diff --git a/.drone.yml b/.drone.yml
index 523f5d316ba..7b4eca4b90a 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -347,7 +347,7 @@ platform:
   os: windows
   arch: amd64
 node:
-  buildbox_version: teleport14
+  buildbox_version: teleport15
 clone:
   disable: true
 steps:
@@ -670,7 +670,7 @@ platform:
   os: windows
   arch: amd64
 node:
-  buildbox_version: teleport14
+  buildbox_version: teleport15
 clone:
   disable: true
 depends_on:
@@ -1295,7 +1295,7 @@ kind: pipeline
 type: kubernetes
 name: build-linux-amd64-centos7
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -1504,7 +1504,7 @@ kind: pipeline
 type: kubernetes
 name: build-linux-amd64-centos7-fips
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -1712,7 +1712,7 @@ kind: pipeline
 type: kubernetes
 name: build-linux-amd64
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -1927,7 +1927,7 @@ kind: pipeline
 type: kubernetes
 name: build-linux-amd64-fips
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -3227,7 +3227,7 @@ kind: pipeline
 type: kubernetes
 name: build-linux-386
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -4053,7 +4053,7 @@ kind: pipeline
 type: kubernetes
 name: build-linux-arm
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -5382,7 +5382,7 @@ kind: pipeline
 type: kubernetes
 name: build-windows-amd64
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   RUNTIME: go1.21.2
 trigger:
   event:
@@ -5942,7 +5942,7 @@ kind: pipeline
 type: kubernetes
 name: build-buildboxes
 environment:
-  BUILDBOX_VERSION: teleport14
+  BUILDBOX_VERSION: teleport15
   GID: "1000"
   UID: "1000"
 trigger:
@@ -6974,7 +6974,7 @@ steps:
   - Build full semver
   - Assume ECR - staging AWS Role
   - Assume ECR - authenticated-pull AWS Role
-- name: Download "teleport_v14-tag_amd64.deb" artifacts from S3
+- name: Download "teleport_v15-tag_amd64.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7004,27 +7004,27 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-- name: Build teleport image "teleport:v14-amd64"
+- name: Build teleport image "teleport:v15-amd64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-v14-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v14-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-v14-amd64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-v15-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v15-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-v15-amd64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-v14-amd64-builder" --config "/tmp/teleport-v14-amd64-builder/buildkitd.toml"
+    "teleport-v15-amd64-builder" --config "/tmp/teleport-v15-amd64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-v14-amd64-builder" --target "teleport"
+  - docker buildx build --push --builder "teleport-v15-amd64-builder" --target "teleport"
     --platform "linux/amd64" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
     --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_amd64.deb
     /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-v14-amd64-builder"
-  - rm -rf "/tmp/teleport-v14-amd64-builder"
+  - docker buildx rm "teleport-v15-amd64-builder"
+  - rm -rf "/tmp/teleport-v15-amd64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7039,8 +7039,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport_v14-tag_amd64.deb" artifacts from S3
-- name: Download "teleport_v14-tag_arm.deb" artifacts from S3
+  - Download "teleport_v15-tag_amd64.deb" artifacts from S3
+- name: Download "teleport_v15-tag_arm.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7070,27 +7070,27 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-- name: Build teleport image "teleport:v14-arm"
+- name: Build teleport image "teleport:v15-arm"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-v14-arm-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v14-arm-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-v14-arm-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-v15-arm-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v15-arm-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-v15-arm-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-v14-arm-builder" --config "/tmp/teleport-v14-arm-builder/buildkitd.toml"
+    "teleport-v15-arm-builder" --config "/tmp/teleport-v15-arm-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-v14-arm-builder" --target "teleport"
+  - docker buildx build --push --builder "teleport-v15-arm-builder" --target "teleport"
     --platform "linux/arm" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
     --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_arm.deb
     /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-v14-arm-builder"
-  - rm -rf "/tmp/teleport-v14-arm-builder"
+  - docker buildx rm "teleport-v15-arm-builder"
+  - rm -rf "/tmp/teleport-v15-arm-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7105,8 +7105,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport_v14-tag_arm.deb" artifacts from S3
-- name: Download "teleport_v14-tag_arm64.deb" artifacts from S3
+  - Download "teleport_v15-tag_arm.deb" artifacts from S3
+- name: Download "teleport_v15-tag_arm64.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7136,27 +7136,27 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-- name: Build teleport image "teleport:v14-arm64"
+- name: Build teleport image "teleport:v15-arm64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-v14-arm64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v14-arm64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-v14-arm64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-v15-arm64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v15-arm64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-v15-arm64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-v14-arm64-builder" --config "/tmp/teleport-v14-arm64-builder/buildkitd.toml"
+    "teleport-v15-arm64-builder" --config "/tmp/teleport-v15-arm64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-v14-arm64-builder" --target "teleport"
+  - docker buildx build --push --builder "teleport-v15-arm64-builder" --target "teleport"
     --platform "linux/arm64" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
     --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_arm64.deb
     /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-v14-arm64-builder"
-  - rm -rf "/tmp/teleport-v14-arm64-builder"
+  - docker buildx rm "teleport-v15-arm64-builder"
+  - rm -rf "/tmp/teleport-v15-arm64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7171,8 +7171,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport_v14-tag_arm64.deb" artifacts from S3
-- name: Tag and push image "teleport:v14-amd64" to ECR - staging
+  - Download "teleport_v15-tag_arm64.deb" artifacts from S3
+- name: Tag and push image "teleport:v15-amd64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport:$(cat
@@ -7200,8 +7200,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport image "teleport:v14-amd64"
-- name: Tag and push image "teleport:v14-arm" to ECR - staging
+  - Build teleport image "teleport:v15-amd64"
+- name: Tag and push image "teleport:v15-arm" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
@@ -7228,8 +7228,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport image "teleport:v14-arm"
-- name: Tag and push image "teleport:v14-arm64" to ECR - staging
+  - Build teleport image "teleport:v15-arm"
+- name: Tag and push image "teleport:v15-arm64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport:$(cat
@@ -7257,7 +7257,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport image "teleport:v14-arm64"
+  - Build teleport image "teleport:v15-arm64"
 - name: Create manifest and push "teleport:full" to ECR - staging
   image: docker
   commands:
@@ -7286,9 +7286,9 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Tag and push image "teleport:v14-amd64" to ECR - staging
-  - Tag and push image "teleport:v14-arm" to ECR - staging
-  - Tag and push image "teleport:v14-arm64" to ECR - staging
+  - Tag and push image "teleport:v15-amd64" to ECR - staging
+  - Tag and push image "teleport:v15-arm" to ECR - staging
+  - Tag and push image "teleport:v15-arm64" to ECR - staging
 - name: Assume S3 Download AWS Role for teleport-ent
   image: amazon/aws-cli
   pull: if-not-exists
@@ -7339,7 +7339,7 @@ steps:
   - Build full semver
   - Assume ECR - staging AWS Role
   - Assume ECR - authenticated-pull AWS Role
-- name: Download "teleport-ent_v14-tag_amd64.deb" artifacts from S3
+- name: Download "teleport-ent_v15-tag_amd64.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7369,27 +7369,27 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport-ent
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-- name: Build teleport-ent image "teleport-ent:v14-amd64"
+- name: Build teleport-ent image "teleport-ent:v15-amd64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v14-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v14-amd64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-ent-v15-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v15-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v15-amd64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v14-amd64-builder" --config "/tmp/teleport-ent-v14-amd64-builder/buildkitd.toml"
+    "teleport-ent-v15-amd64-builder" --config "/tmp/teleport-ent-v15-amd64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v14-amd64-builder" --target
+  - docker buildx build --push --builder "teleport-ent-v15-amd64-builder" --target
     "teleport" --platform "linux/amd64" --tag drone-docker-registry:5000/teleport-ent:$(cat
     "/go/var/full-version")-amd64 --file "/go/build/Dockerfile-teleport-ent" --build-arg
     DEB_PATH=teleport-ent_$(cat "/go/var/full-version")_amd64.deb /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v14-amd64-builder"
-  - rm -rf "/tmp/teleport-ent-v14-amd64-builder"
+  - docker buildx rm "teleport-ent-v15-amd64-builder"
+  - rm -rf "/tmp/teleport-ent-v15-amd64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7404,8 +7404,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v14-tag_amd64.deb" artifacts from S3
-- name: Download "teleport-ent_v14-tag_arm.deb" artifacts from S3
+  - Download "teleport-ent_v15-tag_amd64.deb" artifacts from S3
+- name: Download "teleport-ent_v15-tag_arm.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7435,27 +7435,27 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport-ent
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-- name: Build teleport-ent image "teleport-ent:v14-arm"
+- name: Build teleport-ent image "teleport-ent:v15-arm"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v14-arm-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-arm-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v14-arm-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-ent-v15-arm-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v15-arm-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v15-arm-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v14-arm-builder" --config "/tmp/teleport-ent-v14-arm-builder/buildkitd.toml"
+    "teleport-ent-v15-arm-builder" --config "/tmp/teleport-ent-v15-arm-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v14-arm-builder" --target "teleport"
+  - docker buildx build --push --builder "teleport-ent-v15-arm-builder" --target "teleport"
     --platform "linux/arm" --tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
     --file "/go/build/Dockerfile-teleport-ent" --build-arg DEB_PATH=teleport-ent_$(cat
     "/go/var/full-version")_arm.deb /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v14-arm-builder"
-  - rm -rf "/tmp/teleport-ent-v14-arm-builder"
+  - docker buildx rm "teleport-ent-v15-arm-builder"
+  - rm -rf "/tmp/teleport-ent-v15-arm-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7470,8 +7470,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v14-tag_arm.deb" artifacts from S3
-- name: Download "teleport-ent_v14-tag_arm64.deb" artifacts from S3
+  - Download "teleport-ent_v15-tag_arm.deb" artifacts from S3
+- name: Download "teleport-ent_v15-tag_arm64.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7501,27 +7501,27 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport-ent
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-- name: Build teleport-ent image "teleport-ent:v14-arm64"
+- name: Build teleport-ent image "teleport-ent:v15-arm64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v14-arm64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-arm64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v14-arm64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-ent-v15-arm64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v15-arm64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v15-arm64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v14-arm64-builder" --config "/tmp/teleport-ent-v14-arm64-builder/buildkitd.toml"
+    "teleport-ent-v15-arm64-builder" --config "/tmp/teleport-ent-v15-arm64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v14-arm64-builder" --target
+  - docker buildx build --push --builder "teleport-ent-v15-arm64-builder" --target
     "teleport" --platform "linux/arm64" --tag drone-docker-registry:5000/teleport-ent:$(cat
     "/go/var/full-version")-arm64 --file "/go/build/Dockerfile-teleport-ent" --build-arg
     DEB_PATH=teleport-ent_$(cat "/go/var/full-version")_arm64.deb /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v14-arm64-builder"
-  - rm -rf "/tmp/teleport-ent-v14-arm64-builder"
+  - docker buildx rm "teleport-ent-v15-arm64-builder"
+  - rm -rf "/tmp/teleport-ent-v15-arm64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7536,8 +7536,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v14-tag_arm64.deb" artifacts from S3
-- name: Tag and push image "teleport-ent:v14-amd64" to ECR - staging
+  - Download "teleport-ent_v15-tag_arm64.deb" artifacts from S3
+- name: Tag and push image "teleport-ent:v15-amd64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
@@ -7565,8 +7565,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-ent image "teleport-ent:v14-amd64"
-- name: Tag and push image "teleport-ent:v14-arm" to ECR - staging
+  - Build teleport-ent image "teleport-ent:v15-amd64"
+- name: Tag and push image "teleport-ent:v15-arm" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-ent:$(cat
@@ -7594,8 +7594,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-ent image "teleport-ent:v14-arm"
-- name: Tag and push image "teleport-ent:v14-arm64" to ECR - staging
+  - Build teleport-ent image "teleport-ent:v15-arm"
+- name: Tag and push image "teleport-ent:v15-arm64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-ent:$(cat
@@ -7623,7 +7623,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-ent image "teleport-ent:v14-arm64"
+  - Build teleport-ent image "teleport-ent:v15-arm64"
 - name: Create manifest and push "teleport-ent:full" to ECR - staging
   image: docker
   commands:
@@ -7652,9 +7652,9 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Tag and push image "teleport-ent:v14-amd64" to ECR - staging
-  - Tag and push image "teleport-ent:v14-arm" to ECR - staging
-  - Tag and push image "teleport-ent:v14-arm64" to ECR - staging
+  - Tag and push image "teleport-ent:v15-amd64" to ECR - staging
+  - Tag and push image "teleport-ent:v15-arm" to ECR - staging
+  - Tag and push image "teleport-ent:v15-arm64" to ECR - staging
 - name: Assume S3 Download AWS Role for teleport-ent-fips
   image: amazon/aws-cli
   pull: if-not-exists
@@ -7706,7 +7706,7 @@ steps:
   - Build full semver
   - Assume ECR - staging AWS Role
   - Assume ECR - authenticated-pull AWS Role
-- name: Download "teleport-ent_v14-tag-fips_amd64.deb" artifacts from S3
+- name: Download "teleport-ent_v15-tag-fips_amd64.deb" artifacts from S3
   image: amazon/aws-cli
   commands:
   - END_TIME=$(( $(date +%s) + 3600 ))
@@ -7736,28 +7736,28 @@ steps:
   depends_on:
   - Assume S3 Download AWS Role for teleport-ent-fips
   - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent-fips" for teleport-ent-fips
-- name: Build teleport-ent-fips image "teleport-ent:v14-fips-amd64"
+- name: Build teleport-ent-fips image "teleport-ent:v15-fips-amd64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v14-fips-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-fips-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v14-fips-amd64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-ent-v15-fips-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v15-fips-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v15-fips-amd64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v14-fips-amd64-builder" --config "/tmp/teleport-ent-v14-fips-amd64-builder/buildkitd.toml"
+    "teleport-ent-v15-fips-amd64-builder" --config "/tmp/teleport-ent-v15-fips-amd64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v14-fips-amd64-builder" --target
+  - docker buildx build --push --builder "teleport-ent-v15-fips-amd64-builder" --target
     "teleport-fips" --platform "linux/amd64" --tag drone-docker-registry:5000/teleport-ent:$(cat
     "/go/var/full-version")-fips-amd64 --file "/go/build/Dockerfile-teleport-ent-fips"
     --build-arg DEB_PATH=teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
     /go/build
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v14-fips-amd64-builder"
-  - rm -rf "/tmp/teleport-ent-v14-fips-amd64-builder"
+  - docker buildx rm "teleport-ent-v15-fips-amd64-builder"
+  - rm -rf "/tmp/teleport-ent-v15-fips-amd64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7772,8 +7772,8 @@ steps:
     path: /var/run
   depends_on:
   - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v14-tag-fips_amd64.deb" artifacts from S3
-- name: Tag and push image "teleport-ent:v14-fips-amd64" to ECR - staging
+  - Download "teleport-ent_v15-tag-fips_amd64.deb" artifacts from S3
+- name: Tag and push image "teleport-ent:v15-fips-amd64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
@@ -7801,7 +7801,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-ent-fips image "teleport-ent:v14-fips-amd64"
+  - Build teleport-ent-fips image "teleport-ent:v15-fips-amd64"
 - name: Create manifest and push "teleport-ent:full-fips" to ECR - staging
   image: docker
   commands:
@@ -7828,31 +7828,31 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Tag and push image "teleport-ent:v14-fips-amd64" to ECR - staging
-- name: Build teleport-operator image "teleport-operator:v14-amd64"
+  - Tag and push image "teleport-ent:v15-fips-amd64" to ECR - staging
+- name: Build teleport-operator image "teleport-operator:v15-amd64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
-  - mkdir -pv "/tmp/teleport-operator-v14-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v14-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-operator-v14-amd64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-operator-v15-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v15-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-operator-v15-amd64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-operator-v14-amd64-builder" --config "/tmp/teleport-operator-v14-amd64-builder/buildkitd.toml"
+    "teleport-operator-v15-amd64-builder" --config "/tmp/teleport-operator-v15-amd64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-operator-v14-amd64-builder" --platform
+  - docker buildx build --push --builder "teleport-operator-v15-amd64-builder" --platform
     "linux/amd64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport15
     --build-arg COMPILER_NAME=x86_64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=amd64 --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-operator-v14-amd64-builder"
-  - rm -rf "/tmp/teleport-operator-v14-amd64-builder"
+  - docker buildx rm "teleport-operator-v15-amd64-builder"
+  - rm -rf "/tmp/teleport-operator-v15-amd64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7873,30 +7873,30 @@ steps:
   - Build full semver
   - Assume ECR - staging AWS Role
   - Assume ECR - authenticated-pull AWS Role
-- name: Build teleport-operator image "teleport-operator:v14-arm"
+- name: Build teleport-operator image "teleport-operator:v15-arm"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
-  - mkdir -pv "/tmp/teleport-operator-v14-arm-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v14-arm-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-operator-v14-arm-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-operator-v15-arm-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v15-arm-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-operator-v15-arm-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-operator-v14-arm-builder" --config "/tmp/teleport-operator-v14-arm-builder/buildkitd.toml"
+    "teleport-operator-v15-arm-builder" --config "/tmp/teleport-operator-v15-arm-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-operator-v14-arm-builder" --platform
+  - docker buildx build --push --builder "teleport-operator-v15-arm-builder" --platform
     "linux/arm" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
     --build-arg COMPILER_NAME=arm-linux-gnueabihf-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-operator-v14-arm-builder"
-  - rm -rf "/tmp/teleport-operator-v14-arm-builder"
+  - docker buildx rm "teleport-operator-v15-arm-builder"
+  - rm -rf "/tmp/teleport-operator-v15-arm-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7917,30 +7917,30 @@ steps:
   - Build full semver
   - Assume ECR - staging AWS Role
   - Assume ECR - authenticated-pull AWS Role
-- name: Build teleport-operator image "teleport-operator:v14-arm64"
+- name: Build teleport-operator image "teleport-operator:v15-arm64"
   image: docker
   commands:
   - docker run --privileged --rm tonistiigi/binfmt --install all
   - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
-  - mkdir -pv "/tmp/teleport-operator-v14-arm64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v14-arm64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-operator-v14-arm64-builder/buildkitd.toml"
+  - mkdir -pv "/tmp/teleport-operator-v15-arm64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v15-arm64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-operator-v15-arm64-builder/buildkitd.toml"
   - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-operator-v14-arm64-builder" --config "/tmp/teleport-operator-v14-arm64-builder/buildkitd.toml"
+    "teleport-operator-v15-arm64-builder" --config "/tmp/teleport-operator-v15-arm64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-operator-v14-arm64-builder" --platform
+  - docker buildx build --push --builder "teleport-operator-v15-arm64-builder" --platform
     "linux/arm64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
     --build-arg COMPILER_NAME=aarch64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm64 --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
   - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-operator-v14-arm64-builder"
-  - rm -rf "/tmp/teleport-operator-v14-arm64-builder"
+  - docker buildx rm "teleport-operator-v15-arm64-builder"
+  - rm -rf "/tmp/teleport-operator-v15-arm64-builder"
   environment:
     AWS_PROFILE: ecr-authenticated-pull
     DOCKER_BUILDKIT: "1"
@@ -7961,7 +7961,7 @@ steps:
   - Build full semver
   - Assume ECR - staging AWS Role
   - Assume ECR - authenticated-pull AWS Role
-- name: Tag and push image "teleport-operator:v14-amd64" to ECR - staging
+- name: Tag and push image "teleport-operator:v15-amd64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-operator:$(cat
@@ -7989,8 +7989,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-operator image "teleport-operator:v14-amd64"
-- name: Tag and push image "teleport-operator:v14-arm" to ECR - staging
+  - Build teleport-operator image "teleport-operator:v15-amd64"
+- name: Tag and push image "teleport-operator:v15-arm" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-operator:$(cat
@@ -8018,8 +8018,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-operator image "teleport-operator:v14-arm"
-- name: Tag and push image "teleport-operator:v14-arm64" to ECR - staging
+  - Build teleport-operator image "teleport-operator:v15-arm"
+- name: Tag and push image "teleport-operator:v15-arm64" to ECR - staging
   image: docker
   commands:
   - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-operator:$(cat
@@ -8047,7 +8047,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Build teleport-operator image "teleport-operator:v14-arm64"
+  - Build teleport-operator image "teleport-operator:v15-arm64"
 - name: Create manifest and push "teleport-operator:full" to ECR - staging
   image: docker
   commands:
@@ -8076,9 +8076,9 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Tag and push image "teleport-operator:v14-amd64" to ECR - staging
-  - Tag and push image "teleport-operator:v14-arm" to ECR - staging
-  - Tag and push image "teleport-operator:v14-arm64" to ECR - staging
+  - Tag and push image "teleport-operator:v15-amd64" to ECR - staging
+  - Tag and push image "teleport-operator:v15-arm" to ECR - staging
+  - Tag and push image "teleport-operator:v15-arm64" to ECR - staging
 services:
 - name: Start Docker
   image: docker:dind
@@ -8448,7 +8448,7 @@ steps:
   - Assume ECR - staging AWS Role
   - Verify build is tagged
   - Record if tag ($DRONE_TAG) is prerelease
-- name: Pull teleport:v14-amd64 and push it to Local Registry
+- name: Pull teleport:v15-amd64 and push it to Local Registry
   image: docker
   commands:
   - apk add --no-cache aws-cli
@@ -8481,7 +8481,7 @@ steps:
   - Build major, minor, and full semvers
   - Assume ECR - staging AWS Role
   - Assume ECR - production AWS Role
-- name: Pull teleport:v14-arm and push it to Local Registry
+- name: Pull teleport:v15-arm and push it to Local Registry
   image: docker
   commands:
   - apk add --no-cache aws-cli
@@ -8514,7 +8514,7 @@ steps:
   - Build major, minor, and full semvers
   - Assume ECR - staging AWS Role
   - Assume ECR - production AWS Role
-- name: Pull teleport:v14-arm64 and push it to Local Registry
+- name: Pull teleport:v15-arm64 and push it to Local Registry
   image: docker
   commands:
   - apk add --no-cache aws-cli
@@ -8547,7 +8547,7 @@ steps:
   - Build major, minor, and full semvers
   - Assume ECR - staging AWS Role
   - Assume ECR - production AWS Role
-- name: Tag and push image "teleport:v14-amd64" to ECR - production
+- name: Tag and push image "teleport:v15-amd64" to ECR - production
   image: docker
   commands:
   - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport:$(cat
@@ -8587,8 +8587,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport:v14-amd64 and push it to Local Registry
-- name: Tag and push image "teleport:v14-arm" to ECR - production
+  - Pull teleport:v15-amd64 and push it to Local Registry
+- name: Tag and push image "teleport:v15-arm" to ECR - production
   image: docker
   commands:
   - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
@@ -8627,8 +8627,8 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport:v14-arm and push it to Local Registry
-- name: Tag and push image "teleport:v14-arm64" to ECR - production
+  - Pull teleport:v15-arm and push it to Local Registry
+- name: Tag and push image "teleport:v15-arm64" to ECR - production
   image: docker
   commands:
   - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport:$(cat
@@ -8668,7 +8668,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport:v14-arm64 and push it to Local Registry
+  - Pull teleport:v15-arm64 and push it to Local Registry
 - name: Create manifest and push "teleport:major" to ECR - production
   image: docker
   commands:
@@ -8698,9 +8698,9 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Tag and push image "teleport:v14-amd64" to ECR - production
-  - Tag and push image "teleport:v14-arm" to ECR - production
-  - Tag and push image "teleport:v14-arm64" to ECR - production
+  - Tag and push image "teleport:v15-amd64" to ECR - production
+  - Tag and push image "teleport:v15-arm" to ECR - production
+  - Tag and push image "teleport:v15-arm64" to ECR - production
 - name: Create manifest and push "teleport:minor" to ECR - production
   image: docker
   commands:
@@ -8730,6 +8730,1657 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
+  - Tag and push image "teleport:v15-amd64" to ECR - production
+  - Tag and push image "teleport:v15-arm" to ECR - production
+  - Tag and push image "teleport:v15-arm64" to ECR - production
+- name: Create manifest and push "teleport:full" to ECR - production
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
+    create public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version") --amend
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64 --amend
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm --amend
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64 && docker
+    manifest push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version"))
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport:v15-amd64" to ECR - production
+  - Tag and push image "teleport:v15-arm" to ECR - production
+  - Tag and push image "teleport:v15-arm64" to ECR - production
+- name: Pull teleport-ent:v15-amd64 and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-amd64
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
+  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Pull teleport-ent:v15-arm and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-arm
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-arm drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
+  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Pull teleport-ent:v15-arm64 and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-arm64
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
+  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Tag and push image "teleport-ent:v15-amd64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-amd64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-amd64)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-ent:v15-amd64 and push it to Local Registry
+- name: Tag and push image "teleport-ent:v15-arm" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
+    && docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-ent:v15-arm and push it to Local Registry
+- name: Tag and push image "teleport-ent:v15-arm64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-arm64)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-ent:v15-arm64 and push it to Local Registry
+- name: Create manifest and push "teleport-ent:major" to ECR - production
+  image: docker
+  commands:
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
+  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v15-amd64" to ECR - production
+  - Tag and push image "teleport-ent:v15-arm" to ECR - production
+  - Tag and push image "teleport-ent:v15-arm64" to ECR - production
+- name: Create manifest and push "teleport-ent:minor" to ECR - production
+  image: docker
+  commands:
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
+  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v15-amd64" to ECR - production
+  - Tag and push image "teleport-ent:v15-arm" to ECR - production
+  - Tag and push image "teleport-ent:v15-arm64" to ECR - production
+- name: Create manifest and push "teleport-ent:full" to ECR - production
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
+    create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm64
+    && docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version"))
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v15-amd64" to ECR - production
+  - Tag and push image "teleport-ent:v15-arm" to ECR - production
+  - Tag and push image "teleport-ent:v15-arm64" to ECR - production
+- name: Pull teleport-ent:v15-fips-amd64 and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64
+  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Tag and push image "teleport-ent:v15-fips-amd64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 public.ecr.aws/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
+    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
+  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-ent:v15-fips-amd64 and push it to Local Registry
+- name: Create manifest and push "teleport-ent:major-fips" to ECR - production
+  image: docker
+  commands:
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
+  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v15-fips-amd64" to ECR - production
+- name: Create manifest and push "teleport-ent:minor-fips" to ECR - production
+  image: docker
+  commands:
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
+  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v15-fips-amd64" to ECR - production
+- name: Create manifest and push "teleport-ent:full-fips" to ECR - production
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
+    create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips
+    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
+    && docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips)
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v15-fips-amd64" to ECR - production
+- name: Pull teleport-operator:v15-amd64 and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-amd64
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-amd64 drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-amd64
+  - docker push drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Pull teleport-operator:v15-arm and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm
+  - docker push drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Pull teleport-operator:v15-arm64 and push it to Local Registry
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm64
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm64 drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64
+  - docker push drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Verify build is tagged
+  - Record if tag ($DRONE_TAG) is prerelease
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - production AWS Role
+- name: Tag and push image "teleport-operator:v15-amd64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-amd64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-amd64 && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-amd64)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
+    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
+  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
+    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
+  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-operator:v15-amd64 and push it to Local Registry
+- name: Tag and push image "teleport-operator:v15-arm" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
+    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
+  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
+    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
+  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-operator:v15-arm and push it to Local Registry
+- name: Tag and push image "teleport-operator:v15-arm64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm64 && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-arm64)
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
+    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
+  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
+    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
+  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Pull teleport-operator:v15-arm64 and push it to Local Registry
+- name: Create manifest and push "teleport-operator:major" to ECR - production
+  image: docker
+  commands:
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
+  - docker manifest push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-operator:v15-amd64" to ECR - production
+  - Tag and push image "teleport-operator:v15-arm" to ECR - production
+  - Tag and push image "teleport-operator:v15-arm64" to ECR - production
+- name: Create manifest and push "teleport-operator:minor" to ECR - production
+  image: docker
+  commands:
+  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
+    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
+    ] && echo "skipping" || echo "continuing"
+  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
+  - docker manifest push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-operator:v15-amd64" to ECR - production
+  - Tag and push image "teleport-operator:v15-arm" to ECR - production
+  - Tag and push image "teleport-operator:v15-arm64" to ECR - production
+- name: Create manifest and push "teleport-operator:full" to ECR - production
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
+    create public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm
+    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm64
+    && docker manifest push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version"))
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-operator:v15-amd64" to ECR - production
+  - Tag and push image "teleport-operator:v15-arm" to ECR - production
+  - Tag and push image "teleport-operator:v15-arm64" to ECR - production
+services:
+- name: Start Docker
+  image: docker:dind
+  privileged: true
+  volumes:
+  - name: dockersock
+    path: /var/run
+- name: drone-docker-registry
+  image: registry:2
+  privileged: false
+  volumes: []
+volumes:
+- name: awsconfig
+  temp: {}
+- name: dockersock
+  temp: {}
+- name: dockerconfig
+  temp: {}
+image_pull_secrets:
+- DOCKERHUB_CREDENTIALS
+
+---
+################################################
+# Generated using dronegen, do not edit by hand!
+# Use 'make dronegen' to update.
+# Generated at dronegen/container_images_release_version.go (main.(*ReleaseVersion).buildVersionPipeline)
+################################################
+
+kind: pipeline
+type: kubernetes
+name: teleport-container-images-current-version-cron
+environment:
+  DEBIAN_FRONTEND: noninteractive
+trigger:
+  cron:
+    include:
+    - teleport-container-images-cron
+  repo:
+    include:
+    - gravitational/teleport
+workspace:
+  path: /go
+clone:
+  disable: true
+steps:
+- name: Find the latest available semver for v14
+  image: golang:1.18
+  commands:
+  - mkdir -pv "/tmp/teleport"
+  - cd "/tmp/teleport"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "branch/v14"
+  - mkdir -pv $(dirname "/go/vars/full-version-v14")
+  - cd "/tmp/teleport/build.assets/tooling/cmd/query-latest"
+  - go run . "v14" | sed 's/v//' > "/go/vars/full-version-v14"
+  - echo Found full semver "$(cat "/go/vars/full-version-v14")" for major version
+    "v14"
+- name: Wait for docker
+  image: docker
+  pull: if-not-exists
+  commands:
+  - timeout 30s /bin/sh -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done'
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  environment:
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: dockersock
+    path: /var/run
+  - name: dockerconfig
+    path: /root/.docker
+  depends_on:
+  - Find the latest available semver for v14
+- name: Wait for docker registry
+  image: alpine
+  pull: if-not-exists
+  commands:
+  - apk add curl
+  - timeout 30s /bin/sh -c 'while [ "$(curl -s -o /dev/null -w %{http_code} http://drone-docker-registry:5000/)"
+    != "200" ]; do sleep 1; done'
+  depends_on:
+  - Find the latest available semver for v14
+- name: Check out code
+  image: alpine/git:latest
+  pull: if-not-exists
+  commands:
+  - mkdir -pv "/go/src/github.com/gravitational/teleport"
+  - cd "/go/src/github.com/gravitational/teleport"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "v$(cat '/go/vars/full-version-v14')"
+  depends_on:
+  - Find the latest available semver for v14
+- name: Build major, minor, and full semvers
+  image: alpine
+  commands:
+  - mkdir -pv $(dirname "/go/var/major-version")
+  - echo v$(cat '/go/vars/full-version-v14') | sed 's/v//' | cut -d'.' -f "1" > "/go/var/major-version"
+  - echo $(cat "/go/var/major-version")
+  - mkdir -pv $(dirname "/go/var/minor-version")
+  - echo v$(cat '/go/vars/full-version-v14') | sed 's/v//' | cut -d'.' -f "1,2" >
+    "/go/var/minor-version"
+  - echo $(cat "/go/var/minor-version")
+  - mkdir -pv $(dirname "/go/var/full-version")
+  - echo v$(cat '/go/vars/full-version-v14') | sed 's/v//' > "/go/var/full-version"
+  - echo $(cat "/go/var/full-version")
+  depends_on:
+  - Find the latest available semver for v14
+- name: Assume ECR - staging AWS Role
+  image: amazon/aws-cli
+  pull: if-not-exists
+  commands:
+  - aws sts get-caller-identity
+  - |-
+    printf "[ecr-staging]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
+      $(aws sts assume-role \
+        --role-arn "$AWS_ROLE" \
+        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
+        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+        --output text) \
+      >> /root/.aws/credentials
+  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  - aws sts get-caller-identity --profile ecr-staging
+  environment:
+    AWS_ACCESS_KEY_ID:
+      from_secret: STAGING_TELEPORT_DRONE_USER_ECR_KEY
+    AWS_ROLE:
+      from_secret: STAGING_TELEPORT_DRONE_ECR_AWS_ROLE
+    AWS_SECRET_ACCESS_KEY:
+      from_secret: STAGING_TELEPORT_DRONE_USER_ECR_SECRET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Find the latest available semver for v14
+- name: Assume ECR - authenticated-pull AWS Role
+  image: amazon/aws-cli
+  pull: if-not-exists
+  commands:
+  - aws sts get-caller-identity
+  - |-
+    printf "[ecr-authenticated-pull]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
+      $(aws sts assume-role \
+        --role-arn "$AWS_ROLE" \
+        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
+        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+        --output text) \
+      >> /root/.aws/credentials
+  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  - aws sts get-caller-identity --profile ecr-authenticated-pull
+  environment:
+    AWS_ACCESS_KEY_ID:
+      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_KEY
+    AWS_ROLE:
+      from_secret: PRODUCTION_TELEPORT_DRONE_ECR_AWS_ROLE
+    AWS_SECRET_ACCESS_KEY:
+      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_SECRET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume ECR - staging AWS Role
+  - Find the latest available semver for v14
+- name: Assume ECR - production AWS Role
+  image: amazon/aws-cli
+  pull: if-not-exists
+  commands:
+  - aws sts get-caller-identity
+  - |-
+    printf "[ecr-production]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
+      $(aws sts assume-role \
+        --role-arn "$AWS_ROLE" \
+        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
+        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+        --output text) \
+      >> /root/.aws/credentials
+  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  - aws sts get-caller-identity --profile ecr-production
+  environment:
+    AWS_ACCESS_KEY_ID:
+      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_KEY
+    AWS_ROLE:
+      from_secret: PRODUCTION_TELEPORT_DRONE_ECR_AWS_ROLE
+    AWS_SECRET_ACCESS_KEY:
+      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_SECRET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Find the latest available semver for v14
+- name: Assume S3 Download AWS Role for teleport
+  image: amazon/aws-cli
+  pull: if-not-exists
+  commands:
+  - aws sts get-caller-identity
+  - |-
+    printf "[s3-download-teleport]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
+      $(aws sts assume-role \
+        --role-arn "$AWS_ROLE" \
+        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
+        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+        --output text) \
+      >> /root/.aws/credentials
+  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  - aws sts get-caller-identity --profile s3-download-teleport
+  environment:
+    AWS_ACCESS_KEY_ID:
+      from_secret: AWS_ACCESS_KEY_ID
+    AWS_ROLE:
+      from_secret: AWS_ROLE
+    AWS_SECRET_ACCESS_KEY:
+      from_secret: AWS_SECRET_ACCESS_KEY
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
+  image: alpine/git:latest
+  commands:
+  - mkdir -pv "/tmp/repo"
+  - cd "/tmp/repo"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "v$(cat '/go/vars/full-version-v14')"
+  - mkdir -pv $(dirname "/go/build/Dockerfile-teleport")
+  - cp "/tmp/repo/build.assets/charts/Dockerfile" "/go/build/Dockerfile-teleport"
+  depends_on:
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Download "teleport_v14-tag_amd64.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport_$(cat "/go/var/full-version")_amd64.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport_$(cat
+    "/go/var/full-version")_amd64.deb /go/build/teleport_$(cat "/go/var/full-version")_amd64.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
+- name: Build teleport image "teleport:v14-amd64"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-v14-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v14-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-v14-amd64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-v14-amd64-builder" --config "/tmp/teleport-v14-amd64-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-v14-amd64-builder" --target "teleport"
+    --platform "linux/amd64" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
+    --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_amd64.deb
+    /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-v14-amd64-builder"
+  - rm -rf "/tmp/teleport-v14-amd64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport_v14-tag_amd64.deb" artifacts from S3
+- name: Download "teleport_v14-tag_arm.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport_$(cat "/go/var/full-version")_arm.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport_$(cat
+    "/go/var/full-version")_arm.deb /go/build/teleport_$(cat "/go/var/full-version")_arm.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
+- name: Build teleport image "teleport:v14-arm"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-v14-arm-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v14-arm-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-v14-arm-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-v14-arm-builder" --config "/tmp/teleport-v14-arm-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-v14-arm-builder" --target "teleport"
+    --platform "linux/arm" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+    --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_arm.deb
+    /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-v14-arm-builder"
+  - rm -rf "/tmp/teleport-v14-arm-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport_v14-tag_arm.deb" artifacts from S3
+- name: Download "teleport_v14-tag_arm64.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport_$(cat "/go/var/full-version")_arm64.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport_$(cat
+    "/go/var/full-version")_arm64.deb /go/build/teleport_$(cat "/go/var/full-version")_arm64.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
+- name: Build teleport image "teleport:v14-arm64"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-v14-arm64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v14-arm64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-v14-arm64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-v14-arm64-builder" --config "/tmp/teleport-v14-arm64-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-v14-arm64-builder" --target "teleport"
+    --platform "linux/arm64" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
+    --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_arm64.deb
+    /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-v14-arm64-builder"
+  - rm -rf "/tmp/teleport-v14-arm64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport_v14-tag_arm64.deb" artifacts from S3
+- name: Tag and push image "teleport:v14-amd64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/full-version")-$TIMESTAMP-amd64
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/major-version")-$TIMESTAMP-amd64
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/minor-version")-$TIMESTAMP-amd64
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport image "teleport:v14-amd64"
+- name: Tag and push image "teleport:v14-arm" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/full-version")-$TIMESTAMP-arm
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/major-version")-$TIMESTAMP-arm
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/minor-version")-$TIMESTAMP-arm
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport image "teleport:v14-arm"
+- name: Tag and push image "teleport:v14-arm64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-arm64
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/full-version")-$TIMESTAMP-arm64
