diff --git a/dind-cluster.sh b/dind-cluster.sh
index d8efc3d..0312578 100755
--- a/dind-cluster.sh
+++ b/dind-cluster.sh
@@ -1226,6 +1226,28 @@ function dind::init {
     feature_gates="{CoreDNS: true}"
   fi
 
+  kubeadm_version="$(dind::kubeadm-version)"
+  case $kubeadm_version in
+    1\.9\.* | 1\.10\.*)
+      template="1.10"
+      ;;
+    1\.11\.*)
+      template="1.11"
+      ;;
+    1\.12\.*)
+      template="1.12"
+      ;;
+    *)  # Includes master branch
+      template="1.13"
+      # CoreDNS can no longer be switched off
+      feature_gates="{}"
+      if [[ ${DNS_SERVICE} = "kube-dns" ]]; then
+        echo >&2 "WARNING: for 1.13+, only coredns can be used as the DNS service"
+        DNS_SERVICE="coredns"
+      fi
+      ;;
+  esac
+
   component_feature_gates=""
   if [ "${FEATURE_GATES}" != "none" ]; then
     component_feature_gates="feature-gates: \\\"${FEATURE_GATES}\\\""
@@ -1249,22 +1271,6 @@ function dind::init {
     scheduler_extra_args+="  ${opt_name}: \\\"$(eval echo \$$e)\\\"\\n"
   done
 
-  kubeadm_version="$(dind::kubeadm-version)"
-  case $kubeadm_version in
-    1\.9\.* | 1\.10\.*)
-      template="1.10"
-      ;;
-    1\.11\.*)
-      template="1.11"
-      ;;
-    1\.12\.*)
-      template="1.12"
-      ;;
-    *)  # Includes master branch
-      template="1.13"
-      ;;
-  esac
-
   local mgmt_cidr=${mgmt_net_cidrs[0]}
   if [[ ${IP_MODE} = "dual-stack" && ${SERVICE_NET_MODE} = "ipv6" ]]; then
       mgmt_cidr=${mgmt_net_cidrs[1]}
diff --git a/fixed/dind-cluster-stable.sh b/fixed/dind-cluster-stable.sh
index 68520bd..4dcfba8 100755
--- a/fixed/dind-cluster-stable.sh
+++ b/fixed/dind-cluster-stable.sh
@@ -1226,6 +1226,28 @@ function dind::init {
     feature_gates="{CoreDNS: true}"
   fi
 
+  kubeadm_version="$(dind::kubeadm-version)"
+  case $kubeadm_version in
+    1\.9\.* | 1\.10\.*)
+      template="1.10"
+      ;;
+    1\.11\.*)
+      template="1.11"
+      ;;
+    1\.12\.*)
+      template="1.12"
+      ;;
+    *)  # Includes master branch
+      template="1.13"
+      # CoreDNS can no longer be switched off
+      feature_gates="{}"
+      if [[ ${DNS_SERVICE} = "kube-dns" ]]; then
+        echo >&2 "WARNING: for 1.13+, only coredns can be used as the DNS service"
+        DNS_SERVICE="coredns"
+      fi
+      ;;
+  esac
+
   component_feature_gates=""
   if [ "${FEATURE_GATES}" != "none" ]; then
     component_feature_gates="feature-gates: \\\"${FEATURE_GATES}\\\""
@@ -1249,22 +1271,6 @@ function dind::init {
     scheduler_extra_args+="  ${opt_name}: \\\"$(eval echo \$$e)\\\"\\n"
   done
 
-  kubeadm_version="$(dind::kubeadm-version)"
-  case $kubeadm_version in
-    1\.9\.* | 1\.10\.*)
-      template="1.10"
-      ;;
-    1\.11\.*)
-      template="1.11"
-      ;;
-    1\.12\.*)
-      template="1.12"
-      ;;
-    *)  # Includes master branch
-      template="1.13"
-      ;;
-  esac
-
   local mgmt_cidr=${mgmt_net_cidrs[0]}
   if [[ ${IP_MODE} = "dual-stack" && ${SERVICE_NET_MODE} = "ipv6" ]]; then
       mgmt_cidr=${mgmt_net_cidrs[1]}
diff --git a/fixed/dind-cluster-v1.10.sh b/fixed/dind-cluster-v1.10.sh
index ff3841d..7b8c200 100755
--- a/fixed/dind-cluster-v1.10.sh
+++ b/fixed/dind-cluster-v1.10.sh
@@ -1226,6 +1226,28 @@ function dind::init {
     feature_gates="{CoreDNS: true}"
   fi
 
+  kubeadm_version="$(dind::kubeadm-version)"
+  case $kubeadm_version in
+    1\.9\.* | 1\.10\.*)
+      template="1.10"
+      ;;
+    1\.11\.*)
+      template="1.11"
+      ;;
+    1\.12\.*)
+      template="1.12"
+      ;;
+    *)  # Includes master branch
+      template="1.13"
+      # CoreDNS can no longer be switched off
+      feature_gates="{}"
+      if [[ ${DNS_SERVICE} = "kube-dns" ]]; then
+        echo >&2 "WARNING: for 1.13+, only coredns can be used as the DNS service"
+        DNS_SERVICE="coredns"
+      fi
+      ;;
+  esac
+
   component_feature_gates=""
   if [ "${FEATURE_GATES}" != "none" ]; then
     component_feature_gates="feature-gates: \\\"${FEATURE_GATES}\\\""
@@ -1249,22 +1271,6 @@ function dind::init {
     scheduler_extra_args+="  ${opt_name}: \\\"$(eval echo \$$e)\\\"\\n"
   done
 
-  kubeadm_version="$(dind::kubeadm-version)"
-  case $kubeadm_version in
-    1\.9\.* | 1\.10\.*)
-      template="1.10"
-      ;;
-    1\.11\.*)
-      template="1.11"
-      ;;
-    1\.12\.*)
-      template="1.12"
-      ;;
-    *)  # Includes master branch
-      template="1.13"
-      ;;
-  esac
-
   local mgmt_cidr=${mgmt_net_cidrs[0]}
   if [[ ${IP_MODE} = "dual-stack" && ${SERVICE_NET_MODE} = "ipv6" ]]; then
       mgmt_cidr=${mgmt_net_cidrs[1]}
diff --git a/fixed/dind-cluster-v1.11.sh b/fixed/dind-cluster-v1.11.sh
index 9b8357a..a18cb84 100755
--- a/fixed/dind-cluster-v1.11.sh
+++ b/fixed/dind-cluster-v1.11.sh
@@ -1226,6 +1226,28 @@ function dind::init {
     feature_gates="{CoreDNS: true}"
   fi
 
+  kubeadm_version="$(dind::kubeadm-version)"
+  case $kubeadm_version in
+    1\.9\.* | 1\.10\.*)
+      template="1.10"
+      ;;
+    1\.11\.*)
+      template="1.11"
+      ;;
+    1\.12\.*)
+      template="1.12"
+      ;;
+    *)  # Includes master branch
+      template="1.13"
+      # CoreDNS can no longer be switched off
+      feature_gates="{}"
+      if [[ ${DNS_SERVICE} = "kube-dns" ]]; then
+        echo >&2 "WARNING: for 1.13+, only coredns can be used as the DNS service"
+        DNS_SERVICE="coredns"
+      fi
+      ;;
+  esac
+
   component_feature_gates=""
   if [ "${FEATURE_GATES}" != "none" ]; then
     component_feature_gates="feature-gates: \\\"${FEATURE_GATES}\\\""
@@ -1249,22 +1271,6 @@ function dind::init {
     scheduler_extra_args+="  ${opt_name}: \\\"$(eval echo \$$e)\\\"\\n"
   done
 
-  kubeadm_version="$(dind::kubeadm-version)"
-  case $kubeadm_version in
-    1\.9\.* | 1\.10\.*)
-      template="1.10"
-      ;;
-    1\.11\.*)
-      template="1.11"
-      ;;
-    1\.12\.*)
-      template="1.12"
-      ;;
-    *)  # Includes master branch
-      template="1.13"
-      ;;
-  esac
-
   local mgmt_cidr=${mgmt_net_cidrs[0]}
   if [[ ${IP_MODE} = "dual-stack" && ${SERVICE_NET_MODE} = "ipv6" ]]; then
       mgmt_cidr=${mgmt_net_cidrs[1]}
diff --git a/fixed/dind-cluster-v1.12.sh b/fixed/dind-cluster-v1.12.sh
index d7c3eb3..f1ca21c 100755
--- a/fixed/dind-cluster-v1.12.sh
+++ b/fixed/dind-cluster-v1.12.sh
@@ -1226,6 +1226,28 @@ function dind::init {
     feature_gates="{CoreDNS: true}"
   fi
 
+  kubeadm_version="$(dind::kubeadm-version)"
+  case $kubeadm_version in
+    1\.9\.* | 1\.10\.*)
+      template="1.10"
+      ;;
+    1\.11\.*)
+      template="1.11"
+      ;;
+    1\.12\.*)
+      template="1.12"
+      ;;
+    *)  # Includes master branch
+      template="1.13"
+      # CoreDNS can no longer be switched off
+      feature_gates="{}"
+      if [[ ${DNS_SERVICE} = "kube-dns" ]]; then
+        echo >&2 "WARNING: for 1.13+, only coredns can be used as the DNS service"
+        DNS_SERVICE="coredns"
+      fi
+      ;;
+  esac
+
   component_feature_gates=""
   if [ "${FEATURE_GATES}" != "none" ]; then
     component_feature_gates="feature-gates: \\\"${FEATURE_GATES}\\\""
@@ -1249,22 +1271,6 @@ function dind::init {
     scheduler_extra_args+="  ${opt_name}: \\\"$(eval echo \$$e)\\\"\\n"
   done
 
