diff --git a/cni-plugin/Makefile b/cni-plugin/Makefile
index 33327f81079..c2d354fbf51 100644
--- a/cni-plugin/Makefile
+++ b/cni-plugin/Makefile
@@ -18,7 +18,7 @@ include ../lib.Makefile
 ###############################################################################
 LDFLAGS = -X main.VERSION=$(GIT_VERSION)
 
-SRC_FILES=$(shell find pkg cmd internal -name '*.go')
+SRC_FILES=$(shell find pkg cmd internal -name '*.go') $(shell find ../libcalico-go -name '*.go')
 TEST_SRC_FILES=$(shell find tests -name '*.go')
 WINFV_SRCFILES=$(shell find win_tests -name '*.go')
 
diff --git a/node/tests/k8st/deploy_resources_on_kind_cluster.sh b/node/tests/k8st/deploy_resources_on_kind_cluster.sh
index 279f84abd92..49bf002278c 100755
--- a/node/tests/k8st/deploy_resources_on_kind_cluster.sh
+++ b/node/tests/k8st/deploy_resources_on_kind_cluster.sh
@@ -1,5 +1,14 @@
 #!/bin/bash -e
 
+# Clean up background jobs on exit.
+set -m
+function cleanup() {
+  rc=$?
+  jobs -p | xargs --no-run-if-empty kill
+  exit $rc
+}
+trap 'cleanup' SIGINT SIGHUP SIGTERM EXIT
+
 # test directory.
 TEST_DIR=./tests/k8st
 ARCH=${ARCH:-amd64}
@@ -45,10 +54,10 @@ EOF
 }
 
 echo "Set ipv6 address on each node"
-docker exec kind-control-plane ip -6 a a 2001:20::8/64 dev eth0
-docker exec kind-worker ip -6 a a 2001:20::1/64 dev eth0
-docker exec kind-worker2 ip -6 a a 2001:20::2/64 dev eth0
-docker exec kind-worker3 ip -6 a a 2001:20::3/64 dev eth0
+docker exec kind-control-plane ip -6 addr replace 2001:20::8/64 dev eth0
+docker exec kind-worker ip -6 addr replace 2001:20::1/64 dev eth0
+docker exec kind-worker2 ip -6 addr replace 2001:20::2/64 dev eth0
+docker exec kind-worker3 ip -6 addr replace 2001:20::3/64 dev eth0
 echo
 
 echo "Load calico/node docker images onto each node"
@@ -70,19 +79,50 @@ echo "Install additional permissions for BGP password"
 ${kubectl} apply -f $TEST_DIR/infra/additional-rbac.yaml
 echo
 
+function wait_pod_ready() {
+  args="$@"
+
+  # Start background process, waiting for the pod to be ready.
+  (
+    # Wait in a loop because the command fails fast if the pod isn't visible yet.
+    while ! ${kubectl} wait pod --for=condition=Ready --timeout=30s $args; do
+      echo "Waiting for pod $args to be ready..."
+      kubectl get po -o wide $args || true
+      sleep 1
+    done;
+    ${kubectl} wait pod --for=condition=Ready --timeout=300s $args
+  ) & pid=$!
+  # Start a second background process that implements the actual timeout.
+  ( sleep 300; kill $pid ) 2>/dev/null & watchdog=$!
+  set +e
+
+  wait $pid 2>/dev/null
+  rc=$?
+  kill $watchdog 2>/dev/null
+  wait $watchdog 2>/dev/null
+
+  if [ $rc -ne 0 ]; then
+    echo "Pod $args failed to become ready within 300s"
+    echo "collecting diags..."
+    kubectl get po -A -o wide
+    kubectl describe po $args
+    kubectl logs $args
+    echo "Pod $args failed to become ready within 300s; diags above ^^"
+  fi
+
+  set -e
+  return $rc
+}
+
 echo "Wait for Calico to be ready..."
-while ! time ${kubectl} wait pod -l k8s-app=calico-node --for=condition=Ready -n kube-system --timeout=300s; do
-  # This happens when no matching resources exist yet,
-  # i.e. immediately after application of the Calico YAML.
-  sleep 5
-done
-time ${kubectl} wait pod -l k8s-app=calico-kube-controllers --for=condition=Ready -n kube-system --timeout=300s
-time ${kubectl} wait pod -l k8s-app=kube-dns --for=condition=Ready -n kube-system --timeout=300s
+wait_pod_ready -l k8s-app=calico-node -n kube-system
+wait_pod_ready -l k8s-app=calico-kube-controllers -n kube-system
+wait_pod_ready -l k8s-app=kube-dns -n kube-system
 echo "Calico is running."
 echo
 
 echo "Install MetalLB controller for allocating LoadBalancer IPs"
-${kubectl} create ns metallb-system
+${kubectl} create ns metallb-system || true
 ${kubectl} apply -f $TEST_DIR/infra/metallb.yaml
 ${kubectl} apply -f $TEST_DIR/infra/metallb-config.yaml
 
@@ -91,25 +131,22 @@ echo "Create test-webserver deployment..."
 ${kubectl} apply -f tests/k8st/infra/test-webserver.yaml
 
 echo "Wait for client and webserver pods to be ready..."
-while ! time ${kubectl} wait pod -l pod-name=client --for=condition=Ready --timeout=300s; do
-  sleep 5
-done
-while ! time ${kubectl} wait pod -l app=webserver --for=condition=Ready --timeout=300s; do
-  sleep 5
-done
+wait_pod_ready -l pod-name=client
+wait_pod_ready -l app=webserver
 echo "client and webserver pods are running."
 echo
 
 echo "Deploy Calico apiserver"
 cp $TEST_DIR/infra/apiserver.yaml $TEST_DIR/infra/apiserver.yaml.tmp
 sed -i "s/amd64/${ARCH}/" $TEST_DIR/infra/apiserver.yaml.tmp
-${kubectl} create -f ${TEST_DIR}/infra/apiserver.yaml.tmp
+${kubectl} apply -f ${TEST_DIR}/infra/apiserver.yaml.tmp
 rm $TEST_DIR/infra/apiserver.yaml.tmp
 openssl req -x509 -nodes -newkey rsa:4096 -keyout apiserver.key -out apiserver.crt -days 365 -subj "/" -addext "subjectAltName = DNS:calico-api.calico-apiserver.svc"
-${kubectl} create secret -n calico-apiserver generic calico-apiserver-certs --from-file=apiserver.key --from-file=apiserver.crt
+${kubectl} get secret -n calico-apiserver calico-apiserver-certs ||
+  ${kubectl} create secret -n calico-apiserver generic calico-apiserver-certs --from-file=apiserver.key --from-file=apiserver.crt
 ${kubectl} patch apiservice v3.projectcalico.org -p \
   "{\"spec\": {\"caBundle\": \"$(${kubectl} get secret -n calico-apiserver calico-apiserver-certs -o go-template='{{ index .data "apiserver.crt" }}')\"}}"
-time ${kubectl} wait pod -l k8s-app=calico-apiserver --for=condition=Ready -n calico-apiserver --timeout=30s
+wait_pod_ready -l k8s-app=calico-apiserver -n calico-apiserver
 echo "Calico apiserver is running."
 
 ${kubectl} get po --all-namespaces -o wide