diff --git a/charts/apiserver-webhook/values.yaml b/charts/apiserver-webhook/values.yaml
index 473ff761..5c49b64b 100644
--- a/charts/apiserver-webhook/values.yaml
+++ b/charts/apiserver-webhook/values.yaml
@@ -17,7 +17,7 @@ release_uuid: null
 
 images:
   tags:
-    apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     kubernetes_keystone_webhook: docker.io/k8scloudprovider/k8s-keystone-auth:latest
     scripted_test: docker.io/openstackhelm/heat:newton
     dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1
diff --git a/charts/apiserver/values.yaml b/charts/apiserver/values.yaml
index 9be49129..e65ab1e5 100644
--- a/charts/apiserver/values.yaml
+++ b/charts/apiserver/values.yaml
@@ -58,9 +58,9 @@ const:
 images:
   tags:
     dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1
-    anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-    apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-    key_rotate: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+    apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+    key_rotate: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   pull_policy: "IfNotPresent"
   local_registry:
     active: false
@@ -166,8 +166,6 @@ apiserver:
     - --service-cluster-ip-range=10.96.0.0/16
     - --endpoint-reconciler-type=lease
     - --feature-gates=PodShareProcessNamespace=true
-    # NOTE(mark-burnett): This flag is removed in Kubernetes 1.11
-    - --repair-malformed-updates=false
     - --v=3
   etcd:
     endpoints: https://kubernetes-etcd.kube-system.svc.cluster.local
diff --git a/charts/controller_manager/values.yaml b/charts/controller_manager/values.yaml
index d014c329..b5861c5e 100644
--- a/charts/controller_manager/values.yaml
+++ b/charts/controller_manager/values.yaml
@@ -16,8 +16,8 @@ release_group: null
 
 images:
   tags:
-    anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-    controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+    controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   pull_policy: "IfNotPresent"
 
 labels:
diff --git a/charts/haproxy/values.yaml b/charts/haproxy/values.yaml
index 7d39f39b..1b72fca8 100644
--- a/charts/haproxy/values.yaml
+++ b/charts/haproxy/values.yaml
@@ -64,7 +64,7 @@ conf:
 
 images:
   tags:
-    anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     haproxy: haproxy:1.8.19
     test: python:3.6
   pull_policy: "IfNotPresent"
diff --git a/charts/promenade/values.yaml b/charts/promenade/values.yaml
index 4e34d026..c850123e 100644
--- a/charts/promenade/values.yaml
+++ b/charts/promenade/values.yaml
@@ -49,7 +49,7 @@ conf:
 images:
   tags:
     monitoring_image: busybox:1.28.3
-    hyperkube: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    hyperkube: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     promenade: quay.io/airshipit/promenade:latest
     ks_user: docker.io/openstackhelm/heat:newton
     ks_service: docker.io/openstackhelm/heat:newton
diff --git a/charts/proxy/values.yaml b/charts/proxy/values.yaml
index 80c071b1..339bf9d7 100644
--- a/charts/proxy/values.yaml
+++ b/charts/proxy/values.yaml
@@ -50,7 +50,7 @@ pod:
 
 images:
   tags:
-    proxy: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    proxy: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   pull_policy: "IfNotPresent"
 
 proxy:
diff --git a/charts/scheduler/values.yaml b/charts/scheduler/values.yaml
index a1b0be06..a300585d 100644
--- a/charts/scheduler/values.yaml
+++ b/charts/scheduler/values.yaml
@@ -77,8 +77,8 @@ secrets:
 
 images:
   tags:
-    anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-    scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+    anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+    scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   pull_policy: "IfNotPresent"
 
