diff --git a/upup/models/cloudup/resources/addons/aws-ebs-csi-driver.addons.k8s.io/k8s-1.17.yaml.template b/upup/models/cloudup/resources/addons/aws-ebs-csi-driver.addons.k8s.io/k8s-1.17.yaml.template
index 6458e89b7c703..023d758342fda 100644
--- a/upup/models/cloudup/resources/addons/aws-ebs-csi-driver.addons.k8s.io/k8s-1.17.yaml.template
+++ b/upup/models/cloudup/resources/addons/aws-ebs-csi-driver.addons.k8s.io/k8s-1.17.yaml.template
@@ -409,7 +409,7 @@ spec:
             - --endpoint=$(CSI_ENDPOINT)
             - --logtostderr
             - --k8s-tag-cluster-id={{ ClusterName }}
-            - --extra-tags={{ CsiExtraTags }}
+            - "--extra-tags={{ CloudLabels }}"
             - --v=5
           env:
             - name: CSI_ENDPOINT
diff --git a/upup/models/cloudup/resources/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml.template b/upup/models/cloudup/resources/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml.template
index f0a9128871b8e..fdd0b46b63ba1 100644
--- a/upup/models/cloudup/resources/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml.template
+++ b/upup/models/cloudup/resources/addons/aws-load-balancer-controller.addons.k8s.io/k8s-1.9.yaml.template
@@ -801,6 +801,7 @@ spec:
         - --enable-wafv2=false
         - --enable-shield=false
         - --ingress-class=alb
+        - "--default-tags={{ CloudLabels }}"
         image: amazon/aws-alb-ingress-controller:{{ or .AWSLoadBalancerController.Version "v2.2.0" }}
         livenessProbe:
           failureThreshold: 2
diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template
index 59b0f8b1f7575..8c892d07ca0ab 100644
--- a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template
+++ b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.9.yaml.template
@@ -817,8 +817,9 @@ spec:
     spec:
       containers:
       - args:
-        - --config-dir=/tmp/cilium/config-map
-        - --debug=$(CILIUM_DEBUG)
+        - "--config-dir=/tmp/cilium/config-map"
+        - "--debug=$(CILIUM_DEBUG)"
+        - "--eni-tags={{ CloudLabels }}"
         command:
         - cilium-operator
         env:
diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.10.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.10.yaml.template
index 34c29830a1511..bd3414abfbe75 100644
--- a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.10.yaml.template
+++ b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.10.yaml.template
@@ -838,8 +838,9 @@ spec:
     spec:
       containers:
       - args:
-        - --config-dir=/tmp/cilium/config-map
-        - --debug=$(CILIUM_DEBUG)
+        - "--config-dir=/tmp/cilium/config-map"
+        - "--debug=$(CILIUM_DEBUG)"
+        - "--eni-tags={{ CloudLabels }}"
         command:
         - cilium-operator
         env:
diff --git a/upup/pkg/fi/cloudup/template_functions.go b/upup/pkg/fi/cloudup/template_functions.go
index c173027c18c51..7c2759bf153ce 100644
--- a/upup/pkg/fi/cloudup/template_functions.go
+++ b/upup/pkg/fi/cloudup/template_functions.go
@@ -208,7 +208,7 @@ func (tf *TemplateFunctions) AddTo(dest template.FuncMap, secretStore fi.SecretS
 		dest["WeaveSecret"] = func() string { return weavesecretString }
 	}
 
-	dest["CsiExtraTags"] = func() string {
+	dest["CloudLabels"] = func() string {
 		labels := []string{
 			fmt.Sprintf("KubernetesCluster=%s", cluster.ObjectMeta.Name),
 		}
diff --git a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
index e825cf4dbfbcc..6f9185ed42082 100644
--- a/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
+++ b/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml
@@ -61,7 +61,7 @@ spec:
     version: 1.17.0
   - id: k8s-1.12
     manifest: networking.cilium.io/k8s-1.12-v1.9.yaml
-    manifestHash: 7de4d6e933cda022172f7e38ecf510c20a89c81a
+    manifestHash: 368ab627c5fb9087ad60df6bf4fe5dc29c017f79
     name: networking.cilium.io
     needsRollingUpdate: all
     selector: