diff --git a/build/BUILD b/build/BUILD
index 340f9236b6..7befe25224 100644
--- a/build/BUILD
+++ b/build/BUILD
@@ -3,6 +3,7 @@ package(default_visibility = ["//visibility:public"])
 load("@io_bazel_rules_docker//container:container.bzl", "container_bundle", "container_image")
 load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
 load(":code_generation_test.bzl", "code_generation_test_suite")
+load(":platforms.bzl", "for_platforms")
 
 code_generation_test_suite(
     name = "code_generation_tests",
@@ -30,23 +31,38 @@ filegroup(
 # in build/common.sh.
 DOCKERIZED_BINARIES = {
     "cloud-controller-manager": {
-        "base": "@debian-base-amd64//image",
+        "base": select(for_platforms(
+            for_node = "@debian-base-{ARCH}//image",
+            only_os = "linux",
+        )),
         "target": "//cmd/cloud-controller-manager:cloud-controller-manager",
     },
     "kube-apiserver": {
-        "base": "@debian-base-amd64//image",
+        "base": select(for_platforms(
+            for_node = "@debian-base-{ARCH}//image",
+            only_os = "linux",
+        )),
         "target": "//cmd/kube-apiserver:kube-apiserver",
     },
     "kube-controller-manager": {
-        "base": "@debian-base-amd64//image",
+        "base": select(for_platforms(
+            for_node = "@debian-base-{ARCH}//image",
+            only_os = "linux",
+        )),
         "target": "//cmd/kube-controller-manager:kube-controller-manager",
     },
     "kube-scheduler": {
-        "base": "@debian-base-amd64//image",
+        "base": select(for_platforms(
+            for_node = "@debian-base-{ARCH}//image",
+            only_os = "linux",
+        )),
         "target": "//cmd/kube-scheduler:kube-scheduler",
     },
     "kube-proxy": {
-        "base": "@debian-iptables-amd64//image",
+        "base": select(for_platforms(
+            for_node = "@debian-iptables-{ARCH}//image",
+            only_os = "linux",
+        )),
         "target": "//cmd/kube-proxy:kube-proxy",
     },
 }
@@ -55,9 +71,10 @@ DOCKERIZED_BINARIES = {
     name = binary + "-internal",
     base = meta["base"],
     cmd = ["/usr/bin/" + binary],
-    debs = [
-        "//build/debs:%s.deb" % binary,
-    ],
+    debs = select(for_platforms(
+        for_node = ["//build/debs:%s-{ARCH}.deb" % binary],
+        only_os = "linux",
+    )),
     stamp = True,
     symlinks = {
         # Some cluster startup scripts expect to find the binaries in /usr/local/bin,
@@ -102,19 +119,19 @@ release_filegroup(
 # KUBE_CLIENT_TARGETS
 release_filegroup(
     name = "client-targets",
-    srcs = [
+    conditioned_srcs = for_platforms(for_client = [
         "//cmd/kubectl",
-    ],
+    ]),
 )
 
 # KUBE_NODE_TARGETS
 release_filegroup(
     name = "node-targets",
-    srcs = [
+    conditioned_srcs = for_platforms(for_node = [
         "//cmd/kube-proxy",
         "//cmd/kubeadm",
         "//cmd/kubelet",
-    ],
+    ]),
 )
 
 # KUBE_SERVER_TARGETS
@@ -122,31 +139,35 @@ release_filegroup(
 # since we include them in the actual build rule.
 release_filegroup(
     name = "server-targets",
-    srcs = [
+    conditioned_srcs = for_platforms(for_server = [
         "//cluster/gce/gci/mounter",
         "//cmd/cloud-controller-manager",
         "//cmd/hyperkube",
         "//cmd/kube-apiserver",
         "//cmd/kube-controller-manager",
         "//cmd/kube-scheduler",
-    ],
+    ]),
 )
 
 # kube::golang::test_targets
 filegroup(
     name = "test-targets",
-    srcs = [
-        "//cmd/gendocs",
-        "//cmd/genkubedocs",
-        "//cmd/genman",
-        "//cmd/genswaggertypedocs",
-        "//cmd/genyaml",
-        "//cmd/kubemark",  # TODO: server platforms only
-        "//cmd/linkcheck",
-        "//test/e2e:e2e.test",
-        "//test/e2e_node:e2e_node.test",  # TODO: server platforms only
-        "//vendor/github.com/onsi/ginkgo/ginkgo",
-    ],
+    srcs = select(for_platforms(
+        for_server = [
+            "//cmd/kubemark",
+            "//test/e2e_node:e2e_node.test_binary",
+        ],
+        for_test = [
+            "//cmd/gendocs",
+            "//cmd/genkubedocs",
+            "//cmd/genman",
+            "//cmd/genswaggertypedocs",
+            "//cmd/genyaml",
+            "//cmd/linkcheck",
+            "//test/e2e:e2e.test_binary",
+            "//vendor/github.com/onsi/ginkgo/ginkgo",
+        ],
+    )),
 )
 
 # KUBE_TEST_PORTABLE
diff --git a/build/debs/BUILD b/build/debs/BUILD
index f4163dfb86..6868a566a2 100644
--- a/build/debs/BUILD
+++ b/build/debs/BUILD
@@ -1,8 +1,15 @@
 package(default_visibility = ["//visibility:public"])
 
-load("@io_k8s_repo_infra//defs:deb.bzl", "k8s_deb", "deb_data")
+load("@io_k8s_repo_infra//defs:deb.bzl", "deb_data", "k8s_deb")
 load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
 load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
+load(
+    "//build:platforms.bzl",
+    "CLIENT_PLATFORMS",
+    "NODE_PLATFORMS",
+    "SERVER_PLATFORMS",
+    "for_platforms",
+)
 load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")
 
 # We do not include kube-scheduler, kube-controller-manager,
@@ -12,16 +19,55 @@ load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")
 # images.
 release_filegroup(
     name = "debs",
-    srcs = [
-        ":cri-tools.deb",
-        ":kubeadm.deb",
-        ":kubectl.deb",
-        ":kubelet.deb",
-        ":kubernetes-cni.deb",
-    ],
+    conditioned_srcs = for_platforms(
+        default = [],
+        for_client = [":kubectl-{ARCH}.deb"],
+        for_node = [
+            ":cri-tools-{ARCH}.deb",
+            ":kubeadm-{ARCH}.deb",
+            ":kubelet-{ARCH}.deb",
+            ":kubernetes-cni-{ARCH}.deb",
+        ],
+        only_os = "linux",
+    ),
 )
 
