diff --git a/build/cloudbuild.yaml b/build/cloudbuild.yaml
deleted file mode 100644
index af9f0228423..00000000000
--- a/build/cloudbuild.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# See https://cloud.google.com/cloud-build/docs/build-config
-timeout: 1200s
-options:
-  substitution_option: ALLOW_LOOSE
-  machineType: 'N1_HIGHCPU_8'
-steps:
-  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
-    entrypoint: make
-    dir: ./build/debian-base
-    env:
-      - DOCKER_CLI_EXPERIMENTAL=enabled
-      - REGISTRY=gcr.io/$PROJECT_ID
-      - IMAGE=gcr.io/$PROJECT_ID/debian-base
-      - BUILD_IMAGE=debian-build
-      - HOME=/root
-    args:
-      - all-push
-  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
-    entrypoint: make
-    dir: ./build/debian-iptables
-    env:
-      - DOCKER_CLI_EXPERIMENTAL=enabled
-      - REGISTRY=gcr.io/$PROJECT_ID
-      - BASE_REGISTRY=gcr.io/$PROJECT_ID
-      - IMAGE=gcr.io/$PROJECT_ID/debian-iptables
-      - HOME=/root
-    args:
-      - all-push
-  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
-    entrypoint: 'bash'
-    dir: ./build/pause
-    env:
-      - DOCKER_CLI_EXPERIMENTAL=enabled
-      - REGISTRY=gcr.io/$PROJECT_ID
-      - IMAGE=gcr.io/$PROJECT_ID/pause
-      - HOME=/root
-    args:
-      - '-c'
-      - |
-        gcloud auth configure-docker \
-        && make all-push
diff --git a/build/debian-base/Makefile b/build/debian-base/Makefile
index 8fabd5e1a7d..ffe9837effc 100755
--- a/build/debian-base/Makefile
+++ b/build/debian-base/Makefile
@@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
 IMAGE ?= $(REGISTRY)/debian-base
 BUILD_IMAGE ?= debian-build
 
-TAG ?= v2.0.1
+TAG ?= v2.1.0
 
 TAR_FILE ?= rootfs.tar
 ARCH?=amd64
diff --git a/build/debian-base/OWNERS b/build/debian-base/OWNERS
index 2d01f23decb..9f31a67a8c5 100644
--- a/build/debian-base/OWNERS
+++ b/build/debian-base/OWNERS
@@ -1,10 +1,12 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
+  - build-image-reviewers
   - BenTheElder
   - mkumatag
   - tallclair
 approvers:
+  - build-image-approvers
   - BenTheElder
   - mkumatag
   - tallclair
diff --git a/build/debian-base/cloudbuild.yaml b/build/debian-base/cloudbuild.yaml
new file mode 100644
index 00000000000..87181af413b
--- /dev/null
+++ b/build/debian-base/cloudbuild.yaml
@@ -0,0 +1,15 @@
+# See https://cloud.google.com/cloud-build/docs/build-config
+timeout: 1200s
+options:
+  substitution_option: ALLOW_LOOSE
+  machineType: 'N1_HIGHCPU_8'
+steps:
+  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
+    entrypoint: make
+    env:
+      - DOCKER_CLI_EXPERIMENTAL=enabled
+      - REGISTRY=gcr.io/$PROJECT_ID
+      - IMAGE=gcr.io/$PROJECT_ID/debian-base
+      - BUILD_IMAGE=debian-build
+    args:
+      - all-push
diff --git a/build/debian-iptables/Makefile b/build/debian-iptables/Makefile
index 17d4986fe79..1e7c4f5f93c 100644
--- a/build/debian-iptables/Makefile
+++ b/build/debian-iptables/Makefile
@@ -16,13 +16,13 @@
 
 REGISTRY?="staging-k8s.gcr.io"
 IMAGE=$(REGISTRY)/debian-iptables
-TAG?=v12.0.2
+TAG?=v12.0.1
 ARCH?=amd64
 ALL_ARCH = amd64 arm arm64 ppc64le s390x
 TEMP_DIR:=$(shell mktemp -d)
 
