diff --git a/.semaphore/semaphore-scheduled-builds.yml b/.semaphore/semaphore-scheduled-builds.yml
index 4dda4468456..5b2e4140f3d 100644
--- a/.semaphore/semaphore-scheduled-builds.yml
+++ b/.semaphore/semaphore-scheduled-builds.yml
@@ -675,6 +675,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 6076f36b562..8ba23d8d872 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -675,6 +675,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:
diff --git a/.semaphore/semaphore.yml.tpl b/.semaphore/semaphore.yml.tpl
index fa6aa9c7243..7a4268c52e7 100644
--- a/.semaphore/semaphore.yml.tpl
+++ b/.semaphore/semaphore.yml.tpl
@@ -673,6 +673,7 @@ blocks:
             - export UPPER_CONSTRAINTS_FILE=https://releases.openstack.org/constraints/upper/yoga
             - export NC_PLUGIN_REPO=$(dirname $(pwd))
             - export NC_PLUGIN_REF=$(git rev-parse --abbrev-ref HEAD)
+            - sudo git config --system --add safe.directory ${NC_PLUGIN_REPO}/.git
             - TEMPEST=true DEVSTACK_BRANCH=unmaintained/yoga ./devstack/bootstrap.sh
       epilogue:
         on_fail:
diff --git a/api/go.mod b/api/go.mod
index f5806fbfce3..d9d17a724ee 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -1,13 +1,13 @@
 module github.com/projectcalico/api
 
-go 1.21
+go 1.22
 
 require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.27.10
-	k8s.io/api v0.27.15
-	k8s.io/apimachinery v0.27.15
-	k8s.io/client-go v0.27.15
+	k8s.io/api v0.27.16
+	k8s.io/apimachinery v0.27.16
+	k8s.io/client-go v0.27.16
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
 )
 
@@ -55,30 +55,30 @@ require (
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.15
-	k8s.io/apimachinery => k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver => k8s.io/apiserver v0.27.15
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.15
-	k8s.io/client-go => k8s.io/client-go v0.27.15
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.15
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.15
-	k8s.io/code-generator => k8s.io/code-generator v0.27.15
-	k8s.io/component-base => k8s.io/component-base v0.27.15
-	k8s.io/component-helpers => k8s.io/component-helpers v0.27.15
-	k8s.io/controller-manager => k8s.io/controller-manager v0.27.15
-	k8s.io/cri-api => k8s.io/cri-api v0.27.15
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.15
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.15
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.15
+	k8s.io/api => k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery => k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver => k8s.io/apiserver v0.27.16
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.16
+	k8s.io/client-go => k8s.io/client-go v0.27.16
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.16
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.16
+	k8s.io/code-generator => k8s.io/code-generator v0.27.16
+	k8s.io/component-base => k8s.io/component-base v0.27.16
+	k8s.io/component-helpers => k8s.io/component-helpers v0.27.16
+	k8s.io/controller-manager => k8s.io/controller-manager v0.27.16
+	k8s.io/cri-api => k8s.io/cri-api v0.27.16
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.16
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.16
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.16
 	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20230303024457-afdc3dddf62d
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.15
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.15
-	k8s.io/kubectl => k8s.io/kubectl v0.27.15
-	k8s.io/kubelet => k8s.io/kubelet v0.27.15
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.15
-	k8s.io/metrics => k8s.io/metrics v0.27.15
-	k8s.io/mount-utils => k8s.io/mount-utils v0.27.15
-	k8s.io/node-api => k8s.io/node-api v0.27.15
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.15
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.16
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.16
+	k8s.io/kubectl => k8s.io/kubectl v0.27.16
+	k8s.io/kubelet => k8s.io/kubelet v0.27.16
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.16
+	k8s.io/metrics => k8s.io/metrics v0.27.16
+	k8s.io/mount-utils => k8s.io/mount-utils v0.27.16
+	k8s.io/node-api => k8s.io/node-api v0.27.16
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.16
 )
diff --git a/api/go.sum b/api/go.sum
index 6bab657292d..73ea0734a85 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -233,12 +233,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.27.15 h1:+bR5ju3H+OjePA1DMEmHm33EzhtmqWBuQvqhTVYFXD0=
-k8s.io/api v0.27.15/go.mod h1:x/uHpsq4NAAGMiHWhq3P5W1ABiw4/aUWpIeGq1XmegY=
-k8s.io/apimachinery v0.27.15 h1:wT8HeVe/KNcX+QavW97ZpKiGxSN5glW39Dxvj/8wMPU=
-k8s.io/apimachinery v0.27.15/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
-k8s.io/client-go v0.27.15 h1:SDUs0ap/VuHPyoRiEChUhXQlh25UZAeXcm82J3TYy2w=
-k8s.io/client-go v0.27.15/go.mod h1:/ULqZ7zjeuEm/fSf7A5kKmbWb2GY/CnCiquS5XzAdzo=
+k8s.io/api v0.27.16 h1:70IBoTuiPfd+Tm68WH0tGXQRSQq0R1xnbyhTRe8WYQY=
+k8s.io/api v0.27.16/go.mod h1:5j0Cgo6X4qovBOu3OjzRwETDEYqMxq2qafhDQXOPy3A=
+k8s.io/apimachinery v0.27.16 h1:Nmbei3P/6w6vxbNxV8/sDCZz+TQrJ9A4+bVIRjDufuM=
+k8s.io/apimachinery v0.27.16/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
+k8s.io/client-go v0.27.16 h1:x06Jk6/SIQQ6kAsWs5uzQIkBLHtcAQlbTAgmj1tZzG0=
+k8s.io/client-go v0.27.16/go.mod h1:bPZUNRj8XsHa+JVS5jU6qeU2H/Za8+7riWA08FUjaA8=
 k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230303024457-afdc3dddf62d h1:VcFq5n7wCJB2FQMCIHfC+f+jNcGgNMar1uKd6rVlifU=
diff --git a/felix/Makefile b/felix/Makefile
index 47467b845e4..29333f6e479 100644
--- a/felix/Makefile
+++ b/felix/Makefile
@@ -258,10 +258,10 @@ FELIX_IMAGE_ID=$(shell docker images -q $(FELIX_IMAGE_WITH_TAG))
 $(FELIX_IMAGE)-$(ARCH): $(FELIX_CONTAINER_CREATED)
 $(FELIX_CONTAINER_CREATED): docker-image/calico-felix-wrapper \
                             docker-image/felix.cfg \
-                            docker-image/Dockerfile* \
+                            docker-image/Dockerfile \
                             $(shell test "$(FELIX_IMAGE_ID)" || echo force-rebuild)
 	$(MAKE) register
-	$(DOCKER_BUILD) -t $(FELIX_IMAGE_WITH_TAG) --file ./docker-image/Dockerfile.$(ARCH) docker-image --load;
+	$(DOCKER_BUILD) -t $(FELIX_IMAGE_WITH_TAG) -f ./docker-image/Dockerfile docker-image
 	$(MAKE) retag-build-images-with-registries VALIDARCHES=$(ARCH) IMAGETAG=latest
 	touch $(FELIX_CONTAINER_CREATED)
 
