diff --git a/.bazelrc b/.bazelrc
index 0190a8fe..074170c3 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -12,14 +12,32 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# In case you only have ipv6, you may need this:
+# https://github.com/bazelbuild/bazel/issues/2486#issuecomment-657932374
+#startup --host_jvm_args=-Djava.net.preferIPv6Addresses=true
+
 build --workspace_status_command=./hack/print-workspace-status.sh
 build --verbose_failures
 build --define=TAG=staging
 
 run --workspace_status_command=./hack/print-workspace-status.sh
 
+# https://docs.bazel.build/versions/main/bazel-and-java.html#hermetic-testing-and-compilation
+build --java_runtime_version=remotejdk_11
+run --java_runtime_version=remotejdk_11
+test --java_runtime_version=remotejdk_11
+
+# https://github.com/bazelbuild/rules_jvm_external/issues/445
+build --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 test --test_output=errors
 
 # Taken from https://github.com/grpc/grpc/blob/66b045636018505dfa2654e62003d9596733076b/tools/bazel.rc
 # Builds fail on MacOS otherwise
 build --copt=-DGRPC_BAZEL_BUILD
+
+
+
+# https://github.com/bazelbuild/rules_docker/issues/2016
+# https://github.com/bazelbuild/rules_docker/issues/2078
+# ERICK ERICK ERICK
diff --git a/.bazelversion b/.bazelversion
index 1545d966..91ff5727 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-3.5.0
+5.2.0
diff --git a/WORKSPACE b/WORKSPACE
index 45723f77..9c6c8d4b 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -20,6 +20,32 @@ load("//k8s:k8s.bzl", "k8s_defaults", "k8s_repositories")
 # Tell Gazelle to use @io_bazel_rules_docker as the external repository for rules_docker go packages
 # gazelle:repository go_repository name=io_bazel_rules_docker importpath=github.com/bazelbuild/rules_docker
 
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_python",
+    sha256 = "cdf6b84084aad8f10bf20b46b77cb48d83c319ebe6458a18e9d2cebf57807cdd",
+    strip_prefix = "rules_python-0.8.1",
+    url = "https://github.com/bazelbuild/rules_python/archive/refs/tags/0.8.1.tar.gz",
+)
+
+#load("@rules_python//python:repositories.bzl", "python_register_toolchains")
+#
+#python_register_toolchains(
+#    name = "python3_9",
+#    python_version = "3.9",
+#)
+#
+#load("@python3_9//:defs.bzl", "interpreter")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+# ERICK
+#load("@rules_python//python:pip.bzl", "pip_parse")
+#
+#pip_parse(
+#    python_interpreter_target = interpreter,
+#)
+
 k8s_repositories()
 
 load("@io_bazel_rules_docker//repositories:repositories.bzl", _rules_docker_repos = "repositories")
@@ -30,6 +56,18 @@ load("//k8s:k8s_go_deps.bzl", k8s_go_deps = "deps")
 
 k8s_go_deps()
 
+http_archive(
+    name = "rules_cc",
+    sha256 = "4dccbfd22c0def164c8f47458bd50e0c7148f3d92002cdb459c2a96a68498241",
+    urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.1/rules_cc-0.0.1.tar.gz"],
+)
+
+load("@rules_cc//cc:repositories.bzl", "rules_cc_dependencies", "rules_cc_toolchains")
+
+rules_cc_dependencies()
+
+rules_cc_toolchains()
+
 http_archive(
     name = "com_google_protobuf",
     sha256 = "0cbdc9adda01f6d2facc65a22a2be5cecefbefe5a09e5382ee8879b522c04441",
@@ -46,26 +84,16 @@ protobuf_deps()
 # can be removed once other dependencies are updated.
 git_repository(
     name = "subpar",
+    commit = "9fae6b63cfeace2e0fb93c9c1ebdc28d3991b16f",
     remote = "https://github.com/google/subpar.git",
-    tag = "2.0.0",
 )
 
-http_archive(
-    name = "rules_python",
-    sha256 = "778197e26c5fbeb07ac2a2c5ae405b30f6cb7ad1f5510ea6fdac03bded96cc6f",
-    strip_prefix = "rules_python-0.2.0",
-    url = "https://github.com/bazelbuild/rules_python/releases/download/0.2.0/rules_python-0.2.0.tar.gz",
-)
-
-load("@rules_python//python:repositories.bzl", "py_repositories")
-
-py_repositories()
-
 # Only needed if using the packaging rules.
 load("@rules_python//python:pip.bzl", "pip_install")
 
 pip_install(
     name = "py_deps",
+    #python_interpreter_target = interpreter,
     requirements = "//:requirements.txt",
 )
 
@@ -168,32 +196,99 @@ k8s_defaults(
 # rules_python is a transitive dep of build_stack_rules_proto, so place it
 # first if we're going to explicitly mention it at all
 
+# https://rules-proto-grpc.com/en/latest/#installation
 http_archive(
-    name = "build_stack_rules_proto",
-    patch_args = ["-p1"],
-    patches = [
-        "//third_party/build_stack_rules_proto:stackb.patch",
-    ],
-    sha256 = "2c62ecc133ee0400d969750a5591909a9b3839af402f9c9d148cffb0ce9b374b",
-    strip_prefix = "rules_proto-6b334ece48828fb8e45052976d3516f808819ac7",
-    urls = ["https://github.com/stackb/rules_proto/archive/6b334ece48828fb8e45052976d3516f808819ac7.tar.gz"],
+    name = "rules_proto_grpc",
+    sha256 = "507e38c8d95c7efa4f3b1c0595a8e8f139c885cb41a76cab7e20e4e67ae87731",
+    strip_prefix = "rules_proto_grpc-4.1.1",
+    urls = ["https://github.com/rules-proto-grpc/rules_proto_grpc/archive/4.1.1.tar.gz"],
 )
 
-load("@build_stack_rules_proto//:deps.bzl", "io_grpc_grpc_java")
+load("@rules_proto_grpc//:repositories.bzl", "rules_proto_grpc_repos", "rules_proto_grpc_toolchains")
 
-io_grpc_grpc_java()
+rules_proto_grpc_toolchains()
 
-load("@io_grpc_grpc_java//:repositories.bzl", "grpc_java_repositories")
+rules_proto_grpc_repos()
 
-grpc_java_repositories()
+load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
+
+rules_proto_dependencies()
+
+rules_proto_toolchains()
+
+load("@rules_proto_grpc//go:repositories.bzl", rules_proto_grpc_go_repos = "go_repos")
+
+rules_proto_grpc_go_repos()
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+RULES_JVM_EXTERNAL_TAG = "4.2"
+
+RULES_JVM_EXTERNAL_SHA = "cd1a77b7b02e8e008439ca76fd34f5b07aecb8c752961f9640dea15e9e5ba1ca"
+
+http_archive(
+    name = "rules_jvm_external",
+    sha256 = RULES_JVM_EXTERNAL_SHA,
+    strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
+    url = "https://github.com/bazelbuild/rules_jvm_external/archive/%s.zip" % RULES_JVM_EXTERNAL_TAG,
+)
+
+load("@rules_jvm_external//:repositories.bzl", "rules_jvm_external_deps")
+
+rules_jvm_external_deps()
 
-load("@build_stack_rules_proto//java:deps.bzl", "java_grpc_library")
+load("@rules_jvm_external//:setup.bzl", "rules_jvm_external_setup")
 
-java_grpc_library()
+rules_jvm_external_setup()
 
-load("@build_stack_rules_proto//go:deps.bzl", "go_grpc_library")
+load("@rules_jvm_external//:defs.bzl", "maven_install")
+
+#maven_install(
+#    artifacts = [
+#        "junit:junit:4.12",
+#        "androidx.test.espresso:espresso-core:3.1.1",
+#        "org.hamcrest:hamcrest-library:1.3",
+#    ],
+#    repositories = [
+#        # Private repositories are supported through HTTP Basic auth
+#        "http://username:password@localhost:8081/artifactory/my-repository",
+#        "https://maven.google.com",
+#        "https://repo1.maven.org/maven2",
+#    ],
+#)
+
+load("@rules_proto_grpc//java:repositories.bzl", rules_proto_grpc_java_repos = "java_repos")
+
+rules_proto_grpc_java_repos()
+
+load("@rules_jvm_external//:defs.bzl", "maven_install")
+load("@io_grpc_grpc_java//:repositories.bzl", "IO_GRPC_GRPC_JAVA_ARTIFACTS", "IO_GRPC_GRPC_JAVA_OVERRIDE_TARGETS", "grpc_java_repositories")
+
+#artifacts = [
+#    "com.google.errorprone:error_prone_annotations:2.3.2",
+#],
+#repositories = [
+#    "https://jcenter.bintray.com",
+#    "https://repo1.maven.org/maven2",
+#],
+maven_install(
+    artifacts = IO_GRPC_GRPC_JAVA_ARTIFACTS,
+    generate_compat_repositories = True,
+    override_targets = IO_GRPC_GRPC_JAVA_OVERRIDE_TARGETS,
+    repositories = [
+        "https://repo.maven.apache.org/maven2/",
+    ],
+)
 
-go_grpc_library()
+load("@maven//:compat.bzl", "compat_repositories")
+
+compat_repositories()
+
+grpc_java_repositories()
+
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+
+gazelle_dependencies()
 
 # We use java_image to build a sample service
 load(
@@ -211,23 +306,39 @@ load(
 
 _go_image_repos()
 
-git_repository(
+http_archive(
     name = "io_bazel_rules_jsonnet",
-    commit = "12979862ab51358a8a5753f5a4aa0658fec9d4af",
-    remote = "https://github.com/bazelbuild/rules_jsonnet.git",
-    shallow_since = "1574670556 +0100",
+    sha256 = "d20270872ba8d4c108edecc9581e2bb7f320afab71f8caa2f6394b5202e8a2c3",
+    strip_prefix = "rules_jsonnet-0.4.0",
+    urls = ["https://github.com/bazelbuild/rules_jsonnet/archive/0.4.0.tar.gz"],
 )
 
 load("@io_bazel_rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_repositories")
 
 jsonnet_repositories()
 
+load("@google_jsonnet_go//bazel:repositories.bzl", "jsonnet_go_repositories")
+
+jsonnet_go_repositories()
+
+load("@google_jsonnet_go//bazel:deps.bzl", "jsonnet_go_dependencies")
+
+jsonnet_go_dependencies()
+
 http_archive(
     name = "build_bazel_rules_nodejs",
-    sha256 = "9d93d4e1340c43dbf6b2fd66b683d89630a6310bf8be3bf40ec96685dcacc26c",
-    urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/2.3.3/rules_nodejs-2.3.3.tar.gz"],
+    sha256 = "0fad45a9bda7dc1990c47b002fd64f55041ea751fafc00cd34efb96107675778",
+    urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.5.0/rules_nodejs-5.5.0.tar.gz"],
 )
 
+load("@build_bazel_rules_nodejs//:repositories.bzl", "build_bazel_rules_nodejs_dependencies")
+
+build_bazel_rules_nodejs_dependencies()
+
+load("@build_bazel_rules_nodejs//:index.bzl", "node_repositories")
+
+node_repositories()
+
 load("@build_bazel_rules_nodejs//:index.bzl", "yarn_install")
 
 # We use nodejs_image to build a sample service
@@ -245,26 +356,6 @@ yarn_install(
     yarn_lock = "//examples:yarn.lock",
 )
 