-  kubeadm_version="$(dind::kubeadm-version)"
-  case $kubeadm_version in
-    1\.9\.* | 1\.10\.*)
-      template="1.10"
-      ;;
-    1\.11\.*)
-      template="1.11"
-      ;;
-    1\.12\.*)
-      template="1.12"
-      ;;
-    *)  # Includes master branch
-      template="1.13"
-      ;;
-  esac
-
   local mgmt_cidr=${mgmt_net_cidrs[0]}
   if [[ ${IP_MODE} = "dual-stack" && ${SERVICE_NET_MODE} = "ipv6" ]]; then
       mgmt_cidr=${mgmt_net_cidrs[1]}
diff --git a/fixed/dind-cluster-v1.9.sh b/fixed/dind-cluster-v1.9.sh
index 5d1c96a..1b71e7e 100755
--- a/fixed/dind-cluster-v1.9.sh
+++ b/fixed/dind-cluster-v1.9.sh
@@ -1226,6 +1226,28 @@ function dind::init {
     feature_gates="{CoreDNS: true}"
   fi
 
+  kubeadm_version="$(dind::kubeadm-version)"
+  case $kubeadm_version in
+    1\.9\.* | 1\.10\.*)
+      template="1.10"
+      ;;
+    1\.11\.*)
+      template="1.11"
+      ;;
+    1\.12\.*)
+      template="1.12"
+      ;;
+    *)  # Includes master branch
+      template="1.13"
+      # CoreDNS can no longer be switched off
+      feature_gates="{}"
+      if [[ ${DNS_SERVICE} = "kube-dns" ]]; then
+        echo >&2 "WARNING: for 1.13+, only coredns can be used as the DNS service"
+        DNS_SERVICE="coredns"
+      fi
+      ;;
+  esac
+
   component_feature_gates=""
   if [ "${FEATURE_GATES}" != "none" ]; then
     component_feature_gates="feature-gates: \\\"${FEATURE_GATES}\\\""
@@ -1249,22 +1271,6 @@ function dind::init {
     scheduler_extra_args+="  ${opt_name}: \\\"$(eval echo \$$e)\\\"\\n"
   done
 
-  kubeadm_version="$(dind::kubeadm-version)"
-  case $kubeadm_version in
-    1\.9\.* | 1\.10\.*)
-      template="1.10"
-      ;;
-    1\.11\.*)
-      template="1.11"
-      ;;
-    1\.12\.*)
-      template="1.12"
-      ;;
-    *)  # Includes master branch
-      template="1.13"
-      ;;
-  esac
-
   local mgmt_cidr=${mgmt_net_cidrs[0]}
   if [[ ${IP_MODE} = "dual-stack" && ${SERVICE_NET_MODE} = "ipv6" ]]; then
       mgmt_cidr=${mgmt_net_cidrs[1]}
diff --git a/image/kubeadm.conf.1.13.tmpl b/image/kubeadm.conf.1.13.tmpl
index dbcbee9..c326bda 100644
--- a/image/kubeadm.conf.1.13.tmpl
+++ b/image/kubeadm.conf.1.13.tmpl
@@ -43,7 +43,7 @@ etcd:
     dataDir: /var/lib/etcd
     image: ""
 featureGates: {{FEATURE_GATES}}
-imageRepository: k8s.gcr.io
+useHyperKubeImage: true
 kind: ClusterConfiguration
 kubernetesVersion: "{{KUBEADM_VERSION}}"
 networking:
diff --git a/image/wrapkubeadm b/image/wrapkubeadm
index e3de5d6..4f85d09 100755
--- a/image/wrapkubeadm
+++ b/image/wrapkubeadm
@@ -24,6 +24,15 @@ KUBEADM_SOURCE="${KUBEADM_SOURCE:-keep://}"
 
 hypokube_base_image="mirantis/hypokube:base"
 hypokube_final_image="mirantis/hypokube:final"
+hypokube_extra_tags=()
+# In k8s 1.14+, we can't use unifiedControlPlaneImage anymore,
+# so we have to resort to a hack by pretending we have already
+# pulled the hyperkube image
+# https://github.com/kubernetes/kubernetes/pull/70793
+if kubeadm version -o short >&/dev/null; then
+  image_version="$(kubeadm version -o short|sed 's/-.*//')"
+  hypokube_extra_tags=("k8s.gcr.io/hyperkube:${image_version}")
+fi
 build_src_dir="/go/src/k8s.io/kubernetes"
 binary_dir="/k8s"
 # FIXME: don't hardcode
@@ -164,6 +173,10 @@ function dind::ensure-binaries-and-hypokube {
     # After we "frob" the cluster, the hyperkube image is taken from /k8s directory.
     cp "${hyperkube_bin}" /hypokube/
     docker build -t "${hypokube_final_image}" -f /hypokube/hypokube.dkr /hypokube
+    # in k8s 1.12+
+    for tag in "${hypokube_extra_tags[@]}"; do
+        docker tag "${hypokube_final_image}" "${tag}"
+    done
   fi
 }