diff --git a/felix/bpf-apache/Makefile b/felix/bpf-apache/Makefile
index 94c73f24c5a..4e1225a361a 100644
--- a/felix/bpf-apache/Makefile
+++ b/felix/bpf-apache/Makefile
@@ -32,8 +32,8 @@ CFLAGS +=  \
 TRIPLET := $(shell gcc -dumpmachine)
 CFLAGS += -I/usr/include/$(TRIPLET)
 
-CC := clang-15
-LD := llc-15
+CC := clang
+LD := llc
 
 C_FILES:=filter.c redir.c sockops.c
 OBJS:=$(addprefix bin/,$(C_FILES:.c=.o))
diff --git a/felix/bpf-gpl/Makefile b/felix/bpf-gpl/Makefile
index 0ac2a40b63a..4bb1cb3db89 100644
--- a/felix/bpf-gpl/Makefile
+++ b/felix/bpf-gpl/Makefile
@@ -48,8 +48,8 @@ ifeq ($(ARCH),amd64)
 else ifeq ($(ARCH),arm64)
 	CFLAGS += -D__TARGET_ARCH_arm64
 endif
-CC := clang-15
-LD := llc-15
+CC := clang
+LD := llc
 
 UT_C_FILES:=$(shell find ut -name '*.c')
 UT_OBJS:=$(UT_C_FILES:.c=.o) $(shell ./list-ut-objs)
diff --git a/felix/docker-image/.gitignore b/felix/docker-image/.gitignore
deleted file mode 100644
index a73f698337e..00000000000
--- a/felix/docker-image/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-bpf
diff --git a/felix/docker-image/Dockerfile.amd64 b/felix/docker-image/Dockerfile
similarity index 73%
rename from felix/docker-image/Dockerfile.amd64
rename to felix/docker-image/Dockerfile
index 29f4e9e5551..61419695ae6 100644
--- a/felix/docker-image/Dockerfile.amd64
+++ b/felix/docker-image/Dockerfile
@@ -17,16 +17,18 @@
 # This ensures that testing of Felix in this repository is done in the same
 # userspace environment as it will be deployed in calico/node.
 
-FROM ubuntu:focal AS wgtool
+ARG QEMU_IMAGE
 
-RUN apt-get update && \
-    apt-get install --no-install-recommends wireguard-tools -y
+FROM ${QEMU_IMAGE} AS qemu
 
 FROM calico/bpftool:v7.4.0 AS bpftool
 
-FROM debian:10-slim
+FROM debian:11-slim as source
+
 LABEL maintainer="Shaun Crampton <shaun@tigera.io>"
 
+COPY --from=qemu /usr/bin/qemu-*-static /usr/bin
+
 # Install remaining runtime deps required for felix from the global repository
 RUN apt-get update && apt-get install -y \
     ipset \
@@ -50,20 +52,33 @@ RUN apt-get update && apt-get install -y \
     # Felix FV tests require these
     wget \
     ethtool \
-    tcpdump \
-    hping3
+    hping3 \
+    libpcap0.8 \
+    tcpdump
 
-# Copy in wg tool from stage 1.
-COPY --from=wgtool /usr/bin/wg /usr/bin/wg
+RUN apt-get install --no-install-recommends -y wireguard-tools
+
+RUN apt-get clean
 