-http_archive(
-    name = "rules_jvm_external",
-    sha256 = "e5b97a31a3e8feed91636f42e19b11c49487b85e5de2f387c999ea14d77c7f45",
-    strip_prefix = "rules_jvm_external-2.9",
-    url = "https://github.com/bazelbuild/rules_jvm_external/archive/2.9.zip",
-)
-
-load("@rules_jvm_external//:defs.bzl", "maven_install")
-
-maven_install(
-    name = "maven",
-    artifacts = [
-        "com.google.errorprone:error_prone_annotations:2.3.2",
-    ],
-    repositories = [
-        "https://jcenter.bintray.com",
-        "https://repo1.maven.org/maven2",
-    ],
-)
-
 # error_prone_annotations required by protobuf 3.7.1
 bind(
     name = "error_prone_annotations",
diff --git a/examples/BUILD b/examples/BUILD
index 5c247d49..18cc3b02 100644
--- a/examples/BUILD
+++ b/examples/BUILD
@@ -29,9 +29,10 @@ jsonnet_library(
     srcs = ["container.libsonnet"],
 )
 
-par_binary(
+py_binary(
     name = "e2e_gc",
     srcs = ["e2e_gc.py"],
     main = "e2e_gc.py",
     python_version = "PY3",
+    srcs_version = "PY3",
 )
diff --git a/examples/hellogrpc/deployment_test.py b/examples/hellogrpc/deployment_test.py
index 427d88c1..6b59e023 100644
--- a/examples/hellogrpc/deployment_test.py
+++ b/examples/hellogrpc/deployment_test.py
@@ -24,7 +24,7 @@ class DeploymentTest(unittest.TestCase):
 
   def test_things_match(self):
     with open(TestData('examples/hellogrpc/deployment.yaml'), 'r') as f:
-      static = yaml.load(f.read())
+      static = yaml.safe_load(f.read())
     with open(TestData('examples/hellogrpc/deployment.json'), 'r') as f:
       generated = json.loads(f.read())
 
diff --git a/examples/hellogrpc/e2e-test.sh b/examples/hellogrpc/e2e-test.sh
index 9212f761..e761dabd 100755
--- a/examples/hellogrpc/e2e-test.sh
+++ b/examples/hellogrpc/e2e-test.sh
@@ -20,7 +20,7 @@ set -o pipefail
 source ./examples/util.sh
 
 validate_args "$@"
-shift 2
+shift 1
 
 fail() {
     echo "FAILURE: $@"
diff --git a/examples/hellogrpc/go/server/main.go b/examples/hellogrpc/go/server/main.go
index 4e316e86..92dad678 100644
--- a/examples/hellogrpc/go/server/main.go
+++ b/examples/hellogrpc/go/server/main.go
@@ -40,7 +40,9 @@ func main() {
 	}
 }
 
-type server struct{}
+type server struct {
+	pb.UnimplementedSimpleServer
+}
 
 func (s *server) Foo(ctx context.Context, req *pb.FooRequest) (*pb.FooReply, error) {
 	return &pb.FooReply{
diff --git a/examples/hellogrpc/java/client/BUILD b/examples/hellogrpc/java/client/BUILD
index cfc71617..0d31450e 100644
--- a/examples/hellogrpc/java/client/BUILD
+++ b/examples/hellogrpc/java/client/BUILD
@@ -22,6 +22,6 @@ java_binary(
     main_class = "io.bazel.rules_k8s.examples.helloworld.java.client.HelloClient",
     deps = [
         "//examples/hellogrpc/proto:simple_java_grpc",
-        "@build_stack_rules_proto//java:grpc_netty",
+        #"@build_stack_rules_proto//java:grpc_netty",
     ],
 )
diff --git a/examples/hellogrpc/java/server/BUILD b/examples/hellogrpc/java/server/BUILD
index f1989ab6..0d5f1b14 100644
--- a/examples/hellogrpc/java/server/BUILD
+++ b/examples/hellogrpc/java/server/BUILD
@@ -25,7 +25,7 @@ java_image(
     main_class = "io.bazel.rules_k8s.examples.helloworld.java.server.HelloServer",
     deps = [
         "//examples/hellogrpc/proto:simple_java_grpc",
-        "@build_stack_rules_proto//java:grpc_netty",
+        #"@build_stack_rules_proto//java:grpc_netty",
     ],
 )
 
diff --git a/examples/hellogrpc/proto/BUILD b/examples/hellogrpc/proto/BUILD
index 06c36fc6..0989b9a9 100644
--- a/examples/hellogrpc/proto/BUILD
+++ b/examples/hellogrpc/proto/BUILD
@@ -12,9 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@build_stack_rules_proto//go:go_grpc_library.bzl", "go_grpc_library")
-load("@build_stack_rules_proto//java:java_grpc_library.bzl", "java_grpc_library")
+load("@rules_proto_grpc//go:go_grpc_library.bzl", "go_grpc_library")
+load("@rules_proto_grpc//java:defs.bzl", "java_grpc_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
 proto_library(
     name = "simple_proto",
@@ -25,18 +26,12 @@ proto_library(
 java_grpc_library(
     name = "simple_java_grpc",
     visibility = ["//examples/hellogrpc/java:__subpackages__"],
-    deps = [":simple_proto"],
+    protos = [":simple_proto"],
 )
 
 go_grpc_library(
     name = "simple_go_grpc",
-    go_deps = [
-        "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
-        "@org_golang_google_protobuf//runtime/protoimpl:go_default_library",
-        "@org_golang_google_grpc//codes:go_default_library",
-        "@org_golang_google_grpc//status:go_default_library",
-    ],
     importpath = "github.com/bazelbuild/rules_k8s/examples/hellogrpc/proto/go",
     visibility = ["//examples/hellogrpc/go:__subpackages__"],
-    deps = [":simple_proto"],
+    protos = [":simple_proto"],
 )
diff --git a/examples/hellogrpc/proto/simple.proto b/examples/hellogrpc/proto/simple.proto
index 4c229423..45871229 100644
--- a/examples/hellogrpc/proto/simple.proto
+++ b/examples/hellogrpc/proto/simple.proto
@@ -4,16 +4,14 @@ option java_multiple_files = true;
 option java_package = "io.bazel.rules_k8s.examples.helloworld.proto";
 option java_outer_classname = "SimpleProto";
 