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/major-version")-$TIMESTAMP-arm64
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
+    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/minor-version")-$TIMESTAMP-arm64
+    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport image "teleport:v14-arm64"
+- name: Create manifest and push "teleport:major-$TIMESTAMP" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/major-version")-$TIMESTAMP)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport:v14-amd64" to ECR - staging
+  - Tag and push image "teleport:v14-arm" to ECR - staging
+  - Tag and push image "teleport:v14-arm64" to ECR - staging
+- name: Create manifest and push "teleport:minor-$TIMESTAMP" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/minor-version")-$TIMESTAMP)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport:v14-amd64" to ECR - staging
+  - Tag and push image "teleport:v14-arm" to ECR - staging
+  - Tag and push image "teleport:v14-arm64" to ECR - staging
+- name: Create manifest and push "teleport:full-$TIMESTAMP" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
+    "/go/var/full-version")-$TIMESTAMP)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport:v14-amd64" to ECR - staging
+  - Tag and push image "teleport:v14-arm" to ECR - staging
+  - Tag and push image "teleport:v14-arm64" to ECR - staging
+- name: Tag and push image "teleport:v14-amd64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64
+    && docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64)
+  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-amd64
+  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-amd64
+  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-amd64
+  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-amd64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport image "teleport:v14-amd64"
+- name: Tag and push image "teleport:v14-arm" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm
+    && docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm)
+  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm
+  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm
+  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm
+  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport image "teleport:v14-arm"
+- name: Tag and push image "teleport:v14-arm64" to ECR - production
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-arm64
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64
+    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat
+    "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64
+    && docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64)
+  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm64
+  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm64
+  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
+    public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm64
+  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm64
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport image "teleport:v14-arm64"
+- name: Create manifest and push "teleport:major" to ECR - production
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")
+    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm
+    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm64
+  - docker manifest push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport:v14-amd64" to ECR - production
+  - Tag and push image "teleport:v14-arm" to ECR - production
+  - Tag and push image "teleport:v14-arm64" to ECR - production
+- name: Create manifest and push "teleport:minor" to ECR - production
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker manifest create public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")
+    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-amd64
+    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm
+    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm64
+  - docker manifest push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")
+  - docker logout "public.ecr.aws"
+  environment:
+    AWS_PROFILE: ecr-production
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
   - Tag and push image "teleport:v14-amd64" to ECR - production
   - Tag and push image "teleport:v14-arm" to ECR - production
   - Tag and push image "teleport:v14-arm64" to ECR - production
@@ -8763,19 +10414,287 @@ steps:
   - Tag and push image "teleport:v14-amd64" to ECR - production
   - Tag and push image "teleport:v14-arm" to ECR - production
   - Tag and push image "teleport:v14-arm64" to ECR - production
-- name: Pull teleport-ent:v14-amd64 and push it to Local Registry
+- name: Assume S3 Download AWS Role for teleport-ent
+  image: amazon/aws-cli
+  pull: if-not-exists
+  commands:
+  - aws sts get-caller-identity
+  - |-
+    printf "[s3-download-teleport-ent]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
+      $(aws sts assume-role \
+        --role-arn "$AWS_ROLE" \
+        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
+        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+        --output text) \
+      >> /root/.aws/credentials
+  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  - aws sts get-caller-identity --profile s3-download-teleport-ent
+  environment:
+    AWS_ACCESS_KEY_ID:
+      from_secret: AWS_ACCESS_KEY_ID
+    AWS_ROLE:
+      from_secret: AWS_ROLE
+    AWS_SECRET_ACCESS_KEY:
+      from_secret: AWS_SECRET_ACCESS_KEY
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
+  image: alpine/git:latest
+  commands:
+  - mkdir -pv "/tmp/repo"
+  - cd "/tmp/repo"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "v$(cat '/go/vars/full-version-v14')"
+  - mkdir -pv $(dirname "/go/build/Dockerfile-teleport-ent")
+  - cp "/tmp/repo/build.assets/charts/Dockerfile" "/go/build/Dockerfile-teleport-ent"
+  depends_on:
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Download "teleport-ent_v14-tag_amd64.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")_amd64.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
+    "/go/var/full-version")_amd64.deb /go/build/teleport-ent_$(cat "/go/var/full-version")_amd64.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport-ent
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport-ent
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
+- name: Build teleport-ent image "teleport-ent:v14-amd64"
   image: docker
   commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-ent-v14-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v14-amd64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-ent-v14-amd64-builder" --config "/tmp/teleport-ent-v14-amd64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+  - docker buildx build --push --builder "teleport-ent-v14-amd64-builder" --target
+    "teleport" --platform "linux/amd64" --tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 --file "/go/build/Dockerfile-teleport-ent" --build-arg
+    DEB_PATH=teleport-ent_$(cat "/go/var/full-version")_amd64.deb /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-ent-v14-amd64-builder"
+  - rm -rf "/tmp/teleport-ent-v14-amd64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport-ent_v14-tag_amd64.deb" artifacts from S3
+- name: Download "teleport-ent_v14-tag_arm.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")_arm.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
+    "/go/var/full-version")_arm.deb /go/build/teleport-ent_$(cat "/go/var/full-version")_arm.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport-ent
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport-ent
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
+- name: Build teleport-ent image "teleport-ent:v14-arm"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-ent-v14-arm-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-arm-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v14-arm-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-ent-v14-arm-builder" --config "/tmp/teleport-ent-v14-arm-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-ent-v14-arm-builder" --target "teleport"
+    --platform "linux/arm" --tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
+    --file "/go/build/Dockerfile-teleport-ent" --build-arg DEB_PATH=teleport-ent_$(cat
+    "/go/var/full-version")_arm.deb /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-ent-v14-arm-builder"
+  - rm -rf "/tmp/teleport-ent-v14-arm-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport-ent_v14-tag_arm.deb" artifacts from S3
+- name: Download "teleport-ent_v14-tag_arm64.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")_arm64.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
+    "/go/var/full-version")_arm64.deb /go/build/teleport-ent_$(cat "/go/var/full-version")_arm64.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport-ent
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport-ent
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
+- name: Build teleport-ent image "teleport-ent:v14-arm64"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-ent-v14-arm64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-arm64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v14-arm64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-ent-v14-arm64-builder" --config "/tmp/teleport-ent-v14-arm64-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-ent-v14-arm64-builder" --target
+    "teleport" --platform "linux/arm64" --tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 --file "/go/build/Dockerfile-teleport-ent" --build-arg
+    DEB_PATH=teleport-ent_$(cat "/go/var/full-version")_arm64.deb /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-ent-v14-arm64-builder"
+  - rm -rf "/tmp/teleport-ent-v14-arm64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport-ent_v14-tag_arm64.deb" artifacts from S3
+- name: Tag and push image "teleport-ent:v14-amd64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
     "/go/var/full-version")-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
-  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -8788,27 +10707,36 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
-- name: Pull teleport-ent:v14-arm and push it to Local Registry
+  - Build teleport-ent image "teleport-ent:v14-amd64"
+- name: Tag and push image "teleport-ent:v14-arm" to ECR - staging
   image: docker
   commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-ent:$(cat
     "/go/var/full-version")-arm
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-arm drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
-  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -8821,27 +10749,66 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
-- name: Pull teleport-ent:v14-arm64 and push it to Local Registry
+  - Build teleport-ent image "teleport-ent:v14-arm"
+- name: Tag and push image "teleport-ent:v14-arm64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport-ent image "teleport-ent:v14-arm64"
+- name: Create manifest and push "teleport-ent:major-$TIMESTAMP" to ECR - staging
   image: docker
   commands:
   - apk add --no-cache aws-cli
   - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
     146628656107.dkr.ecr.us-west-2.amazonaws.com
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-arm64
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
-  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -8854,14 +10821,73 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
+  - Tag and push image "teleport-ent:v14-amd64" to ECR - staging
+  - Tag and push image "teleport-ent:v14-arm" to ECR - staging
+  - Tag and push image "teleport-ent:v14-arm64" to ECR - staging
+- name: Create manifest and push "teleport-ent:minor-$TIMESTAMP" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v14-amd64" to ECR - staging
+  - Tag and push image "teleport-ent:v14-arm" to ECR - staging
+  - Tag and push image "teleport-ent:v14-arm64" to ECR - staging
+- name: Create manifest and push "teleport-ent:full-$TIMESTAMP" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v14-amd64" to ECR - staging
+  - Tag and push image "teleport-ent:v14-arm" to ECR - staging
+  - Tag and push image "teleport-ent:v14-arm64" to ECR - staging
 - name: Tag and push image "teleport-ent:v14-amd64" to ECR - production
   image: docker
   commands:
@@ -8876,17 +10902,9 @@ steps:
     "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport-ent:$(cat
     "/go/var/full-version")-amd64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
     "/go/var/full-version")-amd64)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
@@ -8903,7 +10921,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-ent:v14-amd64 and push it to Local Registry
+  - Build teleport-ent image "teleport-ent:v14-amd64"
 - name: Tag and push image "teleport-ent:v14-arm" to ECR - production
   image: docker
   commands:
@@ -8917,17 +10935,9 @@ steps:
     > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
     "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
     && docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
@@ -8944,7 +10954,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-ent:v14-arm and push it to Local Registry
+  - Build teleport-ent image "teleport-ent:v14-arm"
 - name: Tag and push image "teleport-ent:v14-arm64" to ECR - production
   image: docker
   commands:
@@ -8959,17 +10969,9 @@ steps:
     "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport-ent:$(cat
     "/go/var/full-version")-arm64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
     "/go/var/full-version")-arm64)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
@@ -8986,14 +10988,10 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-ent:v14-arm64 and push it to Local Registry
+  - Build teleport-ent image "teleport-ent:v14-arm64"
 - name: Create manifest and push "teleport-ent:major" to ECR - production
   image: docker
   commands:
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
@@ -9022,10 +11020,6 @@ steps:
 - name: Create manifest and push "teleport-ent:minor" to ECR - production
   image: docker
   commands:
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
@@ -9081,20 +11075,157 @@ steps:
   - Tag and push image "teleport-ent:v14-amd64" to ECR - production
   - Tag and push image "teleport-ent:v14-arm" to ECR - production
   - Tag and push image "teleport-ent:v14-arm64" to ECR - production
-- name: Pull teleport-ent:v14-fips-amd64 and push it to Local Registry
+- name: Assume S3 Download AWS Role for teleport-ent-fips
+  image: amazon/aws-cli
+  pull: if-not-exists
+  commands:
+  - aws sts get-caller-identity
+  - |-
+    printf "[s3-download-teleport-ent-fips]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
+      $(aws sts assume-role \
+        --role-arn "$AWS_ROLE" \
+        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
+        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+        --output text) \
+      >> /root/.aws/credentials
+  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  - aws sts get-caller-identity --profile s3-download-teleport-ent-fips
+  environment:
+    AWS_ACCESS_KEY_ID:
+      from_secret: AWS_ACCESS_KEY_ID
+    AWS_ROLE:
+      from_secret: AWS_ROLE
+    AWS_SECRET_ACCESS_KEY:
+      from_secret: AWS_SECRET_ACCESS_KEY
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent-fips" for
+    teleport-ent-fips
+  image: alpine/git:latest
+  commands:
+  - mkdir -pv "/tmp/repo"
+  - cd "/tmp/repo"
+  - git init
+  - git remote add origin ${DRONE_REMOTE_URL}
+  - git fetch origin --tags
+  - git checkout -qf "v$(cat '/go/vars/full-version-v14')"
+  - mkdir -pv $(dirname "/go/build/Dockerfile-teleport-ent-fips")
+  - cp "/tmp/repo/build.assets/charts/Dockerfile" "/go/build/Dockerfile-teleport-ent-fips"
+  depends_on:
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Download "teleport-ent_v14-tag-fips_amd64.deb" artifacts from S3
+  image: amazon/aws-cli
+  commands:
+  - END_TIME=$(( $(date +%s) + 3600 ))
+  - TIMED_OUT=true
+  - while [ $(date +%s) -lt $${END_TIME?} ]; do
+  - SUCCESS=true
+  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
+    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
+    || SUCCESS=false
+  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
+  - echo 'Condition not met yet, waiting another 60 seconds...'
+  - sleep 60
+  - done
+  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
+    "$SUCCESS" = "true" ]'' && exit 1'
+  - mkdir -pv "/go/build"
+  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
+    "/go/var/full-version")-fips_amd64.deb /go/build/teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
+  environment:
+    AWS_PROFILE: s3-download-teleport-ent-fips
+    AWS_REGION: us-west-2
+    AWS_S3_BUCKET:
+      from_secret: AWS_S3_BUCKET
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  depends_on:
+  - Assume S3 Download AWS Role for teleport-ent-fips
+  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent-fips" for teleport-ent-fips
+- name: Build teleport-ent-fips image "teleport-ent:v14-fips-amd64"
   image: docker
   commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/build" && cd "/go/build"
+  - mkdir -pv "/tmp/teleport-ent-v14-fips-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v14-fips-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-ent-v14-fips-amd64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-ent-v14-fips-amd64-builder" --config "/tmp/teleport-ent-v14-fips-amd64-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-ent-v14-fips-amd64-builder" --target
+    "teleport-fips" --platform "linux/amd64" --tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 --file "/go/build/Dockerfile-teleport-ent-fips"
+    --build-arg DEB_PATH=teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
+    /go/build
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-ent-v14-fips-amd64-builder"
+  - rm -rf "/tmp/teleport-ent-v14-fips-amd64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Download "teleport-ent_v14-tag-fips_amd64.deb" artifacts from S3
+- name: Tag and push image "teleport-ent:v14-fips-amd64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64
   - apk add --no-cache aws-cli
   - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
     146628656107.dkr.ecr.us-west-2.amazonaws.com
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips-amd64 > /dev/null 2>&1 && echo 'Found
+    existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips-amd64 > /dev/null 2>&1 && echo 'Found
+    existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips-amd64 > /dev/null 2>&1 && echo 'Found
+    existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
+    "/go/var/full-version")-fips-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips-amd64)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64
-  - docker push drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -9107,14 +11238,91 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
+  - Build teleport-ent-fips image "teleport-ent:v14-fips-amd64"
+- name: Create manifest and push "teleport-ent:major-$TIMESTAMP-fips" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips-amd64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/major-version")-$TIMESTAMP-fips)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v14-fips-amd64" to ECR - staging
+- name: Create manifest and push "teleport-ent:minor-$TIMESTAMP-fips" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips-amd64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-fips)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v14-fips-amd64" to ECR - staging
+- name: Create manifest and push "teleport-ent:full-$TIMESTAMP-fips" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips-amd64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
+    "/go/var/full-version")-$TIMESTAMP-fips)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-ent:v14-fips-amd64" to ECR - staging
 - name: Tag and push image "teleport-ent:v14-fips-amd64" to ECR - production
   image: docker
   commands:
@@ -9129,17 +11337,9 @@ steps:
     "/go/var/full-version")-fips-amd64 public.ecr.aws/gravitational/teleport-ent:$(cat
     "/go/var/full-version")-fips-amd64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
     "/go/var/full-version")-fips-amd64)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
     public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
   - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
@@ -9156,14 +11356,10 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-ent:v14-fips-amd64 and push it to Local Registry
+  - Build teleport-ent-fips image "teleport-ent:v14-fips-amd64"
 - name: Create manifest and push "teleport-ent:major-fips" to ECR - production
   image: docker
   commands:
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
@@ -9188,10 +11384,6 @@ steps:
 - name: Create manifest and push "teleport-ent:minor-fips" to ECR - production
   image: docker
   commands:
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
@@ -9239,20 +11431,173 @@ steps:
     path: /var/run
   depends_on:
   - Tag and push image "teleport-ent:v14-fips-amd64" to ECR - production
-- name: Pull teleport-operator:v14-amd64 and push it to Local Registry
+- name: Build teleport-operator image "teleport-operator:v14-amd64"
   image: docker
   commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
+  - mkdir -pv "/tmp/teleport-operator-v14-amd64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v14-amd64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-operator-v14-amd64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-operator-v14-amd64-builder" --config "/tmp/teleport-operator-v14-amd64-builder/buildkitd.toml"
   - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+  - docker buildx build --push --builder "teleport-operator-v14-amd64-builder" --platform
+    "linux/amd64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
+    --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport15
+    --build-arg COMPILER_NAME=x86_64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
+    --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=amd64 --build-arg BUILD_ARCH=amd64
+    /go/src/github.com/gravitational/teleport
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-operator-v14-amd64-builder"
+  - rm -rf "/tmp/teleport-operator-v14-amd64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Build teleport-operator image "teleport-operator:v14-arm"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
+  - mkdir -pv "/tmp/teleport-operator-v14-arm-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v14-arm-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-operator-v14-arm-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-operator-v14-arm-builder" --config "/tmp/teleport-operator-v14-arm-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-operator-v14-arm-builder" --platform
+    "linux/arm" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
+    --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
+    --build-arg COMPILER_NAME=arm-linux-gnueabihf-gcc --build-arg GOLANG_VERSION=go1.21.2
+    --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm --build-arg BUILD_ARCH=amd64
+    /go/src/github.com/gravitational/teleport
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-operator-v14-arm-builder"
+  - rm -rf "/tmp/teleport-operator-v14-arm-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Build teleport-operator image "teleport-operator:v14-arm64"
+  image: docker
+  commands:
+  - docker run --privileged --rm tonistiigi/binfmt --install all
+  - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
+  - mkdir -pv "/tmp/teleport-operator-v14-arm64-builder"
+  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v14-arm64-builder/buildkitd.toml"
+  - echo '  http = true' >> "/tmp/teleport-operator-v14-arm64-builder/buildkitd.toml"
+  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
+    "teleport-operator-v14-arm64-builder" --config "/tmp/teleport-operator-v14-arm64-builder/buildkitd.toml"
+  - apk add --no-cache aws-cli
+  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
+    public.ecr.aws
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - docker buildx build --push --builder "teleport-operator-v14-arm64-builder" --platform
+    "linux/arm64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
+    --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
+    --build-arg COMPILER_NAME=aarch64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
+    --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm64 --build-arg BUILD_ARCH=amd64
+    /go/src/github.com/gravitational/teleport
+  - docker logout "public.ecr.aws"
+  - docker buildx rm "teleport-operator-v14-arm64-builder"
+  - rm -rf "/tmp/teleport-operator-v14-arm64-builder"
+  environment:
+    AWS_PROFILE: ecr-authenticated-pull
+    DOCKER_BUILDKIT: "1"
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Assume ECR - authenticated-pull AWS Role
+  - Find the latest available semver for v14
+  - Wait for docker
+  - Wait for docker registry
+  - Check out code
+  - Build major, minor, and full semvers
+  - Assume ECR - staging AWS Role
+  - Assume ECR - authenticated-pull AWS Role
+  - Assume ECR - production AWS Role
+- name: Tag and push image "teleport-operator:v14-amd64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-operator:$(cat
     "/go/var/full-version")-amd64
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-amd64 drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64
-  - docker push drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -9265,28 +11610,108 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
-- name: Pull teleport-operator:v14-arm and push it to Local Registry
+  - Build teleport-operator image "teleport-operator:v14-amd64"
+- name: Tag and push image "teleport-operator:v14-arm" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport-operator image "teleport-operator:v14-arm"
+- name: Tag and push image "teleport-operator:v14-arm64" to ECR - staging
+  image: docker
+  commands:
+  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64)
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
+    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
+    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Build teleport-operator image "teleport-operator:v14-arm64"
+- name: Create manifest and push "teleport-operator:major-$TIMESTAMP" to ECR - staging
   image: docker
   commands:
   - apk add --no-cache aws-cli
   - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
     146628656107.dkr.ecr.us-west-2.amazonaws.com
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/major-version")-$TIMESTAMP)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm
-  - docker push drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -9299,28 +11724,26 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
-- name: Pull teleport-operator:v14-arm64 and push it to Local Registry
+  - Tag and push image "teleport-operator:v14-amd64" to ECR - staging
+  - Tag and push image "teleport-operator:v14-arm" to ECR - staging
+  - Tag and push image "teleport-operator:v14-arm64" to ECR - staging
+- name: Create manifest and push "teleport-operator:minor-$TIMESTAMP" to ECR - staging
   image: docker
   commands:
   - apk add --no-cache aws-cli
   - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
     146628656107.dkr.ecr.us-west-2.amazonaws.com
   - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker pull 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm64
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/minor-version")-$TIMESTAMP)
   - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  - docker tag 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm64 drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64
-  - docker push drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
   environment:
     AWS_PROFILE: ecr-staging
     DOCKERHUB_PASSWORD:
@@ -9333,14 +11756,41 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Verify build is tagged
-  - Record if tag ($DRONE_TAG) is prerelease
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - production AWS Role
+  - Tag and push image "teleport-operator:v14-amd64" to ECR - staging
+  - Tag and push image "teleport-operator:v14-arm" to ECR - staging
+  - Tag and push image "teleport-operator:v14-arm64" to ECR - staging
+- name: Create manifest and push "teleport-operator:full-$TIMESTAMP" to ECR - staging
+  image: docker
+  commands:
+  - apk add --no-cache aws-cli
+  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
+    146628656107.dkr.ecr.us-west-2.amazonaws.com
+  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
+  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
+  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
+    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
+    "/go/var/full-version")-$TIMESTAMP)
+  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
+  environment:
+    AWS_PROFILE: ecr-staging
+    DOCKERHUB_PASSWORD:
+      from_secret: DOCKERHUB_READONLY_TOKEN
+    DOCKERHUB_USERNAME:
+      from_secret: DOCKERHUB_USERNAME
+  volumes:
+  - name: awsconfig
+    path: /root/.aws
+  - name: dockersock
+    path: /var/run
+  depends_on:
+  - Tag and push image "teleport-operator:v14-amd64" to ECR - staging
+  - Tag and push image "teleport-operator:v14-arm" to ECR - staging
+  - Tag and push image "teleport-operator:v14-arm64" to ECR - staging
 - name: Tag and push image "teleport-operator:v14-amd64" to ECR - production
   image: docker
   commands:
@@ -9355,17 +11805,9 @@ steps:
     "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport-operator:$(cat
     "/go/var/full-version")-amd64 && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
     "/go/var/full-version")-amd64)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
     public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
   - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
     public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
   - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
@@ -9382,7 +11824,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-operator:v14-amd64 and push it to Local Registry
+  - Build teleport-operator image "teleport-operator:v14-amd64"
 - name: Tag and push image "teleport-operator:v14-arm" to ECR - production
   image: docker
   commands:
@@ -9397,17 +11839,9 @@ steps:
     "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport-operator:$(cat
     "/go/var/full-version")-arm && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
     "/go/var/full-version")-arm)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
     public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
   - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
     public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
   - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
@@ -9424,7 +11858,7 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-operator:v14-arm and push it to Local Registry
+  - Build teleport-operator image "teleport-operator:v14-arm"
 - name: Tag and push image "teleport-operator:v14-arm64" to ECR - production
   image: docker
   commands:
@@ -9439,17 +11873,9 @@ steps:
     "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport-operator:$(cat
     "/go/var/full-version")-arm64 && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
     "/go/var/full-version")-arm64)
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
     public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
   - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
     public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
   - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
@@ -9466,14 +11892,10 @@ steps:
   - name: dockersock
     path: /var/run
   depends_on:
-  - Pull teleport-operator:v14-arm64 and push it to Local Registry
+  - Build teleport-operator image "teleport-operator:v14-arm64"
 - name: Create manifest and push "teleport-operator:major" to ECR - production
   image: docker
   commands:
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
@@ -9502,10 +11924,6 @@ steps:
 - name: Create manifest and push "teleport-operator:minor" to ECR - production
   image: docker
   commands:
-  - printf "Prerelease "; ! [ -f /go/vars/release-is-prerelease ] && printf "not ";
-    printf "detected for version $DRONE_TAG, "; [ -f /go/vars/release-is-prerelease
-    ] && echo "skipping" || echo "continuing"
-  - '[ -f /go/vars/release-is-prerelease ] && exit 0'
   - apk add --no-cache aws-cli
   - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
     public.ecr.aws
@@ -9591,7 +12009,7 @@ image_pull_secrets:
 
 kind: pipeline
 type: kubernetes
-name: teleport-container-images-current-version-cron
+name: teleport-container-images-previous-version-1-cron
 environment:
   DEBIAN_FRONTEND: noninteractive
 trigger:
@@ -11448,7 +13866,7 @@ steps:
   - docker buildx build --push --builder "teleport-operator-v13-amd64-builder" --platform
     "linux/amd64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport15
     --build-arg COMPILER_NAME=x86_64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=amd64 --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
@@ -11494,7 +13912,7 @@ steps:
   - docker buildx build --push --builder "teleport-operator-v13-arm-builder" --platform
     "linux/arm" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
     --build-arg COMPILER_NAME=arm-linux-gnueabihf-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
@@ -11540,7 +13958,7 @@ steps:
   - docker buildx build --push --builder "teleport-operator-v13-arm64-builder" --platform
     "linux/arm64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
     --build-arg COMPILER_NAME=aarch64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm64 --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
@@ -12009,7 +14427,7 @@ image_pull_secrets:
 
 kind: pipeline
 type: kubernetes
-name: teleport-container-images-previous-version-1-cron
+name: teleport-container-images-previous-version-2-cron
 environment:
   DEBIAN_FRONTEND: noninteractive
 trigger:
@@ -13866,7 +16284,7 @@ steps:
   - docker buildx build --push --builder "teleport-operator-v12-amd64-builder" --platform
     "linux/amd64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport15
     --build-arg COMPILER_NAME=x86_64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=amd64 --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
@@ -13912,7 +16330,7 @@ steps:
   - docker buildx build --push --builder "teleport-operator-v12-arm-builder" --platform
     "linux/arm" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
     --build-arg COMPILER_NAME=arm-linux-gnueabihf-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
@@ -13958,7 +16376,7 @@ steps:
   - docker buildx build --push --builder "teleport-operator-v12-arm64-builder" --platform
     "linux/arm64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
     --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
+    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport15
     --build-arg COMPILER_NAME=aarch64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
     --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm64 --build-arg BUILD_ARCH=amd64
     /go/src/github.com/gravitational/teleport
@@ -14418,2424 +16836,6 @@ volumes:
 image_pull_secrets:
 - DOCKERHUB_CREDENTIALS
 
----
-################################################
-# Generated using dronegen, do not edit by hand!
-# Use 'make dronegen' to update.
-# Generated at dronegen/container_images_release_version.go (main.(*ReleaseVersion).buildVersionPipeline)
-################################################
-
-kind: pipeline
-type: kubernetes
-name: teleport-container-images-previous-version-2-cron
-environment:
-  DEBIAN_FRONTEND: noninteractive
-trigger:
-  cron:
-    include:
-    - teleport-container-images-cron
-  repo:
-    include:
-    - gravitational/teleport
-workspace:
-  path: /go
-clone:
-  disable: true
-steps:
-- name: Find the latest available semver for v11
-  image: golang:1.18
-  commands:
-  - mkdir -pv "/tmp/teleport"
-  - cd "/tmp/teleport"
-  - git init
-  - git remote add origin ${DRONE_REMOTE_URL}
-  - git fetch origin --tags
-  - git checkout -qf "branch/v11"
-  - mkdir -pv $(dirname "/go/vars/full-version-v11")
-  - cd "/tmp/teleport/build.assets/tooling/cmd/query-latest"
-  - go run . "v11" | sed 's/v//' > "/go/vars/full-version-v11"
-  - echo Found full semver "$(cat "/go/vars/full-version-v11")" for major version
-    "v11"
-- name: Wait for docker
-  image: docker
-  pull: if-not-exists
-  commands:
-  - timeout 30s /bin/sh -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done'
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  environment:
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: dockersock
-    path: /var/run
-  - name: dockerconfig
-    path: /root/.docker
-  depends_on:
-  - Find the latest available semver for v11
-- name: Wait for docker registry
-  image: alpine
-  pull: if-not-exists
-  commands:
-  - apk add curl
-  - timeout 30s /bin/sh -c 'while [ "$(curl -s -o /dev/null -w %{http_code} http://drone-docker-registry:5000/)"
-    != "200" ]; do sleep 1; done'
-  depends_on:
-  - Find the latest available semver for v11
-- name: Check out code
-  image: alpine/git:latest
-  pull: if-not-exists
-  commands:
-  - mkdir -pv "/go/src/github.com/gravitational/teleport"
-  - cd "/go/src/github.com/gravitational/teleport"
-  - git init
-  - git remote add origin ${DRONE_REMOTE_URL}
-  - git fetch origin --tags
-  - git checkout -qf "v$(cat '/go/vars/full-version-v11')"
-  depends_on:
-  - Find the latest available semver for v11
-- name: Build major, minor, and full semvers
-  image: alpine
-  commands:
-  - mkdir -pv $(dirname "/go/var/major-version")
-  - echo v$(cat '/go/vars/full-version-v11') | sed 's/v//' | cut -d'.' -f "1" > "/go/var/major-version"
-  - echo $(cat "/go/var/major-version")
-  - mkdir -pv $(dirname "/go/var/minor-version")
-  - echo v$(cat '/go/vars/full-version-v11') | sed 's/v//' | cut -d'.' -f "1,2" >
-    "/go/var/minor-version"
-  - echo $(cat "/go/var/minor-version")
-  - mkdir -pv $(dirname "/go/var/full-version")
-  - echo v$(cat '/go/vars/full-version-v11') | sed 's/v//' > "/go/var/full-version"
-  - echo $(cat "/go/var/full-version")
-  depends_on:
-  - Find the latest available semver for v11
-- name: Assume ECR - staging AWS Role
-  image: amazon/aws-cli
-  pull: if-not-exists
-  commands:
-  - aws sts get-caller-identity
-  - |-
-    printf "[ecr-staging]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-      $(aws sts assume-role \
-        --role-arn "$AWS_ROLE" \
-        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-        --output text) \
-      >> /root/.aws/credentials
-  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-  - aws sts get-caller-identity --profile ecr-staging
-  environment:
-    AWS_ACCESS_KEY_ID:
-      from_secret: STAGING_TELEPORT_DRONE_USER_ECR_KEY
-    AWS_ROLE:
-      from_secret: STAGING_TELEPORT_DRONE_ECR_AWS_ROLE
-    AWS_SECRET_ACCESS_KEY:
-      from_secret: STAGING_TELEPORT_DRONE_USER_ECR_SECRET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Find the latest available semver for v11
-- name: Assume ECR - authenticated-pull AWS Role
-  image: amazon/aws-cli
-  pull: if-not-exists
-  commands:
-  - aws sts get-caller-identity
-  - |-
-    printf "[ecr-authenticated-pull]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-      $(aws sts assume-role \
-        --role-arn "$AWS_ROLE" \
-        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-        --output text) \
-      >> /root/.aws/credentials
-  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-  - aws sts get-caller-identity --profile ecr-authenticated-pull
-  environment:
-    AWS_ACCESS_KEY_ID:
-      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_KEY
-    AWS_ROLE:
-      from_secret: PRODUCTION_TELEPORT_DRONE_ECR_AWS_ROLE
-    AWS_SECRET_ACCESS_KEY:
-      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_SECRET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume ECR - staging AWS Role
-  - Find the latest available semver for v11
-- name: Assume ECR - production AWS Role
-  image: amazon/aws-cli
-  pull: if-not-exists
-  commands:
-  - aws sts get-caller-identity
-  - |-
-    printf "[ecr-production]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-      $(aws sts assume-role \
-        --role-arn "$AWS_ROLE" \
-        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-        --output text) \
-      >> /root/.aws/credentials
-  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-  - aws sts get-caller-identity --profile ecr-production
-  environment:
-    AWS_ACCESS_KEY_ID:
-      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_KEY
-    AWS_ROLE:
-      from_secret: PRODUCTION_TELEPORT_DRONE_ECR_AWS_ROLE
-    AWS_SECRET_ACCESS_KEY:
-      from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_SECRET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Find the latest available semver for v11
-- name: Assume S3 Download AWS Role for teleport
-  image: amazon/aws-cli
-  pull: if-not-exists
-  commands:
-  - aws sts get-caller-identity
-  - |-
-    printf "[s3-download-teleport]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-      $(aws sts assume-role \
-        --role-arn "$AWS_ROLE" \
-        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-        --output text) \
-      >> /root/.aws/credentials
-  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-  - aws sts get-caller-identity --profile s3-download-teleport
-  environment:
-    AWS_ACCESS_KEY_ID:
-      from_secret: AWS_ACCESS_KEY_ID
-    AWS_ROLE:
-      from_secret: AWS_ROLE
-    AWS_SECRET_ACCESS_KEY:
-      from_secret: AWS_SECRET_ACCESS_KEY
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-  image: alpine/git:latest
-  commands:
-  - mkdir -pv "/tmp/repo"
-  - cd "/tmp/repo"
-  - git init
-  - git remote add origin ${DRONE_REMOTE_URL}
-  - git fetch origin --tags
-  - git checkout -qf "v$(cat '/go/vars/full-version-v11')"
-  - mkdir -pv $(dirname "/go/build/Dockerfile-teleport")
-  - cp "/tmp/repo/build.assets/charts/Dockerfile" "/go/build/Dockerfile-teleport"
-  depends_on:
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Download "teleport_v11-tag_amd64.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport_$(cat "/go/var/full-version")_amd64.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport_$(cat
-    "/go/var/full-version")_amd64.deb /go/build/teleport_$(cat "/go/var/full-version")_amd64.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-- name: Build teleport image "teleport:v11-amd64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-v11-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v11-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-v11-amd64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-v11-amd64-builder" --config "/tmp/teleport-v11-amd64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-v11-amd64-builder" --target "teleport"
-    --platform "linux/amd64" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
-    --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_amd64.deb
-    /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-v11-amd64-builder"
-  - rm -rf "/tmp/teleport-v11-amd64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport_v11-tag_amd64.deb" artifacts from S3
-- name: Download "teleport_v11-tag_arm.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport_$(cat "/go/var/full-version")_arm.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport_$(cat
-    "/go/var/full-version")_arm.deb /go/build/teleport_$(cat "/go/var/full-version")_arm.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-- name: Build teleport image "teleport:v11-arm"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-v11-arm-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v11-arm-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-v11-arm-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-v11-arm-builder" --config "/tmp/teleport-v11-arm-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-v11-arm-builder" --target "teleport"
-    --platform "linux/arm" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-    --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_arm.deb
-    /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-v11-arm-builder"
-  - rm -rf "/tmp/teleport-v11-arm-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport_v11-tag_arm.deb" artifacts from S3
-- name: Download "teleport_v11-tag_arm64.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport_$(cat "/go/var/full-version")_arm64.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport_$(cat
-    "/go/var/full-version")_arm64.deb /go/build/teleport_$(cat "/go/var/full-version")_arm64.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport" for teleport
-- name: Build teleport image "teleport:v11-arm64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-v11-arm64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-v11-arm64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-v11-arm64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-v11-arm64-builder" --config "/tmp/teleport-v11-arm64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-v11-arm64-builder" --target "teleport"
-    --platform "linux/arm64" --tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
-    --file "/go/build/Dockerfile-teleport" --build-arg DEB_PATH=teleport_$(cat "/go/var/full-version")_arm64.deb
-    /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-v11-arm64-builder"
-  - rm -rf "/tmp/teleport-v11-arm64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport_v11-tag_arm64.deb" artifacts from S3
-- name: Tag and push image "teleport:v11-amd64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/full-version")-$TIMESTAMP-amd64
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/major-version")-$TIMESTAMP-amd64
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/minor-version")-$TIMESTAMP-amd64
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport image "teleport:v11-amd64"
-- name: Tag and push image "teleport:v11-arm" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/full-version")-$TIMESTAMP-arm
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/major-version")-$TIMESTAMP-arm
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/minor-version")-$TIMESTAMP-arm
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport image "teleport:v11-arm"
-- name: Tag and push image "teleport:v11-arm64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-arm64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/full-version")-$TIMESTAMP-arm64
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/major-version")-$TIMESTAMP-arm64
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
-    146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat "/go/var/minor-version")-$TIMESTAMP-arm64
-    && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport image "teleport:v11-arm64"
-- name: Create manifest and push "teleport:major-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/major-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport:v11-amd64" to ECR - staging
-  - Tag and push image "teleport:v11-arm" to ECR - staging
-  - Tag and push image "teleport:v11-arm64" to ECR - staging
-- name: Create manifest and push "teleport:minor-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/minor-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport:v11-amd64" to ECR - staging
-  - Tag and push image "teleport:v11-arm" to ECR - staging
-  - Tag and push image "teleport:v11-arm64" to ECR - staging
-- name: Create manifest and push "teleport:full-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:$(cat
-    "/go/var/full-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport:v11-amd64" to ECR - staging
-  - Tag and push image "teleport:v11-arm" to ECR - staging
-  - Tag and push image "teleport:v11-arm64" to ECR - staging
-- name: Tag and push image "teleport:v11-amd64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64
-    && docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64)
-  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-amd64
-  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-amd64
-  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-amd64
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-amd64
-  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-amd64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport image "teleport:v11-amd64"
