diff --git a/admin/provisioner/kubernetes.go b/admin/provisioner/kubernetes.go
index 60843f287b9..21d375a3249 100644
--- a/admin/provisioner/kubernetes.go
+++ b/admin/provisioner/kubernetes.go
@@ -11,6 +11,7 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/Masterminds/sprig/v3"
 	"github.com/c2h5oh/datasize"
 	retryablehttp "github.com/hashicorp/go-retryablehttp"
 	"go.uber.org/multierr"
@@ -87,8 +88,14 @@ func NewKubernetes(spec json.RawMessage) (*KubernetesProvisioner, error) {
 		return nil, err
 	}
 
+	// Add Sprig template functions (removing functions that leak host info)
+	// Derived from Helm: https://github.com/helm/helm/blob/main/pkg/engine/funcs.go
+	funcMap := sprig.TxtFuncMap()
+	delete(funcMap, "env")
+	delete(funcMap, "expandenv")
+
 	// Parse the template definitions
-	templates := template.Must(template.New("").ParseFiles(
+	templates := template.Must(template.New("").Funcs(funcMap).ParseFiles(
 		ksp.TemplatePaths.HTTPIngress,
 		ksp.TemplatePaths.GRPCIngress,
 		ksp.TemplatePaths.Service,