diff --git a/roles/kubernetes/preinstall/defaults/main.yml b/roles/kubernetes/preinstall/defaults/main.yml
index 10f22cb5b2c702ddb80266d8d14c4cb4223331fd..f755adf6dfe86de04f80f8fc901e450fabfeaaa8 100644
--- a/roles/kubernetes/preinstall/defaults/main.yml
+++ b/roles/kubernetes/preinstall/defaults/main.yml
@@ -60,3 +60,10 @@ pkg_install_retries: 4
 
 # Check if access_ip responds to ping. Set false if your firewall blocks ICMP.
 ping_access_ip: true
+
+apiserver_loadbalancer_domain_name_host: |-
+  {% if inventory_hostname in groups['kube_control_plane'] -%}
+      127.0.0.1
+  {%- else -%}
+      {{ loadbalancer_apiserver.address }}
+  {%- endif %}
diff --git a/roles/kubernetes/preinstall/tasks/0090-etchosts.yml b/roles/kubernetes/preinstall/tasks/0090-etchosts.yml
index 32a2c8e775ff3ec5e338ea5e501dc226078c13dd..6357975f21a04e5802df02116e48abc93dacac76 100644
--- a/roles/kubernetes/preinstall/tasks/0090-etchosts.yml
+++ b/roles/kubernetes/preinstall/tasks/0090-etchosts.yml
@@ -29,7 +29,7 @@
   lineinfile:
     dest: /etc/hosts
     regexp: ".*{{ apiserver_loadbalancer_domain_name }}$"
-    line: "{{ loadbalancer_apiserver.address }} {{ apiserver_loadbalancer_domain_name }}"
+    line: "{{ apiserver_loadbalancer_domain_name_host }} {{ apiserver_loadbalancer_domain_name }}"
     state: present
     backup: yes
     unsafe_writes: yes