diff --git a/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntime.java b/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntime.java
index 8d7a95cf3d71a..d0e36ecb48cd6 100644
--- a/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntime.java
+++ b/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntime.java
@@ -885,11 +885,12 @@ && isNotBlank(authConfig.getClientAuthenticationParameters())) {
                         "--auth-params",
                         authConfig.getClientAuthenticationParameters()));
             }
-            cmd.addAll(Arrays.asList(
-                    "--tls-allow-insecure",
-                    Boolean.toString(authConfig.isTlsAllowInsecureConnection()),
-                    "--tls-enable-hostname-verification",
-                    Boolean.toString(authConfig.isTlsHostnameVerificationEnable())));
+            if (authConfig.isTlsAllowInsecureConnection()) {
+                cmd.add("--tls-allow-insecure");
+            }
+            if (authConfig.isTlsHostnameVerificationEnable()) {
+                cmd.add("--tls-enable-hostname-verification");
+            }
             if (isNotBlank(authConfig.getTlsTrustCertsFilePath())) {
                 cmd.addAll(Arrays.asList(
                         "--tls-trust-cert-path",
diff --git a/pulsar-functions/runtime/src/test/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntimeTest.java b/pulsar-functions/runtime/src/test/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntimeTest.java
index 2cbbeb8a00b92..31f82adfe8c26 100644
--- a/pulsar-functions/runtime/src/test/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntimeTest.java
+++ b/pulsar-functions/runtime/src/test/java/org/apache/pulsar/functions/runtime/kubernetes/KubernetesRuntimeTest.java
@@ -852,7 +852,6 @@ public void testCustomKubernetesDownloadCommandsWithAuth() throws Exception {
         V1StatefulSet spec = container.createStatefulSet();
         String expectedDownloadCommand = "pulsar-admin --admin-url " + pulsarAdminUrl
                 + " --auth-plugin com.MyAuth --auth-params {\"authParam1\": \"authParamValue1\"}"
-                + " --tls-allow-insecure false --tls-enable-hostname-verification false"
                 + " functions download "
                 + "--tenant " + TEST_TENANT
                 + " --namespace " + TEST_NAMESPACE
@@ -879,7 +878,6 @@ public void testCustomKubernetesDownloadCommandsWithAuthWithoutAuthSpec() throws
         V1StatefulSet spec = container.createStatefulSet();
         String expectedDownloadCommand = "pulsar-admin --admin-url " + pulsarAdminUrl
                 + " --auth-plugin com.MyAuth --auth-params {\"authParam1\": \"authParamValue1\"}"
-                + " --tls-allow-insecure false --tls-enable-hostname-verification false"
                 + " functions download "
                 + "--tenant " + TEST_TENANT
                 + " --namespace " + TEST_NAMESPACE
@@ -909,7 +907,7 @@ public void testCustomKubernetesDownloadCommandsWithAuthAndCustomTLSWithoutAuthS
         V1StatefulSet spec = container.createStatefulSet();
         String expectedDownloadCommand = "pulsar-admin --admin-url " + pulsarAdminUrl
                 + " --auth-plugin com.MyAuth --auth-params {\"authParam1\": \"authParamValue1\"}"
-                + " --tls-allow-insecure false --tls-enable-hostname-verification true"
+                + " --tls-enable-hostname-verification"
                 + " --tls-trust-cert-path /my/ca.pem"
                 + " functions download "
                 + "--tenant " + TEST_TENANT