diff --git a/upup/pkg/fi/cloudup/loader.go b/upup/pkg/fi/cloudup/loader.go
index d43c0945b8..683e506fc9 100644
--- a/upup/pkg/fi/cloudup/loader.go
+++ b/upup/pkg/fi/cloudup/loader.go
@@ -27,6 +27,7 @@ import (
 	"k8s.io/kops/upup/pkg/fi/loader"
 	"k8s.io/kops/upup/pkg/fi/utils"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"os"
 	"reflect"
 	"strings"
@@ -45,7 +46,7 @@ type Loader struct {
 
 	ModelStore vfs.Path
 
-	Tags              map[string]struct{}
+	Tags              sets.String
 	TemplateFunctions template.FuncMap
 
 	typeMap map[string]reflect.Type
diff --git a/upup/pkg/fi/cloudup/spec_builder.go b/upup/pkg/fi/cloudup/spec_builder.go
index b3e42c2154..85f610c23d 100644
--- a/upup/pkg/fi/cloudup/spec_builder.go
+++ b/upup/pkg/fi/cloudup/spec_builder.go
@@ -23,12 +23,13 @@ import (
 	"k8s.io/kops/upup/pkg/fi/loader"
 	"k8s.io/kops/upup/pkg/fi/utils"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 )
 
 type SpecBuilder struct {
 	OptionsLoader *loader.OptionsLoader
 
-	Tags map[string]struct{}
+	Tags sets.String
 }
 
 func (l *SpecBuilder) BuildCompleteSpec(clusterSpec *api.ClusterSpec, modelStore vfs.Path, models []string) (*api.ClusterSpec, error) {
diff --git a/upup/pkg/fi/cloudup/tagbuilder.go b/upup/pkg/fi/cloudup/tagbuilder.go
index 5e19a8dfb9..366a6dc48a 100644
--- a/upup/pkg/fi/cloudup/tagbuilder.go
+++ b/upup/pkg/fi/cloudup/tagbuilder.go
@@ -28,49 +28,45 @@ import (
 	"github.com/golang/glog"
 	api "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kubernetes/pkg/util/sets"
 )
 
-//
-//
-func buildCloudupTags(cluster *api.Cluster) (map[string]struct{}, error) {
+func buildCloudupTags(cluster *api.Cluster) (sets.String, error) {
 	// TODO: Make these configurable?
 	useMasterASG := true
 	useMasterLB := false
 
-	tags := make(map[string]struct{})
+	tags := sets.NewString()
 
 	networking := cluster.Spec.Networking
-	glog.Infof("networking: %s", networking)
 
 	if networking == nil || networking.Classic != nil {
-		tags["_networking_classic"] = struct{}{}
+		tags.Insert("_networking_classic")
 	} else if networking.Kubenet != nil {
-		tags["_networking_kubenet"] = struct{}{}
+		tags.Insert("_networking_kubenet")
 	} else if networking.External != nil {
 		// external is based on kubenet
-		tags["_networking_kubenet"] = struct{}{}
-		tags["_networking_external"] = struct{}{}
+		tags.Insert("_networking_kubenet", "_networking_external")
 	} else if networking.CNI != nil || networking.Weave != nil {
-		tags["_networking_cni"] = struct{}{}
-		// TODO combine with the External
+		tags.Insert("_networking_cni")
 	} else if networking.Kopeio != nil {
 		// Kopeio is based on kubenet / external
-		tags["_networking_kubenet"] = struct{}{}
-		tags["_networking_external"] = struct{}{}
+		// TODO combine with External
+		tags.Insert("_networking_kubenet", "_networking_external")
 	} else {
 		return nil, fmt.Errorf("No networking mode set")
 	}
 
 	if useMasterASG {
-		tags["_master_asg"] = struct{}{}
+		tags.Insert("_master_asg")
 	} else {
-		tags["_master_single"] = struct{}{}
+		tags.Insert("_master_single")
 	}
 
 	if useMasterLB {
-		tags["_master_lb"] = struct{}{}
+		tags.Insert("_master_lb")
 	} else if cluster.Spec.Topology.Masters == api.TopologyPublic {
-		tags["_not_master_lb"] = struct{}{}
+		tags.Insert("_not_master_lb")
 	}
 