 # Default to the xtables backend of iptables.
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
-ADD felix.cfg /etc/calico/felix.cfg
-ADD calico-felix-wrapper /usr/bin
+# Felix is built with RHEL/UBI and links against libpcap.so.1. We need this symbolic link
+# until Debian changes the soname from .0.8 to .1.
+RUN ln -s $(readlink /usr/lib/*-linux-gnu/libpcap.so.0.8) $(ldconfig -v 2>/dev/null | grep /usr/lib/ | head -n 1 | sed -e 's/://')/libpcap.so.1
+
+COPY felix.cfg /etc/calico/felix.cfg
+COPY calico-felix-wrapper /usr/bin
 
 COPY --from=bpftool /bpftool /usr/bin
+
+RUN rm -f /usr/bin/qemu-*-static
+
+FROM scratch
+
+COPY --from=source / /
+
 WORKDIR /code
 
 # Run felix (via the wrapper script) by default
diff --git a/felix/docker-image/Dockerfile.s390x b/felix/docker-image/Dockerfile.s390x
deleted file mode 100644
index 57c38631b62..00000000000
--- a/felix/docker-image/Dockerfile.s390x
+++ /dev/null
@@ -1,60 +0,0 @@
-ARG QEMU_IMAGE
-
-FROM ${QEMU_IMAGE} AS qemu
-FROM s390x/ubuntu:focal AS wgtool
-# Enable non-native builds of this image on an amd64 hosts.
-# This must be the first RUN command in this file!
-COPY --from=qemu /usr/bin/qemu-*-static /usr/bin/
-RUN apt-get update && \
-    apt-get install --no-install-recommends wireguard-tools -y
-
-FROM calico/bpftool:v5.3-s390x AS bpftool
-
-FROM s390x/debian:10-slim
-LABEL maintainer="Shaun Crampton <shaun@tigera.io>"
-
-# Enable non-native builds of this image on an amd64 hosts.
-# This must be the first RUN command in this file!
-COPY --from=qemu /usr/bin/qemu-*-static /usr/bin/
-
-# Install remaining runtime deps required for felix from the global repository
-RUN apt-get update && apt-get install -y \
-    ipset \
-    iptables \
-    iproute2 \
-    iputils-arping \
-    iputils-ping \
-    iputils-tracepath \
-    # Need arp
-    net-tools \
-    conntrack \
-    runit \
-    # Need kmod to ensure ip6tables-save works correctly
-    kmod \
-    # Need netbase in order for ipset to work correctly
-    # See https://github.com/kubernetes/kubernetes/issues/68703
-    netbase \
-    # Also needed (provides utilities for browsing procfs like ps)
-    procps \
-    ca-certificates \
-    # Felix FV tests require these
-    wget \
-    ethtool \
-    tcpdump \
-    hping3
-
-# Copy in wg tool from stage 1.
-COPY --from=wgtool /usr/bin/wg /usr/bin/wg
-
-# Default to the xtables backend of iptables.
-RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
-RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
-
-ADD felix.cfg /etc/calico/felix.cfg
-ADD calico-felix-wrapper /usr/bin
-
-COPY --from=bpftool /bpftool /usr/bin
-WORKDIR /code
-
-# Run felix (via the wrapper script) by default
-CMD ["/usr/bin/calico-felix-wrapper"]
diff --git a/go.mod b/go.mod
index 7fb6c64511d..6ec8bf1c977 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/projectcalico/calico
 
-go 1.21
+go 1.22
 
 require (
 	github.com/BurntSushi/toml v1.3.2
@@ -87,16 +87,16 @@ require (
 	gopkg.in/go-playground/validator.v9 v9.30.2
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver v0.27.8
-	k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver v0.27.15
-	k8s.io/client-go v0.27.15
-	k8s.io/code-generator v0.27.15
-	k8s.io/component-base v0.27.15
+	k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver v0.27.16
+	k8s.io/client-go v0.27.16
+	k8s.io/code-generator v0.27.16
+	k8s.io/component-base v0.27.16
 	k8s.io/klog/v2 v2.90.1
 	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
-	k8s.io/kubernetes v1.27.15
+	k8s.io/kubernetes v1.27.16
 	k8s.io/utils v0.0.0-20230313181309-38a27ef9d749
 	modernc.org/memory v1.7.1
 	sigs.k8s.io/kind v0.20.0
@@ -277,20 +277,20 @@ require (
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/cloud-provider v0.27.15 // indirect
-	k8s.io/component-helpers v0.27.15 // indirect
-	k8s.io/controller-manager v0.27.15 // indirect
+	k8s.io/cloud-provider v0.27.16 // indirect
+	k8s.io/component-helpers v0.27.16 // indirect
+	k8s.io/controller-manager v0.27.16 // indirect
 	k8s.io/cri-api v0.25.0 // indirect
-	k8s.io/csi-translation-lib v0.27.8 // indirect
-	k8s.io/dynamic-resource-allocation v0.27.8 // indirect
+	k8s.io/csi-translation-lib v0.27.16 // indirect
+	k8s.io/dynamic-resource-allocation v0.27.16 // indirect
 	k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect
-	k8s.io/kms v0.27.15 // indirect
+	k8s.io/kms v0.27.16 // indirect
 	k8s.io/kube-proxy v0.0.0 // indirect
 	k8s.io/kube-scheduler v0.0.0 // indirect
 	k8s.io/kubectl v0.0.0 // indirect
-	k8s.io/kubelet v0.27.8 // indirect
+	k8s.io/kubelet v0.27.16 // indirect
 	k8s.io/legacy-cloud-providers v0.0.0 // indirect
-	k8s.io/mount-utils v0.27.8 // indirect
+	k8s.io/mount-utils v0.27.16 // indirect
 	k8s.io/pod-security-admission v0.0.0 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.1.2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
@@ -300,34 +300,34 @@ require (
 replace (
 	github.com/projectcalico/api => ./api
 
-	k8s.io/api => k8s.io/api v0.27.15
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.15
-	k8s.io/apimachinery => k8s.io/apimachinery v0.27.15
-	k8s.io/apiserver => k8s.io/apiserver v0.27.15
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.15
-	k8s.io/client-go => k8s.io/client-go v0.27.15
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.15
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.15
-	k8s.io/code-generator => k8s.io/code-generator v0.27.15
-	k8s.io/component-base => k8s.io/component-base v0.27.15
-	k8s.io/component-helpers => k8s.io/component-helpers v0.27.15
-	k8s.io/controller-manager => k8s.io/controller-manager v0.27.15
-	k8s.io/cri-api => k8s.io/cri-api v0.27.15
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.15
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.15
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.15
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.15
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.15
-	k8s.io/kubectl => k8s.io/kubectl v0.27.15
-	k8s.io/kubelet => k8s.io/kubelet v0.27.15
+	k8s.io/api => k8s.io/api v0.27.16
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.27.16
+	k8s.io/apimachinery => k8s.io/apimachinery v0.27.16
+	k8s.io/apiserver => k8s.io/apiserver v0.27.16
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.27.16
+	k8s.io/client-go => k8s.io/client-go v0.27.16
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.27.16
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.27.16
+	k8s.io/code-generator => k8s.io/code-generator v0.27.16
+	k8s.io/component-base => k8s.io/component-base v0.27.16
+	k8s.io/component-helpers => k8s.io/component-helpers v0.27.16
+	k8s.io/controller-manager => k8s.io/controller-manager v0.27.16
+	k8s.io/cri-api => k8s.io/cri-api v0.27.16
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.27.16
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.27.16
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.27.16
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.27.16
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.27.16
+	k8s.io/kubectl => k8s.io/kubectl v0.27.16
+	k8s.io/kubelet => k8s.io/kubelet v0.27.16
 
