diff --git a/charts/kube-master/templates/controller-manager.yaml b/charts/kube-master/templates/controller-manager.yaml
index 68083e77c3..61af64c1e9 100644
--- a/charts/kube-master/templates/controller-manager.yaml
+++ b/charts/kube-master/templates/controller-manager.yaml
@@ -147,7 +147,7 @@ spec:
             - --use-service-account-credentials
             - --pv-recycler-pod-template-filepath-hostpath=/etc/kubernetes/config/pv-recycler-template
             - --pv-recycler-pod-template-filepath-nfs=/etc/kubernetes/config/pv-recycler-template
-{{- if .Values.controllerManager.endpointUpdatePeriod }}
+{{- if and (.Values.controllerManager.endpointUpdatePeriod) (semverCompare "> 1.15-0" .Values.version.kubernetes) }}
             - --endpoint-updates-batch-period={{ .Values.controllerManager.endpointUpdatePeriod }}
 {{- end }}
           livenessProbe:
diff --git a/pkg/templates/ignition.go b/pkg/templates/ignition.go
index e05e81f67d..3feefdea2f 100644
--- a/pkg/templates/ignition.go
+++ b/pkg/templates/ignition.go
@@ -26,7 +26,7 @@ var Ignition = &ignition{}
 
 var passwordHashRounds = 1000000
 
-const TEMPLATE_VERSION = "6"
+const TEMPLATE_VERSION = "7"
 
 func (i *ignition) getIgnitionTemplate(kluster *kubernikusv1.Kluster) (string, error) {
 	switch {
@@ -238,7 +238,7 @@ func (i *ignition) GenerateNode(kluster *kubernikusv1.Kluster, pool *models.Node
 	)
 
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't translate ignition file: %v", report.String())
+		return nil, fmt.Errorf("Couldn't translate ignition file: %v\n%w", report.String(), err)
 	}
 
 	return dataOut, nil
diff --git a/pkg/templates/ignition_test.go b/pkg/templates/ignition_test.go
index 6af79478cd..1c4a0724bf 100644
--- a/pkg/templates/ignition_test.go
+++ b/pkg/templates/ignition_test.go
@@ -70,6 +70,11 @@ func init() {
 
 	imageRegistry = version.ImageRegistry{
 		Versions: map[string]version.KlusterVersion{
+			"1.30": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.30"}},
+			"1.29": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.29"}},
+			"1.28": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.28"}},
+			"1.27": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.27"}},
+			"1.26": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.26"}},
 			"1.24": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.24"}},
 			"1.21": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.21"}},
 			"1.20": {Kubelet: version.ImageVersion{Repository: "nase", Tag: "v1.20"}},
@@ -85,7 +90,6 @@ func init() {
 			"1.10": {Hyperkube: version.ImageVersion{Repository: "nase", Tag: "v1.10"}},
 		},
 	}
-
 }
 
 func TestGenerateNode(t *testing.T) {
@@ -97,28 +101,24 @@ func TestGenerateNode(t *testing.T) {
 	for version := range imageRegistry.Versions {
 		kluster.Spec.Version = version
 		data, err := Ignition.GenerateNode(kluster, nil, "test", "abc123", &testKlusterSecret, false, imageRegistry, log.NewNopLogger())
-
 		if assert.NoError(t, err, "Failed to generate node for version %s", version) {
 			//Ensure we rendered the expected template
 			assert.Contains(t, string(data), fmt.Sprintf("v%s", version))
-
-			if version != "1.10" { //skip for 1.10 which exceeds the limit as its super depreacted
-				userData := base64.StdEncoding.EncodeToString(data)
-				assert.LessOrEqualf(t, len(userData), 65535, "userdata exceeds openstack limit for api version %s template", version)
-			}
+			userData := base64.StdEncoding.EncodeToString(data)
+			assert.LessOrEqualf(t, len(userData), 65535, "userdata exceeds openstack limit for api version %s template", version)
 		}
 	}
 }
 
 func TestNodeLabels(t *testing.T) {
 	kluster := testKluster.DeepCopy()
-	kluster.Spec.Version = "1.21"
+	kluster.Spec.Version = "1.30"
 
 	pool := &models.NodePool{Name: "some-name"}
 
 	data, err := Ignition.GenerateNode(kluster, pool, "test", "abc123", &testKlusterSecret, false, imageRegistry, log.NewNopLogger())
 	if assert.NoError(t, err, "Failed to generate node") {
 		//Ensure we rendered the expected template
-		assert.Contains(t, string(data), fmt.Sprintf("--node-labels=ccloud.sap.com/nodepool=%s", pool.Name))
+		assert.Contains(t, string(data), fmt.Sprintf("--node-labels=kubernikus.cloud.sap/cni=true,ccloud.sap.com/nodepool=%s", pool.Name))
 	}
 }
diff --git a/pkg/templates/node_1.10.go b/pkg/templates/node_1.10.go
index 41d00b97e7..cd11ea8634 100644
--- a/pkg/templates/node_1.10.go
+++ b/pkg/templates/node_1.10.go
@@ -6,6 +6,9 @@ var Node_1_10 = `
 variant: flatcar
 version: 1.0.0
 kernel_arguments:
+  should_exist:
+    - systemd.unified_cgroup_hierarchy=0
+    - systemd.legacy_systemd_cgroup_controller
   should_not_exist:
     - flatcar.autologin
 passwd:
@@ -22,18 +25,6 @@ passwd:
       system: true
 systemd:
   units:
-    - name: legacy-cgroup-reboot.service
-      enabled: true
-      contents: |
-        [Unit]
-        Description=Reboot if legacy cgroups are not enabled yet
-        FailureAction=reboot
-        After=extend-filesystems.service
-        [Service]
-        Type=simple
-        ExecStart=/usr/bin/grep 'systemd.unified_cgroup_hierarchy=0' /proc/cmdline
-        [Install]
-        WantedBy=multi-user.target
     - name: iptables-restore.service
       enabled: true
     - name: ccloud-metadata-hostname.service
@@ -299,20 +290,7 @@ systemd:
         [Install]
         WantedBy=multi-user.target
 storage:
-  filesystems:
-    - name: "OEM"
-      mount:
-        device: "/dev/disk/by-label/OEM"
-        format: "btrfs"
   files:
-    - filesystem: "OEM"
-      path: "/grub.cfg"
-      mode: 0644
-      overwrite: true
-      append: true
-      contents:
-        inline: |
-          set linux_append="$linux_append systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller"
     - path: /etc/systemd/resolved.conf
       filesystem: root
       mode: 0644
@@ -684,35 +662,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.11.go b/pkg/templates/node_1.11.go
index 5ca1f28c3f..522b2256b9 100644
--- a/pkg/templates/node_1.11.go
+++ b/pkg/templates/node_1.11.go
@@ -6,6 +6,9 @@ var Node_1_11 = `
 variant: flatcar
 version: 1.0.0
 kernel_arguments:
+  should_exist:
+    - systemd.unified_cgroup_hierarchy=0
+    - systemd.legacy_systemd_cgroup_controller
   should_not_exist:
     - flatcar.autologin
 passwd:
@@ -22,18 +25,6 @@ passwd:
       system: true
 systemd:
   units:
-    - name: legacy-cgroup-reboot.service
-      enabled: true
-      contents: |
-        [Unit]
-        Description=Reboot if legacy cgroups are not enabled yet
-        FailureAction=reboot
-        After=extend-filesystems.service
-        [Service]
-        Type=simple
-        ExecStart=/usr/bin/grep 'systemd.unified_cgroup_hierarchy=0' /proc/cmdline
-        [Install]
-        WantedBy=multi-user.target
     - name: iptables-restore.service
       enabled: true
     - name: ccloud-metadata-hostname.service
@@ -285,20 +276,7 @@ systemd:
         WantedBy=multi-user.target
 
