diff --git a/cluster/aws/config-default.sh b/cluster/aws/config-default.sh
index b63ec1628c8..8ed226a48c1 100644
--- a/cluster/aws/config-default.sh
+++ b/cluster/aws/config-default.sh
@@ -70,8 +70,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/aws/config-test.sh b/cluster/aws/config-test.sh
index 3ddf633cf8f..87cdf8c29cf 100755
--- a/cluster/aws/config-test.sh
+++ b/cluster/aws/config-test.sh
@@ -67,8 +67,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-false}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/gce/config-default.sh b/cluster/gce/config-default.sh
index 585113478f5..e278b2452ef 100755
--- a/cluster/gce/config-default.sh
+++ b/cluster/gce/config-default.sh
@@ -68,8 +68,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/gce/config-test.sh b/cluster/gce/config-test.sh
index dc7c725562e..d01083a13f2 100755
--- a/cluster/gce/config-test.sh
+++ b/cluster/gce/config-test.sh
@@ -67,8 +67,10 @@ LOGGING_DESTINATION="${KUBE_LOGGING_DESTINATION:-elasticsearch}" # options: elas
 ENABLE_CLUSTER_LOGGING="${KUBE_ENABLE_CLUSTER_LOGGING:-true}"
 ELASTICSEARCH_LOGGING_REPLICAS=1
 
-# Don't require https for registries in our local RFC1918 network
-EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+# Optional: Don't require https for registries in our local RFC1918 network
+if [[ ${KUBE_ENABLE_INSECURE_REGISTRY:-false} == "true" ]]; then
+  EXTRA_DOCKER_OPTS="--insecure-registry 10.0.0.0/8"
+fi
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS=true
diff --git a/cluster/saltbase/salt/docker/default b/cluster/saltbase/salt/docker/default
index 5674af107a3..706f082a521 100644
--- a/cluster/saltbase/salt/docker/default
+++ b/cluster/saltbase/salt/docker/default
@@ -1,5 +1,5 @@
 {% set docker_opts = "" -%}
-{% if grains.docker_opts is defined -%}
+{% if grains.docker_opts is defined and grains.docker_opts -%}
   {% set docker_opts = grains.docker_opts -%}
 {% endif -%}