diff --git a/docs/vars.md b/docs/vars.md
index b01dafd18c0728cc21f1e2b4800cda0a039fb0f1..38d66bcd317e0bfda8ebe4eefbaf50fa8012eb88 100644
--- a/docs/vars.md
+++ b/docs/vars.md
@@ -98,6 +98,7 @@ Stack](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/dns-stack.m
 
 * *docker_options* - Commonly used to set
   ``--insecure-registry=myregistry.mydomain:5000``
+* *docker_plugins* - This list can be used to define [Docker plugins](https://docs.docker.com/engine/extend/) to install. 
 * *http_proxy/https_proxy/no_proxy* - Proxy variables for deploying behind a
   proxy. Note that no_proxy defaults to all internal cluster IPs and hostnames
   that correspond to each node.
diff --git a/roles/container-engine/docker/tasks/docker_plugin.yml b/roles/container-engine/docker/tasks/docker_plugin.yml
new file mode 100644
index 0000000000000000000000000000000000000000..8ee530e9529d12cf5cbaed37135971b9faefe7de
--- /dev/null
+++ b/roles/container-engine/docker/tasks/docker_plugin.yml
@@ -0,0 +1,8 @@
+---
+- name: Install Docker plugin
+  command: docker plugin install --grant-all-permissions {{ docker_plugin | quote }}
+  when: docker_plugin is defined
+  register: docker_plugin_status
+  failed_when:
+    - docker_plugin_status.failed
+    - '"already exists" not in docker_plugin_status.stderr'
diff --git a/roles/container-engine/docker/tasks/main.yml b/roles/container-engine/docker/tasks/main.yml
index 74f99c7d7390356e9604c739d92dbfdbf9543491..e44dca8d616c1b5bf13278035fcf3c774ce7b0aa 100644
--- a/roles/container-engine/docker/tasks/main.yml
+++ b/roles/container-engine/docker/tasks/main.yml
@@ -235,6 +235,12 @@
         resolvconf_mode == 'docker_dns' and
         installed_docker_version.stdout is version('1.12', '<')
 
+# Install each plugin using a looped include to make error handling in the included task simpler.
+- include_tasks: docker_plugin.yml
+  loop: "{{ docker_plugins }}"
+  loop_control:
+    loop_var: docker_plugin
+
 - name: Set docker systemd config
   import_tasks: systemd.yml
 
diff --git a/roles/kubespray-defaults/defaults/main.yaml b/roles/kubespray-defaults/defaults/main.yaml
index 76f86373051df57dd7a11c098bf2dc16932e8fef..3f135c4de46c5ac37a61abcc8fb7e3fc40d1a911 100644
--- a/roles/kubespray-defaults/defaults/main.yaml
+++ b/roles/kubespray-defaults/defaults/main.yaml
@@ -256,6 +256,10 @@ docker_options: >-
   --userland-proxy-path=/usr/libexec/docker/docker-proxy-current --signature-verification=false
   {%- endif -%}
 
+## A list of plugins to install using 'docker plugin install --grant-all-permissions'
+## Empty by default so no plugins will be installed.
+docker_plugins: []
+
 # Experimental kubeadm etcd deployment mode. Available only for new deployment
 etcd_kubeadm_enabled: false