 network:
diff --git a/doc/source/configuration/genesis.rst b/doc/source/configuration/genesis.rst
index c73adcd1..9e49bdeb 100644
--- a/doc/source/configuration/genesis.rst
+++ b/doc/source/configuration/genesis.rst
@@ -48,10 +48,10 @@ Here is a complete sample document:
         helm:
           tiller: gcr.io/kubernetes-helm/tiller:v2.16.1
         kubernetes:
-          apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-          controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+          apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+          controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
           etcd: quay.io/coreos/etcd:v3.4.2
-          scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+          scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       files:
         - path: /var/lib/anchor/calico-etcd-bootstrap
           content: ""
diff --git a/doc/source/configuration/host-system.rst b/doc/source/configuration/host-system.rst
index 0323e5e9..d5173472 100644
--- a/doc/source/configuration/host-system.rst
+++ b/doc/source/configuration/host-system.rst
@@ -16,7 +16,7 @@ Sample Document to run containers in Docker runtime
     data:
       files:
         - path: /opt/kubernetes/bin/kubelet
-          tar_url: https://dl.k8s.io/v1.11.6/kubernetes-node-linux-amd64.tar.gz
+          tar_url: https://dl.k8s.io/v1.16.2/kubernetes-node-linux-amd64.tar.gz
           tar_path: kubernetes/node/bin/kubelet
           mode: 0555
       images:
@@ -24,7 +24,7 @@ Sample Document to run containers in Docker runtime
         helm:
           helm: lachlanevenson/k8s-helm:v2.14.0
         kubernetes:
-          kubectl: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+          kubectl: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       packages:
         repositories:
           - deb http://apt.dockerproject.org/repo ubuntu-xenial main
@@ -83,7 +83,7 @@ Sample Document to run containers in Containerd runtime
     data:
       files:
         - path: /opt/kubernetes/bin/kubelet
-          tar_url: https://dl.k8s.io/v1.11.6/kubernetes-node-linux-amd64.tar.gz
+          tar_url: https://dl.k8s.io/v1.16.2/kubernetes-node-linux-amd64.tar.gz
           tar_path: kubernetes/node/bin/kubelet
           mode: 0555
       images:
@@ -91,7 +91,7 @@ Sample Document to run containers in Containerd runtime
         helm:
           helm: lachlanevenson/k8s-helm:v2.14.0
         kubernetes:
-          kubectl: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+          kubectl: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       packages:
         additional:
           - curl
diff --git a/examples/basic/Genesis.yaml b/examples/basic/Genesis.yaml
index 1c3166c2..ff1072d3 100644
--- a/examples/basic/Genesis.yaml
+++ b/examples/basic/Genesis.yaml
@@ -25,8 +25,6 @@ data:
       - --service-cluster-ip-range=10.96.0.0/16
       - --endpoint-reconciler-type=lease
       - --feature-gates=PodShareProcessNamespace=true
-      # NOTE(mark-burnett): This flag is removed in Kubernetes 1.11
-      - --repair-malformed-updates=false
       - --admission-control-config-file=/etc/kubernetes/apiserver/acconfig.yaml
       - --experimental-encryption-provider-config=/etc/kubernetes/apiserver/encryption_provider.yaml
       - --v=3
@@ -53,10 +51,10 @@ data:
     helm:
       tiller: gcr.io/kubernetes-helm/tiller:v2.16.1
     kubernetes:
-      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       etcd: quay.io/coreos/etcd:v3.4.2
-      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   files:
     - path: /var/lib/anchor/calico-etcd-bootstrap
       content: "# placeholder for triggering calico etcd bootstrapping"
diff --git a/examples/basic/HostSystem.yaml b/examples/basic/HostSystem.yaml
index 6694bc35..1cb5da4f 100644
--- a/examples/basic/HostSystem.yaml
+++ b/examples/basic/HostSystem.yaml
@@ -13,7 +13,7 @@ data:
       enable: true
   files:
     - path: /opt/kubernetes/bin/hyperkube
-      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       file_path: /hyperkube
       mode: 0555
     - path: /opt/kubernetes/bin/kubelet
@@ -48,8 +48,9 @@ data:
         CPUSET_ABSPATH="/sys/fs/cgroup/cpuset/$KUBE_CGROUP"
         CPU_ABSPATH="/sys/fs/cgroup/cpu/$KUBE_CGROUP"
         MEM_ABSPATH="/sys/fs/cgroup/memory/$KUBE_CGROUP"
+        PIDS_ABSPATH="/sys/fs/cgroup/pids/$KUBE_CGROUP"
 
-        for cg in $SYSTEMD_ABSPATH $CPUSET_ABSPATH $CPU_ABSPATH $MEM_ABSPATH
+        for cg in $SYSTEMD_ABSPATH $CPUSET_ABSPATH $CPU_ABSPATH $MEM_ABSPATH $PIDS_ABSPATH
         do
           mkdir -p "$cg"
         done
diff --git a/examples/basic/armada-resources.yaml b/examples/basic/armada-resources.yaml
index db19cd6c..435c2572 100644
--- a/examples/basic/armada-resources.yaml
+++ b/examples/basic/armada-resources.yaml
@@ -160,7 +160,7 @@ data:
   values:
     images:
       tags:
-        proxy: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        proxy: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_netloc: 127.0.0.1:6553
   source:
@@ -627,7 +627,7 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
         haproxy: haproxy:1.8.3
         test: python:3.6
 
@@ -728,8 +728,8 @@ data:
         endpoints: https://127.0.0.1:2378
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_service_ip: 10.96.0.1
       pod_cidr: 10.97.0.0/16
@@ -794,8 +794,8 @@ data:
   values:
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         private_key: placeholder
@@ -868,8 +868,8 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
 
   source:
     type: local
diff --git a/examples/complete/Genesis.yaml b/examples/complete/Genesis.yaml
index 2baea48c..9489cd7c 100644
--- a/examples/complete/Genesis.yaml
+++ b/examples/complete/Genesis.yaml
@@ -39,10 +39,10 @@ data:
     helm:
       tiller: gcr.io/kubernetes-helm/tiller:v2.16.1
     kubernetes:
-      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       etcd: quay.io/coreos/etcd:v3.4.2
-      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   files:
     - path: /var/lib/anchor/calico-etcd-bootstrap
       content: "# placeholder for triggering calico etcd bootstrapping"
diff --git a/examples/complete/HostSystem.yaml b/examples/complete/HostSystem.yaml
index ee6312ff..25fb05f1 100644
--- a/examples/complete/HostSystem.yaml
+++ b/examples/complete/HostSystem.yaml
@@ -10,7 +10,7 @@ metadata:
 data:
   files:
     - path: /opt/kubernetes/bin/hyperkube
-      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       file_path: /hyperkube
       mode: 0555
     - path: /opt/kubernetes/bin/kubelet
diff --git a/examples/complete/armada-resources.yaml b/examples/complete/armada-resources.yaml
index 2090b08c..4ec08017 100644
--- a/examples/complete/armada-resources.yaml
+++ b/examples/complete/armada-resources.yaml
@@ -201,7 +201,7 @@ data:
   values:
     images:
       tags:
-        proxy: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        proxy: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_netloc: 127.0.0.1:6553
   source:
@@ -644,7 +644,7 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
         haproxy: haproxy:1.8.3
         test: python:3.6
 
@@ -730,8 +730,8 @@ data:
         endpoints: https://127.0.0.1:2378
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         public_key: placeholder
@@ -807,8 +807,8 @@ data:
   values:
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         private_key: placeholder
@@ -880,8 +880,8 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
 
   source:
     type: local
diff --git a/examples/containerd/Genesis.yaml b/examples/containerd/Genesis.yaml
index 5967c913..d9afba6a 100644
--- a/examples/containerd/Genesis.yaml
+++ b/examples/containerd/Genesis.yaml
@@ -25,8 +25,6 @@ data:
       - --service-cluster-ip-range=10.96.0.0/16
       - --endpoint-reconciler-type=lease
       - --feature-gates=PodShareProcessNamespace=true
-      # NOTE(segorov): This flag is removed in Kubernetes 1.14
-      - --repair-malformed-updates=false
       - --admission-control-config-file=/etc/kubernetes/apiserver/acconfig.yaml
       - --experimental-encryption-provider-config=/etc/kubernetes/apiserver/encryption_provider.yaml
       - --v=3
@@ -53,10 +51,10 @@ data:
     helm:
       tiller: gcr.io/kubernetes-helm/tiller:v2.16.1
     kubernetes:
-      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       etcd: quay.io/coreos/etcd:v3.4.2
-      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   files:
     - path: /var/lib/anchor/calico-etcd-bootstrap
       content: "# placeholder for triggering calico etcd bootstrapping"
diff --git a/examples/containerd/HostSystem.yaml b/examples/containerd/HostSystem.yaml
index 8ad9a2c3..6cde5fae 100644
--- a/examples/containerd/HostSystem.yaml
+++ b/examples/containerd/HostSystem.yaml
@@ -13,7 +13,7 @@ data:
       enable: true
   files:
     - path: /opt/kubernetes/bin/hyperkube
-      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       file_path: /hyperkube
       mode: 0555
     - path: /opt/kubernetes/bin/kubelet
@@ -48,8 +48,9 @@ data:
         CPUSET_ABSPATH="/sys/fs/cgroup/cpuset/$KUBE_CGROUP"
         CPU_ABSPATH="/sys/fs/cgroup/cpu/$KUBE_CGROUP"
         MEM_ABSPATH="/sys/fs/cgroup/memory/$KUBE_CGROUP"
+        PIDS_ABSPATH="/sys/fs/cgroup/pids/$KUBE_CGROUP"
 
-        for cg in $SYSTEMD_ABSPATH $CPUSET_ABSPATH $CPU_ABSPATH $MEM_ABSPATH
+        for cg in $SYSTEMD_ABSPATH $CPUSET_ABSPATH $CPU_ABSPATH $MEM_ABSPATH $PIDS_ABSPATH
         do
           mkdir -p "$cg"
         done
diff --git a/examples/containerd/armada-resources.yaml b/examples/containerd/armada-resources.yaml
index f37bf3c5..0cea57e3 100644
--- a/examples/containerd/armada-resources.yaml
+++ b/examples/containerd/armada-resources.yaml
@@ -160,7 +160,7 @@ data:
   values:
     images:
       tags:
-        proxy: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        proxy: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_netloc: 127.0.0.1:6553
   source:
@@ -524,7 +524,7 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
         haproxy: haproxy:1.8.3
         test: python:3.6
 
@@ -626,8 +626,8 @@ data:
         endpoints: https://127.0.0.1:2378
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_service_ip: 10.96.0.1
       pod_cidr: 10.97.0.0/16
@@ -692,8 +692,8 @@ data:
   values:
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         private_key: placeholder
@@ -766,8 +766,8 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
 