 	// Need replacements for all the k8s subsidiary projects that are pulled in indirectly because
 	// the kubernets repo pulls them in via a replacement to its own vendored copies, which doesn't work for
 	// transient imports.
-	k8s.io/kubernetes => k8s.io/kubernetes v1.27.15
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.15
-	k8s.io/metrics => k8s.io/metrics v0.27.15
-	k8s.io/mount-utils => k8s.io/mount-utils v0.27.15
-	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.27.15
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.15
+	k8s.io/kubernetes => k8s.io/kubernetes v1.27.16
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.27.16
+	k8s.io/metrics => k8s.io/metrics v0.27.16
+	k8s.io/mount-utils => k8s.io/mount-utils v0.27.16
+	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.27.16
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.27.16
 )
diff --git a/go.sum b/go.sum
index aaca0677146..f1bccc9bdc5 100644
--- a/go.sum
+++ b/go.sum
@@ -1400,36 +1400,36 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.27.15 h1:+bR5ju3H+OjePA1DMEmHm33EzhtmqWBuQvqhTVYFXD0=
-k8s.io/api v0.27.15/go.mod h1:x/uHpsq4NAAGMiHWhq3P5W1ABiw4/aUWpIeGq1XmegY=
-k8s.io/apiextensions-apiserver v0.27.15 h1:7362lG3ieXff69Db5kJ709P8f5Rg3lPsyCEbl53bPQs=
-k8s.io/apiextensions-apiserver v0.27.15/go.mod h1:HYIRJp0hRQNSBiOqN75FGA7A3/fI4Hqq7+9foX7wT8o=
-k8s.io/apimachinery v0.27.15 h1:wT8HeVe/KNcX+QavW97ZpKiGxSN5glW39Dxvj/8wMPU=
-k8s.io/apimachinery v0.27.15/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
-k8s.io/apiserver v0.27.15 h1:EgyZVhJw53CpOfXaiwPM6tlkPNJgftSIaMZzKjLmBrg=
-k8s.io/apiserver v0.27.15/go.mod h1:/67w8vVSEBTwd373IrdWgNZ37P2EcpQn3+BG33d80Fo=
-k8s.io/cli-runtime v0.27.15 h1:UABMgpoRhBknZlNgr5aXn+wZxozdUsFRtmkHqRyQeKM=
-k8s.io/cli-runtime v0.27.15/go.mod h1:3IYFYRl0Qkh4zi+oFT1IUfX/xMAUafy8117te5KSNjo=
-k8s.io/client-go v0.27.15 h1:SDUs0ap/VuHPyoRiEChUhXQlh25UZAeXcm82J3TYy2w=
-k8s.io/client-go v0.27.15/go.mod h1:/ULqZ7zjeuEm/fSf7A5kKmbWb2GY/CnCiquS5XzAdzo=
-k8s.io/cloud-provider v0.27.15 h1:A3FPqRguEltPr2wWJgkROrnpOW7WxSRVxEmIiGjDuc0=
-k8s.io/cloud-provider v0.27.15/go.mod h1:cRv5KQLS2mlPc2AmSs4qnII4uUGel6EsJJm8SAD3NNk=
-k8s.io/cluster-bootstrap v0.27.15 h1:WNXaPDxadloiG1YVBLc0qZdhA2NOZIL0qbnTMHs3zoo=
-k8s.io/cluster-bootstrap v0.27.15/go.mod h1:/b2YR8UF4AP/q8lkweRU9F+LsS6zRhN0DWf04tAQRlI=
-k8s.io/code-generator v0.27.15 h1:Kw/2dkkcbfj81BMRmMdYRePW+bpdHIKvxn2jNHzEL0M=
-k8s.io/code-generator v0.27.15/go.mod h1:NmuMGweDQC7Ewx+c8zgbtVPLsy5r5Rs/+nQ7kuBwNbI=
-k8s.io/component-base v0.27.15 h1:rGksMoF/awvLn+bcm4EMKpLk1Lzkvh4BlzL162q6gG0=
-k8s.io/component-base v0.27.15/go.mod h1:46jXYR70vcRyypfWQf9lQSLrSoA3D7RuRb4WsmneEAo=
-k8s.io/component-helpers v0.27.15 h1:iBf9Yi+PkQz/GUrdj68M8R0XI8cHg562c7pKhR80TsI=
-k8s.io/component-helpers v0.27.15/go.mod h1:YAUfryduJYgNCAjzSiM0qDF4laRHp5ByuYl5bc3LjXM=
-k8s.io/controller-manager v0.27.15 h1:0seCiDugxt5ldsEeBrR4Td3u7nwfJ+i9Jbygt6+LqeE=
-k8s.io/controller-manager v0.27.15/go.mod h1:CsUumZ7pnugheyyS/3mMh4PHqOLEp93c86vxZ02sml4=
-k8s.io/cri-api v0.27.15 h1:lbzjWx+42y4DXFXy4k9sfs7tT3OzzPW11txkX03TtRk=
-k8s.io/cri-api v0.27.15/go.mod h1:l7yoWCx1cRtQ5HV+1Z53qvEH9BFlZatkjvN5dhsG5iY=
-k8s.io/csi-translation-lib v0.27.15 h1:dIGMONHf6dCji0CcaUnnHI4HkX+YwBBga7xNEBWxYzE=
-k8s.io/csi-translation-lib v0.27.15/go.mod h1:WP6TnGXEMq4zjAEahdAWwWNLzHyBWG3ryyZGYOenuHw=
-k8s.io/dynamic-resource-allocation v0.27.8 h1:hHrjkGFn9S9jXvMDByOGcxSkzCM3hxl4ul+o9WNehKo=
-k8s.io/dynamic-resource-allocation v0.27.8/go.mod h1:AU9sEQVLQk1UlNn/rkZXe2KUb+DLfQ25cEi1QnQIrEM=
+k8s.io/api v0.27.16 h1:70IBoTuiPfd+Tm68WH0tGXQRSQq0R1xnbyhTRe8WYQY=
+k8s.io/api v0.27.16/go.mod h1:5j0Cgo6X4qovBOu3OjzRwETDEYqMxq2qafhDQXOPy3A=
