diff --git a/config.tf b/config.tf
index d6157d998d..9b8fcff068 100644
--- a/config.tf
+++ b/config.tf
@@ -87,7 +87,7 @@ variable "tectonic_container_images" {
     tectonic_etcd_operator       = "quay.io/coreos/tectonic-etcd-operator:v0.0.2"
     tectonic_prometheus_operator = "quay.io/coreos/tectonic-prometheus-operator:v1.7.1"
     tectonic_cluo_operator       = "quay.io/coreos/tectonic-cluo-operator:v0.2.5"
-    tectonic_torcx               = "quay.io/coreos/tectonic-torcx:installer-latest"
+    tectonic_torcx               = "quay.io/coreos/tectonic-torcx:v0.2.0"
   }
 }
 
diff --git a/modules/aws/master-asg/ignition.tf b/modules/aws/master-asg/ignition.tf
index b96f55fd1e..cef3430886 100644
--- a/modules/aws/master-asg/ignition.tf
+++ b/modules/aws/master-asg/ignition.tf
@@ -3,6 +3,7 @@ data "ignition_config" "main" {
     "${data.ignition_file.detect_master.id}",
     "${data.ignition_file.init_assets.id}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
     "${var.ign_max_user_watches_id}",
     "${var.ign_s3_puller_id}",
   ]
diff --git a/modules/aws/worker-asg/ignition.tf b/modules/aws/worker-asg/ignition.tf
index b41b983615..eac9216079 100644
--- a/modules/aws/worker-asg/ignition.tf
+++ b/modules/aws/worker-asg/ignition.tf
@@ -1,6 +1,7 @@
 data "ignition_config" "main" {
   files = [
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
     "${var.ign_max_user_watches_id}",
     "${var.ign_s3_puller_id}",
   ]
diff --git a/modules/azure/master-as/ignition-master.tf b/modules/azure/master-as/ignition-master.tf
index 56f26e44a8..4816be9a70 100644
--- a/modules/azure/master-as/ignition-master.tf
+++ b/modules/azure/master-as/ignition-master.tf
@@ -2,6 +2,7 @@ data "ignition_config" "master" {
   files = [
     "${data.ignition_file.kubeconfig.id}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
     "${var.ign_azure_udev_rules_id}",
     "${var.ign_max_user_watches_id}",
     "${data.ignition_file.cloud_provider_config.id}",
diff --git a/modules/azure/worker-as/ignition-worker.tf b/modules/azure/worker-as/ignition-worker.tf
index 8bd3dc8291..2813121402 100644
--- a/modules/azure/worker-as/ignition-worker.tf
+++ b/modules/azure/worker-as/ignition-worker.tf
@@ -2,6 +2,7 @@ data "ignition_config" "worker" {
   files = [
     "${data.ignition_file.kubeconfig.id}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
     "${var.ign_azure_udev_rules_id}",
     "${var.ign_max_user_watches_id}",
     "${data.ignition_file.cloud-provider-config.id}",
diff --git a/modules/gcp/master-igm/ignition.tf b/modules/gcp/master-igm/ignition.tf
index 386b882c3d..3ab283f574 100644
--- a/modules/gcp/master-igm/ignition.tf
+++ b/modules/gcp/master-igm/ignition.tf
@@ -3,6 +3,7 @@ data "ignition_config" "main" {
     "${data.ignition_file.kubeconfig.id}",
     "${var.ign_max_user_watches_id}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
     "${var.ign_gcs_puller_id}",
     "${data.ignition_file.init_assets.id}",
     "${data.ignition_file.detect_master.id}",
diff --git a/modules/gcp/master-igm/variables-ignition.tf b/modules/gcp/master-igm/variables-ignition.tf
deleted file mode 100644
index 6b5116fbbd..0000000000
--- a/modules/gcp/master-igm/variables-ignition.tf
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is supposed to be symlinked in consuming modules
-
-variable "ign_max_user_watches_id" {
-  type = "string"
-}
-
-variable "ign_docker_dropin_id" {
-  type = "string"
-}
-
-variable "ign_kubelet_service_id" {
-  type = "string"
-}
-
-variable "ign_locksmithd_service_id" {
-  type = "string"
-}
-
-variable "ign_installer_kubelet_env_id" {
-  type = "string"
-}
-
-variable "ign_k8s_node_bootstrap_service_id" {
-  type = "string"
-}
diff --git a/modules/gcp/master-igm/variables-ignition.tf b/modules/gcp/master-igm/variables-ignition.tf
new file mode 120000
index 0000000000..e22a48c662
--- /dev/null
+++ b/modules/gcp/master-igm/variables-ignition.tf
@@ -0,0 +1 @@
+../../ignition/outputs.import
\ No newline at end of file
diff --git a/modules/gcp/worker-igm/ignition.tf b/modules/gcp/worker-igm/ignition.tf
index 7f0ac14495..929a810e17 100644
--- a/modules/gcp/worker-igm/ignition.tf
+++ b/modules/gcp/worker-igm/ignition.tf
@@ -3,6 +3,7 @@ data "ignition_config" "main" {
     "${data.ignition_file.kubeconfig.id}",
     "${var.ign_max_user_watches_id}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
   ]
 
   systemd = [
diff --git a/modules/gcp/worker-igm/variables-ignition.tf b/modules/gcp/worker-igm/variables-ignition.tf
deleted file mode 100644
index 6b5116fbbd..0000000000
--- a/modules/gcp/worker-igm/variables-ignition.tf
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is supposed to be symlinked in consuming modules
-
-variable "ign_max_user_watches_id" {
-  type = "string"
-}
-
-variable "ign_docker_dropin_id" {
-  type = "string"
-}
-
-variable "ign_kubelet_service_id" {
-  type = "string"
-}
-
-variable "ign_locksmithd_service_id" {
-  type = "string"
-}
-
-variable "ign_installer_kubelet_env_id" {
-  type = "string"
-}
-
-variable "ign_k8s_node_bootstrap_service_id" {
-  type = "string"
-}
diff --git a/modules/gcp/worker-igm/variables-ignition.tf b/modules/gcp/worker-igm/variables-ignition.tf
new file mode 120000
index 0000000000..e22a48c662
--- /dev/null
+++ b/modules/gcp/worker-igm/variables-ignition.tf
@@ -0,0 +1 @@
+../../ignition/outputs.import
\ No newline at end of file
diff --git a/modules/ignition/assets.tf b/modules/ignition/assets.tf
index 7061c5dceb..15cd81e3e8 100644
--- a/modules/ignition/assets.tf
+++ b/modules/ignition/assets.tf
@@ -28,6 +28,20 @@ data "ignition_systemd_unit" "docker_dropin" {
   ]
 }
 
+data "template_file" "installer_runtime_mappings" {
+  template = "${file("${path.module}/resources/kubernetes/runtime-mappings.yaml")}"
+}
+
+data "ignition_file" "installer_runtime_mappings" {
+  filesystem = "root"
+  path       = "/etc/kubernetes/installer/runtime-mappings.yaml"
+  mode       = 0644
+
+  content {
+    content = "${data.template_file.installer_runtime_mappings.rendered}"
+  }
+}
+
 data "template_file" "kubelet" {
   template = "${file("${path.module}/resources/services/kubelet.service")}"
 
diff --git a/modules/ignition/outputs.import b/modules/ignition/outputs.import
index 6b5116fbbd..98a938565f 100644
--- a/modules/ignition/outputs.import
+++ b/modules/ignition/outputs.import
@@ -16,6 +16,10 @@ variable "ign_locksmithd_service_id" {
   type = "string"
 }
 
+variable "ign_installer_runtime_mappings_id" {
+  type = "string"
+}
+
 variable "ign_installer_kubelet_env_id" {
   type = "string"
 }
diff --git a/modules/ignition/outputs.tf b/modules/ignition/outputs.tf
index 22f1faa882..a984ea0c22 100644
--- a/modules/ignition/outputs.tf
+++ b/modules/ignition/outputs.tf
@@ -46,6 +46,14 @@ output "locksmithd_service_id" {
   value = "${data.ignition_systemd_unit.locksmithd.id}"
 }
 
+output "installer_runtime_mappings_id" {
+  value = "${data.ignition_file.installer_runtime_mappings.id}"
+}
+
+output "installer_runtime_mappings_rendered" {
+  value = "${data.template_file.installer_runtime_mappings.rendered}"
+}
+
 output "installer_kubelet_env_id" {
   value = "${data.ignition_file.installer_kubelet_env.id}"
 }
diff --git a/modules/ignition/resources/kubernetes/runtime-mappings.yaml b/modules/ignition/resources/kubernetes/runtime-mappings.yaml
new file mode 100644
index 0000000000..920e5b7b79
--- /dev/null
+++ b/modules/ignition/resources/kubernetes/runtime-mappings.yaml
@@ -0,0 +1,16 @@
+kind: VersionManifestV1
+versions:
+  k8s:
+    1.6:
+        docker: [ "1.12"]
+    1.7:
+        # Kubernetes: https://github.com/kubernetes/kubernetes/blob/v1.9.0-alpha.2/CHANGELOG-1.7.md#external-dependency-version-information
+        # Latest CL stable: https://tectonic-torcx.release.core-os.net/manifests/amd64-usr/1520.8.0/torcx_manifest.json
+        docker: [ "1.12" ]
+    1.8:
+        # Kubernetes: https://github.com/kubernetes/kubernetes/blob/v1.9.0-alpha.2/CHANGELOG-1.8.md#external-dependency-version-information
+        # Latest CL stable: https://tectonic-torcx.release.core-os.net/manifests/amd64-usr/1520.8.0/torcx_manifest.json
+        docker: [ "17.03", "1.12"]
+    1.9:
+        # TODO: forecast only, fix this with actual versions
+        docker: [ "17.03", "1.12"]
diff --git a/modules/openstack/nodes/ignition.tf b/modules/openstack/nodes/ignition.tf
index e3b0b2da8c..071b0aab78 100644
--- a/modules/openstack/nodes/ignition.tf
+++ b/modules/openstack/nodes/ignition.tf
@@ -8,6 +8,7 @@ data "ignition_config" "node" {
   files = [
     "${data.ignition_file.kubeconfig.id}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
     "${var.ign_max_user_watches_id}",
     "${data.ignition_file.resolv_conf.id}",
     "${data.ignition_file.hostname.*.id[count.index]}",
diff --git a/modules/vmware/node/ignition.tf b/modules/vmware/node/ignition.tf
index 3464a501a1..1ae5806f66 100644
--- a/modules/vmware/node/ignition.tf
+++ b/modules/vmware/node/ignition.tf
@@ -9,6 +9,7 @@ data "ignition_config" "node" {
     "${var.ign_max_user_watches_id}",
     "${data.ignition_file.node_hostname.*.id[count.index]}",
     "${var.ign_installer_kubelet_env_id}",
+    "${var.ign_installer_runtime_mappings_id}",
   ]
 
   systemd = ["${compact(list(
diff --git a/platforms/aws/main.tf b/platforms/aws/main.tf
index b8c2c458b1..ed0bd70fb3 100644
--- a/platforms/aws/main.tf
+++ b/platforms/aws/main.tf
@@ -129,6 +129,7 @@ module "masters" {
   ign_bootkube_service_id           = "${module.bootkube.systemd_service_id}"
   ign_docker_dropin_id              = "${module.ignition_masters.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_masters.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_masters.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_masters.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_masters.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_masters.locksmithd_service_id}"
@@ -176,6 +177,7 @@ module "workers" {
   extra_tags                        = "${var.tectonic_aws_extra_tags}"
   ign_docker_dropin_id              = "${module.ignition_workers.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_workers.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_workers.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_workers.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_workers.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_workers.locksmithd_service_id}"
diff --git a/platforms/azure/main.tf b/platforms/azure/main.tf
index e85c024f8c..5085b4c35c 100644
--- a/platforms/azure/main.tf
+++ b/platforms/azure/main.tf
@@ -144,6 +144,7 @@ module "masters" {
   ign_bootkube_service_id           = "${module.bootkube.systemd_service_id}"
   ign_docker_dropin_id              = "${module.ignition_masters.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_masters.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_masters.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_masters.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_masters.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_masters.locksmithd_service_id}"
@@ -191,6 +192,7 @@ module "workers" {
   ign_azure_udev_rules_id           = "${module.ignition_workers.azure_udev_rules_id}"
   ign_docker_dropin_id              = "${module.ignition_workers.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_workers.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_workers.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_workers.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_workers.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_workers.locksmithd_service_id}"
diff --git a/platforms/gcp/main.tf b/platforms/gcp/main.tf
index 8db90b653e..f6dc61e57e 100644
--- a/platforms/gcp/main.tf
+++ b/platforms/gcp/main.tf
@@ -95,6 +95,7 @@ module "masters" {
   ign_bootkube_service_id           = "${module.bootkube.systemd_service_id}"
   ign_docker_dropin_id              = "${module.ignition_masters.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_masters.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_masters.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_masters.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_masters.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_masters.locksmithd_service_id}"
@@ -120,7 +121,7 @@ module "workers" {
   disk_type                         = "${var.tectonic_gcp_worker_disktype}"
   ign_docker_dropin_id              = "${module.ignition_workers.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_workers.installer_kubelet_env_id}"
-  ign_installer_kubelet_env_id      = "${module.ignition_workers.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_masters.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_workers.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_workers.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_workers.locksmithd_service_id}"
diff --git a/platforms/metal/cl/bootkube-controller.yaml.tmpl b/platforms/metal/cl/bootkube-controller.yaml.tmpl
index 3ee7608bb6..68d85b6924 100644
--- a/platforms/metal/cl/bootkube-controller.yaml.tmpl
+++ b/platforms/metal/cl/bootkube-controller.yaml.tmpl
@@ -64,6 +64,11 @@ storage:
       mode: 0644
       contents:
         inline: {{.ign_installer_kubelet_env_json}}
+    - path: /etc/kubernetes/installer/runtime-mappings.yaml
+      filesystem: root
+      mode: 0644
+      contents:
+        inline: {{.ign_installer_runtime_mappings_json}}
 passwd:
   users:
     - name: core
diff --git a/platforms/metal/cl/bootkube-worker.yaml.tmpl b/platforms/metal/cl/bootkube-worker.yaml.tmpl
index 620c296bc0..72dd3a4e6e 100644
--- a/platforms/metal/cl/bootkube-worker.yaml.tmpl
+++ b/platforms/metal/cl/bootkube-worker.yaml.tmpl
@@ -35,6 +35,11 @@ storage:
       mode: 0644
       contents:
         inline: {{.ign_installer_kubelet_env_json}}
+    - path: /etc/kubernetes/installer/runtime-mappings.yaml
+      filesystem: root
+      mode: 0644
+      contents:
+        inline: {{.ign_installer_runtime_mappings_json}}
     - path: /etc/hostname
       filesystem: root
       mode: 0644
diff --git a/platforms/metal/matchers.tf b/platforms/metal/matchers.tf
index d05796a1f6..d0365bfd69 100644
--- a/platforms/metal/matchers.tf
+++ b/platforms/metal/matchers.tf
@@ -66,6 +66,7 @@ resource "matchbox_group" "controller" {
     ign_docker_dropin_json              = "${jsonencode(module.ignition_masters.docker_dropin_rendered)}"
     ign_etcd_dropin_json                = "${jsonencode(module.ignition_masters.etcd_dropin_rendered_list[count.index])}"
     ign_installer_kubelet_env_json      = "${jsonencode(module.ignition_masters.installer_kubelet_env_rendered)}"
+    ign_installer_runtime_mappings_json = "${jsonencode(module.ignition_masters.installer_runtime_mappings_rendered)}"
     ign_k8s_node_bootstrap_service_json = "${jsonencode(module.ignition_masters.k8s_node_bootstrap_service_rendered)}"
     ign_kubelet_service_json            = "${jsonencode(module.ignition_masters.kubelet_service_rendered)}"
     ign_max_user_watches_json           = "${jsonencode(module.ignition_masters.max_user_watches_rendered)}"
@@ -109,6 +110,7 @@ resource "matchbox_group" "worker" {
 
     ign_docker_dropin_json              = "${jsonencode(module.ignition_workers.docker_dropin_rendered)}"
     ign_installer_kubelet_env_json      = "${jsonencode(module.ignition_workers.installer_kubelet_env_rendered)}"
+    ign_installer_runtime_mappings_json = "${jsonencode(module.ignition_workers.installer_runtime_mappings_rendered)}"
     ign_k8s_node_bootstrap_service_json = "${jsonencode(module.ignition_workers.k8s_node_bootstrap_service_rendered)}"
     ign_kubelet_service_json            = "${jsonencode(module.ignition_workers.kubelet_service_rendered)}"
     ign_max_user_watches_json           = "${jsonencode(module.ignition_workers.max_user_watches_rendered)}"
diff --git a/platforms/openstack/neutron/main.tf b/platforms/openstack/neutron/main.tf
index 40cc83b713..5fc574f20b 100644
--- a/platforms/openstack/neutron/main.tf
+++ b/platforms/openstack/neutron/main.tf
@@ -206,6 +206,7 @@ EOF
   ign_bootkube_service_id           = "${module.bootkube.systemd_service_id}"
   ign_docker_dropin_id              = "${module.ignition_masters.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_masters.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_masters.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_masters.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_masters.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_masters.locksmithd_service_id}"
@@ -243,6 +244,7 @@ EOF
   hostname_infix                    = "worker"
   ign_docker_dropin_id              = "${module.ignition_workers.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_workers.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_workers.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_workers.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_workers.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_workers.locksmithd_service_id}"
diff --git a/platforms/vmware/main.tf b/platforms/vmware/main.tf
index ec7d5eab66..2c273e6aee 100644
--- a/platforms/vmware/main.tf
+++ b/platforms/vmware/main.tf
@@ -67,6 +67,7 @@ module "masters" {
   ign_bootkube_service_id           = "${module.bootkube.systemd_service_id}"
   ign_docker_dropin_id              = "${module.ignition_masters.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_masters.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_masters.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_masters.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_masters.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_masters.locksmithd_service_id}"
@@ -115,6 +116,7 @@ module "workers" {
   hostname                          = "${var.tectonic_vmware_worker_hostnames}"
   ign_docker_dropin_id              = "${module.ignition_workers.docker_dropin_id}"
   ign_installer_kubelet_env_id      = "${module.ignition_workers.installer_kubelet_env_id}"
+  ign_installer_runtime_mappings_id = "${module.ignition_workers.installer_runtime_mappings_id}"
   ign_k8s_node_bootstrap_service_id = "${module.ignition_workers.k8s_node_bootstrap_service_id}"
   ign_kubelet_service_id            = "${module.ignition_workers.kubelet_service_id}"
   ign_locksmithd_service_id         = "${module.ignition_workers.locksmithd_service_id}"