+option go_package = "github.com/bazelbuild/rules_k8s/examples/hellogrpc/proto/go";
+
 package proto;
 
 service Simple {
-  rpc Foo (FooRequest) returns (FooReply) {}
+  rpc Foo(FooRequest) returns (FooReply) {}
 }
 
-message FooRequest {
-  string name = 1;
-}
+message FooRequest { string name = 1; }
 
-message FooReply {
-  string message = 1;
-}
+message FooReply { string message = 1; }
diff --git a/examples/hellohttp/deployment_test.py b/examples/hellohttp/deployment_test.py
index b8bfe094..7c12c01d 100644
--- a/examples/hellohttp/deployment_test.py
+++ b/examples/hellohttp/deployment_test.py
@@ -24,7 +24,7 @@ class DeploymentTest(unittest.TestCase):
 
   def test_things_match(self):
     with open(TestData('examples/hellohttp/deployment.yaml'), 'r') as f:
-      static = yaml.load(f.read())
+      static = yaml.safe_load(f.read())
     with open(TestData('examples/hellohttp/deployment.json'), 'r') as f:
       generated = json.loads(f.read())
 
diff --git a/examples/hellohttp/e2e-test.sh b/examples/hellohttp/e2e-test.sh
index df2c29fa..8bcfbad5 100755
--- a/examples/hellohttp/e2e-test.sh
+++ b/examples/hellohttp/e2e-test.sh
@@ -20,7 +20,7 @@ set -o pipefail
 source ./examples/util.sh
 
 validate_args $@
-shift 2
+shift 1
 
 fail() {
     echo "FAILURE: $1"
@@ -50,6 +50,7 @@ apply-lb() {
 check_msg() {
     stop-port-forwarding
     port-forward hello-http-staging 8080
+    kubectl "--namespace=${namespace}" get svc
     local ip=localhost
     local output
     local url="http://$ip:8080"
@@ -186,5 +187,6 @@ main() {
     trap stop-port-forwarding EXIT
 }
 
+command -v curl || fail curl not installed
 main "$@"
 echo "hellohttp: PASS"
diff --git a/examples/hellohttp/nodejs/BUILD b/examples/hellohttp/nodejs/BUILD
index 9a3a907d..f2df7cab 100644
--- a/examples/hellohttp/nodejs/BUILD
+++ b/examples/hellohttp/nodejs/BUILD
@@ -21,9 +21,13 @@ licenses(["notice"])  # Apache 2.0
 
 nodejs_image(
     name = "server",
-    data = [":server.js"],
+    data = [
+      ":server.js",
+      "@examples_hellohttp_npm//:node_modules",
+    ],
     entry_point = "@io_bazel_rules_k8s//examples/hellohttp/nodejs:server.js",
-    node_modules = "@examples_hellohttp_npm//:node_modules",
+    node_repository_name = "nodejs_linux_amd64",
+    include_node_repo_args = False,
 )
 
 k8s_deploy(
diff --git a/examples/hellohttp/nodejs/server.js b/examples/hellohttp/nodejs/server.js
index 4b3e7093..b103013c 100644
--- a/examples/hellohttp/nodejs/server.js
+++ b/examples/hellohttp/nodejs/server.js
@@ -14,6 +14,6 @@
 const express = require('express')
 const app = express()
 
-app.get('/', (req, res) => res.send('DEMO '))
+app.get('/', (req, res) => res.send('DEMO18396 '))
 
 app.listen(8080, () => console.log('Example app listening on port 8080!'))
diff --git a/examples/stamping/BUILD b/examples/stamping/BUILD
index 433a90b9..42a802e2 100644
--- a/examples/stamping/BUILD
+++ b/examples/stamping/BUILD
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 load("@io_bazel_rules_k8s//k8s:object.bzl", "k8s_object")
+load("@py_deps//:requirements.bzl", "requirement")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -43,8 +44,8 @@ py_test(
     name = "substitution_test",
     srcs = ["substitution_test.py"],
     data = [":substitution_stamping"],
-    python_version = "PY2",
+    python_version = "PY3",
     deps = [
-        "@com_github_yaml_pyyaml//:yaml",
+        requirement("pyyaml"),
     ],
 )
diff --git a/examples/stamping/go/BUILD b/examples/stamping/go/BUILD
index 78c92229..266cb369 100644
--- a/examples/stamping/go/BUILD
+++ b/examples/stamping/go/BUILD
@@ -20,4 +20,7 @@ go_image(
     name = "go-container",
     srcs = ["main.go"],
     importpath = "github.com/bazelbuild/not-my-project/examples/stamping/go",
+    pure = "on",
+    goarch = "amd64",
+    goos = "linux",
 )
diff --git a/examples/stamping/substitution_test.py b/examples/stamping/substitution_test.py
index 86238c57..4825be0f 100644
--- a/examples/stamping/substitution_test.py
+++ b/examples/stamping/substitution_test.py
@@ -28,7 +28,7 @@ def test_e2e_namespace_substituted(self):
     stamp variable."""
     k8s_obj = TestData('examples/stamping/substitution_stamping')
     out = subprocess.check_output([k8s_obj])
-    generated = yaml.load(out)
+    generated = yaml.safe_load(out)
 
     self.assertRegexpMatches(
         generated['data']['e2e_namespace'],
@@ -39,7 +39,7 @@ def test_key_substituted(self):
     """Tests that the %{key} in the template is substituted with a fixed string."""
     k8s_obj = TestData('examples/stamping/substitution_stamping')
     out = subprocess.check_output([k8s_obj])
-    generated = yaml.load(out)
+    generated = yaml.safe_load(out)
 
     self.assertEqual("bar", generated['data']['foo'])
 
diff --git a/images/gcloud-bazel/Dockerfile b/images/gcloud-bazel/Dockerfile
index 0303f308..b9b57b39 100644
--- a/images/gcloud-bazel/Dockerfile
+++ b/images/gcloud-bazel/Dockerfile
@@ -14,7 +14,7 @@
 
