diff --git a/cmd/kubeadm/app/phases/copycerts/copycerts_test.go b/cmd/kubeadm/app/phases/copycerts/copycerts_test.go
index 0f4e379b54b..3cc4f01a335 100644
--- a/cmd/kubeadm/app/phases/copycerts/copycerts_test.go
+++ b/cmd/kubeadm/app/phases/copycerts/copycerts_test.go
@@ -70,7 +70,7 @@ func TestGetDataFromInitConfig(t *testing.T) {
 		t.Fatalf("failed to get secret data. fatal error: %v", err)
 	}
 
-	re := regexp.MustCompile(`[-._a-zA-Z0-9]+`)
+	re := regexp.MustCompile(`[-.\w]+`)
 	for name, data := range secretData {
 		if !re.MatchString(name) {
 			t.Fatalf(dedent.Dedent("failed to validate secretData\n %s isn't a valid secret key"), name)
diff --git a/cmd/kubeadm/app/preflight/utils.go b/cmd/kubeadm/app/preflight/utils.go
index 1587f64e08d..801c5613d2e 100644
--- a/cmd/kubeadm/app/preflight/utils.go
+++ b/cmd/kubeadm/app/preflight/utils.go
@@ -28,7 +28,7 @@ import (
 
 // GetKubeletVersion is helper function that returns version of kubelet available in $PATH
 func GetKubeletVersion(execer utilsexec.Interface) (*version.Version, error) {
-	kubeletVersionRegex := regexp.MustCompile(`^\s*Kubernetes v((0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)([-0-9a-zA-Z_\.+]*)?)\s*$`)
+	kubeletVersionRegex := regexp.MustCompile(`^\s*Kubernetes v((0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)([-\w.+]*)?)\s*$`)
 
 	command := execer.Command("kubelet", "--version")
 	out, err := command.Output()
diff --git a/cmd/kubeadm/app/util/image/image.go b/cmd/kubeadm/app/util/image/image.go
index 0a3c2bb6cb7..028fb48078b 100644
--- a/cmd/kubeadm/app/util/image/image.go
+++ b/cmd/kubeadm/app/util/image/image.go
@@ -25,7 +25,7 @@ var (
 	// (if present). All the parts before the tag we match in a single match everything (but not greedy) group.
 	// All matched sub-groups, except the tag one, get thrown away. Hence, in a result of FindStringSubmatch, if a tag
 	// matches, it's going to be the second returned element (after the full match).
-	tagMatcher = regexp.MustCompile(`^(?U:.*)(?::([[:word:]][[:word:].-]*))?(?:@sha256:[a-fA-F0-9]{64})?$`)
+	tagMatcher = regexp.MustCompile(`^(?U:.*)(?::([[:word:]][[:word:].-]*))?(?:@sha256:[a-fA-F\d]{64})?$`)
 )
 
 // TagFromImage extracts a tag from image. An empty string is returned if no tag is discovered.
diff --git a/cmd/kubeadm/app/util/pkiutil/testing/testing.go b/cmd/kubeadm/app/util/pkiutil/testing/testing.go
index 69a3a81f672..3e80f24a934 100644
--- a/cmd/kubeadm/app/util/pkiutil/testing/testing.go
+++ b/cmd/kubeadm/app/util/pkiutil/testing/testing.go
@@ -48,7 +48,7 @@ func Reset() {
 }
 
 var (
-	testFunction = regexp.MustCompile(`.*\.Test[^./]+(.func[0-9]*)?$`)
+	testFunction = regexp.MustCompile(`.*\.Test[^./]+(.func\d*)?$`)
 
 	lock       = sync.Mutex{}
 	fixtureDir = ""
diff --git a/cmd/kubeadm/app/util/version.go b/cmd/kubeadm/app/util/version.go
index 0520b639bf1..fa5f137c79f 100644
--- a/cmd/kubeadm/app/util/version.go
+++ b/cmd/kubeadm/app/util/version.go
@@ -41,9 +41,9 @@ const (
 var (
 	kubeReleaseBucketURL  = "https://dl.k8s.io"
 	kubeCIBucketURL       = "https://storage.googleapis.com/k8s-release-dev"
-	kubeReleaseRegex      = regexp.MustCompile(`^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)([-0-9a-zA-Z_\.+]*)?$`)
-	kubeReleaseLabelRegex = regexp.MustCompile(`^((latest|stable)+(-[1-9](\.[1-9]([0-9])?)?)?)\z`)
-	kubeBucketPrefixes    = regexp.MustCompile(`^((release|ci)/)?([-\w_\.+]+)$`)
+	kubeReleaseRegex      = regexp.MustCompile(`^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)([-\w.+]*)?$`)
+	kubeReleaseLabelRegex = regexp.MustCompile(`^((latest|stable)+(-[1-9](\.[1-9](\d)?)?)?)\z`)
+	kubeBucketPrefixes    = regexp.MustCompile(`^((release|ci)/)?([-\w.+]+)$`)
 )
 
 // KubernetesReleaseVersion is helper function that can fetch
@@ -135,7 +135,7 @@ func kubernetesReleaseVersion(version string, fetcher func(string, time.Duration
 // Current usage is for CI images where all of symbols except '+' are valid,
 // but function is for generic usage where input can't be always pre-validated.
 func KubernetesVersionToImageTag(version string) string {
-	allowed := regexp.MustCompile(`[^-a-zA-Z0-9_\.]`)
+	allowed := regexp.MustCompile(`[^-\w.]`)
 	return allowed.ReplaceAllString(version, "_")
 }