diff --git a/bindata/network/iptables-alerter/002-script.yaml b/bindata/network/iptables-alerter/002-script.yaml
index ffc0a49e63..aa032d3b27 100644
--- a/bindata/network/iptables-alerter/002-script.yaml
+++ b/bindata/network/iptables-alerter/002-script.yaml
@@ -101,18 +101,18 @@ data:
     apiVersion: events.k8s.io/v1
     kind: Event
     metadata:
-      namespace: ${pod_namespace}
+      namespace: "${pod_namespace}"
       generateName: iptables-alert-
       labels:
-        pod-uid: ${pod_uid}
+        pod-uid: "${pod_uid}"
     regarding:
       apiVersion: v1
       kind: Pod
-      namespace: ${pod_namespace}
-      name: ${pod_name}
-      uid: ${pod_uid}
+      namespace: "${pod_namespace}"
+      name: "${pod_name}"
+      uid: "${pod_uid}"
     reportingController: openshift.io/iptables-deprecation-alerter
-    reportingInstance: ${ALERTER_POD_NAME}
+    reportingInstance: "${ALERTER_POD_NAME}"
     action: IPTablesUsageObserved
     reason: IPTablesUsageObserved
     type: Normal
diff --git a/pkg/network/iptables_alerter_test.go b/pkg/network/iptables_alerter_test.go
new file mode 100644
index 0000000000..d6539058f6
--- /dev/null
+++ b/pkg/network/iptables_alerter_test.go
@@ -0,0 +1,40 @@
+package network
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega"
+	operv1 "github.com/openshift/api/operator/v1"
+	uns "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestRenderIPTablesAlerterQuotesYAMLStringFields(t *testing.T) {
+	g := NewGomegaWithT(t)
+
+	bootstrapResult := fakeBootstrapResult()
+	bootstrapResult.IPTablesAlerter.Enabled = true
+
+	objs, err := renderIPTablesAlerter(&operv1.NetworkSpec{}, bootstrapResult, manifestDir)
+	g.Expect(err).NotTo(HaveOccurred())
+
+	var scriptCM *uns.Unstructured
+	for _, obj := range objs {
+		if obj.GetKind() == "ConfigMap" && obj.GetName() == "iptables-alerter-script" {
+			scriptCM = obj
+			break
+		}
+	}
+	g.Expect(scriptCM).NotTo(BeNil())
+
+	script, found, err := uns.NestedString(scriptCM.Object, "data", "iptables-alerter.sh")
+	g.Expect(err).NotTo(HaveOccurred())
+	g.Expect(found).To(BeTrue())
+
+	// Unquoted YAML 1.1 booleans such as yes/no/true/false/on/off unmarshal as
+	// bool and crash kubectl when metadata.namespace/name must be strings.
+	g.Expect(script).To(ContainSubstring(`namespace: "${pod_namespace}"`))
+	g.Expect(script).To(ContainSubstring(`name: "${pod_name}"`))
+	g.Expect(script).To(ContainSubstring(`uid: "${pod_uid}"`))
+	g.Expect(script).To(ContainSubstring(`pod-uid: "${pod_uid}"`))
+	g.Expect(script).To(ContainSubstring(`reportingInstance: "${ALERTER_POD_NAME}"`))
+}