 # Ubuntu with bazel, gcloud and its dependencies preinstalled.
 
-FROM ubuntu:18.04
+FROM ubuntu:20.04
 # Based off github.com/kubernetes/test-infra/images/bazelbuild
 LABEL maintainer="fejta@google.com"
 
@@ -23,8 +23,9 @@ RUN apt update \
     && apt install -y --no-install-recommends \
        gnupg \
        ca-certificates
+# curl -fsSL https://bazel.build/bazel-release.pub.gpg -o bazel.pub.gpg
 COPY bazel.pub.gpg bazel.list /
-RUN gpg -o /etc/apt/trusted.gpg.d/bazel.gpg --dearmor /bazel.pub.gpg \
+RUN gpg -o /usr/share/keyrings/bazel-archive-keyring.gpg --dearmor /bazel.pub.gpg \
     && rm /bazel.pub.gpg \
     && mv /bazel.list /etc/apt/sources.list.d/bazel.list
 
@@ -32,9 +33,9 @@ ARG NEW_VERSION
 ARG OLD_VERSION
 RUN apt update \
     && apt install -y --no-install-recommends \
+       "bazel" \
        "bazel-${NEW_VERSION}" \
        "bazel-${OLD_VERSION}"
-   
 
 # See the following docs:
 # * https://cloud.google.com/sdk/docs/install#deb
@@ -52,10 +53,17 @@ COPY sources.list /etc/apt/sources.list.d/google-cloud-sdk.list
 # * kubectl: needed by rules_k8s
 # * pip setuptools wheel: needed by python rules
 # * python-pip: needed by python rules
+# * git: some WORKSPACE rules
+# * curl: used by e2e tests
+# * patch: used by grpc
 RUN apt update \
     && apt install -y --no-install-recommends \
       google-cloud-sdk \
+      google-cloud-sdk-gke-gcloud-auth-plugin \
       kubectl \
-      python-pip \
+      python3-pip \
+      git \
+      patch \
+      curl \
     && apt-get clean \
     && pip install pip setuptools wheel
diff --git a/images/gcloud-bazel/Makefile b/images/gcloud-bazel/Makefile
index 015433dc..065acec8 100644
--- a/images/gcloud-bazel/Makefile
+++ b/images/gcloud-bazel/Makefile
@@ -15,7 +15,7 @@
 PROJECT ?= rules-k8s
 IMG = gcr.io/$(PROJECT)/gcloud-bazel
 OLD ?= 3.5.0
-NEW ?= 4.1.0
+NEW ?= 5.2.0
 TAG := $(shell date +v%Y%m%d)-$(shell git describe --tags --always --dirty)
 
