diff --git a/Makefile b/Makefile
index 42aaa3425d..7132e520ee 100644
--- a/Makefile
+++ b/Makefile
@@ -64,13 +64,13 @@ GITSHA := $(shell cd ${KOPS_ROOT}; git describe --always)
 # We lock the versions of our controllers also
 # We need to keep in sync with:
 #   upup/models/cloudup/resources/addons/dns-controller/
-DNS_CONTROLLER_TAG=1.21.0-alpha.2
+DNS_CONTROLLER_TAG=1.21.0-alpha.3
 DNS_CONTROLLER_PUSH_TAG=$(shell tools/get_workspace_status.sh | grep STABLE_DNS_CONTROLLER_TAG | awk '{print $$2}')
 #   upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/
-KOPS_CONTROLLER_TAG=1.21.0-alpha.2
+KOPS_CONTROLLER_TAG=1.21.0-alpha.3
 KOPS_CONTROLLER_PUSH_TAG=$(shell tools/get_workspace_status.sh | grep STABLE_KOPS_CONTROLLER_TAG | awk '{print $$2}')
 #   pkg/model/components/kubeapiserver/model.go
-KUBE_APISERVER_HEALTHCHECK_TAG=1.21.0-alpha.2
+KUBE_APISERVER_HEALTHCHECK_TAG=1.21.0-alpha.3
 KUBE_APISERVER_HEALTHCHECK_PUSH_TAG=$(shell tools/get_workspace_status.sh | grep STABLE_KUBE_APISERVER_HEALTHCHECK_TAG | awk '{print $$2}')
 
 
diff --git a/pkg/model/components/kubeapiserver/model.go b/pkg/model/components/kubeapiserver/model.go
index f555a9a6c5..e4a599fa15 100644
--- a/pkg/model/components/kubeapiserver/model.go
+++ b/pkg/model/components/kubeapiserver/model.go
@@ -95,7 +95,7 @@ kind: Pod
 spec:
   containers:
   - name: healthcheck
-    image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.0-alpha.2
+    image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.0-alpha.3
     livenessProbe:
       httpGet:
         # The sidecar serves a healthcheck on the same port,
diff --git a/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml b/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml
index 2e694d9661..e51a207bf7 100644
--- a/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml
+++ b/pkg/model/components/kubeapiserver/tests/minimal/tasks.yaml
@@ -12,7 +12,7 @@ Contents: |
       - --client-key=/secrets/client.key
       command:
       - /kube-apiserver-healthcheck
-      image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.0-alpha.2
+      image: k8s.gcr.io/kops/kube-apiserver-healthcheck:1.21.0-alpha.3
       livenessProbe:
         httpGet:
           host: 127.0.0.1
diff --git a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template
index a30a7237fa..b47c2f989a 100644
--- a/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template
+++ b/upup/models/cloudup/resources/addons/dns-controller.addons.k8s.io/k8s-1.12.yaml.template
@@ -6,7 +6,7 @@ metadata:
   labels:
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
 spec:
   replicas: 1
   strategy:
@@ -19,7 +19,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
@@ -33,7 +33,7 @@ spec:
       serviceAccount: dns-controller
       containers:
       - name: dns-controller
-        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.3
         command:
 {{ range $arg := DnsControllerArgv }}
         - "{{ $arg }}"
diff --git a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template
index e0cf198b76..ea2d019c51 100644
--- a/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template
+++ b/upup/models/cloudup/resources/addons/kops-controller.addons.k8s.io/k8s-1.16.yaml.template
@@ -19,7 +19,7 @@ metadata:
   labels:
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
 spec:
   selector:
     matchLabels:
@@ -31,7 +31,7 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
 {{ if UseKopsControllerForNodeBootstrap }}
       annotations:
         dns.alpha.kubernetes.io/internal: kops-controller.internal.{{ ClusterName }}
@@ -49,7 +49,7 @@ spec:
       serviceAccount: kops-controller
       containers:
       - name: kops-controller
-        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.3
         volumeMounts:
 {{ if .UseHostCertificates }}
         - mountPath: /etc/ssl/certs
diff --git a/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go b/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
index c4e66d9d15..3afa6414e3 100644
--- a/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
+++ b/upup/pkg/fi/cloudup/bootstrapchannelbuilder/bootstrapchannelbuilder.go
@@ -210,7 +210,7 @@ func (b *BootstrapChannelBuilder) buildAddons(c *fi.ModelBuilderContext) (*chann
 
 	{
 		key := "kops-controller.addons.k8s.io"
-		version := "1.21.0-alpha.2"
+		version := "1.21.0-alpha.3"
 
 		{
 			location := key + "/k8s-1.16.yaml"
@@ -230,7 +230,7 @@ func (b *BootstrapChannelBuilder) buildAddons(c *fi.ModelBuilderContext) (*chann
 
 	if featureflag.PublicJWKS.Enabled() {
 		key := "anonymous-issuer-discovery.addons.k8s.io"
-		version := "1.21.0-alpha.2"
+		version := "1.21.0-alpha.3"
 
 		{
 			location := key + "/k8s-1.16.yaml"
@@ -404,7 +404,7 @@ func (b *BootstrapChannelBuilder) buildAddons(c *fi.ModelBuilderContext) (*chann
 	if externalDNS == nil || !externalDNS.Disable {
 		{
 			key := "dns-controller.addons.k8s.io"
-			version := "1.21.0-alpha.2"
+			version := "1.21.0-alpha.3"
 
 			{
 				location := key + "/k8s-1.12.yaml"
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml
index 5445bf97bf..746f20d97f 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc-containerd/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: b7bd785f276ca12c902e09f22ba551fb4e5f0033
+    manifestHash: 0a42bd40e2057fe077b41f0ddf20b1f4ce6a852e
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml
index e3862dd1f8..1efe6e6b57 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/amazonvpc/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: b7bd785f276ca12c902e09f22ba551fb4e5f0033
+    manifestHash: 0a42bd40e2057fe077b41f0ddf20b1f4ce6a852e
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml
index f010bd9d62..f664b2d86c 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awscloudcontroller/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 266f2e3020ea115166cff7c8b181e6af8de803fb
+    manifestHash: d393cb5a91ee4b47c4666d60f0f88a959aaa7b1c
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml
index 00541a2c01..efe36750ec 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/awsiamauthenticator/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 266f2e3020ea115166cff7c8b181e6af8de803fb
+    manifestHash: d393cb5a91ee4b47c4666d60f0f88a959aaa7b1c
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml
index 67c8eaa78b..b2fccc0c32 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/dns-controller.addons.k8s.io-k8s-1.12.yaml
@@ -4,11 +4,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
   name: dns-controller
   namespace: kube-system
 spec:
@@ -25,7 +25,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
     spec:
       containers:
       - command:
@@ -38,7 +38,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.3
         name: dns-controller
         resources:
           requests:
@@ -63,7 +63,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: dns-controller
@@ -77,7 +77,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
@@ -111,7 +111,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml
index 4fa75b9a18..51911e1f52 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/kops-controller.addons.k8s.io-k8s-1.16.yaml
@@ -7,7 +7,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -21,11 +21,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
   name: kops-controller
   namespace: kube-system
 spec:
@@ -37,14 +37,14 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
     spec:
       containers:
       - command:
         - /kops-controller
         - --v=2
         - --conf=/etc/kubernetes/kops-controller/config/config.yaml
-        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.3
         name: kops-controller
         resources:
           requests:
@@ -86,7 +86,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -100,7 +100,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -123,7 +123,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -144,7 +144,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -191,7 +191,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
index 0f5a01cbbf..fc4be54a2f 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: b7bd785f276ca12c902e09f22ba551fb4e5f0033
+    manifestHash: 0a42bd40e2057fe077b41f0ddf20b1f4ce6a852e
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -48,11 +48,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml
index ba577bc471..4b7d691b0f 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/jwks/manifest.yaml
@@ -19,7 +19,7 @@ spec:
     name: anonymous-access.addons.k8s.io
     selector:
       k8s-addon: anonymous-access.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 3ffe9ac576f9eec72e2bdfbd2ea17d56d9b17b90
     name: core.addons.k8s.io
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/anonymous-issuer-discovery.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/anonymous-issuer-discovery.addons.k8s.io-k8s-1.16.yaml
index da3d8b7e44..d2e8dbd926 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/anonymous-issuer-discovery.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/anonymous-issuer-discovery.addons.k8s.io-k8s-1.16.yaml
@@ -4,7 +4,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: anonymous-issuer-discovery.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: anonymous-issuer-discovery.addons.k8s.io
   name: anonymous:service-account-issuer-discovery
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/dns-controller.addons.k8s.io-k8s-1.12.yaml
index 48839457eb..ddf06f861e 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/dns-controller.addons.k8s.io-k8s-1.12.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/dns-controller.addons.k8s.io-k8s-1.12.yaml
@@ -4,11 +4,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
   name: dns-controller
   namespace: kube-system
 spec:
@@ -25,7 +25,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
     spec:
       containers:
       - command:
@@ -42,7 +42,7 @@ spec:
           value: arn:aws-test:iam::123456789012:role/dns-controller.kube-system.sa.minimal.example.com
         - name: AWS_WEB_IDENTITY_TOKEN_FILE
           value: /var/run/secrets/amazonaws.com/token
-        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.3
         name: dns-controller
         resources:
           requests:
@@ -82,7 +82,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: dns-controller
@@ -96,7 +96,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
@@ -130,7 +130,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/kops-controller.addons.k8s.io-k8s-1.16.yaml
index 4fa75b9a18..51911e1f52 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/kops-controller.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/kops-controller.addons.k8s.io-k8s-1.16.yaml
@@ -7,7 +7,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -21,11 +21,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
   name: kops-controller
   namespace: kube-system
 spec:
@@ -37,14 +37,14 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
     spec:
       containers:
       - command:
         - /kops-controller
         - --v=2
         - --conf=/etc/kubernetes/kops-controller/config/config.yaml
-        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.3
         name: kops-controller
         resources:
           requests:
@@ -86,7 +86,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -100,7 +100,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -123,7 +123,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -144,7 +144,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -191,7 +191,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/manifest.yaml
index 8fa50b60f4..d98889f602 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/public-jwks/manifest.yaml
@@ -7,20 +7,20 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: b7bd785f276ca12c902e09f22ba551fb4e5f0033
+    manifestHash: 0a42bd40e2057fe077b41f0ddf20b1f4ce6a852e
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: anonymous-issuer-discovery.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: a6abe688c7fd4938c6aca807e60e7b0c4779d707
+    manifestHash: 931f4b8124b27eb5eed2da682f46484c95d09c50
     name: anonymous-issuer-discovery.addons.k8s.io
     selector:
       k8s-addon: anonymous-issuer-discovery.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -56,11 +56,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 12377bc07a206be6225c4d9f1fa25e3b35e8214f
+    manifestHash: 498237014e0d454dab24f4ad84e61b5db6a711ed
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml
index 67c8eaa78b..b2fccc0c32 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/dns-controller.addons.k8s.io-k8s-1.12.yaml
@@ -4,11 +4,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
     k8s-app: dns-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
   name: dns-controller
   namespace: kube-system
 spec:
@@ -25,7 +25,7 @@ spec:
       labels:
         k8s-addon: dns-controller.addons.k8s.io
         k8s-app: dns-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
     spec:
       containers:
       - command:
@@ -38,7 +38,7 @@ spec:
         env:
         - name: KUBERNETES_SERVICE_HOST
           value: 127.0.0.1
-        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/dns-controller:1.21.0-alpha.3
         name: dns-controller
         resources:
           requests:
@@ -63,7 +63,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: dns-controller
@@ -77,7 +77,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
@@ -111,7 +111,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: dns-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: dns-controller.addons.k8s.io
   name: kops:dns-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml
index 3a033304f8..dddf77f682 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/kops-controller.addons.k8s.io-k8s-1.16.yaml
@@ -7,7 +7,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -21,11 +21,11 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
     k8s-app: kops-controller
-    version: v1.21.0-alpha.2
+    version: v1.21.0-alpha.3
   name: kops-controller
   namespace: kube-system
 spec:
@@ -39,14 +39,14 @@ spec:
       labels:
         k8s-addon: kops-controller.addons.k8s.io
         k8s-app: kops-controller
-        version: v1.21.0-alpha.2
+        version: v1.21.0-alpha.3
     spec:
       containers:
       - command:
         - /kops-controller
         - --v=2
         - --conf=/etc/kubernetes/kops-controller/config/config.yaml
-        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.2
+        image: k8s.gcr.io/kops/kops-controller:1.21.0-alpha.3
         name: kops-controller
         resources:
           requests:
@@ -88,7 +88,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -102,7 +102,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -125,7 +125,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -146,7 +146,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
@@ -193,7 +193,7 @@ metadata:
   creationTimestamp: null
   labels:
     addon.kops.k8s.io/name: kops-controller.addons.k8s.io
-    addon.kops.k8s.io/version: 1.21.0-alpha.2
+    addon.kops.k8s.io/version: 1.21.0-alpha.3
     app.kubernetes.io/managed-by: kops
     k8s-addon: kops-controller.addons.k8s.io
   name: kops-controller
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml
index d10d39760d..54a7744ecc 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 266f2e3020ea115166cff7c8b181e6af8de803fb
+    manifestHash: d393cb5a91ee4b47c4666d60f0f88a959aaa7b1c
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
index 1024f75958..bdfe64dbe1 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
@@ -7,12 +7,12 @@ spec:
   - id: k8s-1.16
     kubernetesVersion: '>=1.16.0-alpha.0'
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 266f2e3020ea115166cff7c8b181e6af8de803fb
+    manifestHash: d393cb5a91ee4b47c4666d60f0f88a959aaa7b1c
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:
       k8s-addon: kops-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - manifest: core.addons.k8s.io/v1.4.0.yaml
     manifestHash: 75dd91a5b15ade4a61ebc1de8c35714376dfbed4
     name: core.addons.k8s.io
@@ -41,11 +41,11 @@ spec:
     version: 1.5.0
   - id: k8s-1.12
     manifest: dns-controller.addons.k8s.io/k8s-1.12.yaml
-    manifestHash: 46c857881d8cdc761b9ce3d8d35c5204017b9fd4
+    manifestHash: d178237538d133182002c9826af8ead1b863b6f6
     name: dns-controller.addons.k8s.io
     selector:
       k8s-addon: dns-controller.addons.k8s.io
-    version: 1.21.0-alpha.2
+    version: 1.21.0-alpha.3
   - id: v1.15.0
     kubernetesVersion: '>=1.15.0'
     manifest: storage-aws.addons.k8s.io/v1.15.0.yaml
diff --git a/upup/pkg/fi/cloudup/urls_test.go b/upup/pkg/fi/cloudup/urls_test.go
index 080344d8b8..44bc5896ae 100644
--- a/upup/pkg/fi/cloudup/urls_test.go
+++ b/upup/pkg/fi/cloudup/urls_test.go
@@ -36,33 +36,33 @@ func Test_BuildMirroredAsset(t *testing.T) {
 		{
 			url: "https://kubeupv2.s3.amazonaws.com/kops/%s/images/protokube-linux-amd64",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.2/images/protokube-linux-amd64",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.2/images-protokube-linux-amd64",
-				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.2/images/protokube-linux-amd64",
+				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.3/images/protokube-linux-amd64",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.3/images-protokube-linux-amd64",
+				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.3/images/protokube-linux-amd64",
 			},
 		},
 		{
 			url: "https://kubeupv2.s3.amazonaws.com/kops/%s/images/protokube-linux-arm64",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.2/images/protokube-linux-arm64",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.2/images-protokube-linux-arm64",
-				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.2/images/protokube-linux-arm64",
+				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.3/images/protokube-linux-arm64",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.3/images-protokube-linux-arm64",
+				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.3/images/protokube-linux-arm64",
 			},
 		},
 		{
 			url: "https://kubeupv2.s3.amazonaws.com/kops/%s/linux/amd64/nodeup",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.2/linux/amd64/nodeup",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.2/nodeup-linux-amd64",
-				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.2/linux/amd64/nodeup",
+				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.3/linux/amd64/nodeup",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.3/nodeup-linux-amd64",
+				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.3/linux/amd64/nodeup",
 			},
 		},
 		{
 			url: "https://kubeupv2.s3.amazonaws.com/kops/%s/linux/arm64/nodeup",
 			expected: []string{
-				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.2/linux/arm64/nodeup",
-				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.2/nodeup-linux-arm64",
-				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.2/linux/arm64/nodeup",
+				"https://artifacts.k8s.io/binaries/kops/1.21.0-alpha.3/linux/arm64/nodeup",
+				"https://github.com/kubernetes/kops/releases/download/v1.21.0-alpha.3/nodeup-linux-arm64",
+				"https://kubeupv2.s3.amazonaws.com/kops/1.21.0-alpha.3/linux/arm64/nodeup",
 			},
 		},
 	}
diff --git a/version.go b/version.go
index 1430a7e473..b81a5ef28d 100644
--- a/version.go
+++ b/version.go
@@ -21,8 +21,8 @@ var Version = KOPS_RELEASE_VERSION
 
 // These constants are parsed by build tooling - be careful about changing the formats
 const (
-	KOPS_RELEASE_VERSION = "1.21.0-alpha.2"
-	KOPS_CI_VERSION      = "1.21.0-alpha.3"
+	KOPS_RELEASE_VERSION = "1.21.0-alpha.3"
+	KOPS_CI_VERSION      = "1.21.0-alpha.4"
 )
 
 // GitVersion should be replaced by the makefile