diff --git a/Godeps/Godeps.json b/Godeps/Godeps.json
index b2963dd5..342edfe0 100644
--- a/Godeps/Godeps.json
+++ b/Godeps/Godeps.json
@@ -1,6 +1,6 @@
 {
 	"ImportPath": "github.com/coreos/coreos-baremetal",
-	"GoVersion": "go1.5.1",
+	"GoVersion": "go1.5.3",
 	"Packages": [
 		"./..."
 	],
@@ -38,6 +38,10 @@
 			"Comment": "v1.0-71-g0d5a14c",
 			"Rev": "0d5a14c5a477957864f3b747d95255ad4e34bcc0"
 		},
+		{
+			"ImportPath": "golang.org/x/net/context",
+			"Rev": "d75b1902409c457a51e4bd1895031872c370983a"
+		},
 		{
 			"ImportPath": "gopkg.in/yaml.v2",
 			"Rev": "49c95bdc21843256fb6c4e0d370a05f24a0bf213"
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/context.go b/Godeps/_workspace/src/golang.org/x/net/context/context.go
new file mode 100644
index 00000000..11bd8d34
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/context.go
@@ -0,0 +1,447 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package context defines the Context type, which carries deadlines,
+// cancelation signals, and other request-scoped values across API boundaries
+// and between processes.
+//
+// Incoming requests to a server should create a Context, and outgoing calls to
+// servers should accept a Context.  The chain of function calls between must
+// propagate the Context, optionally replacing it with a modified copy created
+// using WithDeadline, WithTimeout, WithCancel, or WithValue.
+//
+// Programs that use Contexts should follow these rules to keep interfaces
+// consistent across packages and enable static analysis tools to check context
+// propagation:
+//
+// Do not store Contexts inside a struct type; instead, pass a Context
+// explicitly to each function that needs it.  The Context should be the first
+// parameter, typically named ctx:
+//
+// 	func DoSomething(ctx context.Context, arg Arg) error {
+// 		// ... use ctx ...
+// 	}
+//
+// Do not pass a nil Context, even if a function permits it.  Pass context.TODO
+// if you are unsure about which Context to use.
+//
+// Use context Values only for request-scoped data that transits processes and
+// APIs, not for passing optional parameters to functions.
+//
+// The same Context may be passed to functions running in different goroutines;
+// Contexts are safe for simultaneous use by multiple goroutines.
+//
+// See http://blog.golang.org/context for example code for a server that uses
+// Contexts.
+package context
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+)
+
+// A Context carries a deadline, a cancelation signal, and other values across
+// API boundaries.
+//
+// Context's methods may be called by multiple goroutines simultaneously.
+type Context interface {
+	// Deadline returns the time when work done on behalf of this context
+	// should be canceled.  Deadline returns ok==false when no deadline is
+	// set.  Successive calls to Deadline return the same results.
+	Deadline() (deadline time.Time, ok bool)
+
+	// Done returns a channel that's closed when work done on behalf of this
+	// context should be canceled.  Done may return nil if this context can
+	// never be canceled.  Successive calls to Done return the same value.
+	//
+	// WithCancel arranges for Done to be closed when cancel is called;
+	// WithDeadline arranges for Done to be closed when the deadline
+	// expires; WithTimeout arranges for Done to be closed when the timeout
+	// elapses.
+	//
+	// Done is provided for use in select statements:
+	//
+	//  // Stream generates values with DoSomething and sends them to out
+	//  // until DoSomething returns an error or ctx.Done is closed.
+	//  func Stream(ctx context.Context, out <-chan Value) error {
+	//  	for {
+	//  		v, err := DoSomething(ctx)
+	//  		if err != nil {
+	//  			return err
+	//  		}
+	//  		select {
+	//  		case <-ctx.Done():
+	//  			return ctx.Err()
+	//  		case out <- v:
+	//  		}
+	//  	}
+	//  }
+	//
+	// See http://blog.golang.org/pipelines for more examples of how to use
+	// a Done channel for cancelation.
+	Done() <-chan struct{}
+
+	// Err returns a non-nil error value after Done is closed.  Err returns
+	// Canceled if the context was canceled or DeadlineExceeded if the
+	// context's deadline passed.  No other values for Err are defined.
+	// After Done is closed, successive calls to Err return the same value.
+	Err() error
+
+	// Value returns the value associated with this context for key, or nil
+	// if no value is associated with key.  Successive calls to Value with
+	// the same key returns the same result.
+	//
+	// Use context values only for request-scoped data that transits
+	// processes and API boundaries, not for passing optional parameters to
+	// functions.
+	//
+	// A key identifies a specific value in a Context.  Functions that wish
+	// to store values in Context typically allocate a key in a global
+	// variable then use that key as the argument to context.WithValue and
+	// Context.Value.  A key can be any type that supports equality;
+	// packages should define keys as an unexported type to avoid
+	// collisions.
+	//
+	// Packages that define a Context key should provide type-safe accessors
+	// for the values stores using that key:
+	//
+	// 	// Package user defines a User type that's stored in Contexts.
+	// 	package user
+	//
+	// 	import "golang.org/x/net/context"
+	//
+	// 	// User is the type of value stored in the Contexts.
+	// 	type User struct {...}
+	//
+	// 	// key is an unexported type for keys defined in this package.
+	// 	// This prevents collisions with keys defined in other packages.
+	// 	type key int
+	//
+	// 	// userKey is the key for user.User values in Contexts.  It is
+	// 	// unexported; clients use user.NewContext and user.FromContext
+	// 	// instead of using this key directly.
+	// 	var userKey key = 0
+	//
+	// 	// NewContext returns a new Context that carries value u.
+	// 	func NewContext(ctx context.Context, u *User) context.Context {
+	// 		return context.WithValue(ctx, userKey, u)
+	// 	}
+	//
+	// 	// FromContext returns the User value stored in ctx, if any.
+	// 	func FromContext(ctx context.Context) (*User, bool) {
+	// 		u, ok := ctx.Value(userKey).(*User)
+	// 		return u, ok
+	// 	}
+	Value(key interface{}) interface{}
+}
+
+// Canceled is the error returned by Context.Err when the context is canceled.
+var Canceled = errors.New("context canceled")
+
+// DeadlineExceeded is the error returned by Context.Err when the context's
+// deadline passes.
+var DeadlineExceeded = errors.New("context deadline exceeded")
+
+// An emptyCtx is never canceled, has no values, and has no deadline.  It is not
+// struct{}, since vars of this type must have distinct addresses.
+type emptyCtx int
+
+func (*emptyCtx) Deadline() (deadline time.Time, ok bool) {
+	return
+}
+
+func (*emptyCtx) Done() <-chan struct{} {
+	return nil
+}
+
+func (*emptyCtx) Err() error {
+	return nil
+}
+
+func (*emptyCtx) Value(key interface{}) interface{} {
+	return nil
+}
+
+func (e *emptyCtx) String() string {
+	switch e {
+	case background:
+		return "context.Background"
+	case todo:
+		return "context.TODO"
+	}
+	return "unknown empty Context"
+}
+
+var (
+	background = new(emptyCtx)
+	todo       = new(emptyCtx)
+)
+
+// Background returns a non-nil, empty Context. It is never canceled, has no
+// values, and has no deadline.  It is typically used by the main function,
+// initialization, and tests, and as the top-level Context for incoming
+// requests.
+func Background() Context {
+	return background
+}
+
+// TODO returns a non-nil, empty Context.  Code should use context.TODO when
+// it's unclear which Context to use or it is not yet available (because the
+// surrounding function has not yet been extended to accept a Context
+// parameter).  TODO is recognized by static analysis tools that determine
+// whether Contexts are propagated correctly in a program.
+func TODO() Context {
+	return todo
+}
+
+// A CancelFunc tells an operation to abandon its work.
+// A CancelFunc does not wait for the work to stop.
+// After the first call, subsequent calls to a CancelFunc do nothing.
+type CancelFunc func()
+
+// WithCancel returns a copy of parent with a new Done channel. The returned
+// context's Done channel is closed when the returned cancel function is called
+// or when the parent context's Done channel is closed, whichever happens first.
+//
+// Canceling this context releases resources associated with it, so code should
+// call cancel as soon as the operations running in this Context complete.
+func WithCancel(parent Context) (ctx Context, cancel CancelFunc) {
+	c := newCancelCtx(parent)
+	propagateCancel(parent, &c)
+	return &c, func() { c.cancel(true, Canceled) }
+}
+
+// newCancelCtx returns an initialized cancelCtx.
+func newCancelCtx(parent Context) cancelCtx {
+	return cancelCtx{
+		Context: parent,
+		done:    make(chan struct{}),
+	}
+}
+
+// propagateCancel arranges for child to be canceled when parent is.
+func propagateCancel(parent Context, child canceler) {
+	if parent.Done() == nil {
+		return // parent is never canceled
+	}
+	if p, ok := parentCancelCtx(parent); ok {
+		p.mu.Lock()
+		if p.err != nil {
+			// parent has already been canceled
+			child.cancel(false, p.err)
+		} else {
+			if p.children == nil {
+				p.children = make(map[canceler]bool)
+			}
+			p.children[child] = true
+		}
+		p.mu.Unlock()
+	} else {
+		go func() {
+			select {
+			case <-parent.Done():
+				child.cancel(false, parent.Err())
+			case <-child.Done():
+			}
+		}()
+	}
+}
+
+// parentCancelCtx follows a chain of parent references until it finds a
+// *cancelCtx.  This function understands how each of the concrete types in this
+// package represents its parent.
+func parentCancelCtx(parent Context) (*cancelCtx, bool) {
+	for {
+		switch c := parent.(type) {
+		case *cancelCtx:
+			return c, true
+		case *timerCtx:
+			return &c.cancelCtx, true
+		case *valueCtx:
+			parent = c.Context
+		default:
+			return nil, false
+		}
+	}
+}
+
+// removeChild removes a context from its parent.
+func removeChild(parent Context, child canceler) {
+	p, ok := parentCancelCtx(parent)
+	if !ok {
+		return
+	}
+	p.mu.Lock()
+	if p.children != nil {
+		delete(p.children, child)
+	}
+	p.mu.Unlock()
+}
+
+// A canceler is a context type that can be canceled directly.  The
+// implementations are *cancelCtx and *timerCtx.
+type canceler interface {
+	cancel(removeFromParent bool, err error)
+	Done() <-chan struct{}
+}
+
+// A cancelCtx can be canceled.  When canceled, it also cancels any children
+// that implement canceler.
+type cancelCtx struct {
+	Context
+
+	done chan struct{} // closed by the first cancel call.
+
+	mu       sync.Mutex
+	children map[canceler]bool // set to nil by the first cancel call
+	err      error             // set to non-nil by the first cancel call
+}
+
+func (c *cancelCtx) Done() <-chan struct{} {
+	return c.done
+}
+
+func (c *cancelCtx) Err() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.err
+}
+
+func (c *cancelCtx) String() string {
+	return fmt.Sprintf("%v.WithCancel", c.Context)
+}
+
+// cancel closes c.done, cancels each of c's children, and, if
+// removeFromParent is true, removes c from its parent's children.
+func (c *cancelCtx) cancel(removeFromParent bool, err error) {
+	if err == nil {
+		panic("context: internal error: missing cancel error")
+	}
+	c.mu.Lock()
+	if c.err != nil {
+		c.mu.Unlock()
+		return // already canceled
+	}
+	c.err = err
+	close(c.done)
+	for child := range c.children {
+		// NOTE: acquiring the child's lock while holding parent's lock.
+		child.cancel(false, err)
+	}
+	c.children = nil
+	c.mu.Unlock()
+
+	if removeFromParent {
+		removeChild(c.Context, c)
+	}
+}
+
+// WithDeadline returns a copy of the parent context with the deadline adjusted
+// to be no later than d.  If the parent's deadline is already earlier than d,
+// WithDeadline(parent, d) is semantically equivalent to parent.  The returned
+// context's Done channel is closed when the deadline expires, when the returned
+// cancel function is called, or when the parent context's Done channel is
+// closed, whichever happens first.
+//
+// Canceling this context releases resources associated with it, so code should
+// call cancel as soon as the operations running in this Context complete.
+func WithDeadline(parent Context, deadline time.Time) (Context, CancelFunc) {
+	if cur, ok := parent.Deadline(); ok && cur.Before(deadline) {
+		// The current deadline is already sooner than the new one.
+		return WithCancel(parent)
+	}
+	c := &timerCtx{
+		cancelCtx: newCancelCtx(parent),
+		deadline:  deadline,
+	}
+	propagateCancel(parent, c)
+	d := deadline.Sub(time.Now())
+	if d <= 0 {
+		c.cancel(true, DeadlineExceeded) // deadline has already passed
+		return c, func() { c.cancel(true, Canceled) }
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.err == nil {
+		c.timer = time.AfterFunc(d, func() {
+			c.cancel(true, DeadlineExceeded)
+		})
+	}
+	return c, func() { c.cancel(true, Canceled) }
+}
+
+// A timerCtx carries a timer and a deadline.  It embeds a cancelCtx to
+// implement Done and Err.  It implements cancel by stopping its timer then
+// delegating to cancelCtx.cancel.
+type timerCtx struct {
+	cancelCtx
+	timer *time.Timer // Under cancelCtx.mu.
+
+	deadline time.Time
+}
+
+func (c *timerCtx) Deadline() (deadline time.Time, ok bool) {
+	return c.deadline, true
+}
+
+func (c *timerCtx) String() string {
+	return fmt.Sprintf("%v.WithDeadline(%s [%s])", c.cancelCtx.Context, c.deadline, c.deadline.Sub(time.Now()))
+}
+
+func (c *timerCtx) cancel(removeFromParent bool, err error) {
+	c.cancelCtx.cancel(false, err)
+	if removeFromParent {
+		// Remove this timerCtx from its parent cancelCtx's children.
+		removeChild(c.cancelCtx.Context, c)
+	}
+	c.mu.Lock()
+	if c.timer != nil {
+		c.timer.Stop()
+		c.timer = nil
+	}
+	c.mu.Unlock()
+}
+
+// WithTimeout returns WithDeadline(parent, time.Now().Add(timeout)).
+//
+// Canceling this context releases resources associated with it, so code should
+// call cancel as soon as the operations running in this Context complete:
+//
+// 	func slowOperationWithTimeout(ctx context.Context) (Result, error) {
+// 		ctx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
+// 		defer cancel()  // releases resources if slowOperation completes before timeout elapses
+// 		return slowOperation(ctx)
+// 	}
+func WithTimeout(parent Context, timeout time.Duration) (Context, CancelFunc) {
+	return WithDeadline(parent, time.Now().Add(timeout))
+}
+
+// WithValue returns a copy of parent in which the value associated with key is
+// val.
+//
+// Use context Values only for request-scoped data that transits processes and
+// APIs, not for passing optional parameters to functions.
+func WithValue(parent Context, key interface{}, val interface{}) Context {
+	return &valueCtx{parent, key, val}
+}
+
+// A valueCtx carries a key-value pair.  It implements Value for that key and
+// delegates all other calls to the embedded Context.
+type valueCtx struct {
+	Context
+	key, val interface{}
+}
+
+func (c *valueCtx) String() string {
+	return fmt.Sprintf("%v.WithValue(%#v, %#v)", c.Context, c.key, c.val)
+}
+
+func (c *valueCtx) Value(key interface{}) interface{} {
+	if c.key == key {
+		return c.val
+	}
+	return c.Context.Value(key)
+}
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/context_test.go b/Godeps/_workspace/src/golang.org/x/net/context/context_test.go
new file mode 100644
index 00000000..05345fc5
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/context_test.go
@@ -0,0 +1,575 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package context
+
+import (
+	"fmt"
+	"math/rand"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// otherContext is a Context that's not one of the types defined in context.go.
+// This lets us test code paths that differ based on the underlying type of the
+// Context.
+type otherContext struct {
+	Context
+}
+
+func TestBackground(t *testing.T) {
+	c := Background()
+	if c == nil {
+		t.Fatalf("Background returned nil")
+	}
+	select {
+	case x := <-c.Done():
+		t.Errorf("<-c.Done() == %v want nothing (it should block)", x)
+	default:
+	}
+	if got, want := fmt.Sprint(c), "context.Background"; got != want {
+		t.Errorf("Background().String() = %q want %q", got, want)
+	}
+}
+
+func TestTODO(t *testing.T) {
+	c := TODO()
+	if c == nil {
+		t.Fatalf("TODO returned nil")
+	}
+	select {
+	case x := <-c.Done():
+		t.Errorf("<-c.Done() == %v want nothing (it should block)", x)
+	default:
+	}
+	if got, want := fmt.Sprint(c), "context.TODO"; got != want {
+		t.Errorf("TODO().String() = %q want %q", got, want)
+	}
+}
+
+func TestWithCancel(t *testing.T) {
+	c1, cancel := WithCancel(Background())
+
+	if got, want := fmt.Sprint(c1), "context.Background.WithCancel"; got != want {
+		t.Errorf("c1.String() = %q want %q", got, want)
+	}
+
+	o := otherContext{c1}
+	c2, _ := WithCancel(o)
+	contexts := []Context{c1, o, c2}
+
+	for i, c := range contexts {
+		if d := c.Done(); d == nil {
+			t.Errorf("c[%d].Done() == %v want non-nil", i, d)
+		}
+		if e := c.Err(); e != nil {
+			t.Errorf("c[%d].Err() == %v want nil", i, e)
+		}
+
+		select {
+		case x := <-c.Done():
+			t.Errorf("<-c.Done() == %v want nothing (it should block)", x)
+		default:
+		}
+	}
+
+	cancel()
+	time.Sleep(100 * time.Millisecond) // let cancelation propagate
+
+	for i, c := range contexts {
+		select {
+		case <-c.Done():
+		default:
+			t.Errorf("<-c[%d].Done() blocked, but shouldn't have", i)
+		}
+		if e := c.Err(); e != Canceled {
+			t.Errorf("c[%d].Err() == %v want %v", i, e, Canceled)
+		}
+	}
+}
+
+func TestParentFinishesChild(t *testing.T) {
+	// Context tree:
+	// parent -> cancelChild
+	// parent -> valueChild -> timerChild
+	parent, cancel := WithCancel(Background())
+	cancelChild, stop := WithCancel(parent)
+	defer stop()
+	valueChild := WithValue(parent, "key", "value")
+	timerChild, stop := WithTimeout(valueChild, 10000*time.Hour)
+	defer stop()
+
+	select {
+	case x := <-parent.Done():
+		t.Errorf("<-parent.Done() == %v want nothing (it should block)", x)
+	case x := <-cancelChild.Done():
+		t.Errorf("<-cancelChild.Done() == %v want nothing (it should block)", x)
+	case x := <-timerChild.Done():
+		t.Errorf("<-timerChild.Done() == %v want nothing (it should block)", x)
+	case x := <-valueChild.Done():
+		t.Errorf("<-valueChild.Done() == %v want nothing (it should block)", x)
+	default:
+	}
+
+	// The parent's children should contain the two cancelable children.
+	pc := parent.(*cancelCtx)
+	cc := cancelChild.(*cancelCtx)
+	tc := timerChild.(*timerCtx)
+	pc.mu.Lock()
+	if len(pc.children) != 2 || !pc.children[cc] || !pc.children[tc] {
+		t.Errorf("bad linkage: pc.children = %v, want %v and %v",
+			pc.children, cc, tc)
+	}
+	pc.mu.Unlock()
+
+	if p, ok := parentCancelCtx(cc.Context); !ok || p != pc {
+		t.Errorf("bad linkage: parentCancelCtx(cancelChild.Context) = %v, %v want %v, true", p, ok, pc)
+	}
+	if p, ok := parentCancelCtx(tc.Context); !ok || p != pc {
+		t.Errorf("bad linkage: parentCancelCtx(timerChild.Context) = %v, %v want %v, true", p, ok, pc)
+	}
+
+	cancel()
+
+	pc.mu.Lock()
+	if len(pc.children) != 0 {
+		t.Errorf("pc.cancel didn't clear pc.children = %v", pc.children)
+	}
+	pc.mu.Unlock()
+
+	// parent and children should all be finished.
+	check := func(ctx Context, name string) {
+		select {
+		case <-ctx.Done():
+		default:
+			t.Errorf("<-%s.Done() blocked, but shouldn't have", name)
+		}
+		if e := ctx.Err(); e != Canceled {
+			t.Errorf("%s.Err() == %v want %v", name, e, Canceled)
+		}
+	}
+	check(parent, "parent")
+	check(cancelChild, "cancelChild")
+	check(valueChild, "valueChild")
+	check(timerChild, "timerChild")
+
+	// WithCancel should return a canceled context on a canceled parent.
+	precanceledChild := WithValue(parent, "key", "value")
+	select {
+	case <-precanceledChild.Done():
+	default:
+		t.Errorf("<-precanceledChild.Done() blocked, but shouldn't have")
+	}
+	if e := precanceledChild.Err(); e != Canceled {
+		t.Errorf("precanceledChild.Err() == %v want %v", e, Canceled)
+	}
+}
+
+func TestChildFinishesFirst(t *testing.T) {
+	cancelable, stop := WithCancel(Background())
+	defer stop()
+	for _, parent := range []Context{Background(), cancelable} {
+		child, cancel := WithCancel(parent)
+
+		select {
+		case x := <-parent.Done():
+			t.Errorf("<-parent.Done() == %v want nothing (it should block)", x)
+		case x := <-child.Done():
+			t.Errorf("<-child.Done() == %v want nothing (it should block)", x)
+		default:
+		}
+
+		cc := child.(*cancelCtx)
+		pc, pcok := parent.(*cancelCtx) // pcok == false when parent == Background()
+		if p, ok := parentCancelCtx(cc.Context); ok != pcok || (ok && pc != p) {
+			t.Errorf("bad linkage: parentCancelCtx(cc.Context) = %v, %v want %v, %v", p, ok, pc, pcok)
+		}
+
+		if pcok {
+			pc.mu.Lock()
+			if len(pc.children) != 1 || !pc.children[cc] {
+				t.Errorf("bad linkage: pc.children = %v, cc = %v", pc.children, cc)
+			}
+			pc.mu.Unlock()
+		}
+
+		cancel()
+
+		if pcok {
+			pc.mu.Lock()
+			if len(pc.children) != 0 {
+				t.Errorf("child's cancel didn't remove self from pc.children = %v", pc.children)
+			}
+			pc.mu.Unlock()
+		}
+
+		// child should be finished.
+		select {
+		case <-child.Done():
+		default:
+			t.Errorf("<-child.Done() blocked, but shouldn't have")
+		}
+		if e := child.Err(); e != Canceled {
+			t.Errorf("child.Err() == %v want %v", e, Canceled)
+		}
+
+		// parent should not be finished.
+		select {
+		case x := <-parent.Done():
+			t.Errorf("<-parent.Done() == %v want nothing (it should block)", x)
+		default:
+		}
+		if e := parent.Err(); e != nil {
+			t.Errorf("parent.Err() == %v want nil", e)
+		}
+	}
+}
+
+func testDeadline(c Context, wait time.Duration, t *testing.T) {
+	select {
+	case <-time.After(wait):
+		t.Fatalf("context should have timed out")
+	case <-c.Done():
+	}
+	if e := c.Err(); e != DeadlineExceeded {
+		t.Errorf("c.Err() == %v want %v", e, DeadlineExceeded)
+	}
+}
+
+func TestDeadline(t *testing.T) {
+	c, _ := WithDeadline(Background(), time.Now().Add(100*time.Millisecond))
+	if got, prefix := fmt.Sprint(c), "context.Background.WithDeadline("; !strings.HasPrefix(got, prefix) {
+		t.Errorf("c.String() = %q want prefix %q", got, prefix)
+	}
+	testDeadline(c, 200*time.Millisecond, t)
+
+	c, _ = WithDeadline(Background(), time.Now().Add(100*time.Millisecond))
+	o := otherContext{c}
+	testDeadline(o, 200*time.Millisecond, t)
+
+	c, _ = WithDeadline(Background(), time.Now().Add(100*time.Millisecond))
+	o = otherContext{c}
+	c, _ = WithDeadline(o, time.Now().Add(300*time.Millisecond))
+	testDeadline(c, 200*time.Millisecond, t)
+}
+
+func TestTimeout(t *testing.T) {
+	c, _ := WithTimeout(Background(), 100*time.Millisecond)
+	if got, prefix := fmt.Sprint(c), "context.Background.WithDeadline("; !strings.HasPrefix(got, prefix) {
+		t.Errorf("c.String() = %q want prefix %q", got, prefix)
+	}
+	testDeadline(c, 200*time.Millisecond, t)
+
+	c, _ = WithTimeout(Background(), 100*time.Millisecond)
+	o := otherContext{c}
+	testDeadline(o, 200*time.Millisecond, t)
+
+	c, _ = WithTimeout(Background(), 100*time.Millisecond)
+	o = otherContext{c}
+	c, _ = WithTimeout(o, 300*time.Millisecond)
+	testDeadline(c, 200*time.Millisecond, t)
+}
+
+func TestCanceledTimeout(t *testing.T) {
+	c, _ := WithTimeout(Background(), 200*time.Millisecond)
+	o := otherContext{c}
+	c, cancel := WithTimeout(o, 400*time.Millisecond)
+	cancel()
+	time.Sleep(100 * time.Millisecond) // let cancelation propagate
+	select {
+	case <-c.Done():
+	default:
+		t.Errorf("<-c.Done() blocked, but shouldn't have")
+	}
+	if e := c.Err(); e != Canceled {
+		t.Errorf("c.Err() == %v want %v", e, Canceled)
+	}
+}
+
+type key1 int
+type key2 int
+
+var k1 = key1(1)
+var k2 = key2(1) // same int as k1, different type
+var k3 = key2(3) // same type as k2, different int
+
+func TestValues(t *testing.T) {
+	check := func(c Context, nm, v1, v2, v3 string) {
+		if v, ok := c.Value(k1).(string); ok == (len(v1) == 0) || v != v1 {
+			t.Errorf(`%s.Value(k1).(string) = %q, %t want %q, %t`, nm, v, ok, v1, len(v1) != 0)
+		}
+		if v, ok := c.Value(k2).(string); ok == (len(v2) == 0) || v != v2 {
+			t.Errorf(`%s.Value(k2).(string) = %q, %t want %q, %t`, nm, v, ok, v2, len(v2) != 0)
+		}
+		if v, ok := c.Value(k3).(string); ok == (len(v3) == 0) || v != v3 {
+			t.Errorf(`%s.Value(k3).(string) = %q, %t want %q, %t`, nm, v, ok, v3, len(v3) != 0)
+		}
+	}
+
+	c0 := Background()
+	check(c0, "c0", "", "", "")
+
+	c1 := WithValue(Background(), k1, "c1k1")
+	check(c1, "c1", "c1k1", "", "")
+
+	if got, want := fmt.Sprint(c1), `context.Background.WithValue(1, "c1k1")`; got != want {
+		t.Errorf("c.String() = %q want %q", got, want)
+	}
+
+	c2 := WithValue(c1, k2, "c2k2")
+	check(c2, "c2", "c1k1", "c2k2", "")
+
+	c3 := WithValue(c2, k3, "c3k3")
+	check(c3, "c2", "c1k1", "c2k2", "c3k3")
