diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 08b7f0383bff61c4cf541a96bfc8954ecffe0c76..0971e6ba99057701dddbbdc12b44ed72fca6f907 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -96,6 +96,8 @@ before_script:
     # Uncomment when gitlab kargo repo has tags
     #- test "${UPGRADE_TEST}" != "false" && git fetch --all && git checkout $(git describe --tags $(git rev-list --tags --max-count=1))
     - test "${UPGRADE_TEST}" != "false" && git checkout 72ae7638bcc94c66afa8620dfa4ad9a9249327ea
+    # Checkout the CI vars file so it is available
+    - test "${UPGRADE_TEST}" != "false" && git checkout "${CI_BUILD_REF}" tests/files/${CI_JOB_NAME}.yml
 
 
     # Create cluster
diff --git a/ansible.cfg b/ansible.cfg
index 20534b1f252ed596dc956e948c361b0dd67b9c36..181262cc64eca44253b08386152c5dbb8d9ce8ed 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,7 +1,7 @@
 [ssh_connection]
 pipelining=True
-ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100
-#ssh_args = -F ./ssh-bastion.conf -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100
+ansible_ssh_common_args = -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100
+#ansible_ssh_common_args = -F {{ inventory_dir|quote }}/ssh-bastion.conf -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100
 #control_path = ~/.ssh/ansible-%%r@%%h:%%p
 [defaults]
 host_key_checking=False
diff --git a/extra_playbooks/upgrade-only-k8s.yml b/extra_playbooks/upgrade-only-k8s.yml
index c2af6a3019785d64ed1a606b1a813da8136f3b00..90ee84ec948e1bef0ebbb9de957fc49aac4e0a43 100644
--- a/extra_playbooks/upgrade-only-k8s.yml
+++ b/extra_playbooks/upgrade-only-k8s.yml
@@ -3,6 +3,7 @@
 ### * Will not upgrade etcd
 ### * Will not upgrade network plugins
 ### * Will not upgrade Docker
+### * Will not pre-download containers or kubeadm
 ### * Currently does not support Vault deployment.
 ###
 ### In most cases, you probably want to use upgrade-cluster.yml playbook and
diff --git a/roles/download/tasks/download_file.yml b/roles/download/tasks/download_file.yml
index dfbfc348d0192ac32835753602c2aa173b9647e9..e0497962a0616049da2adc72d89e0741ad953772 100644
--- a/roles/download/tasks/download_file.yml
+++ b/roles/download/tasks/download_file.yml
@@ -1,4 +1,10 @@
 ---
+- name: file_download | Downloading...
+  debug:
+    msg:
+      - "URL: {{ download.url }}"
+      - "Dest: {{ download.dest }}"
+
 - name: file_download | Create dest directory
   file:
     path: "{{local_release_dir}}/{{download.dest|dirname}}"
diff --git a/roles/download/tasks/sync_container.yml b/roles/download/tasks/sync_container.yml
index 146706543edb000c7a2fa94135a11689705daba1..2a03b014c4f1cea4ea4bed5f14b8d16b31c67792 100644
--- a/roles/download/tasks/sync_container.yml
+++ b/roles/download/tasks/sync_container.yml
@@ -62,7 +62,7 @@
   synchronize:
     src: "{{ fname }}"
     dest: "{{ fname }}"
-    use_ssh_args: yes
+    use_ssh_args: "{{ has_bastion | default(false) }}"
     mode: pull
   delegate_to: localhost
   delegate_facts: no
@@ -81,7 +81,7 @@
   synchronize:
     src: "{{ fname }}"
     dest: "{{ fname }}"
-    use_ssh_args: yes
+    use_ssh_args: "{{ has_bastion | default(false) }}"
     mode: push
   delegate_to: localhost
   delegate_facts: no
diff --git a/tests/ansible.cfg b/tests/ansible.cfg
index a7d2e0183afa088a2186739800327af1abe7a171..780e1524bb0075ec5c790d0955c770495532a8bf 100644
--- a/tests/ansible.cfg
+++ b/tests/ansible.cfg
@@ -1,6 +1,6 @@
 [ssh_connection]
 pipelining=True
-ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100
+ansible_ssh_common_args = -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100
 [defaults]
 forks = 20
 host_key_checking=False
diff --git a/tests/cloud_playbooks/create-gce.yml b/tests/cloud_playbooks/create-gce.yml
index 088479de88c461a3c607425f91e4525075766fca..fdb20e375011059f631e1d18dd827eb817234af1 100644
--- a/tests/cloud_playbooks/create-gce.yml
+++ b/tests/cloud_playbooks/create-gce.yml
@@ -29,7 +29,8 @@
       gce:
         instance_names: "{{instance_names}}"
         machine_type: "{{ cloud_machine_type }}"
-        image_family: "{{ cloud_image }}"
+        image: "{{ cloud_image | default(omit) }}"
+        image_family: "{{ cloud_image_family | default(omit) }}"
         preemptible: "{{ preemptible }}"
         service_account_email: "{{ gce_service_account_email }}"
         pem_file: "{{ gce_pem_file | default(omit)}}"
diff --git a/tests/files/centos-weave-kubeadm.yml b/tests/files/centos-weave-kubeadm.yml
index de7d064e211f48d0c55c72f51eba95a4189f6abf..b4cd8e17c159b3b44be834b7b844c272640b46a7 100644
--- a/tests/files/centos-weave-kubeadm.yml
+++ b/tests/files/centos-weave-kubeadm.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: centos-7
+cloud_image_family: centos-7
 cloud_machine_type: "n1-standard-1"
 cloud_region: us-central1-b
 mode: ha
@@ -9,7 +9,7 @@ startup_script: ""
 kube_network_plugin: weave
 weave_cpu_limit: "100m"
 weave_cpu_requests: "100m"
-kubeadm_enabled: "true"
+kubeadm_enabled: true
 deploy_netchecker: true
 kubedns_min_replicas: 1
 cloud_provider: gce
diff --git a/tests/files/centos7-calico-ha.yml b/tests/files/centos7-calico-ha.yml
index 32a633ff9e32a0740de20929fa8caf4f9090d9cf..a34ab2dfb4f5b989f01bfa48fa5cb5c67198e83c 100644
--- a/tests/files/centos7-calico-ha.yml
+++ b/tests/files/centos7-calico-ha.yml
@@ -1,12 +1,12 @@
 # Instance settings
-cloud_image: centos-7
+cloud_image_family: centos-7
 cloud_region: europe-west1-b
 mode: ha-scale
 