+# Create aliases from the non-arch names to the arch-specific names for backwards compatibility
+alias(
+    name = "kubectl",
+    actual = select(for_platforms(
+        for_client = ":kubectl-{ARCH}",
+        only_os = "linux",
+    )),
+)
+
+[alias(
+    name = pkg,
+    actual = select(for_platforms(
+        for_node = ":%s-{ARCH}" % pkg,
+        only_os = "linux",
+    )),
+) for pkg in [
+    "cri-tools",
+    "kubeadm",
+    "kubelet",
+    "kubernetes-cni",
+]]
+
 [deb_data(
+    name = "kubectl",
+    data = [
+        {
+            "files": ["//cmd/kubectl"],
+            "mode": "0755",
+            "dir": "/usr/bin",
+        },
+    ],
+    goarch = arch,
+    tags = ["manual"],
+) for arch in CLIENT_PLATFORMS["linux"]]
+
+[[deb_data(
     name = binary,
     data = [
         {
@@ -30,26 +76,17 @@ release_filegroup(
             "dir": "/usr/bin",
         },
     ],
+    goarch = arch,
+    tags = ["manual"],
 ) for binary in [
     "cloud-controller-manager",
-    "kubectl",
     "kube-apiserver",
     "kube-controller-manager",
     "kube-proxy",
-]]
+    "kube-scheduler",
+]] for arch in SERVER_PLATFORMS["linux"]]
 
-deb_data(
-    name = "kube-scheduler",
-    data = [
-        {
-            "files": ["//cmd/kube-scheduler"],
-            "mode": "0755",
-            "dir": "/usr/bin",
-        },
-    ],
-)
-
-deb_data(
+[deb_data(
     name = "kubelet",
     data = [
         {
@@ -63,9 +100,11 @@ deb_data(
             "dir": "/lib/systemd/system",
         },
     ],
-)
+    goarch = arch,
+    tags = ["manual"],
+) for arch in NODE_PLATFORMS["linux"]]
 
-deb_data(
+[deb_data(
     name = "kubeadm",
     data = [
         {
@@ -89,63 +128,79 @@ deb_data(
             "dir": "/etc/sysctl.d",
         },
     ],
-)
+    goarch = arch,
+    tags = ["manual"],
+) for arch in NODE_PLATFORMS["linux"]]
 
-pkg_tar(
-    name = "kubernetes-cni-data",
+[pkg_tar(
+    name = "kubernetes-cni-data-%s" % goarch,
     package_dir = "/opt/cni/bin",
-    deps = ["@kubernetes_cni//file"],
-)
+    tags = ["manual"],
+    deps = ["@kubernetes_cni_%s//file" % goarch],
+) for goarch in NODE_PLATFORMS["linux"]]
 
-pkg_tar(
-    name = "cri-tools-data",
+[pkg_tar(
+    name = "cri-tools-data-%s" % goarch,
     package_dir = "/usr/bin",
-    deps = ["@cri_tools//file"],
-)
+    tags = ["manual"],
+    deps = ["@cri_tools_%s//file" % goarch],
+) for goarch in NODE_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "cloud-controller-manager",
     description = "Kubernetes Cloud Controller Manager",
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in SERVER_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kubectl",
     description = """Kubernetes Command Line Tool
 The Kubernetes command line tool for interacting with the Kubernetes API.
 """,
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in CLIENT_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kube-apiserver",
     description = "Kubernetes API Server",
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in SERVER_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kube-controller-manager",
     description = "Kubernetes Controller Manager",
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in SERVER_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kube-scheduler",
     description = "Kubernetes Scheduler",
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in SERVER_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kube-proxy",
     depends = [
         "iptables (>= 1.4.21)",
         "iproute2",
     ],
     description = "Kubernetes Service Proxy",
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kubelet",
     depends = [
         "conntrack",
@@ -161,10 +216,12 @@ k8s_deb(
     description = """Kubernetes Node Agent
 The node agent of Kubernetes, the container cluster manager
 """,
+    goarch = arch,
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kubeadm",
     depends = [
         "kubelet (>= 1.8.0)",
@@ -175,23 +232,29 @@ k8s_deb(
     description = """Kubernetes Cluster Bootstrapping Tool
 The Kubernetes command line tool for bootstrapping a Kubernetes cluster.
 """,
+    goarch = arch,
     postinst = "postinst",
+    tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "kubernetes-cni",
     description = """Kubernetes Packaging of CNI
 The Container Networking Interface tools for provisioning container networks.
 """,
+    goarch = arch,
+    tags = ["manual"],
     version = CNI_VERSION,
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-k8s_deb(
+[k8s_deb(
     name = "cri-tools",
     description = """Container Runtime Interface tools (crictl)""",
+    goarch = arch,
+    tags = ["manual"],
     version = CRI_TOOLS_VERSION,
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
 filegroup(
     name = "package-srcs",
diff --git a/build/go.bzl b/build/go.bzl
new file mode 100644
index 0000000000..58ce9c101b
--- /dev/null
+++ b/build/go.bzl
@@ -0,0 +1,103 @@
+# Copyright 2019 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_test")
+
+# Defines several go_binary rules to work around a Bazel issue which makes
+# the pure attribute on go_binary not configurable.
+# The name provided will have cgo enabled if targeting Linux, and will
+# be a pure go binary otherwise. Additionally, if targeting Windows, the
+# output filename will have a .exe suffix.
+def go_binary_conditional_pure(name, tags = None, **kwargs):
+    tags = tags or []
+    tags.append("manual")
+    go_binary(
+        name = "_%s-cgo" % name,
+        out = name,
+        pure = "off",
+        tags = tags,
+        **kwargs
+    )
+
+    # Define a rule for both Unix and Windows exe suffixes.
+    [go_binary(
+        name = "_%s-pure" % out,
+        out = out,
+        pure = "on",
+        tags = tags,
+        **kwargs
+    ) for out in [name, name + ".exe"]]
+
+    # The real magic, where we work around the pure attribute not being
+    # configurable: select the appropriate go_binary rule above based on the
+    # configured platform.
+    native.alias(
+        name = name,
+        actual = select({
+            "@io_bazel_rules_go//go/platform:linux": ":_%s-cgo" % name,
+            "@io_bazel_rules_go//go/platform:windows": ":_%s.exe-pure" % name,
+            "//conditions:default": ":_%s-pure" % name,
+        }),
+    )
+
+# Defines several go_test rules to work around a Bazel issue which makes
+# the pure attribute on go_test not configurable.
+# This also defines genrules to produce test binaries named ${out} and
+# ${out}.exe, and an alias named ${out}_binary which automatically selects
+# the correct filename suffix (i.e. with a .exe on Windows).
+def go_test_conditional_pure(name, out, tags = None, **kwargs):
+    tags = tags or []
+    tags.append("manual")
+
+    go_test(
+        name = "_%s-cgo" % name,
+        pure = "off",
+        testonly = False,
+        tags = tags,
+        **kwargs
+    )
+
+    go_test(
+        name = "_%s-pure" % name,
+        pure = "on",
+        testonly = False,
+        tags = tags,
+        **kwargs
+    )
+
+    native.alias(
+        name = name,
+        actual = select({
+            "@io_bazel_rules_go//go/platform:linux": ":_%s-cgo" % name,
+            "//conditions:default": ":_%s-pure" % name,
+        }),
+    )
+
+    [native.genrule(
+        name = "gen_%s" % o,
+        srcs = [name],
+        outs = [o],
+        cmd = "cp $< $@;",
+        output_to_bindir = True,
+        executable = True,
+        tags = tags,
+    ) for o in [out, out + ".exe"]]
+
+    native.alias(
+        name = "%s_binary" % out,
+        actual = select({
+            "@io_bazel_rules_go//go/platform:windows": ":gen_%s.exe" % out,
+            "//conditions:default": ":gen_%s" % out,
+        }),
+    )
diff --git a/build/platforms.bzl b/build/platforms.bzl
new file mode 100644
index 0000000000..0a6c8e4fba
--- /dev/null
+++ b/build/platforms.bzl
@@ -0,0 +1,189 @@
+# Copyright 2019 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@bazel_skylib//lib:new_sets.bzl", "sets")
+load("@bazel_skylib//lib:types.bzl", "types")
+
+# KUBE_SERVER_PLATFORMS in hack/lib/golang.sh
+SERVER_PLATFORMS = {
+    "linux": [
+        "amd64",
+        "arm",
+        "arm64",
+        "ppc64le",
+        "s390x",
+    ],
+}
+
+# KUBE_NODE_PLATFORMS in hack/lib/golang.sh
+NODE_PLATFORMS = {
+    "linux": [
+        "amd64",
+        "arm",
+        "arm64",
+        "ppc64le",
+        "s390x",
+    ],
+    "windows": [
+        "amd64",
+    ],
+}
+
+# KUBE_CLIENT_PLATFORMS in hack/lib/golang.sh
+CLIENT_PLATFORMS = {
+    "linux": [
+        "386",
+        "amd64",
+        "arm",
+        "arm64",
+        "ppc64le",
+        "s390x",
+    ],
+    "darwin": [
+        "386",
+        "amd64",
+    ],
+    "windows": [
+        "386",
+        "amd64",
+    ],
+}
+
+# KUBE_TEST_PLATFORMS in hack/lib/golang.sh
+TEST_PLATFORMS = {
+    "linux": [
+        "amd64",
+        "arm",
+        "arm64",
+        "s390x",
+        "ppc64le",
+    ],
+    "darwin": [
+        "amd64",
+    ],
+    "windows": [
+        "amd64",
+    ],
+}
+
+# Helper which produces the ALL_PLATFORMS dictionary, composed of the union of
+# CLIENT, NODE, SERVER, and TEST platforms
+def _all_platforms():
+    all_platforms = {}
+    for platforms in [CLIENT_PLATFORMS, NODE_PLATFORMS, SERVER_PLATFORMS, TEST_PLATFORMS]:
+        for os, archs in platforms.items():
+            all_platforms[os] = sets.union(
+                all_platforms.setdefault(os, sets.make()),
+                sets.make(archs),
+            )
+    for os, archs in all_platforms.items():
+        all_platforms[os] = sets.to_list(archs)
+    return all_platforms
+
+ALL_PLATFORMS = _all_platforms()
+
+def go_platform_constraint(os, arch):
+    return "@io_bazel_rules_go//go/platform:%s_%s" % (os, arch)
+
+# Helper to for_platforms which updates the select() dictionary.
+# d is the dictionary being updated.
+# value is the value to set for each item of platforms, which should
+# be a single platform category dictionary (e.g. SERVER_PLATFORMS).
+# only_os selects one of the OSes in platforms.
+def _update_dict_for_platform_category(d, value, platforms, only_os = None):
+    if not value:
+        return
+    for os, arches in platforms.items():
+        if only_os and os != only_os:
+            continue
+        for arch in arches:
+            constraint = go_platform_constraint(os, arch)
+            fmt_args = {"OS": os, "ARCH": arch}
+            if types.is_list(value):
+                # Format all items in the list, and hope there are no duplicates
+                d.setdefault(constraint, []).extend(
+                    [v.format(**fmt_args) for v in value],
+                )
+            else:
+                # Don't overwrite existing value
+                if constraint in d:
+                    fail("duplicate entry for constraint %s", constraint)
+                if types.is_dict(value):
+                    # Format dictionary values only
+                    d[constraint] = {
+                        dict_key: dict_value.format(**fmt_args)
+                        for dict_key, dict_value in value.items()
+                    }
+                else:
+                    # Hopefully this is just a string
+                    d[constraint] = value.format(**fmt_args)
+
+# for_platforms returns a dictionary to be used with select().
+# select() is used for configurable attributes (most attributes, notably
+# excluding output filenames), and takes a dictionary mapping a condition
+# to a value for that attribute.
+# select() is described in more detail in the Bazel documentation:
+# https://docs.bazel.build/versions/master/be/functions.html#select
+#
+# One notable condition is the target platform (os and arch).
+# Kubernetes binaries generally target particular platform categories,
+# such as client binaries like kubectl, or node binaries like kubelet.
+# Additionally, some build artifacts need specific configurations such as
+# the appropriate arch-specific base image.
+#
+# This macro produces a dictionary where each of the platform categories
+# (client, node, server, test, all) is enumerated and filled in
+# the the provided arguments as the values.
+#
+# For example, a filegroup might want to include one binary for all client
+# platforms and another binary for server platforms. The client and server
+# platform lists have some shared items but also some disjoint items.
+# The client binary can be provided in for_client and the server binary provided
+# in for_server; this macro will then return a select() dictionary that
+# includes the appropriate binaries based on the configured platform.
+#
+# Another example selecting the appropriate base image for a docker container.
+# One can use select(for_platforms(for_server="base-image-{ARCH}//image"))
+# to have the appropriate arch-specific image selected.
+#
+# The for_platform arguments can be lists, dictionaries, or strings, but
+# they should all be the same type for a given call.
+# The tokens {OS} and {ARCH} will be substituted with the corresponding values,
+# but if a dictionary is provided, only the dictionary values will be formatted.
+#
+# If default is provided, a default condition will be added with the provided
+# value.
+# only_os can be used to select a single OS from a platform category that lists
+# multiple OSes. For example, it doesn't make sense to build debs or RPMs for
+# anything besides Linux, so you might supply only_os="linux" for those rules.
+#
+# For a complete example, consult something like the release-tars target in
+# build/release-tars/BUILD.
+def for_platforms(
+        for_client = None,
+        for_node = None,
+        for_server = None,
+        for_test = None,
+        for_all = None,
+        default = None,
+        only_os = None):
+    d = {}
+    if default != None:
+        d["//conditions:default"] = default
+    _update_dict_for_platform_category(d, for_client, CLIENT_PLATFORMS, only_os)
+    _update_dict_for_platform_category(d, for_node, NODE_PLATFORMS, only_os)
+    _update_dict_for_platform_category(d, for_server, SERVER_PLATFORMS, only_os)
+    _update_dict_for_platform_category(d, for_test, TEST_PLATFORMS, only_os)
+    _update_dict_for_platform_category(d, for_all, ALL_PLATFORMS, only_os)
+    return d
diff --git a/build/release-tars/BUILD b/build/release-tars/BUILD
index 6435c57ba2..7e1599ea97 100644
--- a/build/release-tars/BUILD
+++ b/build/release-tars/BUILD
@@ -1,8 +1,47 @@
 package(default_visibility = ["//visibility:public"])
 
+load(
+    "//build:platforms.bzl",
+    "CLIENT_PLATFORMS",
+    "NODE_PLATFORMS",
+    "SERVER_PLATFORMS",
+    "TEST_PLATFORMS",
+    "for_platforms",
+    "go_platform_constraint",
+)
 load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
 load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
+# Bazel doesn't make the output filename
+# (such as kubernetes-server-{OS}-{ARCH}.tar.gz) configurable, so we instead
+# create rules for all platforms and tag them manual.
+# We then select the correct set of platform-specific tarballs in this filegroup
+# using a select() statement.
+# Thus the release-tars target always selects the correct set of tarballs
+# for the configured platform being built.
+release_filegroup(
+    name = "release-tars",
+    conditioned_srcs = for_platforms(
+        for_all = [
+            ":kubernetes.tar.gz",
+            ":kubernetes-src.tar.gz",
+        ],
+        for_client = [":kubernetes-client-{OS}-{ARCH}.tar.gz"],
+        for_node = [":kubernetes-node-{OS}-{ARCH}.tar.gz"],
+        for_server = [
+            ":kubernetes-server-{OS}-{ARCH}.tar.gz",
+            ":kubernetes-manifests.tar.gz",
+        ],
+        for_test = [
+            ":kubernetes-test-portable.tar.gz",
+            ":kubernetes-test-{OS}-{ARCH}.tar.gz",
+            # TODO(ixdy): remove once the "mondo-test" tarball is deprecated.
+            # It isn't really mondo under Bazel anyway.
+            ":kubernetes-test.tar.gz",
+        ],
+    ),
+)
+
 filegroup(
     name = "package-srcs",
     srcs = glob(["**"]),
@@ -48,12 +87,12 @@ pkg_tar(
         ":package_src": "//",
         "//conditions:default": ".",
     }),
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
 )
 
-# FIXME: this should be configurable/auto-detected
-PLATFORM_ARCH_STRING = "linux-amd64"
-
 # Included in node and server tarballs.
 filegroup(
     name = "license-targets",
@@ -69,19 +108,23 @@ pkg_tar(
     srcs = ["//build:client-targets"],
     mode = "0755",
     package_dir = "client/bin",
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
-pkg_tar(
-    name = "kubernetes-client-%s" % PLATFORM_ARCH_STRING,
+[[pkg_tar(
+    name = "kubernetes-client-%s-%s" % (os, arch),
     extension = "tar.gz",
     package_dir = "kubernetes",
-    tags = ["no-cache"],
-    deps = [
-        ":_client-bin",
+    tags = [
+        "manual",
+        "no-cache",
     ],
-)
+    deps = select({go_platform_constraint(os, arch): [":_client-bin"]}),
+) for arch in archs] for os, archs in CLIENT_PLATFORMS.items()]
 
 pkg_tar(
     name = "_node-bin",
@@ -91,21 +134,25 @@ pkg_tar(
     ],
     mode = "0755",
     package_dir = "node/bin",
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
-pkg_tar(
-    name = "kubernetes-node-%s" % PLATFORM_ARCH_STRING,
+[[pkg_tar(
+    name = "kubernetes-node-%s-%s" % (os, arch),
     srcs = [":license-targets"],
     extension = "tar.gz",
     mode = "0644",
     package_dir = "kubernetes",
-    tags = ["no-cache"],
-    deps = [
-        ":_node-bin",
+    tags = [
+        "manual",
+        "no-cache",
     ],
-)
+    deps = select({go_platform_constraint(os, arch): [":_node-bin"]}),
+) for arch in archs] for os, archs in NODE_PLATFORMS.items()]
 
 pkg_tar(
     name = "_server-bin",
@@ -117,7 +164,10 @@ pkg_tar(
     ],
     mode = "0755",
     package_dir = "server/bin",
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
@@ -135,31 +185,43 @@ pkg_tar(
         ":.dummy",
     ],
     package_dir = "addons",
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
-pkg_tar(
-    name = "kubernetes-server-%s" % PLATFORM_ARCH_STRING,
+[[pkg_tar(
+    name = "kubernetes-server-%s-%s" % (os, arch),
     srcs = [":license-targets"],
     extension = "tar.gz",
     mode = "0644",
     package_dir = "kubernetes",
-    tags = ["no-cache"],
-    deps = [
-        ":_server-addons",
-        ":_server-bin",
+    tags = [
+        "manual",
+        "no-cache",
     ],
-)
+    deps = select({
+        go_platform_constraint(os, arch): [
+            ":_server-addons",
+            ":_server-bin",
+        ],
+    }),
+) for arch in archs] for os, archs in SERVER_PLATFORMS.items()]
 
 # The mondo test tarball is deprecated.
 pkg_tar(
     name = "_test-mondo-bin",
     srcs = ["//build:test-targets"],
     mode = "0755",
-    package_dir = "platforms/" + PLATFORM_ARCH_STRING.replace("-", "/"),
-    tags = ["no-cache"],
-    # TODO: how to make this multiplatform?
+    package_dir = select(for_platforms(
+        for_test = "platforms/{OS}/{ARCH}",
+    )),
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
@@ -196,11 +258,13 @@ pkg_tar(
         "build/release-tars/DEPRECATION_NOTICE": "DEPRECATION_NOTICE",
     },
     strip_prefix = "//",
-    tags = ["no-cache"],
-    deps = [
-        # TODO: how to make this multiplatform?
-        ":_test-mondo-bin",
+    tags = [
+        "manual",
+        "no-cache",
     ],
+    deps = select(for_platforms(
+        for_test = [":_test-mondo-bin"],
+    )),
 )
 
 pkg_tar(
@@ -217,21 +281,24 @@ pkg_tar(
     srcs = ["//build:test-targets"],
     mode = "0755",
     package_dir = "test/bin",
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
-pkg_tar(
-    name = "kubernetes-test-%s" % PLATFORM_ARCH_STRING,
+[[pkg_tar(
+    name = "kubernetes-test-%s-%s" % (os, arch),
     extension = "tar.gz",
     package_dir = "kubernetes",
     strip_prefix = "//",
-    tags = ["no-cache"],
-    deps = [
-        # TODO: how to make this multiplatform?
-        ":_test-bin",
+    tags = [
+        "manual",
+        "no-cache",
     ],
-)
+    deps = select({go_platform_constraint(os, arch): [":_test-bin"]}),
+) for arch in archs] for os, archs in TEST_PLATFORMS.items()]
 
 pkg_tar(
     name = "_full_server",
@@ -239,7 +306,10 @@ pkg_tar(
         ":kubernetes-manifests.tar.gz",
     ],
     package_dir = "server",
-    tags = ["no-cache"],
+    tags = [
+        "manual",
+        "no-cache",
+    ],
     visibility = ["//visibility:private"],
 )
 
@@ -270,18 +340,3 @@ pkg_tar(
         "//cluster:manifests",
     ],
 )
-
-release_filegroup(
-    name = "release-tars",
-    srcs = [
-        ":kubernetes.tar.gz",
-        ":kubernetes-client-%s.tar.gz" % PLATFORM_ARCH_STRING,
-        ":kubernetes-node-%s.tar.gz" % PLATFORM_ARCH_STRING,
-        ":kubernetes-server-%s.tar.gz" % PLATFORM_ARCH_STRING,
-        ":kubernetes-manifests.tar.gz",
-        ":kubernetes-src.tar.gz",
-        ":kubernetes-test-%s.tar.gz" % PLATFORM_ARCH_STRING,
-        ":kubernetes-test.tar.gz",
-        ":kubernetes-test-portable.tar.gz",
-    ],
-)
diff --git a/build/root/.bazelrc b/build/root/.bazelrc
index 8fc89e94c5..f08b09c8e0 100644
--- a/build/root/.bazelrc
+++ b/build/root/.bazelrc
@@ -24,3 +24,18 @@ test:unit --flaky_test_attempts=3
 
 test:integration --local_test_jobs 4
 test:integration --test_tag_filters=integration
+
+# Darwin and Windows only cross-compile pure Go
+build:cross:darwin_386 --platforms=@io_bazel_rules_go//go/toolchain:darwin_386
+build:cross:darwin_amd64 --platforms=@io_bazel_rules_go//go/toolchain:darwin_amd64
+build:cross:windows_386 --platforms=@io_bazel_rules_go//go/toolchain:windows_386
+build:cross:windows_amd64 --platforms=@io_bazel_rules_go//go/toolchain:windows_amd64
+
+# We enable cgo cross-compilation for Linux, but need to use our custom crosstool.
+build:repo_infra_crosstool --crosstool_top=@io_k8s_repo_infra//tools:toolchain --compiler=gcc
+build:cross:linux_386 --config=repo_infra_crosstool --platforms=@io_bazel_rules_go//go/toolchain:linux_386
+build:cross:linux_amd64 --config=repo_infra_crosstool --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 --cpu=amd64
+build:cross:linux_arm --config=repo_infra_crosstool --platforms=@io_bazel_rules_go//go/toolchain:linux_arm --cpu=arm
+build:cross:linux_arm64 --config=repo_infra_crosstool --platforms=@io_bazel_rules_go//go/toolchain:linux_arm64 --cpu=arm64
+build:cross:linux_ppc64le --config=repo_infra_crosstool --platforms=@io_bazel_rules_go//go/toolchain:linux_ppc64le --cpu=ppc64le
+build:cross:linux_s390x --config=repo_infra_crosstool --platforms=@io_bazel_rules_go//go/toolchain:linux_s390x --cpu=s390x
diff --git a/build/root/BUILD.root b/build/root/BUILD.root
index d0238420d5..66778a602b 100644
--- a/build/root/BUILD.root
+++ b/build/root/BUILD.root
@@ -14,16 +14,21 @@
 package(default_visibility = ["//visibility:public"])
 
 load("@io_k8s_repo_infra//defs:build.bzl", "gcs_upload")
+load("//build:platforms.bzl", "for_platforms")
 
 filegroup(
     name = "_binary-artifacts-and-hashes",
-    srcs = [
-        "//build:client-targets-and-hashes",
-        "//build:docker-artifacts-and-hashes",
-        "//build:node-targets-and-hashes",
-        "//build:server-targets-and-hashes",
-        "//build/debs:debs-and-hashes",
-    ],
+    srcs = select(for_platforms(
+        for_client = ["//build:client-targets-and-hashes"],
+        for_node = [
+            "//build:node-targets-and-hashes",
+            "//build/debs:debs-and-hashes",
+        ],
+        for_server = [
+            "//build:docker-artifacts-and-hashes",
+            "//build:server-targets-and-hashes",
+        ],
+    )),
     visibility = ["//visibility:private"],
 )
 
@@ -35,11 +40,21 @@ gcs_upload(
         "//cluster/gce/gci:gcs-release-artifacts-and-hashes",
     ],
     tags = ["manual"],
-    upload_paths = {
-        "//:_binary-artifacts-and-hashes": "bin/linux/amd64",
+    # Use for_platforms to format the upload path based on the configured
+    # platform (os/arch).
+    # For example, this will turn into something like
+    # upload_paths = select({
+    #    "@io_bazel_rules_go//go/platform:windows_386": {
+    #        ...,"//:binary-artifacts-and-hashes": "bin/windows/386"},
+    #    "@io_bazel_rules_go//go/platform:linux_ppc64le": {
+    #        ...,"//:binary-artifacts-and-hashes": "bin/linux/ppc64le"},
+    #})
+    # and bazel will select the correct entry.
+    upload_paths = select(for_platforms(for_all = {
         "//build/release-tars:release-tars-and-hashes": "",
         "//cluster/gce/gci:gcs-release-artifacts-and-hashes": "extra/gce",
-    },
+        "//:_binary-artifacts-and-hashes": "bin/{OS}/{ARCH}",
+    })),
 )
 
 filegroup(
diff --git a/build/root/WORKSPACE b/build/root/WORKSPACE
index ea1c648192..43e2868bda 100644
--- a/build/root/WORKSPACE
+++ b/build/root/WORKSPACE
@@ -1,6 +1,5 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 load("//build:workspace_mirror.bzl", "mirror")
-load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")
 
 http_archive(
     name = "bazel_skylib",
@@ -15,9 +14,9 @@ versions.check(minimum_bazel_version = "0.18.0")
 
 http_archive(
     name = "io_k8s_repo_infra",
-    sha256 = "4ce2d8576e786c8fb8bc4f7ed79f5fda543568d78c09306d16cc8d1b7d5621f0",
-    strip_prefix = "repo-infra-8a5707674e76b825bfd9a8624bae045bc6e5f24d",
-    urls = mirror("https://github.com/kubernetes/repo-infra/archive/8a5707674e76b825bfd9a8624bae045bc6e5f24d.tar.gz"),
+    sha256 = "2cc74219eafebb0af1e0cf80b9c2b78aac9aa570de762bfb82b83e9164be9da2",
+    strip_prefix = "repo-infra-b461270ab6ccfb94ff2d78df96d26f669376d660",
+    urls = mirror("https://github.com/kubernetes/repo-infra/archive/b461270ab6ccfb94ff2d78df96d26f669376d660.tar.gz"),
 )
 
 ETCD_VERSION = "3.3.10"
@@ -60,44 +59,6 @@ container_repositories()
 
 load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
 
-http_file(
-    name = "kubernetes_cni",
-    downloaded_file_path = "kubernetes_cni.tgz",
-    sha256 = "f04339a21b8edf76d415e7f17b620e63b8f37a76b2f706671587ab6464411f2d",
-    urls = mirror("https://storage.googleapis.com/kubernetes-release/network-plugins/cni-plugins-amd64-v%s.tgz" % CNI_VERSION),
-)
-
-http_file(
-    name = "cri_tools",
-    downloaded_file_path = "cri_tools.tgz",
-    sha256 = "e7d913bcce40bf54e37ab1d4b75013c823d0551e6bc088b217bc1893207b4844",
-    urls = mirror("https://github.com/kubernetes-incubator/cri-tools/releases/download/v%s/crictl-v%s-linux-amd64.tar.gz" % (CRI_TOOLS_VERSION, CRI_TOOLS_VERSION)),
-)
-
-container_pull(
-    name = "debian-base-amd64",
-    digest = "sha256:8ccb65cd2dd7e0c24193d0742a20e4a673dbd11af5a33f16fcd471a31486866c",
-    registry = "k8s.gcr.io",
-    repository = "debian-base-amd64",
-    tag = "0.4.1",  # ignored, but kept here for documentation
-)
-
-container_pull(
-    name = "debian-iptables-amd64",
-    digest = "sha256:9c41b4c326304b94eb96fdd2e181aa6e9995cc4642fcdfb570cedd73a419ba39",
-    registry = "k8s.gcr.io",
-    repository = "debian-iptables-amd64",
-    tag = "v11.0.1",  # ignored, but kept here for documentation
-)
-
-container_pull(
-    name = "debian-hyperkube-base-amd64",
-    digest = "sha256:5d4ea2fb5fbe9a9a9da74f67cf2faefc881968bc39f2ac5d62d9167e575812a1",
-    registry = "k8s.gcr.io",
-    repository = "debian-hyperkube-base-amd64",
-    tag = "0.12.1",  # ignored, but kept here for documentation
-)
-
 container_pull(
     name = "official_busybox",
     digest = "sha256:cb63aa0641a885f54de20f61d152187419e8f6b159ed11a251a09d115fdff9bd",
@@ -106,6 +67,10 @@ container_pull(
     tag = "latest",  # ignored, but kept here for documentation
 )
 
+load("//build:workspace.bzl", "release_dependencies")
+
+release_dependencies()
+
 load("//build:workspace_mirror.bzl", "export_urls")
 
 export_urls("workspace_urls")
diff --git a/build/rpms/BUILD b/build/rpms/BUILD
index be011df488..b6d5e33d17 100644
--- a/build/rpms/BUILD
+++ b/build/rpms/BUILD
@@ -1,49 +1,76 @@
 package(default_visibility = ["//visibility:public"])
 
-load("@bazel_tools//tools/build_defs/pkg:rpm.bzl", "pkg_rpm")
+load("//build:platforms.bzl", "CLIENT_PLATFORMS", "NODE_PLATFORMS", "for_platforms")
 load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:rpm.bzl", "pkg_rpm_for_goarch")
 
-filegroup(
+release_filegroup(
     name = "rpms",
-    srcs = [
-        ":cri-tools",
-        ":kubeadm",
-        ":kubectl",
-        ":kubelet",
-        ":kubernetes-cni",
-    ],
+    conditioned_srcs = for_platforms(
+        default = [],
+        for_client = [":kubectl-{ARCH}"],
+        for_node = [
+            ":cri-tools-{ARCH}",
+            ":kubeadm-{ARCH}",
+            ":kubelet-{ARCH}",
+            ":kubernetes-cni-{ARCH}",
+        ],
+        only_os = "linux",
+    ),
     tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 
-pkg_rpm(
+# Create aliases from the non-arch names to the arch-specific names for backwards compatibility
+alias(
+    name = "kubectl",
+    actual = select(for_platforms(
+        for_client = ":kubectl-{ARCH}",
+        only_os = "linux",
+    )),
+)
+
+[alias(
+    name = pkg,
+    actual = select(for_platforms(
+        for_client = ":%s-{ARCH}" % pkg,
+        only_os = "linux",
+    )),
+) for pkg in [
+    "cri-tools",
+    "kubeadm",
+    "kubelet",
+    "kubernetes-cni",
+]]
+
+[pkg_rpm_for_goarch(
     name = "kubectl",
-    architecture = "x86_64",
     changelog = "//:CHANGELOG.md",
     data = [
         "//cmd/kubectl",
     ],
+    goarch = arch,
     spec_file = "kubectl.spec",
     tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in CLIENT_PLATFORMS["linux"]]
 
-pkg_rpm(
+[pkg_rpm_for_goarch(
     name = "kubelet",
-    architecture = "x86_64",
     changelog = "//:CHANGELOG.md",
     data = [
         "kubelet.service",
         "//cmd/kubelet",
     ],
+    goarch = arch,
     spec_file = "kubelet.spec",
     tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-pkg_rpm(
+[pkg_rpm_for_goarch(
     name = "kubeadm",
-    architecture = "x86_64",
     changelog = "//:CHANGELOG.md",
     data = [
         "10-kubeadm.conf",
@@ -52,33 +79,34 @@ pkg_rpm(
         "kubelet.env",
         "//cmd/kubeadm",
     ],
+    goarch = arch,
     spec_file = "kubeadm.spec",
     tags = ["manual"],
     version_file = "//build:os_package_version",
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-pkg_rpm(
+[pkg_rpm_for_goarch(
     name = "kubernetes-cni",
-    architecture = "x86_64",
     changelog = "//:CHANGELOG.md",
     data = [
-        "@kubernetes_cni//file",
+        "@kubernetes_cni_{GOARCH}//file",
     ],
+    goarch = arch,
     spec_file = "kubernetes-cni.spec",
     tags = ["manual"],
     version = CNI_VERSION,
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
-pkg_rpm(
+[pkg_rpm_for_goarch(
     name = "cri-tools",
-    architecture = "x86_64",
     data = [
-        "@cri_tools//file",
+        "@cri_tools_{GOARCH}//file",
     ],
+    goarch = arch,
     spec_file = "cri-tools.spec",
     tags = ["manual"],
     version = CRI_TOOLS_VERSION,
-)
+) for arch in NODE_PLATFORMS["linux"]]
 
 filegroup(
     name = "package-srcs",
diff --git a/build/workspace.bzl b/build/workspace.bzl
index edd2af76e7..6a0252e7c4 100644
--- a/build/workspace.bzl
+++ b/build/workspace.bzl
@@ -12,6 +12,83 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-CRI_TOOLS_VERSION = "1.12.0"
+load("//build:platforms.bzl", "SERVER_PLATFORMS")
+load("//build:workspace_mirror.bzl", "mirror")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
 
 CNI_VERSION = "0.6.0"
+_CNI_TARBALL_ARCH_SHA256 = {
+    "amd64": "f04339a21b8edf76d415e7f17b620e63b8f37a76b2f706671587ab6464411f2d",
+    "arm": "ffb62021d2fc6e1266dc6ef7f2058125b6e6b44c016291a2b04a15ed9b4be70a",
+    "arm64": "016bbc989877e35e3cd49fafe11415fb2717e52c74fde6b1650411154cb91b81",
+    "ppc64le": "dd38dec69b167cfe40ecbba4b18cfe5b4296f2e49b90c00804b3988ef968e859",
+    "s390x": "7708289eee7e52ad055407c421033d8e593f5cf1a0b43a872f09eb4e1508aafc",
+}
+
+CRI_TOOLS_VERSION = "1.12.0"
+_CRI_TARBALL_ARCH_SHA256 = {
+    "amd64": "e7d913bcce40bf54e37ab1d4b75013c823d0551e6bc088b217bc1893207b4844",
+    "arm": "ca6b4ac80278d32d9cc8b8b19de140fd1cc35640f088969f7068fea2df625490",
+    "arm64": "8466f08b59bf36d2eebcb9428c3d4e6e224c3065d800ead09ad730ce374da6fe",
+    "ppc64le": "ec6254f1f6ffa064ba41825aab5612b7b005c8171fbcdac2ca3927d4e393000f",
+    "s390x": "814aa9cd496be416612c2653097a1c9eb5784e38aa4889034b44ebf888709057",
+}
+
+# Note that these are digests for the manifest list. We resolve the manifest
+# list to each of its platform-specific images in
+# debian_image_dependencies().
+_DEBIAN_BASE_DIGEST = "sha256:6966a0aedd7592c18ff2dd803c08bd85780ee19f5e3a2e7cf908a4cd837afcde"  # 0.4.1
+_DEBIAN_IPTABLES_DIGEST = "sha256:656e45c00083359107b1d6ae0411ff3894ba23011a8533e229937a71be84e063"  # v11.0.1
+_DEBIAN_HYPERKUBE_BASE_DIGEST = "sha256:8cabe02be6e86685d8860b7ace7c7addc9591a339728703027a4854677f1c772"  # 0.12.1
+
+# Dependencies needed for a Kubernetes "release", e.g. building docker images,
+# debs, RPMs, or tarballs.
+def release_dependencies():
+    cni_tarballs()
+    cri_tarballs()
+    debian_image_dependencies()
+
+def cni_tarballs():
+    for arch, sha in _CNI_TARBALL_ARCH_SHA256.items():
+        http_file(
+            name = "kubernetes_cni_%s" % arch,
+            downloaded_file_path = "kubernetes_cni.tgz",
+            sha256 = sha,
+            urls = mirror("https://storage.googleapis.com/kubernetes-release/network-plugins/cni-plugins-%s-v%s.tgz" % (arch, CNI_VERSION)),
+        )
+
+def cri_tarballs():
+    for arch, sha in _CRI_TARBALL_ARCH_SHA256.items():
+        http_file(
+            name = "cri_tools_%s" % arch,
+            downloaded_file_path = "cri_tools.tgz",
+            sha256 = sha,
+            urls = mirror("https://github.com/kubernetes-incubator/cri-tools/releases/download/v%s/crictl-v%s-linux-%s.tar.gz" % (CRI_TOOLS_VERSION, CRI_TOOLS_VERSION, arch)),
+        )
+
+def debian_image_dependencies():
+    for arch in SERVER_PLATFORMS["linux"]:
+        container_pull(
+            name = "debian-base-" + arch,
+            architecture = arch,
+            digest = _DEBIAN_BASE_DIGEST,
+            registry = "k8s.gcr.io",
+            repository = "debian-base",
+        )
+
+        container_pull(
+            name = "debian-iptables-" + arch,
+            architecture = arch,
+            digest = _DEBIAN_IPTABLES_DIGEST,
+            registry = "k8s.gcr.io",
+            repository = "debian-iptables",
+        )
+
+        container_pull(
+            name = "debian-hyperkube-base-" + arch,
+            architecture = arch,
+            digest = _DEBIAN_HYPERKUBE_BASE_DIGEST,
+            registry = "k8s.gcr.io",
+            repository = "debian-hyperkube-base",
+        )
diff --git a/cluster/images/conformance/BUILD b/cluster/images/conformance/BUILD
index 5968c20b1c..399127f2df 100644
--- a/cluster/images/conformance/BUILD
+++ b/cluster/images/conformance/BUILD
@@ -12,7 +12,7 @@ container_layer(
     directory = "/usr/local/bin",
     files = [
         "//cmd/kubectl",
-        "//test/e2e:e2e.test",
+        "//test/e2e:e2e.test_binary",
         "//vendor/github.com/onsi/ginkgo/ginkgo",
     ],
 )
diff --git a/cmd/gendocs/BUILD b/cmd/gendocs/BUILD
index 04897fb312..6b2af89afb 100644
--- a/cmd/gendocs/BUILD
+++ b/cmd/gendocs/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_binary(
     name = "gendocs",
diff --git a/cmd/genkubedocs/BUILD b/cmd/genkubedocs/BUILD
index 6e461f7df3..deddd64c7f 100644
--- a/cmd/genkubedocs/BUILD
+++ b/cmd/genkubedocs/BUILD
@@ -1,8 +1,11 @@
 package(default_visibility = ["//visibility:public"])
 
+load(
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
+)
 load(
     "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
     "go_library",
     "go_test",
 )
diff --git a/cmd/genman/BUILD b/cmd/genman/BUILD
index 31c33b4f0c..09a7a7573d 100644
--- a/cmd/genman/BUILD
+++ b/cmd/genman/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_binary(
     name = "genman",
diff --git a/cmd/genswaggertypedocs/BUILD b/cmd/genswaggertypedocs/BUILD
index 5fabe41559..846f92857c 100644
--- a/cmd/genswaggertypedocs/BUILD
+++ b/cmd/genswaggertypedocs/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_binary(
     name = "genswaggertypedocs",
diff --git a/cmd/genyaml/BUILD b/cmd/genyaml/BUILD
index 924e6144d2..b659a37962 100644
--- a/cmd/genyaml/BUILD
+++ b/cmd/genyaml/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_binary(
     name = "genyaml",
diff --git a/cmd/hyperkube/BUILD b/cmd/hyperkube/BUILD
index 22f9f3d433..369cc94fc3 100644
--- a/cmd/hyperkube/BUILD
+++ b/cmd/hyperkube/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("//pkg/version:def.bzl", "version_x_defs")
 
 go_binary(
diff --git a/cmd/kubelet/BUILD b/cmd/kubelet/BUILD
index e2900d3cf3..b0afbcc788 100644
--- a/cmd/kubelet/BUILD
+++ b/cmd/kubelet/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("//pkg/version:def.bzl", "version_x_defs")
 
 go_binary(
diff --git a/cmd/kubemark/BUILD b/cmd/kubemark/BUILD
index 7dedb9587f..56f362c1e2 100644
--- a/cmd/kubemark/BUILD
+++ b/cmd/kubemark/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_binary(
     name = "kubemark",
diff --git a/cmd/linkcheck/BUILD b/cmd/linkcheck/BUILD
index 00d36ada08..7aa32491ce 100644
--- a/cmd/linkcheck/BUILD
+++ b/cmd/linkcheck/BUILD
@@ -1,10 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_binary",
-    "go_library",
+    "//build:go.bzl",
+    go_binary = "go_binary_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_binary(
     name = "linkcheck",
diff --git a/test/e2e/BUILD b/test/e2e/BUILD
index b0d0e531ec..7e464dde31 100644
--- a/test/e2e/BUILD
+++ b/test/e2e/BUILD
@@ -1,14 +1,15 @@
 package(default_visibility = ["//visibility:public"])
 
 load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
+    "//build:go.bzl",
+    go_test = "go_test_conditional_pure",
 )
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_test(
     name = "go_default_test",
     srcs = ["e2e_test.go"],
+    out = "e2e.test",
     embed = [":go_default_library"],
     tags = ["e2e"],
     deps = [
@@ -78,17 +79,6 @@ go_library(
     ],
 )
 
-# This is a handwritten rule. Do not delete, it will not be regenerated by
-# update-bazel.sh.
-genrule(
-    name = "gen_e2e.test",
-    testonly = 1,
-    srcs = [":go_default_test"],
-    outs = ["e2e.test"],
-    cmd = "srcs=($(SRCS)); cp $$(dirname $${srcs[0]})/go_default_test $@;",
-    output_to_bindir = 1,
-)
-
 filegroup(
     name = "package-srcs",
     srcs = glob(["**"]),
diff --git a/test/e2e_kubeadm/BUILD b/test/e2e_kubeadm/BUILD
index eba7037ba0..bf37bd72c2 100644
--- a/test/e2e_kubeadm/BUILD
+++ b/test/e2e_kubeadm/BUILD
@@ -1,6 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load(
+    "//build:go.bzl",
+    go_test = "go_test_conditional_pure",
+)
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_test(
     name = "go_default_test",
@@ -8,6 +12,7 @@ go_test(
         "e2e_kubeadm_suite_test.go",
         "kubeadm_test.go",
     ],
+    out = "e2e_kubeadm.test",
     embed = [":go_default_library"],
     tags = ["e2e"],
     deps = [
@@ -32,15 +37,6 @@ filegroup(
     visibility = ["//visibility:private"],
 )
 
-genrule(
-    name = "gen_e2e_kubeadm.test",
-    testonly = 1,
-    srcs = [":go_default_test"],
-    outs = ["e2e_kubeadm.test"],
-    cmd = "srcs=($(SRCS)); cp $$(dirname $${srcs[0]})/go_default_test $@;",
-    output_to_bindir = 1,
-)
-
 filegroup(
     name = "all-srcs",
     srcs = [
diff --git a/test/e2e_node/BUILD b/test/e2e_node/BUILD
index 4c81963967..a8cf1c6b3c 100644
--- a/test/e2e_node/BUILD
+++ b/test/e2e_node/BUILD
@@ -1,6 +1,10 @@
 package(default_visibility = ["//visibility:public"])
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load(
+    "//build:go.bzl",
+    go_test = "go_test_conditional_pure",
+)
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
     name = "go_default_library",
@@ -106,6 +110,7 @@ go_test(
         "summary_test.go",
         "volume_manager_test.go",
     ],
+    out = "e2e_node.test",
     embed = [":go_default_library"],
     tags = ["e2e"],
     deps = [
@@ -180,15 +185,6 @@ go_test(
     }),
 )
 
-genrule(
-    name = "gen_e2e_node.test",
-    testonly = 1,
-    srcs = [":go_default_test"],
-    outs = ["e2e_node.test"],
-    cmd = "srcs=($(SRCS)); cp $$(dirname $${srcs[0]})/go_default_test $@;",
-    output_to_bindir = 1,
-)
-
 filegroup(
     name = "package-srcs",
     srcs = glob(["**"]),