+
+	c4 := WithValue(c3, k1, nil)
+	check(c4, "c4", "", "c2k2", "c3k3")
+
+	o0 := otherContext{Background()}
+	check(o0, "o0", "", "", "")
+
+	o1 := otherContext{WithValue(Background(), k1, "c1k1")}
+	check(o1, "o1", "c1k1", "", "")
+
+	o2 := WithValue(o1, k2, "o2k2")
+	check(o2, "o2", "c1k1", "o2k2", "")
+
+	o3 := otherContext{c4}
+	check(o3, "o3", "", "c2k2", "c3k3")
+
+	o4 := WithValue(o3, k3, nil)
+	check(o4, "o4", "", "c2k2", "")
+}
+
+func TestAllocs(t *testing.T) {
+	bg := Background()
+	for _, test := range []struct {
+		desc       string
+		f          func()
+		limit      float64
+		gccgoLimit float64
+	}{
+		{
+			desc:       "Background()",
+			f:          func() { Background() },
+			limit:      0,
+			gccgoLimit: 0,
+		},
+		{
+			desc: fmt.Sprintf("WithValue(bg, %v, nil)", k1),
+			f: func() {
+				c := WithValue(bg, k1, nil)
+				c.Value(k1)
+			},
+			limit:      3,
+			gccgoLimit: 3,
+		},
+		{
+			desc: "WithTimeout(bg, 15*time.Millisecond)",
+			f: func() {
+				c, _ := WithTimeout(bg, 15*time.Millisecond)
+				<-c.Done()
+			},
+			limit:      8,
+			gccgoLimit: 15,
+		},
+		{
+			desc: "WithCancel(bg)",
+			f: func() {
+				c, cancel := WithCancel(bg)
+				cancel()
+				<-c.Done()
+			},
+			limit:      5,
+			gccgoLimit: 8,
+		},
+		{
+			desc: "WithTimeout(bg, 100*time.Millisecond)",
+			f: func() {
+				c, cancel := WithTimeout(bg, 100*time.Millisecond)
+				cancel()
+				<-c.Done()
+			},
+			limit:      8,
+			gccgoLimit: 25,
+		},
+	} {
+		limit := test.limit
+		if runtime.Compiler == "gccgo" {
+			// gccgo does not yet do escape analysis.
+			// TOOD(iant): Remove this when gccgo does do escape analysis.
+			limit = test.gccgoLimit
+		}
+		if n := testing.AllocsPerRun(100, test.f); n > limit {
+			t.Errorf("%s allocs = %f want %d", test.desc, n, int(limit))
+		}
+	}
+}
+
+func TestSimultaneousCancels(t *testing.T) {
+	root, cancel := WithCancel(Background())
+	m := map[Context]CancelFunc{root: cancel}
+	q := []Context{root}
+	// Create a tree of contexts.
+	for len(q) != 0 && len(m) < 100 {
+		parent := q[0]
+		q = q[1:]
+		for i := 0; i < 4; i++ {
+			ctx, cancel := WithCancel(parent)
+			m[ctx] = cancel
+			q = append(q, ctx)
+		}
+	}
+	// Start all the cancels in a random order.
+	var wg sync.WaitGroup
+	wg.Add(len(m))
+	for _, cancel := range m {
+		go func(cancel CancelFunc) {
+			cancel()
+			wg.Done()
+		}(cancel)
+	}
+	// Wait on all the contexts in a random order.
+	for ctx := range m {
+		select {
+		case <-ctx.Done():
+		case <-time.After(1 * time.Second):
+			buf := make([]byte, 10<<10)
+			n := runtime.Stack(buf, true)
+			t.Fatalf("timed out waiting for <-ctx.Done(); stacks:\n%s", buf[:n])
+		}
+	}
+	// Wait for all the cancel functions to return.
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(1 * time.Second):
+		buf := make([]byte, 10<<10)
+		n := runtime.Stack(buf, true)
+		t.Fatalf("timed out waiting for cancel functions; stacks:\n%s", buf[:n])
+	}
+}
+
+func TestInterlockedCancels(t *testing.T) {
+	parent, cancelParent := WithCancel(Background())
+	child, cancelChild := WithCancel(parent)
+	go func() {
+		parent.Done()
+		cancelChild()
+	}()
+	cancelParent()
+	select {
+	case <-child.Done():
+	case <-time.After(1 * time.Second):
+		buf := make([]byte, 10<<10)
+		n := runtime.Stack(buf, true)
+		t.Fatalf("timed out waiting for child.Done(); stacks:\n%s", buf[:n])
+	}
+}
+
+func TestLayersCancel(t *testing.T) {
+	testLayers(t, time.Now().UnixNano(), false)
+}
+
+func TestLayersTimeout(t *testing.T) {
+	testLayers(t, time.Now().UnixNano(), true)
+}
+
+func testLayers(t *testing.T, seed int64, testTimeout bool) {
+	rand.Seed(seed)
+	errorf := func(format string, a ...interface{}) {
+		t.Errorf(fmt.Sprintf("seed=%d: %s", seed, format), a...)
+	}
+	const (
+		timeout   = 200 * time.Millisecond
+		minLayers = 30
+	)
+	type value int
+	var (
+		vals      []*value
+		cancels   []CancelFunc
+		numTimers int
+		ctx       = Background()
+	)
+	for i := 0; i < minLayers || numTimers == 0 || len(cancels) == 0 || len(vals) == 0; i++ {
+		switch rand.Intn(3) {
+		case 0:
+			v := new(value)
+			ctx = WithValue(ctx, v, v)
+			vals = append(vals, v)
+		case 1:
+			var cancel CancelFunc
+			ctx, cancel = WithCancel(ctx)
+			cancels = append(cancels, cancel)
+		case 2:
+			var cancel CancelFunc
+			ctx, cancel = WithTimeout(ctx, timeout)
+			cancels = append(cancels, cancel)
+			numTimers++
+		}
+	}
+	checkValues := func(when string) {
+		for _, key := range vals {
+			if val := ctx.Value(key).(*value); key != val {
+				errorf("%s: ctx.Value(%p) = %p want %p", when, key, val, key)
+			}
+		}
+	}
+	select {
+	case <-ctx.Done():
+		errorf("ctx should not be canceled yet")
+	default:
+	}
+	if s, prefix := fmt.Sprint(ctx), "context.Background."; !strings.HasPrefix(s, prefix) {
+		t.Errorf("ctx.String() = %q want prefix %q", s, prefix)
+	}
+	t.Log(ctx)
+	checkValues("before cancel")
+	if testTimeout {
+		select {
+		case <-ctx.Done():
+		case <-time.After(timeout + 100*time.Millisecond):
+			errorf("ctx should have timed out")
+		}
+		checkValues("after timeout")
+	} else {
+		cancel := cancels[rand.Intn(len(cancels))]
+		cancel()
+		select {
+		case <-ctx.Done():
+		default:
+			errorf("ctx should be canceled")
+		}
+		checkValues("after cancel")
+	}
+}
+
+func TestCancelRemoves(t *testing.T) {
+	checkChildren := func(when string, ctx Context, want int) {
+		if got := len(ctx.(*cancelCtx).children); got != want {
+			t.Errorf("%s: context has %d children, want %d", when, got, want)
+		}
+	}
+
+	ctx, _ := WithCancel(Background())
+	checkChildren("after creation", ctx, 0)
+	_, cancel := WithCancel(ctx)
+	checkChildren("with WithCancel child ", ctx, 1)
+	cancel()
+	checkChildren("after cancelling WithCancel child", ctx, 0)
+
+	ctx, _ = WithCancel(Background())
+	checkChildren("after creation", ctx, 0)
+	_, cancel = WithTimeout(ctx, 60*time.Minute)
+	checkChildren("with WithTimeout child ", ctx, 1)
+	cancel()
+	checkChildren("after cancelling WithTimeout child", ctx, 0)
+}
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/cancelreq.go b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/cancelreq.go
new file mode 100644
index 00000000..48610e36
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/cancelreq.go
@@ -0,0 +1,18 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.5
+
+package ctxhttp
+
+import "net/http"
+
+func canceler(client *http.Client, req *http.Request) func() {
+	ch := make(chan struct{})
+	req.Cancel = ch
+
+	return func() {
+		close(ch)
+	}
+}
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/cancelreq_go14.go b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/cancelreq_go14.go
new file mode 100644
index 00000000..56bcbadb
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/cancelreq_go14.go
@@ -0,0 +1,23 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !go1.5
+
+package ctxhttp
+
+import "net/http"
+
+type requestCanceler interface {
+	CancelRequest(*http.Request)
+}
+
+func canceler(client *http.Client, req *http.Request) func() {
+	rc, ok := client.Transport.(requestCanceler)
+	if !ok {
+		return func() {}
+	}
+	return func() {
+		rc.CancelRequest(req)
+	}
+}
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/ctxhttp.go b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/ctxhttp.go
new file mode 100644
index 00000000..9f348881
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/ctxhttp.go
@@ -0,0 +1,79 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package ctxhttp provides helper functions for performing context-aware HTTP requests.
+package ctxhttp
+
+import (
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"golang.org/x/net/context"
+)
+
+// Do sends an HTTP request with the provided http.Client and returns an HTTP response.
+// If the client is nil, http.DefaultClient is used.
+// If the context is canceled or times out, ctx.Err() will be returned.
+func Do(ctx context.Context, client *http.Client, req *http.Request) (*http.Response, error) {
+	if client == nil {
+		client = http.DefaultClient
+	}
+
+	// Request cancelation changed in Go 1.5, see cancelreq.go and cancelreq_go14.go.
+	cancel := canceler(client, req)
+
+	type responseAndError struct {
+		resp *http.Response
+		err  error
+	}
+	result := make(chan responseAndError, 1)
+
+	go func() {
+		resp, err := client.Do(req)
+		result <- responseAndError{resp, err}
+	}()
+
+	select {
+	case <-ctx.Done():
+		cancel()
+		return nil, ctx.Err()
+	case r := <-result:
+		return r.resp, r.err
+	}
+}
+
+// Get issues a GET request via the Do function.
+func Get(ctx context.Context, client *http.Client, url string) (*http.Response, error) {
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+	return Do(ctx, client, req)
+}
+
+// Head issues a HEAD request via the Do function.
+func Head(ctx context.Context, client *http.Client, url string) (*http.Response, error) {
+	req, err := http.NewRequest("HEAD", url, nil)
+	if err != nil {
+		return nil, err
+	}
+	return Do(ctx, client, req)
+}
+
+// Post issues a POST request via the Do function.
+func Post(ctx context.Context, client *http.Client, url string, bodyType string, body io.Reader) (*http.Response, error) {
+	req, err := http.NewRequest("POST", url, body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", bodyType)
+	return Do(ctx, client, req)
+}
+
+// PostForm issues a POST request via the Do function.
+func PostForm(ctx context.Context, client *http.Client, url string, data url.Values) (*http.Response, error) {
+	return Post(ctx, client, url, "application/x-www-form-urlencoded", strings.NewReader(data.Encode()))
+}
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/ctxhttp_test.go b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/ctxhttp_test.go
new file mode 100644
index 00000000..47b53d7f
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/ctxhttp/ctxhttp_test.go
@@ -0,0 +1,72 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package ctxhttp
+
+import (
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"golang.org/x/net/context"
+)
+
+const (
+	requestDuration = 100 * time.Millisecond
+	requestBody     = "ok"
+)
+
+func TestNoTimeout(t *testing.T) {
+	ctx := context.Background()
+	resp, err := doRequest(ctx)
+
+	if resp == nil || err != nil {
+		t.Fatalf("error received from client: %v %v", err, resp)
+	}
+}
+func TestCancel(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		time.Sleep(requestDuration / 2)
+		cancel()
+	}()
+
+	resp, err := doRequest(ctx)
+
+	if resp != nil || err == nil {
+		t.Fatalf("expected error, didn't get one. resp: %v", resp)
+	}
+	if err != ctx.Err() {
+		t.Fatalf("expected error from context but got: %v", err)
+	}
+}
+
+func TestCancelAfterRequest(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+
+	resp, err := doRequest(ctx)
+
+	// Cancel before reading the body.
+	// Request.Body should still be readable after the context is canceled.
+	cancel()
+
+	b, err := ioutil.ReadAll(resp.Body)
+	if err != nil || string(b) != requestBody {
+		t.Fatalf("could not read body: %q %v", b, err)
+	}
+}
+
+func doRequest(ctx context.Context) (*http.Response, error) {
+	var okHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(requestDuration)
+		w.Write([]byte(requestBody))
+	})
+
+	serv := httptest.NewServer(okHandler)
+	defer serv.Close()
+
+	return Get(ctx, nil, serv.URL)
+}
diff --git a/Godeps/_workspace/src/golang.org/x/net/context/withtimeout_test.go b/Godeps/_workspace/src/golang.org/x/net/context/withtimeout_test.go
new file mode 100644
index 00000000..a6754dc3
--- /dev/null
+++ b/Godeps/_workspace/src/golang.org/x/net/context/withtimeout_test.go
@@ -0,0 +1,26 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package context_test
+
+import (
+	"fmt"
+	"time"
+
+	"golang.org/x/net/context"
+)
+
+func ExampleWithTimeout() {
+	// Pass a context with a timeout to tell a blocking function that it
+	// should abandon its work after the timeout elapses.
+	ctx, _ := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	select {
+	case <-time.After(200 * time.Millisecond):
+		fmt.Println("overslept")
+	case <-ctx.Done():
+		fmt.Println(ctx.Err()) // prints "context deadline exceeded"
+	}
+	// Output:
+	// context deadline exceeded
+}
diff --git a/api/cloud.go b/api/cloud.go
index 1c904e9b..15dd5f40 100644
--- a/api/cloud.go
+++ b/api/cloud.go
@@ -4,6 +4,8 @@ import (
 	"net/http"
 	"strings"
 	"time"
+
+	"golang.org/x/net/context"
 )
 