   source:
     type: local
diff --git a/examples/gate/Genesis.yaml b/examples/gate/Genesis.yaml
index 5faf8cbe..d9afba6a 100644
--- a/examples/gate/Genesis.yaml
+++ b/examples/gate/Genesis.yaml
@@ -25,8 +25,6 @@ data:
       - --service-cluster-ip-range=10.96.0.0/16
       - --endpoint-reconciler-type=lease
       - --feature-gates=PodShareProcessNamespace=true
-      # NOTE(mark-burnett): This flag is removed in Kubernetes 1.11
-      - --repair-malformed-updates=false
       - --admission-control-config-file=/etc/kubernetes/apiserver/acconfig.yaml
       - --experimental-encryption-provider-config=/etc/kubernetes/apiserver/encryption_provider.yaml
       - --v=3
@@ -53,10 +51,10 @@ data:
     helm:
       tiller: gcr.io/kubernetes-helm/tiller:v2.16.1
     kubernetes:
-      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       etcd: quay.io/coreos/etcd:v3.4.2
-      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   files:
     - path: /var/lib/anchor/calico-etcd-bootstrap
       content: "# placeholder for triggering calico etcd bootstrapping"
diff --git a/examples/gate/HostSystem.yaml b/examples/gate/HostSystem.yaml
index 6694bc35..1cb5da4f 100644
--- a/examples/gate/HostSystem.yaml
+++ b/examples/gate/HostSystem.yaml
@@ -13,7 +13,7 @@ data:
       enable: true
   files:
     - path: /opt/kubernetes/bin/hyperkube
-      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      docker_image: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       file_path: /hyperkube
       mode: 0555
     - path: /opt/kubernetes/bin/kubelet
@@ -48,8 +48,9 @@ data:
         CPUSET_ABSPATH="/sys/fs/cgroup/cpuset/$KUBE_CGROUP"
         CPU_ABSPATH="/sys/fs/cgroup/cpu/$KUBE_CGROUP"
         MEM_ABSPATH="/sys/fs/cgroup/memory/$KUBE_CGROUP"
+        PIDS_ABSPATH="/sys/fs/cgroup/pids/$KUBE_CGROUP"
 
-        for cg in $SYSTEMD_ABSPATH $CPUSET_ABSPATH $CPU_ABSPATH $MEM_ABSPATH
+        for cg in $SYSTEMD_ABSPATH $CPUSET_ABSPATH $CPU_ABSPATH $MEM_ABSPATH $PIDS_ABSPATH
         do
           mkdir -p "$cg"
         done
diff --git a/examples/gate/armada-resources.yaml b/examples/gate/armada-resources.yaml
index 4bc7b975..8ffaed03 100644
--- a/examples/gate/armada-resources.yaml
+++ b/examples/gate/armada-resources.yaml
@@ -160,7 +160,7 @@ data:
   values:
     images:
       tags:
-        proxy: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        proxy: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_netloc: 127.0.0.1:6553
   source:
@@ -252,6 +252,12 @@ data:
   upgrade:
     no_hooks: true
   values:
+    pod:
+      # Disables AppArmor for calico-etcd
+      mandatory_access_control:
+        type: apparmor
+        example-etcd:
+          etcd: null
     anchor:
       etcdctl_endpoint: 10.96.232.136
     labels:
@@ -365,7 +371,7 @@ data:
     no_hooks: true
   values:
     pod:
-      # Disables AppArmor in the gate
+      # Disables AppArmor for calico
       mandatory_access_control:
         type: apparmor
         calico-node:
@@ -524,7 +530,7 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
         haproxy: haproxy:1.8.3
         test: python:3.6
 
@@ -626,8 +632,8 @@ data:
         endpoints: https://127.0.0.1:2378
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_service_ip: 10.96.0.1
       pod_cidr: 10.97.0.0/16
@@ -692,8 +698,8 @@ data:
   values:
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         private_key: placeholder
@@ -766,8 +772,8 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
 