 BASE_REGISTRY?=k8s.gcr.io
-BASEIMAGE?=$(BASE_REGISTRY)/debian-base-$(ARCH):v2.0.1
+BASEIMAGE?=$(BASE_REGISTRY)/debian-base-$(ARCH):v2.0.0
 
 # This option is for running docker manifest command
 export DOCKER_CLI_EXPERIMENTAL := enabled
diff --git a/build/debian-iptables/OWNERS b/build/debian-iptables/OWNERS
index e5b4c36bad5..477c0d59b0e 100644
--- a/build/debian-iptables/OWNERS
+++ b/build/debian-iptables/OWNERS
@@ -1,6 +1,7 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 reviewers:
+  - build-image-reviewers
   - BenTheElder
   - bowei
   - freehan
@@ -9,6 +10,7 @@ reviewers:
   - mrhohn
   - tallclair
 approvers:
+  - build-image-approvers
   - BenTheElder
   - bowei
   - freehan
diff --git a/build/debian-iptables/cloudbuild.yaml b/build/debian-iptables/cloudbuild.yaml
new file mode 100644
index 00000000000..670edd9feb4
--- /dev/null
+++ b/build/debian-iptables/cloudbuild.yaml
@@ -0,0 +1,15 @@
+# See https://cloud.google.com/cloud-build/docs/build-config
+timeout: 1200s
+options:
+  substitution_option: ALLOW_LOOSE
+  machineType: 'N1_HIGHCPU_8'
+steps:
+  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
+    entrypoint: make
+    env:
+      - DOCKER_CLI_EXPERIMENTAL=enabled
+      - REGISTRY=gcr.io/$PROJECT_ID
+      - BASE_REGISTRY=gcr.io/$PROJECT_ID
+      - IMAGE=gcr.io/$PROJECT_ID/debian-iptables
+    args:
+      - all-push
diff --git a/build/dependencies.yaml b/build/dependencies.yaml
index dc0396b3cf1..70beb72db64 100644
--- a/build/dependencies.yaml
+++ b/build/dependencies.yaml
@@ -1,44 +1,4 @@
 dependencies:
-  - name: "etcd"
-    version: 3.4.7
-    refPaths:
-    - path: cluster/gce/manifests/etcd.manifest
-      match: etcd_docker_tag|etcd_version
-    - path: build/workspace.bzl
-      match: ETCD_VERSION
-    - path: cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
-      match: k8s.gcr.io/etcd-empty-dir-cleanup
-    - path: cluster/gce/upgrade-aliases.sh
-      match: ETCD_IMAGE|ETCD_VERSION
-    - path: cluster/images/etcd-empty-dir-cleanup/Makefile
-      match: ETCD_VERSION|TAG
-    - path: cluster/images/etcd/Makefile
-      match: BUNDLED_ETCD_VERSIONS\?|LATEST_ETCD_VERSION\?
-    - path: cluster/images/etcd/migrate-if-needed.sh
-      match: BUNDLED_VERSIONS=
-    - path: cmd/kubeadm/app/constants/constants.go
-    - path: hack/lib/etcd.sh
-      match: ETCD_VERSION=
-    - path: staging/src/k8s.io/sample-apiserver/artifacts/example/deployment.yaml
-      match: quay.io/coreos/etcd
-    - path: test/e2e/framework/nodes_util.go
-      match: const etcdImage
-
-  - name: "docker"
-    version: 19.03
-    refPaths:
-    - path: vendor/k8s.io/system-validators/validators/docker_validator.go
-      match: latestValidatedDockerVersion
-
-
-  - name: "golang"
-    version: 1.13.9
-    refPaths:
-    - path: build/build-image/cross/VERSION
-    - path: test/images/Makefile
-      match: GOLANG_VERSION
-
-
   - name: "cni"
     version: 0.8.5
     refPaths:
@@ -51,7 +11,6 @@ dependencies:
     - path: test/e2e_node/remote/utils.go
       match: cniVersion[\t\n\f\r ]*=
 
-
   - name: "coredns-kube-up"
     version: 1.6.7
     refPaths:
@@ -77,3 +36,141 @@ dependencies:
       match: DEFAULT_CRICTL_VERSION=
     - path: cluster/gce/windows/k8s-node-setup.psm1
       match: CRICTL_VERSION =
+
+  - name: "docker"
+    version: 19.03
+    refPaths:
+    - path: vendor/k8s.io/system-validators/validators/docker_validator.go
+      match: latestValidatedDockerVersion
+
+  - name: "etcd"
+    version: 3.4.7
+    refPaths:
+    - path: cluster/gce/manifests/etcd.manifest
+      match: etcd_docker_tag|etcd_version
+    - path: build/workspace.bzl
+      match: ETCD_VERSION
+    - path: cluster/gce/manifests/etcd-empty-dir-cleanup.yaml
+      match: k8s.gcr.io/etcd-empty-dir-cleanup
+    - path: cluster/gce/upgrade-aliases.sh
+      match: ETCD_IMAGE|ETCD_VERSION
+    - path: cluster/images/etcd-empty-dir-cleanup/Makefile
+      match: ETCD_VERSION|TAG
+    - path: cluster/images/etcd/Makefile
+      match: BUNDLED_ETCD_VERSIONS\?|LATEST_ETCD_VERSION\?
+    - path: cluster/images/etcd/migrate-if-needed.sh
+      match: BUNDLED_VERSIONS=
+    - path: cmd/kubeadm/app/constants/constants.go
+    - path: hack/lib/etcd.sh
+      match: ETCD_VERSION=
+    - path: staging/src/k8s.io/sample-apiserver/artifacts/example/deployment.yaml
+      match: quay.io/coreos/etcd
+    - path: test/e2e/framework/nodes_util.go
+      match: const etcdImage
+
+  - name: "golang"
+    version: 1.13.9
+    refPaths:
+    - path: build/build-image/cross/VERSION
+    - path: test/images/Makefile
+      match: GOLANG_VERSION
+
+  - name: "k8s.gcr.io/debian-base"
+    version: 2.1.0
+    refPaths:
+    - path: build/debian-base/Makefile
+      match: TAG \?=
+
+  - name: "k8s.gcr.io/debian-base: dependents"
+    version: 2.0.0
+    refPaths:
+    - path: build/common.sh
+      match: debian_base_version=
+    - path: build/workspace.bzl
+      match: tag =
+    - path: build/debian-iptables/Makefile
+      match: BASEIMAGE\?\=\$\(BASE_REGISTRY\)\/debian-base-\$\(ARCH\)
+    - path: cluster/images/etcd/Makefile
+      match: BASEIMAGE\?\=k8s\.gcr\.io\/debian-base:v\d+\.\d+\.\d+
+    - path: cluster/images/etcd/Makefile
+      match: BASEIMAGE\?\=k8s\.gcr\.io\/debian-base-arm:v\d+\.\d+\.\d+
+    - path: cluster/images/etcd/Makefile
+      match: BASEIMAGE\?\=k8s\.gcr\.io\/debian-base-arm64:v\d+\.\d+\.\d+
+    - path: cluster/images/etcd/Makefile
+      match: BASEIMAGE\?\=k8s\.gcr\.io\/debian-base-ppc64le:v\d+\.\d+\.\d+
+    - path: cluster/images/etcd/Makefile
+      match: BASEIMAGE\?\=k8s\.gcr\.io\/debian-base-s390x:v\d+\.\d+\.\d+
+    - path: cluster/images/etcd-empty-dir-cleanup/Dockerfile
+      match: k8s.gcr.io\/debian-base:v\d+\.\d+\.\d+
+
+  - name: "k8s.gcr.io/debian-iptables"
+    version: 12.0.1
+    refPaths:
+    - path: build/debian-iptables/Makefile
+      match: TAG\?=
+
+  - name: "k8s.gcr.io/debian-iptables: dependents"
+    version: 12.0.1
+    refPaths:
+    - path: build/common.sh
+      match: debian_iptables_version=
+    - path: build/workspace.bzl
+      match: tag =
+
+  - name: "k8s.gcr.io/pause"
+    version: 3.3
+    refPaths:
+    - path: build/pause/Makefile
+      match: TAG =
+
+  - name: "k8s.gcr.io/pause: dependents"
+    version: 3.2
+    refPaths:
+    - path: cmd/kubeadm/app/constants/constants_unix.go
+      match: PauseVersion\s+=
+    - path: cmd/kubeadm/app/util/template_test.go
+      match: validTmpl\s+=
+    - path: cmd/kubeadm/app/util/template_test.go
+      match: validTmplOut\s+=
+    - path: cmd/kubeadm/app/util/template_test.go
+      match: doNothing\s+=
+    - path: cmd/kubelet/app/options/container_runtime.go
+      match: defaultPodSandboxImageVersion\s+=
+    - path: hack/testdata/pod-with-precision.json
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: pkg/kubelet/dockershim/docker_sandbox.go
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: staging/src/k8s.io/kubectl/testdata/set/multi-resource-yaml.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: staging/src/k8s.io/kubectl/testdata/set/namespaced-resource.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/cmd/core.sh
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/fixtures/pkg/kubectl/cmd/set/namespaced-resource.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/benchmark-controller.json
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-default.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-node-affinity.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-pod-affinity.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-pod-anti-affinity.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-preferred-pod-affinity.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-preferred-pod-anti-affinity.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-preferred-topology-spreading.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-secret-volume.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/integration/scheduler_perf/config/pod-with-topology-spreading.yaml
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/utils/runners.go
+      match: k8s.gcr.io\/pause:\d+\.\d+
+    - path: test/utils/image/manifest.go
+      match: configs\[Pause\] = Config{gcRegistry, "pause", "\d+\.\d+"}
diff --git a/build/pause/Makefile b/build/pause/Makefile
index 1979c49548c..0559b13a8a8 100644
--- a/build/pause/Makefile
+++ b/build/pause/Makefile
@@ -18,7 +18,7 @@ REGISTRY ?= staging-k8s.gcr.io
 IMAGE = $(REGISTRY)/pause
 IMAGE_WITH_ARCH = $(IMAGE)-$(ARCH)
 