 // CloudConfig defines a cloud-init config.
@@ -13,15 +15,13 @@ type CloudConfig struct {
 
 // cloudHandler returns a handler that responds with the cloud config for the
 // requester.
-func cloudHandler(store Store) http.Handler {
-	fn := func(w http.ResponseWriter, req *http.Request) {
-		attrs := labelsFromRequest(req)
-		spec, err := getMatchingSpec(store, attrs)
+func cloudHandler(store Store) ContextHandler {
+	fn := func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+		spec, err := specFromContext(ctx)
 		if err != nil || spec.CloudConfig == "" {
 			http.NotFound(w, req)
 			return
 		}
-
 		config, err := store.CloudConfig(spec.CloudConfig)
 		if err != nil {
 			http.NotFound(w, req)
@@ -29,5 +29,5 @@ func cloudHandler(store Store) http.Handler {
 		}
 		http.ServeContent(w, req, "", time.Time{}, strings.NewReader(config.Content))
 	}
-	return http.HandlerFunc(fn)
+	return ContextHandlerFunc(fn)
 }
diff --git a/api/cloud_test.go b/api/cloud_test.go
index afc3f8c2..fdad04bd 100644
--- a/api/cloud_test.go
+++ b/api/cloud_test.go
@@ -6,45 +6,38 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
 func TestCloudHandler(t *testing.T) {
-	cloudcfg := &CloudConfig{
-		Content: "#cloud-config",
-	}
+	cloudcfg := &CloudConfig{Content: "#cloud-config"}
 	store := &fixedStore{
-		Groups:       []Group{testGroup},
-		Specs:        map[string]*Spec{testGroup.Spec: testSpec},
 		CloudConfigs: map[string]*CloudConfig{testSpec.CloudConfig: cloudcfg},
 	}
 	h := cloudHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+	ctx := withSpec(context.Background(), testSpec)
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	// assert that:
-	// - match parameters to a Spec
-	// - render the Spec's cloud config
+	// - the Spec's cloud config is served
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, cloudcfg.Content, w.Body.String())
 }
 
-func TestCloudHandler_NoMatchingSpec(t *testing.T) {
-	store := &emptyStore{}
-	h := cloudHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+func TestCloudHandler_MissingCtxSpec(t *testing.T) {
+	h := cloudHandler(&emptyStore{})
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(context.Background(), w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
 
 func TestCloudHandler_MissingCloudConfig(t *testing.T) {
-	store := &fixedStore{
-		Groups: []Group{testGroup},
-		Specs:  map[string]*Spec{testGroup.Spec: testSpec},
-	}
-	h := cloudHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+	h := cloudHandler(&emptyStore{})
+	ctx := withSpec(context.Background(), testSpec)
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
diff --git a/api/context.go b/api/context.go
new file mode 100644
index 00000000..6217d39a
--- /dev/null
+++ b/api/context.go
@@ -0,0 +1,32 @@
+package api
+
+import (
+	"errors"
+
+	"golang.org/x/net/context"
+)
+
+// unexported key prevents collisions
+type key int
+
+const (
+	specKey key = iota
+)
+
+var (
+	errNoSpecFromContext = errors.New("api: Context missing a Spec")
+)
+
+// withSpec returns a copy of ctx that stores the given Spec.
+func withSpec(ctx context.Context, spec *Spec) context.Context {
+	return context.WithValue(ctx, specKey, spec)
+}
+
+// specFromContext returns the Spec from the ctx.
+func specFromContext(ctx context.Context) (*Spec, error) {
+	spec, ok := ctx.Value(specKey).(*Spec)
+	if !ok {
+		return nil, errNoSpecFromContext
+	}
+	return spec, nil
+}
diff --git a/api/context_test.go b/api/context_test.go
new file mode 100644
index 00000000..91c510cb
--- /dev/null
+++ b/api/context_test.go
@@ -0,0 +1,24 @@
+package api
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
+)
+
+func TestContextSpec(t *testing.T) {
+	expectedSpec := &Spec{ID: "g1h2i3j4"}
+	ctx := withSpec(context.Background(), expectedSpec)
+	spec, err := specFromContext(ctx)
+	assert.Nil(t, err)
+	assert.Equal(t, expectedSpec, spec)
+}
+
+func TestContextSpec_Error(t *testing.T) {
+	spec, err := specFromContext(context.Background())
+	assert.Nil(t, spec)
+	if assert.NotNil(t, err) {
+		assert.Equal(t, "api: Context missing a Spec", err.Error())
+	}
+}
diff --git a/api/groups.go b/api/groups.go
index a029a7b4..a5c26d72 100644
--- a/api/groups.go
+++ b/api/groups.go
@@ -1,8 +1,15 @@
 package api
 
 import (
-	"fmt"
+	"errors"
+	"net/http"
 	"sort"
+
+	"golang.org/x/net/context"
+)
+
+var (
+	errNoMatchingGroup = errors.New("api: No matching Group")
 )
 
 // Group associates matcher conditions with a Specification identifier. The
@@ -48,15 +55,36 @@ func newGroupsResource(store Store) *groupsResource {
 }
 
 // listGroups lists all Group resources.
-func (r *groupsResource) listGroups() ([]Group, error) {
-	return r.store.ListGroups()
+func (gr *groupsResource) listGroups() ([]Group, error) {
+	return gr.store.ListGroups()
+}
+
+// matchSpecHandler returns a ContextHandler that matches machine requests
+// to a Spec and adds the Spec to the ctx and calls the next handler. The
+// next handler should handle the case that no matching Spec is found.
+func (gr *groupsResource) matchSpecHandler(next ContextHandler) ContextHandler {
+	fn := func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+		attrs := labelsFromRequest(req)
+		// match machine request
+		group, err := gr.findMatch(attrs)
+		if err == nil {
+			// lookup Spec by id
+			spec, err := gr.store.Spec(group.Spec)
+			if err == nil {
+				// add the Spec to the ctx for next handler
+				ctx = withSpec(ctx, spec)
+			}
+		}
+		next.ServeHTTP(ctx, w, req)
+	}
+	return ContextHandlerFunc(fn)
 }
 
 // findMatch returns the first Group whose Matcher is satisfied by the given
 // labels. Groups are attempted in sorted order, preferring those with
 // more matcher conditions, alphabetically.
-func (r *groupsResource) findMatch(labels Labels) (*Group, error) {
-	groups, err := r.store.ListGroups()
+func (gr *groupsResource) findMatch(labels Labels) (*Group, error) {
+	groups, err := gr.store.ListGroups()
 	if err != nil {
 		return nil, err
 	}
@@ -66,5 +94,5 @@ func (r *groupsResource) findMatch(labels Labels) (*Group, error) {
 			return &group, nil
 		}
 	}
-	return nil, fmt.Errorf("no Group matching %v", labels)
+	return nil, errNoMatchingGroup
 }
diff --git a/api/groups_test.go b/api/groups_test.go
index 2684fa8e..2a9ea219 100644
--- a/api/groups_test.go
+++ b/api/groups_test.go
@@ -1,10 +1,14 @@
 package api
 
 import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"sort"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
 var (
@@ -64,3 +68,72 @@ func TestByMatcherSort(t *testing.T) {
 		assert.Equal(t, c.expected, c.input)
 	}
 }
+
+func TestNewGroupsResource(t *testing.T) {
+	store := &fixedStore{}
+	gr := newGroupsResource(store)
+	assert.Equal(t, store, gr.store)
+}
+
+func TestGroupsResource_ListGroups(t *testing.T) {
+	expectedGroups := []Group{Group{Name: "test group"}}
+	store := &fixedStore{
+		Groups: expectedGroups,
+	}
+	res := newGroupsResource(store)
+	groups, err := res.listGroups()
+	assert.Nil(t, err)
+	assert.Equal(t, expectedGroups, groups)
+}
+
+func TestGroupsResource_MatchSpecHandler(t *testing.T) {
+	store := &fixedStore{
+		Groups: []Group{testGroup},
+		Specs:  map[string]*Spec{testGroup.Spec: testSpec},
+	}
+	gr := newGroupsResource(store)
+	next := func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+		spec, err := specFromContext(ctx)
+		assert.Nil(t, err)
+		assert.Equal(t, testSpec, spec)
+		fmt.Fprintf(w, "next handler called")
+	}
+	// assert that:
+	// - request arguments are used to match uuid=a1b2c3d4 -> testGroup
+	// - the group's Spec is found by id and added to the context
+	// - next handler is called
+	h := gr.matchSpecHandler(ContextHandlerFunc(next))
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+	h.ServeHTTP(context.Background(), w, req)
+	assert.Equal(t, "next handler called", w.Body.String())
+}
+
+func TestGroupsResource_FindMatch(t *testing.T) {
+	store := &fixedStore{
+		Groups: []Group{testGroup},
+		Specs:  map[string]*Spec{testGroup.Spec: testSpec},
+	}
+	uuidLabel := LabelSet(map[string]string{
+		"uuid": "a1b2c3d4",
+	})
+
+	cases := []struct {
+		store         Store
+		labels        Labels
+		expectedGroup *Group
+		expectedErr   error
+	}{
+		{store, uuidLabel, &testGroup, nil},
+		{store, nil, nil, errNoMatchingGroup},
+		// no groups in the store
+		{&emptyStore{}, uuidLabel, nil, errNoMatchingGroup},
+	}
+
+	for _, c := range cases {
+		gr := newGroupsResource(c.store)
+		group, err := gr.findMatch(c.labels)
+		assert.Equal(t, c.expectedGroup, group)
+		assert.Equal(t, c.expectedErr, err)
+	}
+}
diff --git a/api/http.go b/api/http.go
index 54dea5f8..6dd6ba0f 100644
--- a/api/http.go
+++ b/api/http.go
@@ -4,8 +4,50 @@ import (
 	"net"
 	"net/http"
 	"strings"
+
+	"golang.org/x/net/context"
 )
 
+// ContextHandler defines a handler which receives a passed context.Context
+// with the standard ResponseWriter and Request.
+type ContextHandler interface {
+	ServeHTTP(context.Context, http.ResponseWriter, *http.Request)
+}
+
+// ContextHandlerFunc type is an adapter to allow the use of an ordinary
+// function as a ContextHandler. If f is a function with the correct
+// signature, ContextHandlerFunc(f) is a ContextHandler that calls f.
+type ContextHandlerFunc func(context.Context, http.ResponseWriter, *http.Request)
+
+// ServeHTTP calls the function f(ctx, w, req).
+func (f ContextHandlerFunc) ServeHTTP(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+	f(ctx, w, req)
+}
+
+// handler wraps a ContextHandler to implement the http.Handler interface for
+// compatability with ServeMux and middlewares.
+//
+// Middleswares which do not pass a ctx break the chain so place them before
+// or after chains of ContextHandlers.
+type handler struct {
+	ctx     context.Context
+	handler ContextHandler
+}
+
+// NewHandler returns an http.Handler which wraps the given ContextHandler
+// and creates a background context.Context.
+func NewHandler(h ContextHandler) http.Handler {
+	return &handler{
+		ctx:     context.Background(),
+		handler: h,
+	}
+}
+
+// ServeHTTP lets handler implement the http.Handler interface.
+func (h *handler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	h.handler.ServeHTTP(h.ctx, w, req)
+}
+
 // labelsFromRequest returns Labels from request query parameters.
 func labelsFromRequest(req *http.Request) Labels {
 	values := req.URL.Query()
diff --git a/api/http_test.go b/api/http_test.go
index d21d3899..1f413f45 100644
--- a/api/http_test.go
+++ b/api/http_test.go
@@ -1,10 +1,13 @@
 package api
 
 import (
+	"fmt"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
 func TestLabelsFromRequest(t *testing.T) {
@@ -30,3 +33,14 @@ func TestLabelsFromRequest(t *testing.T) {
 		assert.Equal(t, LabelSet(c.labelSet), labelsFromRequest(req))
 	}
 }
+
+func TestNewHandler(t *testing.T) {
+	fn := func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+		fmt.Fprintf(w, "ContextHandler called")
+	}
+	h := NewHandler(ContextHandlerFunc(fn))
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(w, req)
+	assert.Equal(t, "ContextHandler called", w.Body.String())
+}
diff --git a/api/ignition.go b/api/ignition.go
index 3ca537be..c064c094 100644
--- a/api/ignition.go
+++ b/api/ignition.go
@@ -2,19 +2,19 @@ package api
 
 import (
 	"net/http"
+
+	"golang.org/x/net/context"
 )
 
 // ignitionHandler returns a handler that responds with the ignition config
 // for the requester.
-func ignitionHandler(store Store) http.Handler {
-	fn := func(w http.ResponseWriter, req *http.Request) {
-		attrs := labelsFromRequest(req)
-		spec, err := getMatchingSpec(store, attrs)
+func ignitionHandler(store Store) ContextHandler {
+	fn := func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+		spec, err := specFromContext(ctx)
 		if err != nil || spec.IgnitionConfig == "" {
 			http.NotFound(w, req)
 			return
 		}
-
 		config, err := store.IgnitionConfig(spec.IgnitionConfig)
 		if err != nil {
 			http.NotFound(w, req)
@@ -22,5 +22,5 @@ func ignitionHandler(store Store) http.Handler {
 		}
 		renderJSON(w, config)
 	}
-	return http.HandlerFunc(fn)
+	return ContextHandlerFunc(fn)
 }
diff --git a/api/ignition_test.go b/api/ignition_test.go
index dfb19882..e32c4a36 100644
--- a/api/ignition_test.go
+++ b/api/ignition_test.go
@@ -7,45 +7,40 @@ import (
 
 	ignition "github.com/coreos/ignition/src/config"
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
 func TestIgnitionHandler(t *testing.T) {
 	ignitioncfg := &ignition.Config{}
 	store := &fixedStore{
-		Groups:          []Group{testGroup},
-		Specs:           map[string]*Spec{testGroup.Spec: testSpec},
 		IgnitionConfigs: map[string]*ignition.Config{testSpec.IgnitionConfig: ignitioncfg},
 	}
 	h := ignitionHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+	ctx := withSpec(context.Background(), testSpec)
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	// assert that:
-	// - match parameters to a Spec
-	// - render the Spec's ignition config
+	// - the Spec's ignition config is rendered
 	expectedJSON := `{"ignitionVersion":0,"storage":{},"systemd":{},"networkd":{},"passwd":{}}`
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, jsonContentType, w.HeaderMap.Get(contentType))
 	assert.Equal(t, expectedJSON, w.Body.String())
 }
 
-func TestIgnitionHandler_NoMatchingSpec(t *testing.T) {
-	store := &emptyStore{}
-	h := ignitionHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+func TestIgnitionHandler_MissingCtxSpec(t *testing.T) {
+	h := ignitionHandler(&emptyStore{})
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(context.Background(), w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
 
 func TestIgnitionHandler_MissingIgnitionConfig(t *testing.T) {
-	store := &fixedStore{
-		Groups: []Group{testGroup},
-		Specs:  map[string]*Spec{testGroup.Spec: testSpec},
-	}
-	h := ignitionHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+	h := ignitionHandler(&emptyStore{})
+	ctx := withSpec(context.Background(), testSpec)
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
diff --git a/api/ipxe.go b/api/ipxe.go
index 6f685819..2220f201 100644
--- a/api/ipxe.go
+++ b/api/ipxe.go
@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"net/http"
 	"text/template"
+
+	"golang.org/x/net/context"
 )
 
 const ipxeBootstrap = `#!ipxe
@@ -28,15 +30,13 @@ func ipxeInspect() http.Handler {
 
 // ipxeBoot returns a handler which renders the iPXE boot script for the
 // requester.
-func ipxeHandler(store Store) http.Handler {
-	fn := func(w http.ResponseWriter, req *http.Request) {
-		attrs := labelsFromRequest(req)
-		spec, err := getMatchingSpec(store, attrs)
+func ipxeHandler() ContextHandler {
+	fn := func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
+		spec, err := specFromContext(ctx)
 		if err != nil {
 			http.NotFound(w, req)
 			return
 		}
-
 		var buf bytes.Buffer
 		err = ipxeTemplate.Execute(&buf, spec.BootConfig)
 		if err != nil {
@@ -49,5 +49,5 @@ func ipxeHandler(store Store) http.Handler {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}
-	return http.HandlerFunc(fn)
+	return ContextHandlerFunc(fn)
 }
diff --git a/api/ipxe_test.go b/api/ipxe_test.go
index fb63cb0c..f3420c9b 100644
--- a/api/ipxe_test.go
+++ b/api/ipxe_test.go
@@ -6,28 +6,26 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
 )
 
 func TestIPXEInspect(t *testing.T) {
 	h := ipxeInspect()
-	req, _ := http.NewRequest("GET", "/", nil)
 	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/", nil)
 	h.ServeHTTP(w, req)
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, ipxeBootstrap, w.Body.String())
 }
 
 func TestIPXEHandler(t *testing.T) {
-	store := &fixedStore{
-		Groups: []Group{testGroup},
-		Specs:  map[string]*Spec{testGroup.Spec: testSpec},
-	}
-	h := ipxeHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+	h := ipxeHandler()
+	ctx := withSpec(context.Background(), testSpec)
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	// assert that:
-	// - boot config is rendered as an iPXE script
+	// - the Spec's boot config is rendered as an iPXE script
 	expectedScript := `#!ipxe
 kernel /image/kernel a=b c
 initrd /image/initrd_a /image/initrd_b 
@@ -37,37 +35,30 @@ boot
 	assert.Equal(t, expectedScript, w.Body.String())
 }
 
