diff --git a/hack/verify-flags-underscore.py b/hack/verify-flags-underscore.py
index 8ed34a03c9b..9ade05d9f53 100755
--- a/hack/verify-flags-underscore.py
+++ b/hack/verify-flags-underscore.py
@@ -103,6 +103,8 @@ def line_has_bad_flag(line, flagre):
             return False
         if "pillar[" + result + "]" in line:
             return False
+        if "grains" + result in line:
+            return False
         return True
     return False
 
diff --git a/hack/verify-flags/exceptions.txt b/hack/verify-flags/exceptions.txt
index b19d08633eb..2b8c252dc09 100644
--- a/hack/verify-flags/exceptions.txt
+++ b/hack/verify-flags/exceptions.txt
@@ -15,27 +15,16 @@ cluster/vagrant/provision-minion.sh:  hostname_override: '$(echo "$MINION_IP" |
 cluster/addons/cluster-monitoring/README.md:Heapster enables monitoring of Kubernetes Clusters using [cAdvisor](https://github.com/google/cadvisor). The kubelet will communicate with an instance of cAdvisor running on localhost and proxy container stats to Heapster. Kubelet will attempt to connect to cAdvisor on port 4194 by default but this port can be configured with kubelet's `-cadvisor_port` run flag. Detailed information about heapster can be found [here](https://github.com/GoogleCloudPlatform/heapster).
 cluster/aws/templates/salt-minion.sh:# We set the hostname_override to the full EC2 private dns name
 cluster/aws/templates/salt-minion.sh:  hostname_override: "${HOSTNAME_OVERRIDE}"
-cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest:  {% if grains.cloud in [ 'aws', 'gce' ] and grains.cloud_config is defined -%}
-cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest:    {% set cloud_config_mount = "{\"name\": \"cloudconfigmount\",\"mountPath\": \"" + grains.cloud_config + "\", \"readOnly\": true}," -%}
-cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest:    {% set cloud_config_volume = "{\"name\": \"cloudconfigmount\",\"hostPath\": {\"path\": \"" + grains.cloud_config + "\"}}," -%}
 cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest:{% set params = "--master=127.0.0.1:8080" + " " + cluster_name + " " + cluster_cidr + " " + allocate_node_cidrs + " " + cloud_provider  + " " + cloud_config + service_account_key + pillar['log_level'] + " " + root_ca_file -%}
 cluster/saltbase/salt/kube-proxy/default:  {% set api_servers_with_port = api_servers + ":7080" -%}
-cluster/saltbase/salt/kube-proxy/default:  {% if grains.api_servers is defined -%}
 cluster/saltbase/salt/kube-proxy/default:     {% set api_servers_with_port = api_servers -%}
 cluster/saltbase/salt/kube-proxy/default:    {% set api_servers_with_port = api_servers + ":6443" -%}
 cluster/saltbase/salt/kube-addons/kube-addons.sh:# Create admission_control objects if defined before any other addon services. If the limits
-cluster/saltbase/salt/kubelet/default:{% if grains.api_servers is defined -%}
 cluster/saltbase/salt/kubelet/default:  {% set api_servers_with_port = api_servers -%}
 cluster/saltbase/salt/kubelet/default:  {% set api_servers_with_port = api_servers + ":6443" -%}
-cluster/saltbase/salt/kubelet/default:{% if grains.hostname_override is defined -%}
 cluster/saltbase/salt/kube-admission-controls/init.sls:{% if 'LimitRanger' in pillar.get('admission_control', '') %}
 cluster/saltbase/salt/monit/monit_watcher.sh:# Apply oom_score_adj: -901 to processes
 cluster/saltbase/salt/supervisor/supervisor_watcher.sh:# Apply oom_score_adj: -901 to processes
-cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:  {% if grains.cloud in [ 'aws', 'gce' ] and grains.cloud_config is defined -%}
-cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:    {% set cloud_config_mount = "{\"name\": \"cloudconfigmount\",\"mountPath\": \"" + grains.cloud_config + "\", \"readOnly\": true}," -%}
-cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:    {% set cloud_config_volume = "{\"name\": \"cloudconfigmount\",\"hostPath\": {\"path\": \"" + grains.cloud_config + "\"}}," -%}
-cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:{% if grains.advertise_address is defined -%}
-cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:{% if grains.runtime_config is defined -%}
 cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:{% set params = address + " " + etcd_servers + " " + cloud_provider + " " + cloud_config + " " + runtime_config + " " + admission_control + " " + service_cluster_ip_range + " " + client_ca_file + " " + basic_auth_file + " " + min_request_timeout -%}
 cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:{% set params = params + " " + cluster_name + " " + cert_file + " " + key_file + " --secure-port=" + secure_port + " " + token_auth_file + " " + bind_address + " " + pillar['log_level'] + " " + advertise_address  + " " + proxy_ssh_options -%}
 cluster/juju/charms/trusty/kubernetes-master/hooks/network-relation-changed:    for k in ('etcd_servers',):