 storage:
-  filesystems:
-    - name: "OEM"
-      mount:
-        device: "/dev/disk/by-label/OEM"
-        format: "btrfs"
   files:
-    - filesystem: "OEM"
-      path: "/grub.cfg"
-      mode: 0644
-      overwrite: true
-      append: true
-      contents:
-        inline: |
-          set linux_append="$linux_append systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller"
     - path: /etc/systemd/resolved.conf
       filesystem: root
       mode: 0644
@@ -637,35 +615,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.12.go b/pkg/templates/node_1.12.go
index e4b6103b8e..1f4438da0b 100644
--- a/pkg/templates/node_1.12.go
+++ b/pkg/templates/node_1.12.go
@@ -6,6 +6,9 @@ var Node_1_12 = `
 variant: flatcar
 version: 1.0.0
 kernel_arguments:
+  should_exist:
+    - systemd.unified_cgroup_hierarchy=0
+    - systemd.legacy_systemd_cgroup_controller
   should_not_exist:
     - flatcar.autologin
 passwd:
@@ -22,18 +25,6 @@ passwd:
       system: true
 systemd:
   units:
-    - name: legacy-cgroup-reboot.service
-      enabled: true
-      contents: |
-        [Unit]
-        Description=Reboot if legacy cgroups are not enabled yet
-        FailureAction=reboot
-        After=extend-filesystems.service
-        [Service]
-        Type=simple
-        ExecStart=/usr/bin/grep 'systemd.unified_cgroup_hierarchy=0' /proc/cmdline
-        [Install]
-        WantedBy=multi-user.target
     - name: iptables-restore.service
       enabled: true
     - name: ccloud-metadata-hostname.service
@@ -283,20 +274,7 @@ systemd:
         [Install]
         WantedBy=multi-user.target
 storage:
-  filesystems:
-    - name: "OEM"
-      mount:
-        device: "/dev/disk/by-label/OEM"
-        format: "btrfs"
   files:
-    - filesystem: "OEM"
-      path: "/grub.cfg"
-      mode: 0644
-      overwrite: true
-      append: true
-      contents:
-        inline: |
-          set linux_append="$linux_append systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller"
     - path: /etc/systemd/resolved.conf
       filesystem: root
       mode: 0644
@@ -635,35 +613,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.14.go b/pkg/templates/node_1.14.go
index c79fc465ee..185454eef3 100644
--- a/pkg/templates/node_1.14.go
+++ b/pkg/templates/node_1.14.go
@@ -6,6 +6,9 @@ var Node_1_14 = `
 variant: flatcar
 version: 1.0.0
 kernel_arguments:
+  should_exist:
+    - systemd.unified_cgroup_hierarchy=0
+    - systemd.legacy_systemd_cgroup_controller
   should_not_exist:
     - flatcar.autologin
 passwd:
@@ -22,18 +25,6 @@ passwd:
       system: true
 systemd:
   units:
-    - name: legacy-cgroup-reboot.service
-      enabled: true
-      contents: |
-        [Unit]
-        Description=Reboot if legacy cgroups are not enabled yet
-        FailureAction=reboot
-        After=extend-filesystems.service
-        [Service]
-        Type=simple
-        ExecStart=/usr/bin/grep 'systemd.unified_cgroup_hierarchy=0' /proc/cmdline
-        [Install]
-        WantedBy=multi-user.target
     - name: iptables-restore.service
       enabled: true
     - name: ccloud-metadata-hostname.service
@@ -285,20 +276,7 @@ systemd:
         [Install]
         WantedBy=multi-user.target
 storage:
-  filesystems:
-    - name: "OEM"
-      mount:
-        device: "/dev/disk/by-label/OEM"
-        format: "btrfs"
   files:
-    - filesystem: "OEM"
-      path: "/grub.cfg"
-      mode: 0644
-      overwrite: true
-      append: true
-      contents:
-        inline: |
-          set linux_append="$linux_append systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller"
     - path: /etc/systemd/resolved.conf
       filesystem: root
       mode: 0644
@@ -639,35 +617,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.17.go b/pkg/templates/node_1.17.go
index 449b01caea..2f311327e9 100644
--- a/pkg/templates/node_1.17.go
+++ b/pkg/templates/node_1.17.go
@@ -6,6 +6,9 @@ var Node_1_17 = `
 variant: flatcar
 version: 1.0.0
 kernel_arguments:
+  should_exist:
+    - systemd.unified_cgroup_hierarchy=0
+    - systemd.legacy_systemd_cgroup_controller
   should_not_exist:
     - flatcar.autologin
 passwd:
@@ -22,18 +25,6 @@ passwd:
       system: true
 systemd:
   units:
-    - name: legacy-cgroup-reboot.service
-      enabled: true
-      contents: |
-        [Unit]
-        Description=Reboot if legacy cgroups are not enabled yet
-        FailureAction=reboot
-        After=extend-filesystems.service
-        [Service]
-        Type=simple
-        ExecStart=/usr/bin/grep 'systemd.unified_cgroup_hierarchy=0' /proc/cmdline
-        [Install]
-        WantedBy=multi-user.target
     - name: iptables-restore.service
       enabled: true
     - name: ccloud-metadata-hostname.service
@@ -264,6 +255,7 @@ systemd:
         [Install]
         WantedBy=multi-user.target
     - name: rkt-gc.service
+      enabled: true
       contents: |
         [Unit]
         Description=Garbage Collection for rkt
@@ -286,20 +278,7 @@ systemd:
         [Install]
         WantedBy=multi-user.target
 storage:
-  filesystems:
-    - name: "OEM"
-      mount:
-        device: "/dev/disk/by-label/OEM"
-        format: "btrfs"
   files:
-    - filesystem: "OEM"
-      path: "/grub.cfg"
-      mode: 0644
-      overwrite: true
-      append: true
-      contents:
-        inline: |
-          set linux_append="$linux_append systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller"
     - path: /etc/systemd/resolved.conf
       filesystem: root
       mode: 0644
@@ -640,35 +619,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.19.go b/pkg/templates/node_1.19.go
index a4331060a1..491230e2bc 100644
--- a/pkg/templates/node_1.19.go
+++ b/pkg/templates/node_1.19.go
@@ -622,35 +622,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.20.go b/pkg/templates/node_1.20.go
index 2831384e26..82d6c86480 100644
--- a/pkg/templates/node_1.20.go
+++ b/pkg/templates/node_1.20.go
@@ -626,35 +626,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
diff --git a/pkg/templates/node_1.21.go b/pkg/templates/node_1.21.go
index 7288caff1c..5e5a1e8cb6 100644
--- a/pkg/templates/node_1.21.go
+++ b/pkg/templates/node_1.21.go
@@ -613,35 +613,26 @@ storage:
       mode: 0755
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
-          compression: gzip
-          verification:
-            hash:
-              function: sha512
-              sum: 259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/rkt-v1.30.0.gz
+        compression: gzip
+        verification:
+          hash: sha512-259fd4d1e1d33715c03ec1168af42962962cf70abc5ae9976cf439949f3bcdaf97110455fcf40c415a2adece28f6a52b46f8abd180cad1ee2e802d41a590b35f
     - path: /opt/rkt/stage1-fly.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: 624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-fly-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-624bcf48b6829d2ac05c5744996d0fbbe2a0757bf2e5ad859f962a7001bb81980b0aa7be8532f3ec1ef7bbf025bbd089f5aa2eee9fdadefed1602343624750f1
     - path: /opt/rkt/stage1-coreos.aci
       filesystem: root
       mode: 0644
       overwrite: true
       contents:
-        remote:
-          url: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
-          verification:
-            hash:
-              function: sha512
-              sum: b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
+        source: https://repo.{{.OpenstackRegion}}.cloud.sap/controlplane/flatcar-rkt/stage1-coreos-rkt-v1.30.0.aci
+        verification:
+          hash: sha512-b295e35daab8ca312aeb516a59e79781fd8661d585ecd6c2714bbdec9738ee9012114a2ec886b19cb6eb2e212d72da6f902f02ca889394ef23dbd81fbf147f8c
     - path: /etc/rkt/paths.d/stage1.json
       filesystem: root
       mode: 0644
@@ -817,6 +808,7 @@ storage:
     - path: /etc/sysctl.d/30-br_netfilter.conf
       filesystem: root
       mode: 0644
+      overwrite: true
       contents:
         inline: |
           net.bridge.bridge-nf-call-ip6tables = 1