+k8s.io/apiextensions-apiserver v0.27.16 h1:gJ0sEbfYmvgdysC2WjkeYujvjmWAyPH6e8ANVAL5qxk=
+k8s.io/apiextensions-apiserver v0.27.16/go.mod h1:wq5IgoFVjYyJqqcjD+R+/opZJxBQcu9PIcFWJ8eaQLQ=
+k8s.io/apimachinery v0.27.16 h1:Nmbei3P/6w6vxbNxV8/sDCZz+TQrJ9A4+bVIRjDufuM=
+k8s.io/apimachinery v0.27.16/go.mod h1:TWo+8wOIz3CytsrlI9k/LBWXLRr9dqf5hRSCbbggMAg=
+k8s.io/apiserver v0.27.16 h1:s3+lMqISTj5l/ZH/BvhdbiMfIoTF3/lrAN99BHccLmk=
+k8s.io/apiserver v0.27.16/go.mod h1:xwxM8/bcAtgkWqbsGwMQjImIC5Jik7a4pHRptEDqQf0=
+k8s.io/cli-runtime v0.27.16 h1:8ICGnxcbgZKl2HThESIJ0mwbvFqAaOSdwVs8zKzrEcg=
+k8s.io/cli-runtime v0.27.16/go.mod h1:48X5XSy536FjT30gE7GwXJPCbTk+ZtQMhEbZs/9bzGU=
+k8s.io/client-go v0.27.16 h1:x06Jk6/SIQQ6kAsWs5uzQIkBLHtcAQlbTAgmj1tZzG0=
+k8s.io/client-go v0.27.16/go.mod h1:bPZUNRj8XsHa+JVS5jU6qeU2H/Za8+7riWA08FUjaA8=
+k8s.io/cloud-provider v0.27.16 h1:DPWnVrouMaBdwQJkMj7/cf3zyNsqPYEPXhRkQtZ3s9U=
+k8s.io/cloud-provider v0.27.16/go.mod h1:XgbHhQ7Z+57xaRvxxVSq2tWC00cT1SO74mLBop8SOTk=
+k8s.io/cluster-bootstrap v0.27.16 h1:iySGnST9X4W1IfAdANdF6uBzV6kTL9SIAiKQnlZm4ug=
+k8s.io/cluster-bootstrap v0.27.16/go.mod h1:u7tVB3+r4X0I/fEfirH+dNWuwGjQyReAVZa7/V92Pkk=
+k8s.io/code-generator v0.27.16 h1:nDZ6TL+hyEczXIlts1WCz57F09zDC1Xs/UMg0X+QvY0=
+k8s.io/code-generator v0.27.16/go.mod h1:NmuMGweDQC7Ewx+c8zgbtVPLsy5r5Rs/+nQ7kuBwNbI=
+k8s.io/component-base v0.27.16 h1:CpPBD1GIwsaRdDF0WzJkIppakYJwQCvsKK8exRxe9rY=
+k8s.io/component-base v0.27.16/go.mod h1:g636fljq9A7zsIB0nRE4fgmBCo8aqjoJe1aLkCX0Vwc=
+k8s.io/component-helpers v0.27.16 h1:7ulLXd43EYGIN200/ARhNxhmGJJMNrkxtd7nZwqJuBM=
+k8s.io/component-helpers v0.27.16/go.mod h1:zx8ypRCqOvRH/gB8aRCLqJWU98A3sYYMG2fU1d5/Qqg=
+k8s.io/controller-manager v0.27.16 h1:3TbbII/lnKbOwk64uCD1uUJqAEYD1zuz9LAC8et76WQ=
+k8s.io/controller-manager v0.27.16/go.mod h1:EQVxw6KP3WPV/0Y43ycsGwlzW6eH5hVprLyfwK8echc=
+k8s.io/cri-api v0.27.16 h1:Yxh72+SeHhJngFMw+9H58jASvUzt0nTaMOS/t8M9Cbw=
+k8s.io/cri-api v0.27.16/go.mod h1:l7yoWCx1cRtQ5HV+1Z53qvEH9BFlZatkjvN5dhsG5iY=
+k8s.io/csi-translation-lib v0.27.16 h1:6DCkJ0SoiSMmAdWDXE7FmOieCIabPkS4or2vDI5JUPE=
+k8s.io/csi-translation-lib v0.27.16/go.mod h1:kwBSQLCAdQRVsyNfrEhOWCHFXmxpB0hjbfe2lEBAP04=
+k8s.io/dynamic-resource-allocation v0.27.16 h1:dfLUAqzEWemX0gD3sQDJdJA/+aYtgnXbpr5d3ncN9b4=
+k8s.io/dynamic-resource-allocation v0.27.16/go.mod h1:TITVXvbofyxJc4nxajzE0ya7d1Wb/MVDKEIZVLXRAcI=
 k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08=
 k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
@@ -1438,32 +1438,32 @@ k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
 k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/kms v0.27.15 h1:U9PifyDQJWa3CEET+y87tOK/JCEXLRvv9+obqVhzagw=
-k8s.io/kms v0.27.15/go.mod h1:PsFg4I/RVe9n8QyRUA+AkbiXBQhzuVpPQ7s/VFQTiCU=
-k8s.io/kube-aggregator v0.27.15 h1:rNDpet0ByQ7ceRBimUuEKYvpiColarnCq0vF0ELqsPU=
-k8s.io/kube-aggregator v0.27.15/go.mod h1:JcOCyjbCAY+zhfdmTx8RK7+v08y6LwhuzR5TC51kRKM=
+k8s.io/kms v0.27.16 h1:Zso2+ixKQzz/N9b8q9MrFKHv2Fu7jb+0Zvu+iLWAUME=
+k8s.io/kms v0.27.16/go.mod h1:BQf/ALdGhPhqoc1q81A7WdWpjrZ6jCSfePCNecz1AW8=
+k8s.io/kube-aggregator v0.27.16 h1:UPq0RB75NNMN3UrEUzNMNDcAtpln6aHUez+KcLcQaPs=
+k8s.io/kube-aggregator v0.27.16/go.mod h1:i1VDXxBS1jAYl77QeLm4gpEV4ZCubqurNsoSmc1Bygc=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
 k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
-k8s.io/kube-proxy v0.27.15 h1:p/fb1kMkwEU05ucJAAr7fCJdEK/Kam8jAN6ewUcUeXE=
-k8s.io/kube-proxy v0.27.15/go.mod h1:Xs64JNqZwu4xfyUxfOtAB6+/KPTLtdidJKMUIjS1FW0=
-k8s.io/kube-scheduler v0.27.15 h1:Nsoa3AbVwNoEaCxOefhE1QilAKhRsAr03IZs9ufNwNc=
-k8s.io/kube-scheduler v0.27.15/go.mod h1:ruXinUf8kWsc3T+KibWg4TpiZHAgj3nZbnICz/cNFFc=
-k8s.io/kubectl v0.27.15 h1:/+SVRrlO8yGVLAwCBwL75DaQ6JozOsVyAEuv3rfWfRk=
