diff --git a/roles/build-images/defaults/main.yml b/roles/build-images/defaults/main.yml
index 920b35bab..6c0596b56 100644
--- a/roles/build-images/defaults/main.yml
+++ b/roles/build-images/defaults/main.yml
@@ -13,8 +13,8 @@
 ---
 version:
   kubernetes: v1.18.9
-  helm: v2.13.0
-  cni: v0.6.0
+  helm: v2.16.9
+  cni: v0.8.5
 
 proxy:
   http: null
diff --git a/roles/deploy-docker/tasks/deploy-ansible-docker-support.yaml b/roles/deploy-docker/tasks/deploy-ansible-docker-support.yaml
index dcb8c1868..ebbd24433 100644
--- a/roles/deploy-docker/tasks/deploy-ansible-docker-support.yaml
+++ b/roles/deploy-docker/tasks/deploy-ansible-docker-support.yaml
@@ -43,6 +43,22 @@
             - python-urllib3
             - python-requests
 
+- name: install additional packages
+  include_role:
+    name: deploy-package
+    tasks_from: dist
+  vars:
+    state: present
+    packages:
+      deb:
+        - conntrack
+        - bc
+        - nmap
+      rpm:
+        - conntrack-tools
+        - bc
+        - nmap
+
 - name: Ensure docker python packages deployed
   include_role:
     name: deploy-package
diff --git a/roles/deploy-docker/tasks/main.yaml b/roles/deploy-docker/tasks/main.yaml
index 453ef916d..d0ad154d2 100644
--- a/roles/deploy-docker/tasks/main.yaml
+++ b/roles/deploy-docker/tasks/main.yaml
@@ -11,6 +11,13 @@
 # limitations under the License.
 
 ---
+- name: setting default limit memlock
+  shell: |
+    set -xe;
+    echo "DefaultLimitMEMLOCK=16777216" | sudo tee -a /etc/systemd/system.conf
+    sudo systemctl daemon-reexec
+    sudo systemctl daemon-reload
+
 - name: check if docker deploy is needed
   raw: which docker
   register: need_docker
diff --git a/roles/deploy-kubeadm-aio-node/tasks/util-generate-join-command.yaml b/roles/deploy-kubeadm-aio-node/tasks/util-generate-join-command.yaml
index 0671a2ec0..a99b909e3 100644
--- a/roles/deploy-kubeadm-aio-node/tasks/util-generate-join-command.yaml
+++ b/roles/deploy-kubeadm-aio-node/tasks/util-generate-join-command.yaml
@@ -39,7 +39,7 @@
       become_user: root
       register: kubeadm_aio_action_logs
     - name: storing cluster join command
-      set_fact: kubeadm_cluster_join_command="{{ kubeadm_aio_action_logs.stdout }}"
+      set_fact: kubeadm_cluster_join_command="{{ kubeadm_aio_action_logs.stdout | regex_search('kubeadm join.*') }}"
   rescue:
     - name: "dumping logs for {{ kubeadm_aio_action }} action"
       debug:
diff --git a/tools/images/kubeadm-aio/Dockerfile b/tools/images/kubeadm-aio/Dockerfile
index efc3b6b29..7728d102a 100644
--- a/tools/images/kubeadm-aio/Dockerfile
+++ b/tools/images/kubeadm-aio/Dockerfile
@@ -38,7 +38,7 @@ ENV GOOGLE_HELM_REPO_URL ${GOOGLE_HELM_REPO_URL}
 ARG KUBE_VERSION="v1.18.9"
 ENV KUBE_VERSION ${KUBE_VERSION}
 
-ARG CNI_VERSION="v0.6.0"
+ARG CNI_VERSION="v0.8.5"
 ENV CNI_VERSION ${CNI_VERSION}
 
 ARG CNI_REPO_URL=https://github.com/containernetworking/plugins/releases/download/$CNI_VERSION
@@ -97,7 +97,7 @@ RUN set -ex ;\
       ${GOOGLE_KUBERNETES_REPO_URL}/kubelet ;\
     chmod +x /opt/assets/usr/bin/kubelet ;\
     mkdir -p /opt/assets${CNI_BIN_DIR} ;\
-    curl -sSL ${CNI_REPO_URL}/cni-plugins-amd64-$CNI_VERSION.tgz | \
+    curl -sSL ${CNI_REPO_URL}/cni-plugins-linux-amd64-$CNI_VERSION.tgz | \
       tar -zxv --strip-components=1 -C /opt/assets${CNI_BIN_DIR} ;\
     TMP_DIR=$(mktemp -d) ;\
     curl -sSL ${GOOGLE_HELM_REPO_URL}/helm-${HELM_VERSION}-linux-amd64.tar.gz | tar -zxv --strip-components=1 -C ${TMP_DIR} ;\
diff --git a/tools/images/kubeadm-aio/assets/opt/playbooks/roles/deploy-kubelet/tasks/kubelet.yaml b/tools/images/kubeadm-aio/assets/opt/playbooks/roles/deploy-kubelet/tasks/kubelet.yaml
index baa1e6cbe..7ea9ccf01 100644
--- a/tools/images/kubeadm-aio/assets/opt/playbooks/roles/deploy-kubelet/tasks/kubelet.yaml
+++ b/tools/images/kubeadm-aio/assets/opt/playbooks/roles/deploy-kubelet/tasks/kubelet.yaml
@@ -141,7 +141,8 @@
         - portmap
         - tuning
         - vlan
-        - sample
+        # NOTE(aostapenko) absent with v0.8.5 cni
+        # - sample
         - dhcp
         - ipvlan
         - macvlan