diff --git a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2 b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2
index b11fb3343..ca48a3a91 100644
--- a/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2
+++ b/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2
@@ -14,7 +14,7 @@ certificateKey: {{ kubeadm_certificate_key }}
 {% endif %}
 nodeRegistration:
 {% if kube_override_hostname | default('') %}
-  name: {{ kube_override_hostname }}
+  name: "{{ kube_override_hostname }}"
 {% endif %}
 {% if inventory_hostname in groups['kube_control_plane'] and inventory_hostname not in groups['kube_node'] %}
   taints:
@@ -76,17 +76,17 @@ etcd:
 {% endfor %}
     serverCertSANs:
 {% for san in etcd_cert_alt_names %}
-      - {{ san }}
+      - "{{ san }}"
 {% endfor %}
 {% for san in etcd_cert_alt_ips %}
-      - {{ san }}
+      - "{{ san }}"
 {% endfor %}
     peerCertSANs:
 {% for san in etcd_cert_alt_names %}
-      - {{ san }}
+      - "{{ san }}"
 {% endfor %}
 {% for san in etcd_cert_alt_ips %}
-      - {{ san }}
+      - "{{ san }}"
 {% endfor %}
 {% endif %}
 dns:
@@ -294,7 +294,7 @@ apiServer:
 {% endif %}
   certSANs:
 {% for san in apiserver_sans %}
-  - {{ san }}
+  - "{{ san }}"
 {% endfor %}
   timeoutForControlPlane: 5m0s
 controllerManager:
@@ -416,7 +416,7 @@ conntrack:
   tcpEstablishedTimeout: {{ kube_proxy_conntrack_tcp_established_timeout }}
 enableProfiling: {{ kube_proxy_enable_profiling }}
 healthzBindAddress: {{ kube_proxy_healthz_bind_address }}
-hostnameOverride: {{ kube_override_hostname }}
+hostnameOverride: "{{ kube_override_hostname }}"
 iptables:
   masqueradeAll: {{ kube_proxy_masquerade_all }}
   masqueradeBit: {{ kube_proxy_masquerade_bit }}