 build:
diff --git a/images/gcloud-bazel/bazel.list b/images/gcloud-bazel/bazel.list
index 187b569f..b7d89371 100644
--- a/images/gcloud-bazel/bazel.list
+++ b/images/gcloud-bazel/bazel.list
@@ -1 +1 @@
-deb [arch=amd64] https://storage.googleapis.com/bazel-apt stable jdk1.8
+deb [arch=amd64 signed-by=/usr/share/keyrings/bazel-archive-keyring.gpg] https://storage.googleapis.com/bazel-apt stable jdk1.8
diff --git a/images/gcloud-bazel/bazel.pub.gpg b/images/gcloud-bazel/bazel.pub.gpg
index 20a530a2..97c579c6 100644
--- a/images/gcloud-bazel/bazel.pub.gpg
+++ b/images/gcloud-bazel/bazel.pub.gpg
@@ -12,41 +12,65 @@ PnKju1SKl5iwzfDQGpi6u6UAMFmc53EaH05naYDAigCueZ+/2rIaY358bECK6/VR
 kyrBqpeq6VkWUeOkt03VqoPzrw4gEzRvfRtLj+D2j/pZCH3vyMYHzbaaXBv6AT0e
 RmgtGo9I9BYqKSWlGEF0D+CQ3uZfOyovvrbYqNaHynFBtrx/ZkM82gMA5QARAQAB
 tEdCYXplbCBEZXZlbG9wZXIgKEJhemVsIEFQVCByZXBvc2l0b3J5IGtleSkgPGJh
-emVsLWRldkBnb29nbGVncm91cHMuY29tPokCVQQTAQgAPwIbAwYLCQgHAwIGFQgC
-CQoLBBYCAwECHgECF4AWIQRxodDvz+tigf0EN8k9WRm0SEV+4AUCXsoWGgUJC0fh
-4QAKCRA9WRm0SEV+4NDCD/9c5rhZREBlikdi5QYRq1YOkwzJLXFoVe0FonEwMuWK
-fQzT/rIwyh14tssptU5+eXwTEXL0ZDskgzvrFSpzjQZzcSG/gzNCATNfrZpC2nfE
-SxMKOeIwQedn26YIHCI8s9tEQ7BSvfBfJgqfIo3IURhmfzNMj+qszca+3IDYAlAy
-8lxUVbJcIQ0apnAdnIadtydzca56mMN7ma+btddaWLpAdyfUvQ/Zsx3TYYLF7inQ
-km0JpzISN0fGngzGNDGNmtHNhCdSpyfkr+7fvpbKAYkSH7uZ1AIPDyHdLIwDQnX2
-kbLRkxKncKGSDhUSdlJTl0x36cU+xmgO15FFdOyk3BUfrlfDrgXIBjeX8KNh9TV6
-HgFFR/mNONoJ93ZvZQNO2s1gbPZJe3VJ1Q5PMLW1sdl8q8JthBwT/5TJ1k8E5VYj
-jAc8dl+RAALxqj+eo5xI45o1FdV5s1aGDjbwFoCIhGCy2zaog1q5wnhmEptAAD0S
-TVbJSpwNiLlPIcGVaCjXp8Ow3SzOGTRKIjFTO/I6FiSJOpgfri07clXmnb4ETjou
-mUdglg8/8nQ120zHEOqoSzzIbTNUDjNZY8SuY6Ig3/ObQ/JAFS0i6h74KLfXUZzn
-uETY7KURLdyPAhL37Hb9FDhvkJCUO/l6eqDh9jk1JjB7Cvb7hEvnbvDrr2hWNAL7
-RrkCDQRXRJs5ARAA55/1VBlDpV/ElUyLmRyPCz/V+msHdinyw4Mv5DJQupuZwlMy
-vxPPzc7GmsIfk1zuOzDWirNs22r43ak6dsAvpcU+iVBi46MqUcbNtC+kfxlKiToD
-PCs82rdfCgHT7XYDzrCWlqNQ9++BqM2OYRIxyEucizeofWPlrJUgKvu8fWLVZ6bY
-n4L/PqAhobhuSjRcoB5Tp81hGa4cscKIGIqhymfnguaY8viJ83tHPUqQJoApNPy8
-q1pWHSDV6zBv71beqV2b6cBzp7VqNYOIuqE6ZNBFWuCG3zRc9ia2/bHxx2TGAQJt
-PpPzitm0xkB3GGN06YnnSCE+f2j+7F0IO6uFlSy7ho0PoSFbDgR91kJK3S0ZBZx4
-H21cIpWWBzf9Nd1M4H3O7KhnGSZDq6+tXZ9/F/ZUvCZHpQlJewDPY9315Ymacf5C
-Zk8xeE5UUIxFMdOxF8B7Itb6rbFWv+tzWdX/0/M8/b0ZJhVvngWzuh/agdS4E5an
-f7ahGWM96jPRIQEb9DRN2YGp9hOiX2sZqkhxE5zWqD2gdXp2ZAxMCTHf4ijzOVsO
-nde7b5BqC0JL73gNwf1iOHyCAzqGiFfah8/odBTDhMsdVMsjSIxzcwlwRnzy+hBs
-dYpP19ieJCMoERJTbUgSspPdhY/Y4ChzlFHjiAKYT6vXiYcKS04stCtHqwEAEQEA
-AYkCPAQYAQgAJgIbDBYhBHGh0O/P62KB/QQ3yT1ZGbRIRX7gBQJeyhYlBQkLR+Hs
-AAoJED1ZGbRIRX7g3Y8P/iuOAHmyCMeSELvUs9ZvLYJKGzmz67R8fJSmgst/Bs3p
-dWCAjGE56M6UgZzHXK+fBRWFPDOXT64XNq0UIG7tThthwe4Gdvg/5rWG61Pe/vCZ
-2FkMAlEMkuufZYMcw9jItHMKLcYyW/jtN9EzCX+vM6SZlu4o8la5rCIBEaiKfzft
-a/dRMjW+RqQnU31NQCDAy3zoGUCQumJtv3GVbMYHIrRZua2yyNo9Iborh2SVdBbK
-v9WJKH4JcCHd0/XDGdys6EXeATIIRxchumkmxpIg87OhsC0n5yuH1FnFIFQEjbYX
-bb46F7ZFT+8Tov+lgMEw4CZmps4uvvZlKbIH4Zi/ULiobwvm2ad3nejWICmGmHYz
-ro6t08hdcY6GnOzCpDwx9yHechMCkU3KEE98nb/CxcmA4VzDHudTJe7o0OyaSarh
-6D5WcXf7D9FfcKmUD9xaCsfXh66OCksMVGE1JctrO1wQTF2jTdTUq7mmi30tlM+o
-JjVk65OSOd4JYol8auzE4oXOfsNzXbyvj7WzM1v5m7C45jOL+Ly7I3IUzZNfF41J
-AMmSd73EOoR9YH4qTrL3jx69Ekf7ww70Qea5enLE8xUgQfGTOaEHxkFcEovmzv54
-6IVe083iK8alXD/9OUTaDY9NwMnOn1K1aU2XOfliGGLgwwaHg+wVFh5rZIHsDl7v
-=Embu
------END PGP PUBLIC KEY BLOCK-----
+emVsLWRldkBnb29nbGVncm91cHMuY29tPokCPgQTAQIAKAIbAwYLCQgHAwIGFQgC
+CQoLBBYCAwECHgECF4AFAlsGueoFCQeEhaQACgkQPVkZtEhFfuCojRAAqtUaEbK8
+zVAPssZDRPun0k1XB3hXxEoe5kt00cl51F+KLXN2OM5gOn2PcUw4A+Ci+48cgt9b
+hTWwWuC9OPn9OCvYVyuTJXT189Pmg+F9l3zD/vrD5gdFKDLJCUPo/tRBTDQqrRGA
+JssWIzvGR65O2AosoIcj7VAfNj34CBHm25abNpGnWmkiREZzElLFqjTR+FwAMxyA
+VJnPbn+K1zyi9xUZKcL1QzKcHBTPFAdZR6zTII/+03n4wAL/w8+x/A1ocmE7jxCI
+cgq7vaHSpGmigU2+TXckUslIgIC64iqYBpPvFAPNlqXmo9rDfL2Imyyuz1ep7j/b
+JrsOxVKwHO8HfgE2WcvcEmkjQ3kpW+qVflwPKsfKRN6oe1rX5l9MxS/nGPok4BII
+V9Y82K3o8Yu0KUgbHhEsITNizBgeJSIEhbF9YAmMeBie6zRnsOKmOqnx2Y9OAfU7
+QhpUoO9DBVk/c3KkiOSf6RYxjrLmou/tLKdsQaenKTDOH8fQTexnMYxRlp5yU1+9
+eZOdJeRDm078tGB+IRWB3QElIgYiRbCd8VzgDsMJJQbQ2VdQlVaZL84d6Zntk2pL
+a4HDB4nE+UpfoLcT7iM9hqn9b7NHzmHiPVJecNNGjLTvxZ1sW7+0S7oo7lOMrEPp
+k84DXEqg20Cb3D7YKirwR7qi/StTdil3bYKJAk8EEwEIADkCGwMGCwkIBwMCBhUI
+AgkKCwQWAgMBAh4BAheAFiEEcaHQ78/rYoH9BDfJPVkZtEhFfuAFAmKM1bQACgkQ
+PVkZtEhFfuAD5A/7BdC4RiWxifnmfBX46bjMq0YVI5dcc4vPxDXpM4+AhVjjhVcg
+mDWbhS/+OeYLcmw/TPd4h0/BLbwP5p+GyicgTc24XAmVEYFSOKfqwkn198hU3E6n
+27HKQ8fjRnkvEHFd61kUJwU/pBWBNFe+0dKWUp4rJptLBnjb7+VPxFKFK05skhHV
+sBSwKGfUehCuxw3rsMOiwlu4KQSOmpMStC7msPFT3/FiR46znBF4C5GxzAbXdLjw
+BTXM89uwHVpE5HH1MB1jLjUj8Me6MfMvBL+H3Ogw/FqOPjrSVX4fPdt7nsezE3Gg
+Elecsv+4oDfS6mAMxYuUAQyu/0kAcSl1bqmxvx4kJ6YnUD9RiMz3T32XgWKMmJDN
+Q6vfOfyy7OviFjBhbaRWcIfWfTHrDMvrOXs+M+qPfyltb9HVPYt+d8HDcXzVsLsR
+g9hUNUbddpignlo4waIJxAWiM9hl/GDFPOOL/UafSiOM+gI737zG4MWa22BPid5J
+b1Ph3eWQkTWW+oYqaMjKfkFPy4jTwz9IKRXSrFZOzkbdon+iIWvbrXz0aXbzhj8I
+TPrh1WZH0oUbNUAK81D3gGODglBGd5fypzSMJe4+aLaRLjb1M/rubY1JjQrGGhu8
+6XyLmOcoZFNWBfTWlJ9CrOW3E22DnMuvuyl1wBk6kXv8HInoK4gUbJ8KWwO5Ag0E
+V0SbOQEQAOef9VQZQ6VfxJVMi5kcjws/1fprB3Yp8sODL+QyULqbmcJTMr8Tz83O
+xprCH5Nc7jsw1oqzbNtq+N2pOnbAL6XFPolQYuOjKlHGzbQvpH8ZSok6AzwrPNq3
+XwoB0+12A86wlpajUPfvgajNjmESMchLnIs3qH1j5ayVICr7vH1i1Wem2J+C/z6g
+IaG4bko0XKAeU6fNYRmuHLHCiBiKocpn54LmmPL4ifN7Rz1KkCaAKTT8vKtaVh0g
+1eswb+9W3qldm+nAc6e1ajWDiLqhOmTQRVrght80XPYmtv2x8cdkxgECbT6T84rZ
+tMZAdxhjdOmJ50ghPn9o/uxdCDurhZUsu4aND6EhWw4EfdZCSt0tGQWceB9tXCKV
+lgc3/TXdTOB9zuyoZxkmQ6uvrV2ffxf2VLwmR6UJSXsAz2Pd9eWJmnH+QmZPMXhO
+VFCMRTHTsRfAeyLW+q2xVr/rc1nV/9PzPP29GSYVb54Fs7of2oHUuBOWp3+2oRlj
+Peoz0SEBG/Q0TdmBqfYTol9rGapIcROc1qg9oHV6dmQMTAkx3+Io8zlbDp3Xu2+Q
+agtCS+94DcH9Yjh8ggM6hohX2ofP6HQUw4TLHVTLI0iMc3MJcEZ88voQbHWKT9fY
+niQjKBESU21IErKT3YWP2OAoc5RR44gCmE+r14mHCktOLLQrR6sBABEBAAGJAiUE
+GAECAA8CGwwFAlsGuf0FCQeEhcEACgkQPVkZtEhFfuCMcA/9GRtPSda2fW84ZXoc
+9QrXQYl6JqZr+6wCmS029F3PD7OHE3F2aeFe+eZIWOFpQG6IKHLbZ2XbYnzAfSBA
+TpnTjULbDlAk7dFBIWEZMu5aP8DGvdtsGLE+DZjiLoyaCsQisWp4vIOxiXBnymAy
+iFcY570CJPm7/Woo5ACdNYHW67Jdq7KTIpMy9mrTvkJccdLrifksddlKDkrcUSyQ
+6hHHDmtAdNGyD6Wnm/6Yx7lRM1shQyKxYO1RwFmaB1lsG65+5gKc7wXgyOtxyAbW
+KFxsbbaBStvPo0amBuIxnprQe7CEKcc90SIG5Ji4v6yEyfBuG5bR92UDw8rIhLr9
+nBprtUr87nsAU1mxFJoGEFmXekIZp5x3AvZw99OtNx8HGf02i0DKAME0c/PCUIck
+t2epluZs2DDDuIG0eG2FX+MJDGErt6Tktwcoz2d6Qxh0TAZ9Dh9ci7/0FFcyYCyG
+iiQ39Mr8xM1U91df9vwjq6/neisTsTMhkqwzkTD26NzoJz98oauDnB9hNeBKCX7b
+A92/IAZ5tYzeSBstb12d+LfGpTo6Xl6/Pj0xGqMbE8ANfOix53Ugtm4ZODyynS7q
+geZBSCfdoQTrUNxdO2xJuJ5BQVnBMcbYXxVYuaZb+VKioVKOsad7KMCTx5UseA/A
+PEuflVm352z0x6cARlJwO5HhSx2JAjYEGAEIACACGwwWIQRxodDvz+tigf0EN8k9
+WRm0SEV+4AUCYozV3wAKCRA9WRm0SEV+4HOTD/sElzm4kfrMbzxNjnA2WCwn0CdY
+f2cmmAaFPmbuzy02dLDr9DIvyGfW7O8Wami+Oc63c9F09a+3ZjiTZP++Jrc8WrRs
+L87q8H87zugIIglyobIQOzA9YUyV32Hip+nXR4rg7z0uDAIet3ggxnuPv9OXnT8p
+8FdGPIvE2HCKwFwN1FSjv4/Coq1ryvDktkBeiWgqHB3zwDl7soczUqdXoRnqGKSY
+F2Ezj6QhvAMz3d8lW5T281tN50HtHD8rhr2JcdoxYTYb2kaRTbh3rtdrDUIvKvP/
+YYWlMdjGFaqhfL3wA9QD+WVUQTl7ifLAlfj1vS6ll9qdQRwb2tPYN+1BPmXWLNmK
+qRP6ECWXkRinA81saWRLaA4otF5SaB1bLbp2ZrBMqYTDDBB0QjF5UcMFU5Pqxmya
+FP+crpzZq+XgSgFfgCWcJ9PLTjkhzHFMTqnE7BVZdSYcRk2IBXtK7DJwuatH4A8m
+MOV+qxN+ECjlRNNSyRasjuYVNdFVO6UUb9MMgOLsoJMpbCPJUQd9Wx6Q6irjTiUk
+bImrkQjn0HGqTVGi3ASYpne7NE+yWOAw3ZH009UBTk5sPIdD6ZwlbHRNM+3OKWSC
+3uoaOgq4H1d+hVSy7l198Frx5gfKoiTJUjLXgOmwCJUQfJjEspvw2XuFuVNfBzuk
+MZaF+SBEZXd1ZSqB5Q==
+=laPs
+-----END PGP PUBLIC KEY BLOCK-----
\ No newline at end of file
diff --git a/k8s/BUILD b/k8s/BUILD
index 77b57495..c6231ecf 100644
--- a/k8s/BUILD
+++ b/k8s/BUILD
@@ -33,6 +33,7 @@ exports_files([
 par_binary(
     name = "stamper",
     srcs = ["stamper.py"],
+    compiler_args = ["--interpreter=bazel_tools/tools/python/py3wrapper.sh"],
     main = "stamper.py",
     python_version = "PY3",
     srcs_version = "PY3",
@@ -42,6 +43,7 @@ par_binary(
 par_binary(
     name = "reverser",
     srcs = ["reverser.py"],
+    compiler_args = ["--interpreter=bazel_tools/tools/python/py3wrapper.sh"],
     main = "reverser.py",
     python_version = "PY3",
     srcs_version = "PY3",
diff --git a/k8s/k8s.bzl b/k8s/k8s.bzl
index 3e9471ef..6b38d611 100644
--- a/k8s/k8s.bzl
+++ b/k8s/k8s.bzl
@@ -70,10 +70,10 @@ def k8s_repositories():
     maybe(
         http_archive,
         name = "io_bazel_rules_go",
-        sha256 = "52d0a57ea12139d727883c2fef03597970b89f2cc2a05722c42d1d7d41ec065b",
+        sha256 = "685052b498b6ddfe562ca7a97736741d87916fe536623afb7da2824c0211c369",
         urls = [
-            "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.24.13/rules_go-v0.24.13.tar.gz",
-            "https://github.com/bazelbuild/rules_go/releases/download/v0.24.13/rules_go-v0.24.13.tar.gz",
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.33.0/rules_go-v0.33.0.zip",
+            "https://github.com/bazelbuild/rules_go/releases/download/v0.33.0/rules_go-v0.33.0.zip",
         ],
     )
 
@@ -88,11 +88,11 @@ def k8s_repositories():
     )
 
     maybe(
-        http_archive,
-        name = "io_bazel_rules_docker",
-        sha256 = "92779d3445e7bdc79b961030b996cb0c91820ade7ffa7edca69273f404b085d5",
-        strip_prefix = "rules_docker-0.20.0",
-        urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.20.0/rules_docker-v0.20.0.tar.gz"],
+      http_archive,
+      name = "io_bazel_rules_docker",
+      sha256 = "27d53c1d646fc9537a70427ad7b034734d08a9c38924cc6357cc973fed300820",
+      strip_prefix = "rules_docker-0.24.0",
+      urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.24.0/rules_docker-v0.24.0.tar.gz"],
     )
 
     maybe(
diff --git a/k8s/k8s_go_deps.bzl b/k8s/k8s_go_deps.bzl
index d41f73a6..adee9f3d 100644
--- a/k8s/k8s_go_deps.bzl
+++ b/k8s/k8s_go_deps.bzl
@@ -32,7 +32,7 @@ def deps():
        already.
     """
     go_rules_dependencies()
-    go_register_toolchains()
+    go_register_toolchains("1.18.3")
     gazelle_dependencies()
     rules_docker_repositories()
     rules_docker_go_deps()
diff --git a/requirements.txt b/requirements.txt
index 7a997b5e..bee6c144 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-PyYAML==5.3.1
+PyYAML==6.0