   source:
     type: local
diff --git a/tests/unit/api/test_validatedesign.py b/tests/unit/api/test_validatedesign.py
index 9bf06325..ce94e703 100644
--- a/tests/unit/api/test_validatedesign.py
+++ b/tests/unit/api/test_validatedesign.py
@@ -107,13 +107,13 @@ VALID_DOCS = [
                 },
                 'kubernetes': {
                     'apiserver':
-                    'gcr.io/google_containers/hyperkube-amd64:v1.11.6',
+                    'gcr.io/google_containers/hyperkube-amd64:v1.16.2',
                     'controller-manager':
-                    'gcr.io/google_containers/hyperkube-amd64:v1.11.6',
+                    'gcr.io/google_containers/hyperkube-amd64:v1.16.2',
                     'etcd':
                     'quay.io/coreos/etcd:v3.4.2',
                     'scheduler':
-                    'gcr.io/google_containers/hyperkube-amd64:v1.11.6'
+                    'gcr.io/google_containers/hyperkube-amd64:v1.16.2'
                 }
             },
             'ip':
@@ -149,7 +149,7 @@ VALID_DOCS = [
                 'tar_path':
                 'kubernetes/node/bin/kubelet',
                 'tar_url':
-                'https://dl.k8s.io/v1.11.6/kubernetes-node-linux-amd64.tar.gz'
+                'https://dl.k8s.io/v1.16.2/kubernetes-node-linux-amd64.tar.gz'
             },
              {
                  'content':
@@ -166,7 +166,7 @@ VALID_DOCS = [
                 },
                 'kubernetes': {
                     'kubectl':
-                    'gcr.io/google_containers/hyperkube-amd64:v1.11.6'
+                    'gcr.io/google_containers/hyperkube-amd64:v1.16.2'
                 }
             },
             'packages': {
diff --git a/tests/unit/builder_data/simple/Genesis.yaml b/tests/unit/builder_data/simple/Genesis.yaml
index a4f81a42..a7f04f5b 100644
--- a/tests/unit/builder_data/simple/Genesis.yaml
+++ b/tests/unit/builder_data/simple/Genesis.yaml
@@ -36,10 +36,10 @@ data:
     helm:
       tiller: gcr.io/kubernetes-helm/tiller:v2.16.1
     kubernetes:
-      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+      controller-manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
       etcd: quay.io/coreos/etcd:v3.4.2
-      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+      scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
   files:
     - path: /var/lib/anchor/calico-etcd-bootstrap
       content: "# placeholder for triggering calico etcd bootstrapping"
diff --git a/tests/unit/builder_data/simple/HostSystem.yaml b/tests/unit/builder_data/simple/HostSystem.yaml
index 1ac19b57..bc441395 100644
--- a/tests/unit/builder_data/simple/HostSystem.yaml
+++ b/tests/unit/builder_data/simple/HostSystem.yaml
@@ -14,7 +14,7 @@ data:
     # attempt to actually run Kubernetes, only to construct the genesis and
     # join scripts.
     # - path: /opt/kubernetes/bin/kubelet
-    #   tar_url: https://dl.k8s.io/v1.11.6/kubernetes-node-linux-amd64.tar.gz
+    #   tar_url: https://dl.k8s.io/v1.16.2/kubernetes-node-linux-amd64.tar.gz
     #   tar_path: kubernetes/node/bin/kubelet
     #   mode: 0555
     - path: /etc/logrotate.d/json-logrotate
diff --git a/tests/unit/builder_data/simple/armada-resources.yaml b/tests/unit/builder_data/simple/armada-resources.yaml
index a142e24c..2a9e5f8c 100644
--- a/tests/unit/builder_data/simple/armada-resources.yaml
+++ b/tests/unit/builder_data/simple/armada-resources.yaml
@@ -161,7 +161,7 @@ data:
   values:
     images:
       tags:
-        proxy: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        proxy: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     network:
       kubernetes_netloc: 127.0.0.1:6553
   source:
@@ -537,7 +537,7 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
         haproxy: haproxy:1.8.3
         test: python:3.6
 
@@ -629,8 +629,8 @@ data:
         endpoints: https://127.0.0.1:2378
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        apiserver: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         public_key: placeholder
@@ -706,8 +706,8 @@ data:
   values:
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        controller_manager: gcr.io/google_containers/hyperkube-amd64:v1.16.2
     secrets:
       service_account:
         private_key: placeholder
@@ -779,8 +779,8 @@ data:
 
     images:
       tags:
-        anchor: gcr.io/google_containers/hyperkube-amd64:v1.11.6
-        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.11.6
+        anchor: gcr.io/google_containers/hyperkube-amd64:v1.16.2
+        scheduler: gcr.io/google_containers/hyperkube-amd64:v1.16.2
 
   source:
     type: local
diff --git a/tools/g2/lib/config.sh b/tools/g2/lib/config.sh
index f1069533..adf573e6 100644
--- a/tools/g2/lib/config.sh
+++ b/tools/g2/lib/config.sh
@@ -2,7 +2,7 @@ export TEMP_DIR=${TEMP_DIR:-$(mktemp -d)}
 export BASE_IMAGE_SIZE=${BASE_IMAGE_SIZE:-68719476736}
 export BASE_IMAGE_URL=${BASE_IMAGE_URL:-https://cloud-images.ubuntu.com/releases/16.04/release/ubuntu-16.04-server-cloudimg-amd64-disk1.img}
 export IMAGE_PROMENADE=${IMAGE_PROMENADE:-quay.io/airshipit/promenade:master}
-export IMAGE_HYPERKUBE=${IMAGE_HYPERKUBE:-gcr.io/google_containers/hyperkube-amd64:v1.11.6}
+export IMAGE_HYPERKUBE=${IMAGE_HYPERKUBE:-gcr.io/google_containers/hyperkube-amd64:v1.16.2}
 export NGINX_DIR="${TEMP_DIR}/nginx"
 export NGINX_URL="http://192.168.77.1:7777"
 export PROMENADE_BASE_URL="http://promenade-api.ucp.svc.cluster.local"
diff --git a/tools/gate/default-config-env b/tools/gate/default-config-env
index a851bdb5..e410ddca 100644
--- a/tools/gate/default-config-env
+++ b/tools/gate/default-config-env
@@ -8,6 +8,6 @@ IMAGE_DEP_CHECK=quay.io/stackanetes/kubernetes-entrypoint:v0.3.1
 IMAGE_ETCD=quay.io/coreos/etcd:v3.4.2
 IMAGE_HAPROXY=haproxy:1.8.3
 IMAGE_HELM=lachlanevenson/k8s-helm:v2.14.0
-IMAGE_HYPERKUBE=gcr.io/google_containers/hyperkube-amd64:v1.11.6
+IMAGE_HYPERKUBE=gcr.io/google_containers/hyperkube-amd64:v1.16.2
 IMAGE_TILLER=gcr.io/kubernetes-helm/tiller:v2.16.1
-KUBELET_URL=https://dl.k8s.io/v1.11.6/kubernetes-node-linux-amd64.tar.gz
+KUBELET_URL=https://dl.k8s.io/v1.16.2/kubernetes-node-linux-amd64.tar.gz
diff --git a/tools/registry/IMAGES b/tools/registry/IMAGES
index 675a774d..3d2dfae6 100644
--- a/tools/registry/IMAGES
+++ b/tools/registry/IMAGES
@@ -1,6 +1,6 @@
 # source_name, tag, cache_name
 coredns/coredns,0.9.9,coredns
-gcr.io/google_containers/hyperkube-amd64,v1.11.6,hyperkube
+gcr.io/google_containers/hyperkube-amd64,v1.16.2,hyperkube
 gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64,1.14.4,k8s-dns-dnsmasq-nanny-amd64
 gcr.io/google_containers/k8s-dns-kube-dns-amd64,1.14.4,k8s-dns-kube-dns-amd64
 gcr.io/google_containers/k8s-dns-sidecar-amd64,1.14.4,k8s-dns-sidecar-amd64
diff --git a/tools/simple-deployment.sh b/tools/simple-deployment.sh
index 2049b38e..e0ce09a6 100755
--- a/tools/simple-deployment.sh
+++ b/tools/simple-deployment.sh
@@ -3,7 +3,7 @@
 set -eux
 
 IMAGE_PROMENADE=${IMAGE_PROMENADE:-quay.io/airshipit/promenade:master}
-IMAGE_HYPERKUBE=${IMAGE_HYPERKUBE:-gcr.io/google_containers/hyperkube-amd64:v1.11.6}
+IMAGE_HYPERKUBE=${IMAGE_HYPERKUBE:-gcr.io/google_containers/hyperkube-amd64:v1.16.2}
 PROMENADE_DEBUG=${PROMENADE_DEBUG:-0}
 
 SCRIPT_DIR=$(realpath $(dirname $0))