 	// Network Topologies
@@ -78,27 +74,27 @@ func buildCloudupTags(cluster *api.Cluster) (map[string]struct{}, error) {
 		return nil, fmt.Errorf("missing topology spec")
 	}
 	if cluster.Spec.Topology.Masters == api.TopologyPublic && cluster.Spec.Topology.Nodes == api.TopologyPublic {
-		tags["_topology_public"] = struct{}{}
+		tags.Insert("_topology_public")
 	} else if cluster.Spec.Topology.Masters == api.TopologyPrivate && cluster.Spec.Topology.Nodes == api.TopologyPrivate {
-		tags["_topology_private"] = struct{}{}
+		tags.Insert("_topology_private")
 	} else {
 		return nil, fmt.Errorf("Unable to parse topology. Unsupported topology configuration. Masters and nodes must match!")
 	}
 
 	if fi.BoolValue(cluster.Spec.IsolateMasters) {
-		tags["_isolate_masters"] = struct{}{}
+		tags.Insert("_isolate_masters")
 	}
 
 	switch cluster.Spec.CloudProvider {
 	case "gce":
 		{
 			glog.Fatalf("GCE is (probably) not working currently - please ping @justinsb for cleanup")
-			tags["_gce"] = struct{}{}
+			tags.Insert("_gce")
 		}
 
 	case "aws":
 		{
-			tags["_aws"] = struct{}{}
+			tags.Insert("_aws")
 		}
 
 	default:
@@ -124,15 +120,15 @@ func buildCloudupTags(cluster *api.Cluster) (map[string]struct{}, error) {
 	if versionTag == "" {
 		return nil, fmt.Errorf("unable to determine kubernetes version from %q", cluster.Spec.KubernetesVersion)
 	} else {
-		tags[versionTag] = struct{}{}
+		tags.Insert(versionTag)
 	}
 
-	glog.Infof("tags: %s", tags)
+	glog.Infof("tags: %s", tags.List())
 
 	return tags, nil
 }
 
-func buildNodeupTags(role api.InstanceGroupRole, cluster *api.Cluster, clusterTags map[string]struct{}) ([]string, error) {
+func buildNodeupTags(role api.InstanceGroupRole, cluster *api.Cluster, clusterTags sets.String) ([]string, error) {
 	var tags []string
 
 	networking := cluster.Spec.Networking
diff --git a/upup/pkg/fi/cloudup/template_functions.go b/upup/pkg/fi/cloudup/template_functions.go
index d5bce3d630..c2d6924cdc 100644
--- a/upup/pkg/fi/cloudup/template_functions.go
+++ b/upup/pkg/fi/cloudup/template_functions.go
@@ -35,6 +35,7 @@ import (
 	api "k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"math/big"
 	"net"
 	"sort"
@@ -46,7 +47,7 @@ type TemplateFunctions struct {
 	cluster        *api.Cluster
 	instanceGroups []*api.InstanceGroup
 
-	tags   map[string]struct{}
+	tags   sets.String
 	region string
 }
 
diff --git a/upup/pkg/fi/loader/tree_walker.go b/upup/pkg/fi/loader/tree_walker.go
index f203245e88..81d52c51b5 100644
--- a/upup/pkg/fi/loader/tree_walker.go
+++ b/upup/pkg/fi/loader/tree_walker.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"github.com/golang/glog"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"os"
 	"path"
 	"strings"
@@ -29,7 +30,7 @@ type TreeWalker struct {
 	Contexts       map[string]Handler
 	Extensions     map[string]Handler
 	DefaultHandler Handler
-	Tags           map[string]struct{}
+	Tags           sets.String
 }
 
 type TreeWalkItem struct {
diff --git a/upup/pkg/fi/nodeup/cloudinit/cloud_init_target.go b/upup/pkg/fi/nodeup/cloudinit/cloud_init_target.go
index 893bc2371c..adbcc9fe57 100644
--- a/upup/pkg/fi/nodeup/cloudinit/cloud_init_target.go
+++ b/upup/pkg/fi/nodeup/cloudinit/cloud_init_target.go
@@ -23,6 +23,7 @@ import (
 	"io"
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/utils"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"os"
 	"path"
 )
@@ -30,7 +31,7 @@ import (
 type CloudInitTarget struct {
 	Config *CloudConfig
 	out    io.Writer
-	Tags   map[string]struct{}
+	Tags   sets.String
 }
 
 type AddBehaviour int
@@ -40,7 +41,7 @@ const (
 	Once
 )
 
-func NewCloudInitTarget(out io.Writer, tags map[string]struct{}) *CloudInitTarget {
+func NewCloudInitTarget(out io.Writer, tags sets.String) *CloudInitTarget {
 	t := &CloudInitTarget{
 		Config: &CloudConfig{},
 		out:    out,
diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go
index 51d5fd55ee..12dd729d6c 100644
--- a/upup/pkg/fi/nodeup/command.go
+++ b/upup/pkg/fi/nodeup/command.go
@@ -29,6 +29,7 @@ import (
 	"k8s.io/kops/upup/pkg/fi/nodeup/nodetasks"
 	"k8s.io/kops/upup/pkg/fi/utils"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -174,13 +175,9 @@ func (c *NodeUpCommand) Run(out io.Writer) error {
 		return fmt.Errorf("error determining OS tags: %v", err)
 	}
 
-	tags := make(map[string]struct{})
-	for _, tag := range osTags {
-		tags[tag] = struct{}{}
-	}
-	for _, tag := range c.config.Tags {
-		tags[tag] = struct{}{}
-	}
+	tags := sets.NewString()
+	tags.Insert(osTags...)
+	tags.Insert(c.config.Tags...)
 
 	glog.Infof("Config tags: %v", c.config.Tags)
 	glog.Infof("OS tags: %v", osTags)
diff --git a/upup/pkg/fi/nodeup/loader.go b/upup/pkg/fi/nodeup/loader.go
index d944b9e52d..b4b2173bd4 100644
--- a/upup/pkg/fi/nodeup/loader.go
+++ b/upup/pkg/fi/nodeup/loader.go
@@ -26,6 +26,7 @@ import (
 	"k8s.io/kops/upup/pkg/fi/loader"
 	"k8s.io/kops/upup/pkg/fi/nodeup/nodetasks"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"strings"
 	"text/template"
 )
@@ -38,11 +39,11 @@ type Loader struct {
 	assets *fi.AssetStore
 	tasks  map[string]fi.Task
 
-	tags              map[string]struct{}
+	tags              sets.String
 	TemplateFunctions template.FuncMap
 }
 
-func NewLoader(config *NodeUpConfig, cluster *api.Cluster, assets *fi.AssetStore, tags map[string]struct{}) *Loader {
+func NewLoader(config *NodeUpConfig, cluster *api.Cluster, assets *fi.AssetStore, tags sets.String) *Loader {
 	l := &Loader{}
 	l.assets = assets
 	l.tasks = make(map[string]fi.Task)
diff --git a/upup/pkg/fi/nodeup/local/local_target.go b/upup/pkg/fi/nodeup/local/local_target.go
index 5cc5321c68..9979b45546 100644
--- a/upup/pkg/fi/nodeup/local/local_target.go
+++ b/upup/pkg/fi/nodeup/local/local_target.go
@@ -16,11 +16,14 @@ limitations under the License.
 
 package local
 
-import "k8s.io/kops/upup/pkg/fi"
+import (
+	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kubernetes/pkg/util/sets"
+)
 
 type LocalTarget struct {
 	CacheDir string
-	Tags     map[string]struct{}
+	Tags     sets.String
 }
 
 var _ fi.Target = &LocalTarget{}
diff --git a/upup/pkg/fi/nodeup/template_functions.go b/upup/pkg/fi/nodeup/template_functions.go
index d55cf80aa6..e46b8cb9f0 100644
--- a/upup/pkg/fi/nodeup/template_functions.go
+++ b/upup/pkg/fi/nodeup/template_functions.go
@@ -24,6 +24,7 @@ import (
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/secrets"
 	"k8s.io/kops/util/pkg/vfs"
+	"k8s.io/kubernetes/pkg/util/sets"
 	"text/template"
 )
 
@@ -45,14 +46,14 @@ type templateFunctions struct {
 	// secretStore is populated with a SecretStore, if SecretStore is set
 	secretStore fi.SecretStore
 
-	tags map[string]struct{}
+	tags sets.String
 
 	// kubeletConfig is the kubelet config for the current node
 	kubeletConfig *api.KubeletConfigSpec
 }
 
 // newTemplateFunctions is the constructor for templateFunctions
-func newTemplateFunctions(nodeupConfig *NodeUpConfig, cluster *api.Cluster, instanceGroup *api.InstanceGroup, tags map[string]struct{}) (*templateFunctions, error) {
+func newTemplateFunctions(nodeupConfig *NodeUpConfig, cluster *api.Cluster, instanceGroup *api.InstanceGroup, tags sets.String) (*templateFunctions, error) {
 	t := &templateFunctions{
 		nodeupConfig:  nodeupConfig,
 		cluster:       cluster,