-func TestIPXEHandler_NoMatchingSpec(t *testing.T) {
-	store := &emptyStore{}
-	h := ipxeHandler(store)
-	req, _ := http.NewRequest("GET", "?uuid=a1b2c3d4", nil)
+func TestIPXEHandler_MissingCtxSpec(t *testing.T) {
+	h := ipxeHandler()
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(context.Background(), w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
 
 func TestIPXEHandler_RenderTemplateError(t *testing.T) {
-	// nil BootConfig forces a template.Execute error
-	store := &fixedStore{
-		Groups: []Group{testGroup},
-		Specs:  map[string]*Spec{testGroup.Spec: &Spec{BootConfig: nil}},
-	}
-	h := ipxeHandler(store)
-	req, _ := http.NewRequest("GET", "/?uuid=a1b2c3d4", nil)
+	h := ipxeHandler()
+	// a Spec with nil BootConfig forces a template.Execute error
+	ctx := withSpec(context.Background(), &Spec{BootConfig: nil})
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
 
 func TestIPXEHandler_WriteError(t *testing.T) {
-	store := &fixedStore{
-		Groups: []Group{testGroup},
-		Specs:  map[string]*Spec{testGroup.Spec: testSpec},
-	}
-	h := ipxeHandler(store)
-	req, _ := http.NewRequest("GET", "/?uuid=a1b2c3d4", nil)
+	h := ipxeHandler()
+	ctx := withSpec(context.Background(), testSpec)
 	w := NewUnwriteableResponseWriter()
-	h.ServeHTTP(w, req)
+	req, _ := http.NewRequest("GET", "/", nil)
+	h.ServeHTTP(ctx, w, req)
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
 	assert.Empty(t, w.Body.String())
 }
diff --git a/api/matchers.go b/api/matchers.go
index f0111c2e..0781f456 100644
--- a/api/matchers.go
+++ b/api/matchers.go
@@ -13,7 +13,7 @@ type RequirementSet map[string]string
 // false otherwise.
 func (r RequirementSet) Matches(labels Labels) bool {
 	for k, v := range r {
-		if labels.Get(k) != v {
+		if labels == nil || labels.Get(k) != v {
 			return false
 		}
 	}
diff --git a/api/pixiecore.go b/api/pixiecore.go
index 6e41192b..f21199c6 100644
--- a/api/pixiecore.go
+++ b/api/pixiecore.go
@@ -8,7 +8,7 @@ import (
 // pixiecoreHandler returns a handler that renders the boot config JSON for
 // the requester, to implement the Pixiecore API specification.
 // https://github.com/danderson/pixiecore/blob/master/README.api.md
-func pixiecoreHandler(store Store) http.Handler {
+func pixiecoreHandler(gr *groupsResource, store Store) http.Handler {
 	fn := func(w http.ResponseWriter, req *http.Request) {
 		macAddr, err := parseMAC(filepath.Base(req.URL.Path))
 		if err != nil {
@@ -17,7 +17,12 @@ func pixiecoreHandler(store Store) http.Handler {
 		}
 		// pixiecore only provides MAC addresses
 		attrs := LabelSet(map[string]string{"mac": macAddr.String()})
-		spec, err := getMatchingSpec(store, attrs)
+		group, err := gr.findMatch(attrs)
+		if err != nil {
+			http.NotFound(w, req)
+			return
+		}
+		spec, err := store.Spec(group.Spec)
 		if err != nil {
 			http.NotFound(w, req)
 			return
diff --git a/api/pixiecore_test.go b/api/pixiecore_test.go
index c8a7b9fe..a08fbd42 100644
--- a/api/pixiecore_test.go
+++ b/api/pixiecore_test.go
@@ -13,12 +13,13 @@ func TestPixiecoreHandler(t *testing.T) {
 		Groups: []Group{testGroupWithMAC},
 		Specs:  map[string]*Spec{testGroupWithMAC.Spec: testSpec},
 	}
-	h := pixiecoreHandler(store)
-	req, _ := http.NewRequest("GET", "/"+validMACStr, nil)
+	h := pixiecoreHandler(newGroupsResource(store), store)
 	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/"+validMACStr, nil)
 	h.ServeHTTP(w, req)
 	// assert that:
-	// - boot config is rendered as Pixiecore JSON
+	// - MAC address argument is used for Spec matching
+	// - the Spec's boot config is rendered as Pixiecore JSON
 	expectedJSON := `{"kernel":"/image/kernel","initrd":["/image/initrd_a","/image/initrd_b"],"cmdline":{"a":"b","c":""}}`
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, jsonContentType, w.HeaderMap.Get(contentType))
@@ -26,20 +27,29 @@ func TestPixiecoreHandler(t *testing.T) {
 }
 
 func TestPixiecoreHandler_InvalidMACAddress(t *testing.T) {
-	store := &emptyStore{}
-	h := pixiecoreHandler(store)
-	req, _ := http.NewRequest("GET", "/", nil)
+	h := pixiecoreHandler(&groupsResource{}, &emptyStore{})
 	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/", nil)
 	h.ServeHTTP(w, req)
 	assert.Equal(t, http.StatusBadRequest, w.Code)
 	assert.Equal(t, "invalid MAC address /\n", w.Body.String())
 }
 
-func TestPixiecoreHandler_NoMatchingSpec(t *testing.T) {
-	store := &emptyStore{}
-	h := pixiecoreHandler(store)
-	req, _ := http.NewRequest("GET", "/"+validMACStr, nil)
+func TestPixiecoreHandler_NoMatchingGroup(t *testing.T) {
+	h := pixiecoreHandler(newGroupsResource(&emptyStore{}), &emptyStore{})
 	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/"+validMACStr, nil)
+	h.ServeHTTP(w, req)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestPixiecoreHandler_NoMatchingSpec(t *testing.T) {
+	store := &fixedStore{
+		Groups: []Group{testGroupWithMAC},
+	}
+	h := pixiecoreHandler(newGroupsResource(store), &emptyStore{})
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/"+validMACStr, nil)
 	h.ServeHTTP(w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
diff --git a/api/server.go b/api/server.go
index d7777250..9adcfa69 100644
--- a/api/server.go
+++ b/api/server.go
@@ -38,20 +38,22 @@ func NewServer(config *Config) *Server {
 // HTTPHandler returns a HTTP handler for the server.
 func (s *Server) HTTPHandler() http.Handler {
 	mux := http.NewServeMux()
-	// iPXE
+	// API Resources
+	newSpecResource(mux, "/spec/", s.store)
+	gr := newGroupsResource(s.store)
+
+	// Endpoints
+	// Boot via iPXE
 	mux.Handle("/boot.ipxe", logRequests(ipxeInspect()))
 	mux.Handle("/boot.ipxe.0", logRequests(ipxeInspect()))
-	mux.Handle("/ipxe", logRequests(ipxeHandler(s.store)))
-	// Pixiecore
-	mux.Handle("/pixiecore/v1/boot/", logRequests(pixiecoreHandler(s.store)))
+	mux.Handle("/ipxe", logRequests(NewHandler(gr.matchSpecHandler(ipxeHandler()))))
+	// Boot via Pixiecore
+	mux.Handle("/pixiecore/v1/boot/", logRequests(pixiecoreHandler(gr, s.store)))
 	// cloud configs
-	mux.Handle("/cloud", logRequests(cloudHandler(s.store)))
+	mux.Handle("/cloud", logRequests(NewHandler(gr.matchSpecHandler(cloudHandler(s.store)))))
 	// ignition configs
-	mux.Handle("/ignition", logRequests(ignitionHandler(s.store)))
+	mux.Handle("/ignition", logRequests(NewHandler(gr.matchSpecHandler(ignitionHandler(s.store)))))
 
-	// API Resources
-	// specs
-	newSpecResource(mux, "/spec/", s.store)
 	// kernel, initrd, and TLS assets
 	mux.Handle("/assets/", http.StripPrefix("/assets/", http.FileServer(http.Dir(s.assetsPath))))
 	return mux
diff --git a/api/spec.go b/api/spec.go
index 3ca51789..4b12c88c 100644
--- a/api/spec.go
+++ b/api/spec.go
@@ -38,13 +38,3 @@ func (r *specResource) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 	renderJSON(w, spec)
 }
-
-// getMatchingSpec returns the Spec matching the given attributes.
-func getMatchingSpec(store Store, labels Labels) (*Spec, error) {
-	groups := newGroupsResource(store)
-	group, err := groups.findMatch(labels)
-	if err != nil {
-		return nil, err
-	}
-	return store.Spec(group.Spec)
-}
diff --git a/api/spec_test.go b/api/spec_test.go
index f09c8b84..18789fb1 100644
--- a/api/spec_test.go
+++ b/api/spec_test.go
@@ -44,7 +44,7 @@ func TestSpecHandler(t *testing.T) {
 	assert.Equal(t, expectedSpecJSON, w.Body.String())
 }
 
-func TestSpecHandler_MissingConfig(t *testing.T) {
+func TestSpecHandler_MissingSpec(t *testing.T) {
 	store := &emptyStore{}
 	h := specResource{store}
 	req, _ := http.NewRequest("GET", "/", nil)