-k8s.io/kubectl v0.27.15/go.mod h1:pOi0BbATT95x4lfp3vdRhOjInhtYLMIWTKiw8SRsN2o=
-k8s.io/kubelet v0.27.15 h1:8wEgRiglGeSmxL4hb1Ta6BZ5TpaTxJtWGUyu3wMRWzs=
-k8s.io/kubelet v0.27.15/go.mod h1:+cBqAocyf5icgsxoDcuhawHP1mLQ8xb0ViW/zLGGmaQ=
-k8s.io/kubernetes v1.27.15 h1:nTVHLXxUf9iCGAhO422+PNuyCFxmkTgFQIxUZDxzlwQ=
-k8s.io/kubernetes v1.27.15/go.mod h1:T4toI2XSWG5FJoq/H8q9eFYPymAxe/k4UnaC00uPnMs=
-k8s.io/legacy-cloud-providers v0.27.15 h1:xrlxje3UrS4DwawnqgbfxmZS5t0912XdUpu35wX5q1M=
-k8s.io/legacy-cloud-providers v0.27.15/go.mod h1:2nQkzerJuuUDEFqfOUKL+BSwgnNeGDWKfiOSItfoxok=
-k8s.io/metrics v0.27.15 h1:ok3O/08IXp6rOC404qCmOFFiKiK1wXYJSB4Dq3L8Opg=
-k8s.io/metrics v0.27.15/go.mod h1:8FU/31I8DWMfqR4DN8sdZXbzCja8MU1c4zy/kvn4t9s=
-k8s.io/mount-utils v0.27.15 h1:KOx1qhcrXEx6Otv5hpBnCq17zJsCPNfP3lfeKkZC3e8=
-k8s.io/mount-utils v0.27.15/go.mod h1:bBE748kmEaM5B38hXaPJjlVeoAtHxHg/aizoiqm+6OI=
-k8s.io/pod-security-admission v0.27.15 h1:DfrXFDIsdmshWbHzt6ozL++s7gV9snkN3ZjYGm/Gcb4=
-k8s.io/pod-security-admission v0.27.15/go.mod h1:DMrh5e/pa9/HgzOj6RAIIMO75ouA5zNMPWg2IlpOE0A=
-k8s.io/sample-apiserver v0.27.15 h1:eiaqGo0HxtXPOBBl3uzprb3Om0Vhj/eCCbRh1H2RN5k=
-k8s.io/sample-apiserver v0.27.15/go.mod h1:qh20Up8T+XuYJHkehHuNf84nSjs9fRTYXoV9ktNtswE=
+k8s.io/kube-proxy v0.27.16 h1:ZVLxMcHKr/flpLiSR3URMDIXZ8Rd3pNGQPk5Zq6xzU8=
+k8s.io/kube-proxy v0.27.16/go.mod h1:/gdNmlwUNOy4WK6j4ZSWN/F6Q3vqpVxyOik7bZ5J1RI=
+k8s.io/kube-scheduler v0.27.16 h1:gZ6HSEQasQdruFBjWr/kh/8oMW+4gSjG/DjhAfsRePM=
+k8s.io/kube-scheduler v0.27.16/go.mod h1:qW9JMRnRX8Hn5XJ5kVDf+5ey3BueG0HDf3Mk4H007+w=
+k8s.io/kubectl v0.27.16 h1:lcsr0VokO7UWbTKTZG1t5jPlWAT62/RPFBfGq7WPdsw=
+k8s.io/kubectl v0.27.16/go.mod h1:2oG5aJh0qRtUazp5dU2ilDnRJtPUNhaiYP1mo4ot7xY=
+k8s.io/kubelet v0.27.16 h1:ubei/gPi92hFYIc+lN8FNPifDzfZssrBl4M1yC64TgQ=
+k8s.io/kubelet v0.27.16/go.mod h1:+aFHesx5Swb/I1KEkEaK235MGpaxNcIBxLWrxWiO6T4=
+k8s.io/kubernetes v1.27.16 h1:DHFqj/HTUqHStFlRH9wCKPocqgHsjR6Q/DzYarB2QQE=
+k8s.io/kubernetes v1.27.16/go.mod h1:T4toI2XSWG5FJoq/H8q9eFYPymAxe/k4UnaC00uPnMs=
+k8s.io/legacy-cloud-providers v0.27.16 h1:sKjWW8MQy9IUsdqv+dl9rEa/a4cR8H3LmJw2iBYbXAI=
+k8s.io/legacy-cloud-providers v0.27.16/go.mod h1:ptrEAxtOobaIT5agAKndYsF9hkcJOr4NIuTJUode23I=
+k8s.io/metrics v0.27.16 h1:n9mZ1OV2A7qwgQyQkdZsinWnttZv4IDxqRLAovhwvUY=
+k8s.io/metrics v0.27.16/go.mod h1:7WjdtT5LHByzueQa8AQrHt4Qttuehjk9RtL/+RTwnV0=
+k8s.io/mount-utils v0.27.16 h1:pvt8J9jW1xlt7R9RM8SKwVo1ya994Kz9qADEmW6WcWg=
+k8s.io/mount-utils v0.27.16/go.mod h1:bBE748kmEaM5B38hXaPJjlVeoAtHxHg/aizoiqm+6OI=
+k8s.io/pod-security-admission v0.27.16 h1:CZqa4a40Gg3XvrJhST/7rUPGPj8fzRkT7tMLqpe5gOY=
+k8s.io/pod-security-admission v0.27.16/go.mod h1:dTZsLwiRlkgywGU6jl+Armj8Bf65za4Y/NbZYmfwIII=
+k8s.io/sample-apiserver v0.27.16 h1:oaofmVu+w59fUqlNRc4vnPTagzWUBau/c0exKCDGdf4=
+k8s.io/sample-apiserver v0.27.16/go.mod h1:tYKs2sEMPBfc+qT0J08AfmdlUf4cjDrBdU5vPx2Nr9k=
 k8s.io/utils v0.0.0-20200410111917-5770800c2500/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
 k8s.io/utils v0.0.0-20211116205334-6203023598ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20230313181309-38a27ef9d749 h1:xMMXJlJbsU8w3V5N2FLDQ8YgU8s1EoULdbQBcAeNJkY=
diff --git a/lib.Makefile b/lib.Makefile
index 6a5fcc80c6b..dcf27175c64 100644
--- a/lib.Makefile
+++ b/lib.Makefile
@@ -154,7 +154,8 @@ endif
 # the one for the host should contain all the necessary cross-compilation tools
 # we do not need to use the arch since go-build:v0.15 now is multi-arch manifest
 GO_BUILD_IMAGE ?= calico/go-build
-CALICO_BUILD    = $(GO_BUILD_IMAGE):$(GO_BUILD_VER)
+#CALICO_BUILD    = $(GO_BUILD_IMAGE):$(GO_BUILD_VER)
+CALICO_BUILD    = quay.io/coutinho/calico-go-build:v0.89 # TODO: remove this
 
 
 # We use BoringCrypto as FIPS validated cryptography in order to allow users to run in FIPS Mode (amd64 only).
diff --git a/metadata.mk b/metadata.mk
index ffb22c7803b..c1896881dee 100644
--- a/metadata.mk
+++ b/metadata.mk
@@ -8,7 +8,7 @@ GO_BUILD_VER = v0.89
 ACK_GINKGO=ACK_GINKGO_DEPRECATIONS=1.16.5
 
 # Version of Kubernetes to use for tests, bitnami/kubectl, and kubectl binary release.
-K8S_VERSION=v1.27.15
+K8S_VERSION=v1.27.16
 
 # Version of various tools used in the build and tests.
 COREDNS_VERSION=1.5.2
@@ -49,5 +49,5 @@ WINDOWS_VERSIONS ?= 1809 ltsc2022
 
 # The CNI plugin code that will be cloned and rebuilt with this repo's go-build image
 # whenever the cni-plugin image is created. v1.22.4+ are not compatible with go 1.21.
-CNI_VERSION=v1.1.1-calico+go-1.22.3
-FLANNEL_VERSION=v1.2.0-flannel2-go1.22.2
+CNI_VERSION=master
+FLANNEL_VERSION=main
diff --git a/process/testing/winfv/create_kubeadm_cluster.sh b/process/testing/winfv/create_kubeadm_cluster.sh
index 660f2b13000..496221f5493 100755
--- a/process/testing/winfv/create_kubeadm_cluster.sh
+++ b/process/testing/winfv/create_kubeadm_cluster.sh
@@ -32,7 +32,7 @@ echo \
   "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
   $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
   sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-sudo apt-get update -y
+sudo apt update -y
 sudo apt remove containerd
 sudo apt install containerd.io
 sudo rm /etc/containerd/config.toml
@@ -46,11 +46,15 @@ curl -fsSL --retry 5 "https://pkgs.k8s.io/core:/stable:/v${KUBE_REPO_VERSION}/de
 sudo chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
 # Add the Kubernetes apt repository
 echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${KUBE_REPO_VERSION}/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list
+sudo chmod 644 /etc/apt/sources.list.d/kubernetes.list
 
 K8S_PKG_VERSION=${KUBE_VERSION}-1.1
-sudo apt-get update && sudo apt-get install -y kubelet=${K8S_PKG_VERSION} kubeadm=${K8S_PKG_VERSION} kubectl=${K8S_PKG_VERSION}
+sudo apt --allow-insecure-repositories update && sudo apt install --allow-unauthenticated -y kubelet=${K8S_PKG_VERSION} kubeadm=${K8S_PKG_VERSION} kubectl=${K8S_PKG_VERSION}
 sudo swapoff -a
 
+sudo modprobe br_netfilter
+sudo sh -c 'echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables'
+
 K8S_VERSION=stable-$(echo ${KUBE_VERSION} | cut -d. -f1,2)
 sudo kubeadm init --kubernetes-version ${K8S_VERSION} --pod-network-cidr=192.168.0.0/16
 mkdir -p $HOME/.kube