diff --git a/ca/deploy.tf b/ca/deploy.tf
index 0225729..fc75744 100644
--- a/ca/deploy.tf
+++ b/ca/deploy.tf
@@ -8,6 +8,7 @@ resource "null_resource" "deploy-ca-certs" {
     early_renewal_hours   = "${var.early_renewal_hours}"
     common_name           = "${var.common_name}"
     organization          = "${var.organization}"
+    deploy_ssh_hosts      = "${join(",",var.deploy_ssh_hosts)}"
   }
 
   connection {
diff --git a/ca/main.tf b/ca/main.tf
index 877b4fb..efb8056 100644
--- a/ca/main.tf
+++ b/ca/main.tf
@@ -6,7 +6,7 @@ variable "is_ca_certificate" { default = true }
 variable "ca_count" {}
 # supports if you have a public/private ip and you want to set the private ip
 # for internal cert but use the public_ip to connect via ssh
-variable "deploy_ssh_hosts" {}
+variable "deploy_ssh_hosts" { type = "list" }
 variable "common_name" { default = "kube-ca" }
 variable "target_folder" { default = "/etc/kubernetes/ssl"}
 variable "user" { default = "core" }
diff --git a/docker/client/deploy.tf b/docker/client/deploy.tf
index c665c9f..c08f3b5 100644
--- a/docker/client/deploy.tf
+++ b/docker/client/deploy.tf
@@ -8,8 +8,9 @@ resource "null_resource" "configure-docker-client-certs" {
     docker_client_certs_pem   = "${element(tls_locally_signed_cert.docker_client.*.cert_pem, count.index)}"
     validity_period_hours     = "${var.validity_period_hours}"
     early_renewal_hours       = "${var.early_renewal_hours}"
-    ip_addresses_list         = "${var.ip_addresses_list}"
-    dns_names_list            = "${var.dns_names_list}"
+    ip_addresses_list         = "${join(",",var.ip_addresses_list)}"
+    dns_names_list            = "${join(",",var.dns_names_list)}"
+    deploy_ssh_hosts          = "${join(",",var.deploy_ssh_hosts)}"
   }
 
   connection {
diff --git a/docker/client/main.tf b/docker/client/main.tf
index 20daa44..8f96670 100644
--- a/docker/client/main.tf
+++ b/docker/client/main.tf
@@ -1,10 +1,13 @@
 variable "ca_cert_pem" {}
 variable "ca_private_key_pem" {}
-variable "ip_addresses_list" {}
+variable "ip_addresses_list" { type = "list" }
 # supports if you have a public/private ip and you want to set the private ip
 # for internal cert but use the public_ip to connect via ssh
-variable "deploy_ssh_hosts" {}
-variable "dns_names_list" { default = "*.*.cluster.internal,*.ec2.internal" }
+variable "deploy_ssh_hosts" { type = "list" }
+variable "dns_names_list" {
+    type = "list"
+    default = [ "*.*.cluster.internal", "*.ec2.internal" ]
+}
 variable "docker_client_count" {}
 variable "private_key" {}
 variable "validity_period_hours" {}
@@ -25,7 +28,7 @@ resource "tls_cert_request" "docker_client" {
     common_name  = "docker_client_${count.index}"
   }
 
-  dns_names = ["${split(",", var.dns_names_list)}"]
+  dns_names = ["${var.dns_names_list}"]
   ip_addresses = ["${element(var.ip_addresses_list, count.index)}"]
 }
 
diff --git a/docker/daemon/deploy.tf b/docker/daemon/deploy.tf
index ea11996..6e1b9fc 100644
--- a/docker/daemon/deploy.tf
+++ b/docker/daemon/deploy.tf
@@ -8,8 +8,9 @@ resource "null_resource" "configure-docker-dameon-certs" {
     docker_daemon_certs_pem   = "${element(tls_locally_signed_cert.docker_daemon.*.cert_pem, count.index)}"
     validity_period_hours     = "${var.validity_period_hours}"
     early_renewal_hours       = "${var.early_renewal_hours}"
-    ip_addresses_list         = "${var.ip_addresses_list}"
-    dns_names_list            = "${var.dns_names_list}"
+    ip_addresses_list         = "${join(",",var.ip_addresses_list)}"
+    dns_names_list            = "${join(",",var.dns_names_list)}"
+    deploy_ssh_hosts          = "${join(",",var.deploy_ssh_hosts)}"
   }
 
   connection {
diff --git a/docker/daemon/main.tf b/docker/daemon/main.tf
index 306fd7d..d22eb63 100644
--- a/docker/daemon/main.tf
+++ b/docker/daemon/main.tf
@@ -1,10 +1,17 @@
 variable "ca_cert_pem" {}
 variable "ca_private_key_pem" {}
-variable "ip_addresses_list" {}
+variable "ip_addresses_list" { type = "list" }
 # supports if you have a public/private ip and you want to set the private ip
 # for internal cert but use the public_ip to connect via ssh
-variable "deploy_ssh_hosts" {}
-variable "dns_names_list" { default = "kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local" }
+variable "deploy_ssh_hosts" { type = "list" }
+variable "dns_names_list" {
+    type = "list"
+    default = [
+        "kubernetes,kubernetes.default",
+        "kubernetes.default.svc",
+        "kubernetes.default.svc.cluster.local"
+    ]
+}
 variable "docker_daemon_count" {}
 variable "private_key" {}
 variable "validity_period_hours" { default = 8760 }
@@ -25,7 +32,7 @@ resource "tls_cert_request" "docker_daemon" {
     common_name = "docker_daemon"
   }
 
-  dns_names = ["${split(",", var.dns_names_list)}"]
+  dns_names    = ["${var.dns_names_list}"]
   ip_addresses = [
     "127.0.0.1",
     "${element(var.ip_addresses_list, count.index)}"
diff --git a/kubernetes/kubelet/deploy.tf b/kubernetes/kubelet/deploy.tf
index 5927fac..bc56eda 100644
--- a/kubernetes/kubelet/deploy.tf
+++ b/kubernetes/kubelet/deploy.tf
@@ -8,7 +8,8 @@ resource "null_resource" "configure-kubelet-certs" {
     kubelet_certs_pem      = "${element(tls_locally_signed_cert.kubelet.*.cert_pem, count.index)}"
     validity_period_hours  = "${var.validity_period_hours}"
     early_renewal_hours    = "${var.early_renewal_hours}"
-    ip_addresses           = "${var.ip_addresses}"
+    ip_addresses           = "${join(",",var.ip_addresses)}"
+    deploy_ssh_hosts       = "${join(",",var.deploy_ssh_hosts)}"
   }
 
   connection {
diff --git a/kubernetes/kubelet/main.tf b/kubernetes/kubelet/main.tf
index 1282275..91a328d 100644
--- a/kubernetes/kubelet/main.tf
+++ b/kubernetes/kubelet/main.tf
@@ -1,9 +1,9 @@
 variable "ca_cert_pem" {}
 variable "ca_private_key_pem" {}
-variable "ip_addresses" {}
+variable "ip_addresses" { type = "list" }
 # supports if you have a public/private ip and you want to set the private ip
 # for internal cert but use the public_ip to connect via ssh
-variable "deploy_ssh_hosts" {}
+variable "deploy_ssh_hosts" { type = "list" }
 variable "kubelet_count" { default = "1" }
 variable "validity_period_hours" { default = "8760" }
 variable "early_renewal_hours" { default = "720" }
diff --git a/kubernetes/master/deploy.tf b/kubernetes/master/deploy.tf
index 490e7c9..6cd2497 100644
--- a/kubernetes/master/deploy.tf
+++ b/kubernetes/master/deploy.tf
@@ -7,8 +7,8 @@ resource "null_resource" "configure-master-certs" {
     master_certs_pem      = "${element(tls_locally_signed_cert.master.*.cert_pem, count.index)}"
     validity_period_hours = "${var.validity_period_hours}"
     early_renewal_hours   = "${var.early_renewal_hours}"
-    dns_names             = "${var.dns_names}"
-    ip_addresses          = "${var.ip_addresses}"
+    dns_names             = "${join(",",var.dns_names)}"
+    ip_addresses          = "${join(",",var.ip_addresses)}"
   }
 
   connection {
diff --git a/kubernetes/master/main.tf b/kubernetes/master/main.tf
index cfc0f17..366bd48 100644
--- a/kubernetes/master/main.tf
+++ b/kubernetes/master/main.tf
@@ -1,12 +1,31 @@
 variable "ca_cert_pem" {}
 variable "ca_private_key_pem" {}
-variable "ip_addresses" {}
-variable "dns_names" { default = "" }
 # supports if you have a public/private ip and you want to set the private ip
 # for internal cert but use the public_ip to connect via ssh
-variable "deploy_ssh_hosts" {}
+variable "deploy_ssh_hosts" {
+    type = "list"
+}
+variable "ip_addresses" {
+    type = "list"
+}
+variable "kube_service_ip" {
+    type = "list"
+    default = [ "10.3.0.1" ]
+}
+variable "dns_names" {
+    type = "list"
+}
+variable "default_dns_names" {
+    type = "list"
+    default = [
+        "kubernetes",
+        "kubernetes.default",
+        "kubernetes.default.svc",
+        "kubernetes.default.svc.cluster.local"
+    ]
+}
+
 variable "master_count" {}
-variable "kube_service_ip" { default = "10.3.0.1" }
 variable "validity_period_hours" { default = "8760" }
 variable "early_renewal_hours" { default = "720" }
 variable "ssh_user" { default = "core" }
@@ -26,7 +45,7 @@ resource "tls_cert_request" "master" {
     common_name = "kube-master"
   }
 
-  dns_names    = ["${compact(var.dns_names)}", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster.local"]
+  dns_names    = ["${concat(var.dns_names, var.default_dns_names)}"]
   ip_addresses = ["${concat(var.kube_service_ip, var.ip_addresses)}"]
 }