-- name: Tag and push image "teleport:v11-arm" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm
-    && docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm)
-  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm
-  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm
-  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm
-  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport image "teleport:v11-arm"
-- name: Tag and push image "teleport:v11-arm64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-arm64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport:$(cat
-    "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64
-    && docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64)
-  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm64
-  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm64
-  - docker tag drone-docker-registry:5000/teleport:$(cat "/go/var/full-version")-arm64
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm64
-  - docker push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport image "teleport:v11-arm64"
-- name: Create manifest and push "teleport:major" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")
-    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm
-    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")-arm64
-  - docker manifest push public.ecr.aws/gravitational/teleport:$(cat "/go/var/major-version")
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport:v11-amd64" to ECR - production
-  - Tag and push image "teleport:v11-arm" to ECR - production
-  - Tag and push image "teleport:v11-arm64" to ECR - production
-- name: Create manifest and push "teleport:minor" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")
-    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm
-    --amend public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")-arm64
-  - docker manifest push public.ecr.aws/gravitational/teleport:$(cat "/go/var/minor-version")
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport:v11-amd64" to ECR - production
-  - Tag and push image "teleport:v11-arm" to ECR - production
-  - Tag and push image "teleport:v11-arm64" to ECR - production
-- name: Create manifest and push "teleport:full" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
-    create public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version") --amend
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-amd64 --amend
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm --amend
-    public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version")-arm64 && docker
-    manifest push public.ecr.aws/gravitational/teleport:$(cat "/go/var/full-version"))
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport:v11-amd64" to ECR - production
-  - Tag and push image "teleport:v11-arm" to ECR - production
-  - Tag and push image "teleport:v11-arm64" to ECR - production
-- name: Assume S3 Download AWS Role for teleport-ent
-  image: amazon/aws-cli
-  pull: if-not-exists
-  commands:
-  - aws sts get-caller-identity
-  - |-
-    printf "[s3-download-teleport-ent]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-      $(aws sts assume-role \
-        --role-arn "$AWS_ROLE" \
-        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-        --output text) \
-      >> /root/.aws/credentials
-  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-  - aws sts get-caller-identity --profile s3-download-teleport-ent
-  environment:
-    AWS_ACCESS_KEY_ID:
-      from_secret: AWS_ACCESS_KEY_ID
-    AWS_ROLE:
-      from_secret: AWS_ROLE
-    AWS_SECRET_ACCESS_KEY:
-      from_secret: AWS_SECRET_ACCESS_KEY
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-  image: alpine/git:latest
-  commands:
-  - mkdir -pv "/tmp/repo"
-  - cd "/tmp/repo"
-  - git init
-  - git remote add origin ${DRONE_REMOTE_URL}
-  - git fetch origin --tags
-  - git checkout -qf "v$(cat '/go/vars/full-version-v11')"
-  - mkdir -pv $(dirname "/go/build/Dockerfile-teleport-ent")
-  - cp "/tmp/repo/build.assets/charts/Dockerfile" "/go/build/Dockerfile-teleport-ent"
-  depends_on:
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Download "teleport-ent_v11-tag_amd64.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")_amd64.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
-    "/go/var/full-version")_amd64.deb /go/build/teleport-ent_$(cat "/go/var/full-version")_amd64.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport-ent
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport-ent
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-- name: Build teleport-ent image "teleport-ent:v11-amd64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v11-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v11-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v11-amd64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v11-amd64-builder" --config "/tmp/teleport-ent-v11-amd64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v11-amd64-builder" --target
-    "teleport" --platform "linux/amd64" --tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 --file "/go/build/Dockerfile-teleport-ent" --build-arg
-    DEB_PATH=teleport-ent_$(cat "/go/var/full-version")_amd64.deb /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v11-amd64-builder"
-  - rm -rf "/tmp/teleport-ent-v11-amd64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v11-tag_amd64.deb" artifacts from S3
-- name: Download "teleport-ent_v11-tag_arm.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")_arm.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
-    "/go/var/full-version")_arm.deb /go/build/teleport-ent_$(cat "/go/var/full-version")_arm.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport-ent
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport-ent
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-- name: Build teleport-ent image "teleport-ent:v11-arm"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v11-arm-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v11-arm-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v11-arm-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v11-arm-builder" --config "/tmp/teleport-ent-v11-arm-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v11-arm-builder" --target "teleport"
-    --platform "linux/arm" --tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
-    --file "/go/build/Dockerfile-teleport-ent" --build-arg DEB_PATH=teleport-ent_$(cat
-    "/go/var/full-version")_arm.deb /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v11-arm-builder"
-  - rm -rf "/tmp/teleport-ent-v11-arm-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v11-tag_arm.deb" artifacts from S3
-- name: Download "teleport-ent_v11-tag_arm64.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")_arm64.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
-    "/go/var/full-version")_arm64.deb /go/build/teleport-ent_$(cat "/go/var/full-version")_arm64.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport-ent
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport-ent
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent" for teleport-ent
-- name: Build teleport-ent image "teleport-ent:v11-arm64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v11-arm64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v11-arm64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v11-arm64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v11-arm64-builder" --config "/tmp/teleport-ent-v11-arm64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v11-arm64-builder" --target
-    "teleport" --platform "linux/arm64" --tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 --file "/go/build/Dockerfile-teleport-ent" --build-arg
-    DEB_PATH=teleport-ent_$(cat "/go/var/full-version")_arm64.deb /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v11-arm64-builder"
-  - rm -rf "/tmp/teleport-ent-v11-arm64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v11-tag_arm64.deb" artifacts from S3
-- name: Tag and push image "teleport-ent:v11-amd64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent image "teleport-ent:v11-amd64"
-- name: Tag and push image "teleport-ent:v11-arm" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent image "teleport-ent:v11-arm"
-- name: Tag and push image "teleport-ent:v11-arm64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent image "teleport-ent:v11-arm64"
-- name: Create manifest and push "teleport-ent:major-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-amd64" to ECR - staging
-  - Tag and push image "teleport-ent:v11-arm" to ECR - staging
-  - Tag and push image "teleport-ent:v11-arm64" to ECR - staging
-- name: Create manifest and push "teleport-ent:minor-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-amd64" to ECR - staging
-  - Tag and push image "teleport-ent:v11-arm" to ECR - staging
-  - Tag and push image "teleport-ent:v11-arm64" to ECR - staging
-- name: Create manifest and push "teleport-ent:full-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-amd64" to ECR - staging
-  - Tag and push image "teleport-ent:v11-arm" to ECR - staging
-  - Tag and push image "teleport-ent:v11-arm64" to ECR - staging
-- name: Tag and push image "teleport-ent:v11-amd64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-amd64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-amd64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-amd64)
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-amd64
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent image "teleport-ent:v11-amd64"
-- name: Tag and push image "teleport-ent:v11-arm" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
-    && docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm)
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent image "teleport-ent:v11-arm"
-- name: Tag and push image "teleport-ent:v11-arm64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-arm64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-arm64)
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-arm64
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent image "teleport-ent:v11-arm64"
-- name: Create manifest and push "teleport-ent:major" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-arm64
-  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-amd64" to ECR - production
-  - Tag and push image "teleport-ent:v11-arm" to ECR - production
-  - Tag and push image "teleport-ent:v11-arm64" to ECR - production
-- name: Create manifest and push "teleport-ent:minor" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-arm64
-  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-amd64" to ECR - production
-  - Tag and push image "teleport-ent:v11-arm" to ECR - production
-  - Tag and push image "teleport-ent:v11-arm64" to ECR - production
-- name: Create manifest and push "teleport-ent:full" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
-    create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-arm64
-    && docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version"))
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-amd64" to ECR - production
-  - Tag and push image "teleport-ent:v11-arm" to ECR - production
-  - Tag and push image "teleport-ent:v11-arm64" to ECR - production
-- name: Assume S3 Download AWS Role for teleport-ent-fips
-  image: amazon/aws-cli
-  pull: if-not-exists
-  commands:
-  - aws sts get-caller-identity
-  - |-
-    printf "[s3-download-teleport-ent-fips]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-      $(aws sts assume-role \
-        --role-arn "$AWS_ROLE" \
-        --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-        --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-        --output text) \
-      >> /root/.aws/credentials
-  - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-  - aws sts get-caller-identity --profile s3-download-teleport-ent-fips
-  environment:
-    AWS_ACCESS_KEY_ID:
-      from_secret: AWS_ACCESS_KEY_ID
-    AWS_ROLE:
-      from_secret: AWS_ROLE
-    AWS_SECRET_ACCESS_KEY:
-      from_secret: AWS_SECRET_ACCESS_KEY
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent-fips" for
-    teleport-ent-fips
-  image: alpine/git:latest
-  commands:
-  - mkdir -pv "/tmp/repo"
-  - cd "/tmp/repo"
-  - git init
-  - git remote add origin ${DRONE_REMOTE_URL}
-  - git fetch origin --tags
-  - git checkout -qf "v$(cat '/go/vars/full-version-v11')"
-  - mkdir -pv $(dirname "/go/build/Dockerfile-teleport-ent-fips")
-  - cp "/tmp/repo/build.assets/charts/Dockerfile" "/go/build/Dockerfile-teleport-ent-fips"
-  depends_on:
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Download "teleport-ent_v11-tag-fips_amd64.deb" artifacts from S3
-  image: amazon/aws-cli
-  commands:
-  - END_TIME=$(( $(date +%s) + 3600 ))
-  - TIMED_OUT=true
-  - while [ $(date +%s) -lt $${END_TIME?} ]; do
-  - SUCCESS=true
-  - aws s3 ls s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/ | tr
-    -s ' ' | cut -d' ' -f 4 | grep -x teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
-    || SUCCESS=false
-  - '[ "$SUCCESS" = "true" ] && TIMED_OUT=false && break;'
-  - echo 'Condition not met yet, waiting another 60 seconds...'
-  - sleep 60
-  - done
-  - '[ $${TIMED_OUT?} = true ] && echo ''Timed out while waiting for condition: [
-    "$SUCCESS" = "true" ]'' && exit 1'
-  - mkdir -pv "/go/build"
-  - aws s3 cp s3://$AWS_S3_BUCKET/teleport/tag/$(cat "/go/var/full-version")/teleport-ent_$(cat
-    "/go/var/full-version")-fips_amd64.deb /go/build/teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
-  environment:
-    AWS_PROFILE: s3-download-teleport-ent-fips
-    AWS_REGION: us-west-2
-    AWS_S3_BUCKET:
-      from_secret: AWS_S3_BUCKET
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  depends_on:
-  - Assume S3 Download AWS Role for teleport-ent-fips
-  - Download Teleport Dockerfile to "/go/build/Dockerfile-teleport-ent-fips" for teleport-ent-fips
-- name: Build teleport-ent-fips image "teleport-ent:v11-fips-amd64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/build" && cd "/go/build"
-  - mkdir -pv "/tmp/teleport-ent-v11-fips-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-ent-v11-fips-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-ent-v11-fips-amd64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-ent-v11-fips-amd64-builder" --config "/tmp/teleport-ent-v11-fips-amd64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-ent-v11-fips-amd64-builder" --target
-    "teleport-fips" --platform "linux/amd64" --tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 --file "/go/build/Dockerfile-teleport-ent-fips"
-    --build-arg DEB_PATH=teleport-ent_$(cat "/go/var/full-version")-fips_amd64.deb
-    /go/build
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-ent-v11-fips-amd64-builder"
-  - rm -rf "/tmp/teleport-ent-v11-fips-amd64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Download "teleport-ent_v11-tag-fips_amd64.deb" artifacts from S3
-- name: Tag and push image "teleport-ent:v11-fips-amd64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips-amd64 > /dev/null 2>&1 && echo 'Found
-    existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips-amd64 > /dev/null 2>&1 && echo 'Found
-    existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips-amd64 > /dev/null 2>&1 && echo 'Found
-    existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips-amd64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent-fips image "teleport-ent:v11-fips-amd64"
-- name: Create manifest and push "teleport-ent:major-$TIMESTAMP-fips" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips-amd64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/major-version")-$TIMESTAMP-fips)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-fips-amd64" to ECR - staging
-- name: Create manifest and push "teleport-ent:minor-$TIMESTAMP-fips" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips-amd64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-fips)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-fips-amd64" to ECR - staging
-- name: Create manifest and push "teleport-ent:full-$TIMESTAMP-fips" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips-amd64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-$TIMESTAMP-fips)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-fips-amd64" to ECR - staging
-- name: Tag and push image "teleport-ent:v11-fips-amd64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 public.ecr.aws/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64 && docker push public.ecr.aws/gravitational/teleport-ent:$(cat
-    "/go/var/full-version")-fips-amd64)
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
-  - docker tag drone-docker-registry:5000/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
-    public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
-  - docker push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-ent-fips image "teleport-ent:v11-fips-amd64"
-- name: Create manifest and push "teleport-ent:major-fips" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips-amd64
-  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/major-version")-fips
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-fips-amd64" to ECR - production
-- name: Create manifest and push "teleport-ent:minor-fips" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips-amd64
-  - docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/minor-version")-fips
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-fips-amd64" to ECR - production
-- name: Create manifest and push "teleport-ent:full-fips" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
-    create public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips
-    --amend public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips-amd64
-    && docker manifest push public.ecr.aws/gravitational/teleport-ent:$(cat "/go/var/full-version")-fips)
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-ent:v11-fips-amd64" to ECR - production
-- name: Build teleport-operator image "teleport-operator:v11-amd64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
-  - mkdir -pv "/tmp/teleport-operator-v11-amd64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v11-amd64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-operator-v11-amd64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-operator-v11-amd64-builder" --config "/tmp/teleport-operator-v11-amd64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-operator-v11-amd64-builder" --platform
-    "linux/amd64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
-    --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox:teleport14
-    --build-arg COMPILER_NAME=x86_64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
-    --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=amd64 --build-arg BUILD_ARCH=amd64
-    /go/src/github.com/gravitational/teleport
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-operator-v11-amd64-builder"
-  - rm -rf "/tmp/teleport-operator-v11-amd64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Build teleport-operator image "teleport-operator:v11-arm"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
-  - mkdir -pv "/tmp/teleport-operator-v11-arm-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v11-arm-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-operator-v11-arm-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-operator-v11-arm-builder" --config "/tmp/teleport-operator-v11-arm-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-operator-v11-arm-builder" --platform
-    "linux/arm" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
-    --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
-    --build-arg COMPILER_NAME=arm-linux-gnueabihf-gcc --build-arg GOLANG_VERSION=go1.21.2
-    --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm --build-arg BUILD_ARCH=amd64
-    /go/src/github.com/gravitational/teleport
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-operator-v11-arm-builder"
-  - rm -rf "/tmp/teleport-operator-v11-arm-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Build teleport-operator image "teleport-operator:v11-arm64"
-  image: docker
-  commands:
-  - docker run --privileged --rm tonistiigi/binfmt --install all
-  - mkdir -pv "/go/src/github.com/gravitational/teleport" && cd "/go/src/github.com/gravitational/teleport"
-  - mkdir -pv "/tmp/teleport-operator-v11-arm64-builder"
-  - echo '[registry."drone-docker-registry:5000"]' > "/tmp/teleport-operator-v11-arm64-builder/buildkitd.toml"
-  - echo '  http = true' >> "/tmp/teleport-operator-v11-arm64-builder/buildkitd.toml"
-  - docker buildx create --driver "docker-container" --driver-opt "network=host" --name
-    "teleport-operator-v11-arm64-builder" --config "/tmp/teleport-operator-v11-arm64-builder/buildkitd.toml"
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker buildx build --push --builder "teleport-operator-v11-arm64-builder" --platform
-    "linux/arm64" --tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
-    --file "/go/src/github.com/gravitational/teleport/integrations/operator/Dockerfile"
-    --build-arg BUILDBOX=public.ecr.aws/gravitational/teleport-buildbox-arm:teleport14
-    --build-arg COMPILER_NAME=aarch64-linux-gnu-gcc --build-arg GOLANG_VERSION=go1.21.2
-    --build-arg PROTOC_VERSION=3.20.3 --build-arg TARGETARCH=arm64 --build-arg BUILD_ARCH=amd64
-    /go/src/github.com/gravitational/teleport
-  - docker logout "public.ecr.aws"
-  - docker buildx rm "teleport-operator-v11-arm64-builder"
-  - rm -rf "/tmp/teleport-operator-v11-arm64-builder"
-  environment:
-    AWS_PROFILE: ecr-authenticated-pull
-    DOCKER_BUILDKIT: "1"
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Assume ECR - authenticated-pull AWS Role
-  - Find the latest available semver for v11
-  - Wait for docker
-  - Wait for docker registry
-  - Check out code
-  - Build major, minor, and full semvers
-  - Assume ECR - staging AWS Role
-  - Assume ECR - authenticated-pull AWS Role
-  - Assume ECR - production AWS Role
-- name: Tag and push image "teleport-operator:v11-amd64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-operator image "teleport-operator:v11-amd64"
-- name: Tag and push image "teleport-operator:v11-arm" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-operator image "teleport-operator:v11-arm"
-- name: Tag and push image "teleport-operator:v11-arm64" to ECR - staging
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64)
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 > /dev/null 2>&1 && echo 'Found existing
-    image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-operator image "teleport-operator:v11-arm64"
-- name: Create manifest and push "teleport-operator:major-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/major-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-operator:v11-amd64" to ECR - staging
-  - Tag and push image "teleport-operator:v11-arm" to ECR - staging
-  - Tag and push image "teleport-operator:v11-arm64" to ECR - staging
-- name: Create manifest and push "teleport-operator:minor-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/minor-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-operator:v11-amd64" to ECR - staging
-  - Tag and push image "teleport-operator:v11-arm" to ECR - staging
-  - Tag and push image "teleport-operator:v11-arm64" to ECR - staging
-- name: Create manifest and push "teleport-operator:full-$TIMESTAMP" to ECR - staging
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr get-login-password --region=us-west-2 | docker login -u="AWS" --password-stdin
-    146628656107.dkr.ecr.us-west-2.amazonaws.com
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - TIMESTAMP=$(date -d @"$DRONE_BUILD_CREATED" '+%Y%m%d%H%M')
-  - docker manifest inspect 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP > /dev/null 2>&1 && echo 'Found existing image,
-    skipping' || (docker manifest create 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-amd64 --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm --amend 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP-arm64 && docker manifest push 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-$TIMESTAMP)
-  - docker logout "146628656107.dkr.ecr.us-west-2.amazonaws.com"
-  environment:
-    AWS_PROFILE: ecr-staging
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-operator:v11-amd64" to ECR - staging
-  - Tag and push image "teleport-operator:v11-arm" to ECR - staging
-  - Tag and push image "teleport-operator:v11-arm64" to ECR - staging
-- name: Tag and push image "teleport-operator:v11-amd64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/amd64" drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-amd64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-amd64 public.ecr.aws/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-amd64 && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-amd64)
-  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
-    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
-  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
-  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-amd64
-    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
-  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-operator image "teleport-operator:v11-amd64"
-- name: Tag and push image "teleport-operator:v11-arm" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm" drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm public.ecr.aws/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm)
-  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
-    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
-  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
-  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm
-    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
-  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-operator image "teleport-operator:v11-arm"
-- name: Tag and push image "teleport-operator:v11-arm64" to ECR - production
-  image: docker
-  commands:
-  - docker pull --platform "linux/arm64" drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm64
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker tag drone-docker-registry:5000/teleport-operator:$(cat
-    "/go/var/full-version")-arm64 public.ecr.aws/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm64 && docker push public.ecr.aws/gravitational/teleport-operator:$(cat
-    "/go/var/full-version")-arm64)
-  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
-    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
-  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
-  - docker tag drone-docker-registry:5000/teleport-operator:$(cat "/go/var/full-version")-arm64
-    public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
-  - docker push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Build teleport-operator image "teleport-operator:v11-arm64"
-- name: Create manifest and push "teleport-operator:major" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")-arm64
-  - docker manifest push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/major-version")
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-operator:v11-amd64" to ECR - production
-  - Tag and push image "teleport-operator:v11-arm" to ECR - production
-  - Tag and push image "teleport-operator:v11-arm64" to ECR - production
-- name: Create manifest and push "teleport-operator:minor" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest create public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")-arm64
-  - docker manifest push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/minor-version")
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-operator:v11-amd64" to ECR - production
-  - Tag and push image "teleport-operator:v11-arm" to ECR - production
-  - Tag and push image "teleport-operator:v11-arm64" to ECR - production
-- name: Create manifest and push "teleport-operator:full" to ECR - production
-  image: docker
-  commands:
-  - apk add --no-cache aws-cli
-  - aws ecr-public get-login-password --region=us-east-1 | docker login -u="AWS" --password-stdin
-    public.ecr.aws
-  - printenv DOCKERHUB_PASSWORD | docker login -u="$DOCKERHUB_USERNAME" --password-stdin
-  - docker manifest inspect public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")
-    > /dev/null 2>&1 && echo 'Found existing image, skipping' || (docker manifest
-    create public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-amd64
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm
-    --amend public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version")-arm64
-    && docker manifest push public.ecr.aws/gravitational/teleport-operator:$(cat "/go/var/full-version"))
-  - docker logout "public.ecr.aws"
-  environment:
-    AWS_PROFILE: ecr-production
-    DOCKERHUB_PASSWORD:
-      from_secret: DOCKERHUB_READONLY_TOKEN
-    DOCKERHUB_USERNAME:
-      from_secret: DOCKERHUB_USERNAME
-  volumes:
-  - name: awsconfig
-    path: /root/.aws
-  - name: dockersock
-    path: /var/run
-  depends_on:
-  - Tag and push image "teleport-operator:v11-amd64" to ECR - production
-  - Tag and push image "teleport-operator:v11-arm" to ECR - production
-  - Tag and push image "teleport-operator:v11-arm64" to ECR - production
-services:
-- name: Start Docker
-  image: docker:dind
-  privileged: true
-  volumes:
-  - name: dockersock
-    path: /var/run
-- name: drone-docker-registry
-  image: registry:2
-  privileged: false
-  volumes: []
-volumes:
-- name: awsconfig
-  temp: {}
-- name: dockersock
-  temp: {}
-- name: dockerconfig
-  temp: {}
-image_pull_secrets:
-- DOCKERHUB_CREDENTIALS
-
 ---
 ################################################
 # Generated using dronegen, do not edit by hand!
@@ -16976,6 +16976,6 @@ image_pull_secrets:
 - DOCKERHUB_CREDENTIALS
 ---
 kind: signature
-hmac: 0a9eefeb445d1d2cb1b5b295efde997f47b04f5e856eddedd415b554bc7f18e7
+hmac: 01ec56abc6bcae651ff3d8d54e7245aab3bc8104f0938081cd37da85fccd3809
 
 ...
diff --git a/build.assets/images.mk b/build.assets/images.mk
index 5eb8a3b2aa9..ae449dce498 100644
--- a/build.assets/images.mk
+++ b/build.assets/images.mk
@@ -2,7 +2,7 @@
 # by other Makefiles
 # These values may need to be updated in `dronegen/container_image_products.go` if
 # they change here
-BUILDBOX_VERSION ?= teleport14
+BUILDBOX_VERSION ?= teleport15
 BUILDBOX_BASE_NAME ?= public.ecr.aws/gravitational/teleport-buildbox
 
 BUILDBOX=$(BUILDBOX_BASE_NAME):$(BUILDBOX_VERSION)
diff --git a/dronegen/container_images.go b/dronegen/container_images.go
index aacee0f089c..1ac2d26cb28 100644
--- a/dronegen/container_images.go
+++ b/dronegen/container_images.go
@@ -25,8 +25,8 @@ import (
 // *************************************************************
 // These should match up when a feature branch is cut, but should be off by
 // one on master
-const branchMajorVersion int = 14
-const latestReleaseVersion int = 13
+const branchMajorVersion int = 15
+const latestReleaseVersion int = 14
 
 func buildPipelineVersions() (string, []string) {
 	branchMajorSemver := fmt.Sprintf("v%d", branchMajorVersion)