-TAG = 3.2
+TAG = 3.3
 REV = $(shell git describe --contains --always --match='v*')
 
 # Architectures supported: amd64, arm, arm64, ppc64le and s390x
diff --git a/build/pause/OWNERS b/build/pause/OWNERS
new file mode 100644
index 00000000000..8760e69dd46
--- /dev/null
+++ b/build/pause/OWNERS
@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - build-image-approvers
+reviewers:
+  - build-image-reviewers
diff --git a/build/pause/cloudbuild.yaml b/build/pause/cloudbuild.yaml
new file mode 100644
index 00000000000..6c83082b4f2
--- /dev/null
+++ b/build/pause/cloudbuild.yaml
@@ -0,0 +1,19 @@
+# See https://cloud.google.com/cloud-build/docs/build-config
+timeout: 1200s
+options:
+  substitution_option: ALLOW_LOOSE
+  machineType: 'N1_HIGHCPU_8'
+steps:
+  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
+    entrypoint: 'bash'
+    dir: ./build/pause
+    env:
+      - DOCKER_CLI_EXPERIMENTAL=enabled
+      - REGISTRY=gcr.io/$PROJECT_ID
+      - IMAGE=gcr.io/$PROJECT_ID/pause
+      - HOME=/root
+    args:
+      - '-c'
+      - |
+        gcloud auth configure-docker \
+        && make all-push
diff --git a/cluster/images/etcd-empty-dir-cleanup/Dockerfile b/cluster/images/etcd-empty-dir-cleanup/Dockerfile
index 7398f4e4642..0775a5e496f 100644
--- a/cluster/images/etcd-empty-dir-cleanup/Dockerfile
+++ b/cluster/images/etcd-empty-dir-cleanup/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM k8s.gcr.io/debian-base:v1.0.0
+FROM k8s.gcr.io/debian-base:v2.0.0
 
 COPY etcdctl etcd-empty-dir-cleanup.sh /
 RUN chmod a+rx /etcdctl /etcd-empty-dir-cleanup.sh