diff --git a/ansible/roles/assets/tasks/containerimages.yml b/ansible/roles/assets/tasks/containerimages.yml
index 8a841aa..f0c1b75 100644
--- a/ansible/roles/assets/tasks/containerimages.yml
+++ b/ansible/roles/assets/tasks/containerimages.yml
@@ -1,6 +1,14 @@
 - name: Parse manifests for container images
   ansible.builtin.shell:
-    cmd: cat {{ item.dest }} | yq --no-doc eval '.. | .image? | select(.)' | awk '!/ /' | sort -u
+    # This set of commands is necessary to deal with multi-line scalar values
+    # eg.:
+    #      key: |
+    #        multi-line
+    #        value
+    cmd: >-
+      cat {{ item.dest }} | yq --no-doc eval '.. | .image? | select(.)' | awk '!/ /';
+      cat {{ item.dest }} | yq eval '.data.data' | yq --no-doc eval '.. | .image? | select(.)';
+      cat {{ item.dest }} | yq --no-doc eval '.. | .files? | with_entries(select(.value.path == "*.yaml")).[0].content' | awk '!/null/' | yq eval '.. | .image? | select(.)'
   register: parsedmanifests
   loop: "{{ clusterapi_manifests.results }}"
   loop_control:
diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/.note b/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/.note
index 6a186b2..b8bc971 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/.note
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/.note
@@ -1,53 +1,23 @@
     files:
     - [...]
-    - content: |
-        #!/bin/bash
-        vmtoolsd --cmd 'info-get guestinfo.ovfEnv' > /tmp/ovfenv
-
-        IPAddress=$(sed -n 's/.*Property oe:key="guestinfo.interface.0.ip.0.address" oe:value="\([^"]*\).*/\1/p' /tmp/ovfenv)
-        SubnetMask=$(sed -n 's/.*Property oe:key="guestinfo.interface.0.ip.0.netmask" oe:value="\([^"]*\).*/\1/p' /tmp/ovfenv)
-        Gateway=$(sed -n 's/.*Property oe:key="guestinfo.interface.0.route.0.gateway" oe:value="\([^"]*\).*/\1/p' /tmp/ovfenv)
-        DNS=$(sed -n 's/.*Property oe:key="guestinfo.dns.servers" oe:value="\([^"]*\).*/\1/p' /tmp/ovfenv)
-        MACAddress=$(sed -n 's/.*ve:Adapter ve:mac="\([^"]*\).*/\1/p' /tmp/ovfenv)
-
-        mask2cidr() {
-          c=0
-          x=0$( printf '%o' $${1//./ } )
-
-          while [ $x -gt 0 ]; do
-            let c+=$((x%2)) 'x>>=1'
-          done
-
-          echo $c
-        }
-
-        Prefix=$(mask2cidr $SubnetMask)
-
-        cat > /etc/netplan/01-netcfg.yaml <<EOF
-        network:
-          version: 2
-          renderer: networkd
-          ethernets:
-            id0:
-              set-name: eth0
-              match:
-                macaddress: $MACAddress
-              addresses:
-                - $IPAddress/$Prefix
-              gateway4: $Gateway
-              nameservers:
-                addresses : [$DNS]
-        EOF
-        rm /etc/netplan/50*.yaml
-
-        sudo netplan apply
+    - encoding: base64
+      content: |
+        IyEvYmluL2Jhc2gKdm10b29sc2QgLS1jbWQgJ2luZm8tZ2V0IGd1ZXN0aW5mby5vdmZFbnYnID4gL3RtcC9vdmZlbnYKCklQQWRkcmVzcz0kKHNlZCAtbiAncy8uKlByb3BlcnR5IG9lOmtleT0iZ3Vlc3RpbmZvLmludGVyZmFjZS4wLmlwLjAuYWRkcmVzcyIgb2U6dmFsdWU9IlwoW14iXSpcKS4qL1wxL3AnIC90bXAvb3ZmZW52KQpTdWJuZXRNYXNrPSQoc2VkIC1uICdzLy4qUHJvcGVydHkgb2U6a2V5PSJndWVzdGluZm8uaW50ZXJmYWNlLjAuaXAuMC5uZXRtYXNrIiBvZTp2YWx1ZT0iXChbXiJdKlwpLiovXDEvcCcgL3RtcC9vdmZlbnYpCkdhdGV3YXk9JChzZWQgLW4gJ3MvLipQcm9wZXJ0eSBvZTprZXk9Imd1ZXN0aW5mby5pbnRlcmZhY2UuMC5yb3V0ZS4wLmdhdGV3YXkiIG9lOnZhbHVlPSJcKFteIl0qXCkuKi9cMS9wJyAvdG1wL292ZmVudikKRE5TPSQoc2VkIC1uICdzLy4qUHJvcGVydHkgb2U6a2V5PSJndWVzdGluZm8uZG5zLnNlcnZlcnMiIG9lOnZhbHVlPSJcKFteIl0qXCkuKi9cMS9wJyAvdG1wL292ZmVudikKTUFDQWRkcmVzcz0kKHNlZCAtbiAncy8uKnZlOkFkYXB0ZXIgdmU6bWFjPSJcKFteIl0qXCkuKi9cMS9wJyAvdG1wL292ZmVudikKCm1hc2syY2lkcigpIHsKICBjPTAKICB4PTAkKCBwcmludGYgJyVvJyAkezEvLy4vIH0gKQoKICB3aGlsZSBbICR4IC1ndCAwIF07IGRvCiAgICBsZXQgYys9JCgoeCUyKSkgJ3g+Pj0xJwogIGRvbmUKCiAgZWNobyAkYwp9CgpQcmVmaXg9JChtYXNrMmNpZHIgJFN1Ym5ldE1hc2spCgpjYXQgPiAvZXRjL25ldHBsYW4vMDEtbmV0Y2ZnLnlhbWwgPDxFT0YKbmV0d29yazoKICB2ZXJzaW9uOiAyCiAgcmVuZGVyZXI6IG5ldHdvcmtkCiAgZXRoZXJuZXRzOgogICAgaWQwOgogICAgICBzZXQtbmFtZTogZXRoMAogICAgICBtYXRjaDoKICAgICAgICBtYWNhZGRyZXNzOiAkTUFDQWRkcmVzcwogICAgICBhZGRyZXNzZXM6CiAgICAgICAgLSAkSVBBZGRyZXNzLyRQcmVmaXgKICAgICAgZ2F0ZXdheTQ6ICRHYXRld2F5CiAgICAgIG5hbWVzZXJ2ZXJzOgogICAgICAgIGFkZHJlc3NlcyA6IFskRE5TXQpFT0YKcm0gL2V0Yy9uZXRwbGFuLzUwKi55YW1sIC1mCgpzdWRvIG5ldHBsYW4gYXBwbHk=
       owner: root:root
       path: /root/network.sh
+      permissions: '0744'
     - content: |
         network: {config: disabled}
       owner: root:root
       path: /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg
+    - content: |
+        -----BEGIN CERTIFICATE-----
+        [...]
+        -----END CERTIFICATE-----
+      owner: root:root
+      path: /usr/local/share/ca-certificates/root_ca.crt
 
     preKubeadmCommands:
     - [...]
+    - update-ca-certificates
     - bash /root/network.sh
diff --git a/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/clusterapi.yml b/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/clusterapi.yml
index 109d69e..1cfb7ae 100644
--- a/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/clusterapi.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/roles/workloadcluster/tasks/clusterapi.yml
@@ -33,7 +33,7 @@
   vars:
     _template:
       pattern: registry.{{ vapp['metacluster.fqdn'] }}/library/
-  loop: "{{ lookup('community.general.filetree', '/opt/metacluster/wip') }}"
+  loop: "{{ lookup('community.general.filetree', '/opt/metacluster/cluster-api') }}"
   loop_control:
     label: "{{ item.path }}"
   when: