diff --git a/cluster/images/etcd/Dockerfile b/cluster/images/etcd/Dockerfile
index 6c811ea1b98..4e8e4027c7d 100644
--- a/cluster/images/etcd/Dockerfile
+++ b/cluster/images/etcd/Dockerfile
@@ -14,6 +14,9 @@
 
 FROM BASEIMAGE as builder
 
+# This image needs bash for running "migrate-if-needed.sh". Instead of a full debian image
+# we use just the bash-static and we wrap bash-static into a distroless image instead of
+# a full debian image
 RUN apt-get update -y \
 	&& apt-get -yy -q install --no-install-recommends --no-install-suggests --fix-missing \
 		bash-static
diff --git a/cluster/images/etcd/cloudbuild.yaml b/cluster/images/etcd/cloudbuild.yaml
new file mode 100644
index 00000000000..75feeb310d6
--- /dev/null
+++ b/cluster/images/etcd/cloudbuild.yaml
@@ -0,0 +1,22 @@
+# See https://cloud.google.com/cloud-build/docs/build-config
+timeout: 1200s
+options:
+  substitution_option: ALLOW_LOOSE
+  machineType: 'N1_HIGHCPU_8'
+steps:
+  - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20200422-b25d964'
+    entrypoint: 'bash'
+    dir: ./cluster/images/etcd
+    env:
+      - DOCKER_CLI_EXPERIMENTAL=enabled
+      - REGISTRY=gcr.io/$PROJECT_ID
+      - PUSH_REGISTRY=gcr.io/$PROJECT_ID
+      - IMAGE=gcr.io/$PROJECT_ID/etcd
+      - BUILD_IMAGE=debian-build
+      - TMPDIR=/workspace
+    args:
+      - '-c'
+      - |
+        gcloud auth configure-docker \
+        && docker run --rm --privileged linuxkit/binfmt:4ea3b9b0938cbd19834c096aa31ff475cc75d281 \
+        && make all-push