 # Deployment settings
 kube_network_plugin: calico
-download_localhost: "true"
-download_run_once: "true"
+download_localhost: true
+download_run_once: true
 deploy_netchecker: true
 kubedns_min_replicas: 1
 cloud_provider: gce
diff --git a/tests/files/centos7-flannel-addons.yml b/tests/files/centos7-flannel-addons.yml
index 6022cc48981c29ec7ac9fb6dd7da20002bedb1eb..70da8d13e61a4bae0e065a979c44944814bd6ffa 100644
--- a/tests/files/centos7-flannel-addons.yml
+++ b/tests/files/centos7-flannel-addons.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: centos-7
+cloud_image_family: centos-7
 cloud_region: us-west1-a
 cloud_machine_type: "n1-standard-1"
 mode: default
diff --git a/tests/files/coreos-alpha-weave-ha.yml b/tests/files/coreos-alpha-weave-ha.yml
index df00cd31cd9f7ea2bb2e0301ee8ceefb0ec953d8..d8087c62188f9d97a6f8c60fccf0d27edba41b85 100644
--- a/tests/files/coreos-alpha-weave-ha.yml
+++ b/tests/files/coreos-alpha-weave-ha.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: coreos-alpha
+cloud_image_family: coreos-alpha
 cloud_region: us-west1-a
 mode: ha-scale
 startup_script: 'systemctl disable locksmithd && systemctl stop locksmithd'
diff --git a/tests/files/coreos-calico-aio.yml b/tests/files/coreos-calico-aio.yml
index 030eb74be56278fd8ce4002a1408bcff664de2de..37ff7ac8f77397bd36927076ac87fa8c1d7739bd 100644
--- a/tests/files/coreos-calico-aio.yml
+++ b/tests/files/coreos-calico-aio.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: coreos-stable
+cloud_image_family: coreos-stable
 cloud_region: us-west1-b
 cloud_machine_type: "n1-standard-2"
 mode: aio
diff --git a/tests/files/coreos-canal.yml b/tests/files/coreos-canal.yml
index e5bc5eba001f13964b5f3dcbace802a966e34f4f..afbedc30ca143c86bfbde1c8acde494c41244f53 100644
--- a/tests/files/coreos-canal.yml
+++ b/tests/files/coreos-canal.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: coreos-stable
+cloud_image_family: coreos-stable
 cloud_region: us-east1-b
 mode: default
 startup_script: 'systemctl disable locksmithd && systemctl stop locksmithd'
diff --git a/tests/files/debian8-calico.yml b/tests/files/debian8-calico-upgrade.yml
similarity index 100%
rename from tests/files/debian8-calico.yml
rename to tests/files/debian8-calico-upgrade.yml
diff --git a/tests/files/rhel7-canal-sep.yml b/tests/files/rhel7-canal-sep.yml
index 3742c802505f2a9d9dc48dfd95fde0b1ce079c04..2fc39cbb17d70d0d353d19104b2ffa615f42f557 100644
--- a/tests/files/rhel7-canal-sep.yml
+++ b/tests/files/rhel7-canal-sep.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: rhel-7
+cloud_image_family: rhel-7
 cloud_region: us-east1-b
 mode: separate
 
diff --git a/tests/files/rhel7-weave.yml b/tests/files/rhel7-weave.yml
index 41b2fc98102987119005a61bbc56e5c6a9dd2874..66804df5c820e6c092965b2f103b7f7eb41716c5 100644
--- a/tests/files/rhel7-weave.yml
+++ b/tests/files/rhel7-weave.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: rhel-7
+cloud_image_family: rhel-7
 cloud_region: europe-west1-b
 mode: default
 
diff --git a/tests/files/ubuntu-canal-ha.yml b/tests/files/ubuntu-canal-ha.yml
index c86a5f8b86e2231abdb2c051d096ce02b0246f7c..7900c055bbaa416535eec6abd64a9405739a0203 100644
--- a/tests/files/ubuntu-canal-ha.yml
+++ b/tests/files/ubuntu-canal-ha.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: ubuntu-1604-lts
+cloud_image_family: ubuntu-1604-lts
 cloud_region: europe-west1-b
 mode: ha
 
diff --git a/tests/files/ubuntu-canal-kubeadm.yml b/tests/files/ubuntu-canal-kubeadm.yml
index ede3b9ef5434075f685df4ee63424d8126fa86ec..93574118fdbd39a7f69269c640279f17137353f5 100644
--- a/tests/files/ubuntu-canal-kubeadm.yml
+++ b/tests/files/ubuntu-canal-kubeadm.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image:  ubuntu-1604-lts
+cloud_image_family:  ubuntu-1604-lts
 cloud_machine_type: "n1-standard-1"
 cloud_region: europe-west1-b
 mode: ha
@@ -7,7 +7,7 @@ mode: ha
 # Deployment settings
 bootstrap_os: ubuntu
 kube_network_plugin: canal
-kubeadm_enabled: "true"
+kubeadm_enabled: true
 deploy_netchecker: true
 kubedns_min_replicas: 1
 cloud_provider: gce
diff --git a/tests/files/ubuntu-flannel.yml b/tests/files/ubuntu-flannel-sep.yml
similarity index 85%
rename from tests/files/ubuntu-flannel.yml
rename to tests/files/ubuntu-flannel-sep.yml
index 815d6ff9ce1d6a006bba88f26f9a77279a9e55c9..6292926c8ade0002445a462f34973f69b8a5d43f 100644
--- a/tests/files/ubuntu-flannel.yml
+++ b/tests/files/ubuntu-flannel-sep.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: ubuntu-1604-lts
+cloud_image_family: ubuntu-1604-lts
 cloud_region: europe-west1-b
 mode: separate
 
diff --git a/tests/files/ubuntu-rkt-sep.yml b/tests/files/ubuntu-rkt-sep.yml
index 8cc71534dbd6a99fe97075db0bdcc40715245c69..297ce5be06f7f4ac4d4f9dc365021af6097cebc6 100644
--- a/tests/files/ubuntu-rkt-sep.yml
+++ b/tests/files/ubuntu-rkt-sep.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: ubuntu-1604-lts
+cloud_image_family: ubuntu-1604-lts
 cloud_region: us-central1-b
 mode: separate
 
@@ -8,6 +8,8 @@ bootstrap_os: ubuntu
 kube_network_plugin: flannel
 etcd_deployment: rkt
 kubelet_deployment: rkt
+download_localhost: true
+download_run_once: true
 deploy_netchecker: true
 kubedns_min_replicas: 1
 cloud_provider: gce
diff --git a/tests/files/ubuntu-vault-sep.yml b/tests/files/ubuntu-vault-sep.yml
index 58a519c9a752f53b71a3520f39db893476558df8..2e4926f2125cf35d6dcb433c239f9cc833ce4c87 100644
--- a/tests/files/ubuntu-vault-sep.yml
+++ b/tests/files/ubuntu-vault-sep.yml
@@ -1,6 +1,6 @@
 # Instance settings
 cloud_machine_type: "n1-standard-1"
-cloud_image: ubuntu-1604-lts
+cloud_image_family: ubuntu-1604-lts
 cloud_region: us-central1-b
 mode: separate
 
diff --git a/tests/files/ubuntu-weave-sep.yml b/tests/files/ubuntu-weave-sep.yml
index 34a39af3c326abb7a4bbc4ab7fc332ba4b74e0dd..9ab13c278549a8e62e1794ce20f6fbc742ee59e3 100644
--- a/tests/files/ubuntu-weave-sep.yml
+++ b/tests/files/ubuntu-weave-sep.yml
@@ -1,5 +1,5 @@
 # Instance settings
-cloud_image: ubuntu-1604-lts
+cloud_image_family: ubuntu-1604-lts
 cloud_region: us-central1-b
 mode: separate
 
diff --git a/upgrade-cluster.yml b/upgrade-cluster.yml
index a377a625a49404b0566d4d540e8312674ed1d14b..747ed6023e09cc09b4b405bfd2f33d41e19148df 100644
--- a/upgrade-cluster.yml
+++ b/upgrade-cluster.yml
@@ -32,6 +32,7 @@
     - role: rkt
       tags: rkt
       when: "'rkt' in [etcd_deployment_type, kubelet_deployment_type, vault_deployment_type]"
+    - { role: download, tags: download, skip_downloads: false }
 
 - hosts: etcd:k8s-cluster:vault
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"