diff --git a/cluster/aws/config-default.sh b/cluster/aws/config-default.sh
index b63ec1628c8..8ed226a48c1 100644
--- a/cluster/aws/config-default.sh
+++ b/cluster/aws/config-default.sh
@@ -70,8 +70,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/aws/config-test.sh b/cluster/aws/config-test.sh
index 3ddf633cf8f..87cdf8c29cf 100755
--- a/cluster/aws/config-test.sh
+++ b/cluster/aws/config-test.sh
@@ -67,8 +67,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-false}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/gce/config-default.sh b/cluster/gce/config-default.sh
index 5264df770af..cb042641f1d 100755
--- a/cluster/gce/config-default.sh
+++ b/cluster/gce/config-default.sh
@@ -69,8 +69,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-gcp}" # options: elasticsearch,
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/gce/config-test.sh b/cluster/gce/config-test.sh
index a80117132dc..7cb977a7ae7 100755
--- a/cluster/gce/config-test.sh
+++ b/cluster/gce/config-test.sh
@@ -67,8 +67,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/gce/coreos/helper.sh b/cluster/gce/coreos/helper.sh
index 3901666ca5b..d50fb58f09e 100644
--- a/cluster/gce/coreos/helper.sh
+++ b/cluster/gce/coreos/helper.sh
@@ -84,7 +84,7 @@ ADMISSION_CONTROL=$(yaml-quote ${ADMISSION_CONTROL:-})
 MASTER_IP_RANGE=$(yaml-quote ${MASTER_IP_RANGE})
 KUBERNETES_MASTER_NAME=$(yaml-quote ${MASTER_NAME})
 ZONE=$(yaml-quote ${ZONE})
-EXTRA_DOCKER_OPTS=$(yaml-quote ${EXTRA_DOCKER_OPTS})
+EXTRA_DOCKER_OPTS=$(yaml-quote ${EXTRA_DOCKER_OPTS:-})
 ENABLE_DOCKER_REGISTRY_CACHE=$(yaml-quote ${ENABLE_DOCKER_REGISTRY_CACHE:-false})
 PROJECT_ID=$(yaml-quote ${PROJECT})
 KUBERNETES_CONTAINER_RUNTIME=$(yaml-quote ${CONTAINER_RUNTIME})
diff --git a/cluster/gce/debian/helper.sh b/cluster/gce/debian/helper.sh
index 264c4259eea..2b29eb26d7b 100644
--- a/cluster/gce/debian/helper.sh
+++ b/cluster/gce/debian/helper.sh
@@ -70,7 +70,7 @@ EOF
     cat >>$file <<EOF
 KUBERNETES_MASTER: "false"
 ZONE: $(yaml-quote ${ZONE})
-EXTRA_DOCKER_OPTS: $(yaml-quote ${EXTRA_DOCKER_OPTS})
+EXTRA_DOCKER_OPTS: $(yaml-quote ${EXTRA_DOCKER_OPTS:-})
 ENABLE_DOCKER_REGISTRY_CACHE: $(yaml-quote ${ENABLE_DOCKER_REGISTRY_CACHE:-false})
 KUBELET_CERT: $(yaml-quote ${KUBELET_CERT_BASE64:-})
 KUBELET_KEY: $(yaml-quote ${KUBELET_KEY_BASE64:-})
diff --git a/cluster/saltbase/salt/docker/default b/cluster/saltbase/salt/docker/default
index 5674af107a3..706f082a521 100644
--- a/cluster/saltbase/salt/docker/default
+++ b/cluster/saltbase/salt/docker/default
@@ -1,5 +1,5 @@
 {% set docker_opts = "" -%}
-{% if grains.docker_opts is defined -%}
+{% if grains.docker_opts is defined and grains.docker_opts -%}
   {% set docker_opts = grains.docker_opts -%}
 {% endif -%}