diff --git a/Dockerfile b/Dockerfile
index 45189fe..41bff95 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@ ARG ALPINE_VERSION=3.19
 FROM docker.io/alpine:${ALPINE_VERSION}
 
 ARG ALPINE_VERSION
-ARG KUBE_VERSION=1.27
+ARG KUBE_VERSION=1.28
 
 RUN cd /etc/apk/keys && \
     wget "https://cdn.zero-downtime.net/alpine/stefan@zero-downtime.net-61bb6bfb.rsa.pub" && \
diff --git a/admin/libhelm.sh b/admin/libhelm.sh
index 81d5b76..8a9e8e9 100644
--- a/admin/libhelm.sh
+++ b/admin/libhelm.sh
@@ -4,7 +4,7 @@
 API_VERSIONS="-a monitoring.coreos.com/v1 -a snapshot.storage.k8s.io/v1 -a policy/v1/PodDisruptionBudget"
 
 #VERSION="latest"
-VERSION="v1.27"
+VERSION="v1.28"
 
 # Waits for max 300s and retries
 function wait_for() {
diff --git a/charts/kubeadm/Chart.yaml b/charts/kubeadm/Chart.yaml
index f7a04c1..889b2fd 100644
--- a/charts/kubeadm/Chart.yaml
+++ b/charts/kubeadm/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubeadm
 description: KubeZero Kubeadm cluster config
 type: application
-version: 1.27.8
+version: 1.28.8
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:
diff --git a/charts/kubeadm/templates/ClusterConfiguration.yaml b/charts/kubeadm/templates/ClusterConfiguration.yaml
index 58eccad..e2f60b9 100644
--- a/charts/kubeadm/templates/ClusterConfiguration.yaml
+++ b/charts/kubeadm/templates/ClusterConfiguration.yaml
@@ -9,7 +9,7 @@ networking:
   podSubnet: 10.244.0.0/16
 etcd:
   local:
-    # imageTag: 3.5.5-0
+    # imageTag: 3.5.12-0
     extraArgs:
       ### DNS discovery
       #discovery-srv: {{ .Values.domain }}
diff --git a/charts/kubeadm/templates/KubeProxyConfiguration.yaml b/charts/kubeadm/templates/KubeProxyConfiguration.yaml
index 26da352..681ddd7 100644
--- a/charts/kubeadm/templates/KubeProxyConfiguration.yaml
+++ b/charts/kubeadm/templates/KubeProxyConfiguration.yaml
@@ -2,6 +2,6 @@ apiVersion: kubeproxy.config.k8s.io/v1alpha1
 kind: KubeProxyConfiguration
 # kube-proxy doesnt really support setting dynamic bind-address via config, replaced by cilium long-term anyways
 metricsBindAddress: "0.0.0.0:10249"
-# calico < 3.22.1 breaks starting with 1.23, see https://github.com/projectcalico/calico/issues/5011
-# we go Cilium anyways
 mode: "iptables"
+logging:
+  format: json
diff --git a/charts/kubeadm/templates/_helpers.tpl b/charts/kubeadm/templates/_helpers.tpl
index 094346c..5aafc4b 100644
--- a/charts/kubeadm/templates/_helpers.tpl
+++ b/charts/kubeadm/templates/_helpers.tpl
@@ -1,9 +1,9 @@
 {{- /* Feature gates for all control plane components */ -}}
-{{- /* ToAdd: "PodAndContainerStatsFromCRI" */ -}}
 {{- /* Issues: "MemoryQoS" */ -}}
-{{- /* v1.28: "NodeSwap" */ -}}
+{{- /* v1.30?: "NodeSwap" */ -}}
+{{- /* v1.29: remove/beta now "SidecarContainers" */ -}}
 {{- define "kubeadm.featuregates" }}
-{{- $gates := list "CustomCPUCFSQuotaPeriod" }}
+{{- $gates := list "CustomCPUCFSQuotaPeriod" "SidecarContainers" "PodAndContainerStatsFromCRI" }}
 {{- if eq .return "csv" }}
 {{- range $key := $gates }}
 {{- $key }}=true,
diff --git a/charts/kubezero-ci/values.yaml b/charts/kubezero-ci/values.yaml
index 2f7be8d..d9f8a0c 100644
--- a/charts/kubezero-ci/values.yaml
+++ b/charts/kubezero-ci/values.yaml
@@ -164,7 +164,7 @@ jenkins:
   agent:
     image:
       repository: public.ecr.aws/zero-downtime/jenkins-podman
-      tag: v0.4.6
+      tag: v0.5.0
     #alwaysPullImage: true
     podRetention: "Default"
     showRawYaml: false
diff --git a/charts/kubezero/Chart.yaml b/charts/kubezero/Chart.yaml
index d170de2..d3d511b 100644
--- a/charts/kubezero/Chart.yaml
+++ b/charts/kubezero/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero
 description: KubeZero - Root App of Apps chart
 type: application
-version: 1.27.8
+version: 1.28.8
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:
diff --git a/docs/v1.28.md b/docs/v1.28.md
new file mode 100644
index 0000000..8db7fed
--- /dev/null
+++ b/docs/v1.28.md
@@ -0,0 +1,23 @@
+# KubeZero 1.28
+
+## What's new - Major themes
+- all KubeZero and support AMIs based on Alpine 3.19.1
+- further reduced boot time, eg. less than 30s for a bastion on EC2
+- sub-second timestamps for all system logs
+
+
+## Fixes
+- `kubectl top nodes` works now using node-exporter metrics rather than cadvisor
+
+## Version upgrades
+- cilium 1.14.4
+- istio 1.19.4
+- fluent-bit 2.2.0
+- ArgoCD 2.9
+- Prometheus / Grafana
+
+### FeatureGates
+- CustomCPUCFSQuotaPeriod
+
+## Known issues
+None.