterPath string
+}
+
+func (nsm *nsManager) init() error {
+	var err error
+	nsm.nsenterPath, err = exec.LookPath(defaultNamespaceEnterCommandName)
+	return err
+}
+
+func getContainerDetails(nsm *nsManager, netnsPath, interfaceName, addrType string) (*net.IPNet, *net.HardwareAddr, error) {
+	// Try to retrieve ip inside container network namespace
+	output, err := exec.Command(nsm.nsenterPath, fmt.Sprintf("--net=%s", netnsPath), "-F", "--",
+		"ip", "-o", addrType, "addr", "show", "dev", interfaceName, "scope", "global").CombinedOutput()
+	if err != nil {
+		return nil, nil, fmt.Errorf("Unexpected command output %s with error: %v", output, err)
+	}
+
+	lines := strings.Split(string(output), "\n")
+	if len(lines) < 1 {
+		return nil, nil, fmt.Errorf("Unexpected command output %s", output)
+	}
+	fields := strings.Fields(lines[0])
+	if len(fields) < 4 {
+		return nil, nil, fmt.Errorf("Unexpected address output %s ", lines[0])
+	}
+	ip, ipNet, err := net.ParseCIDR(fields[3])
+	if err != nil {
+		return nil, nil, fmt.Errorf("CNI failed to parse ip from output %s due to %v", output, err)
+	}
+	if ip.To4() == nil {
+		ipNet.IP = ip
+	} else {
+		ipNet.IP = ip.To4()
+	}
+
+	// Try to retrieve MAC inside container network namespace
+	output, err = exec.Command(nsm.nsenterPath, fmt.Sprintf("--net=%s", netnsPath), "-F", "--",
+		"ip", "link", "show", "dev", interfaceName).CombinedOutput()
+	if err != nil {
+		return nil, nil, fmt.Errorf("unexpected 'ip link' command output %s with error: %v", output, err)
+	}
+
+	lines = strings.Split(string(output), "\n")
+	if len(lines) < 2 {
+		return nil, nil, fmt.Errorf("unexpected 'ip link' command output %s", output)
+	}
+	fields = strings.Fields(lines[1])
+	if len(fields) < 4 {
+		return nil, nil, fmt.Errorf("unexpected link output %s ", lines[0])
+	}
+	mac, err := net.ParseMAC(fields[1])
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse MAC from output %s due to %v", output, err)
+	}
+
+	return ipNet, &mac, nil
+}
diff --git a/vendor/github.com/cri-o/ocicni/pkg/ocicni/util_unsupported.go b/vendor/github.com/cri-o/ocicni/pkg/ocicni/util_unsupported.go
new file mode 100644
index 0000000000..0b1c722082
--- /dev/null
+++ b/vendor/github.com/cri-o/ocicni/pkg/ocicni/util_unsupported.go
@@ -0,0 +1,19 @@
+// +build !linux
+
+package ocicni
+
+import (
+	"fmt"
+	"net"
+)
+
+type nsManager struct {
+}
+
+func (nsm *nsManager) init() error {
+	return nil
+}
+
+func getContainerDetails(nsm *nsManager, netnsPath, interfaceName, addrType string) (*net.IPNet, *net.HardwareAddr, error) {
+	return nil, nil, fmt.Errorf("not supported yet")
+}
diff --git a/vendor/vendor.json b/vendor/vendor.json
index 378c36e45d..b7998fa2ee 100644
--- a/vendor/vendor.json
+++ b/vendor/vendor.json
@@ -564,40 +564,11 @@
 			"revisionTime": "2017-09-11T20:35:56Z"
 		},
 		{
-			"checksumSHA1": "ym448FWZpZNMLeS6bDFqG+3X5FE=",
-			"path": "github.com/containernetworking/cni/libcni",
-			"revision": "9ded5d186f6c16013fa34c611d9b1be751169aaa",
-			"revisionTime": "2018-01-10T16:53:04Z"
-		},
-		{
-			"checksumSHA1": "Kh/msV2XTuYy0UB63hhoKcKfkyY=",
-			"path": "github.com/containernetworking/cni/pkg/invoke",
-			"revision": "9ded5d186f6c16013fa34c611d9b1be751169aaa",
-			"revisionTime": "2018-01-10T16:53:04Z"
-		},
-		{
-			"checksumSHA1": "kgSp8eemMPHCvxZdxva5OU94jIo=",
-			"path": "github.com/containernetworking/cni/pkg/types",
-			"revision": "9ded5d186f6c16013fa34c611d9b1be751169aaa",
-			"revisionTime": "2018-01-10T16:53:04Z"
-		},
-		{
-			"checksumSHA1": "lmLYXYR/twmBu+6U678QNF+BQlQ=",
-			"path": "github.com/containernetworking/cni/pkg/types/020",
-			"revision": "9ded5d186f6c16013fa34c611d9b1be751169aaa",
-			"revisionTime": "2018-01-10T16:53:04Z"
-		},
-		{
-			"checksumSHA1": "r6qX7lyz4pweijiXjWMcxvm4wQQ=",
-			"path": "github.com/containernetworking/cni/pkg/types/current",
-			"revision": "9ded5d186f6c16013fa34c611d9b1be751169aaa",
-			"revisionTime": "2018-01-10T16:53:04Z"
-		},
-		{
-			"checksumSHA1": "Y9KLxL9fFDnFHaDGOUfDkcbyV0U=",
-			"path": "github.com/containernetworking/cni/pkg/version",
-			"revision": "9ded5d186f6c16013fa34c611d9b1be751169aaa",
-			"revisionTime": "2018-01-10T16:53:04Z"
+			"checksumSHA1": "kjLThM+U4qeDQE0GLNd+rJPt7HA=",
+			"path": "github.com/containernetworking/cni",
+			"revision": "96343561e0363c7dcc5f94bef655a8ddbb0b3e5c",
+			"revisionTime": "2018-06-21T05:42:04Z",
+			"tree": true
 		},
 		{
 			"checksumSHA1": "tkdJGOYqk/F/YIDedKl5CllvbYA=",
@@ -673,10 +644,10 @@
 			"tree": true
 		},
 		{
-			"checksumSHA1": "2/jWygRyq/dGS2wMjuK6cYiSvPY=",
+			"checksumSHA1": "Qlh/kXGRId3PZQSyFQjaTX+8QJU=",
 			"path": "github.com/cri-o/ocicni/pkg/ocicni",
-			"revision": "2a19a0093d927d3ecc0e305b522c48e2213b22fd",
-			"revisionTime": "2018-02-02T23:36:03Z"
+			"revision": "0df475a8ba44e465783db50823eb4a0e226c4bf6",
+			"revisionTime": "2018-07-12T15:06:23Z"
 		},
 		{
 			"checksumSHA1": "OFu4xJEIjiI8Suu+j/gabfp+y6Q=",