{"record":{"id":"6f73ddbaf66e57bd","repo":"kubernetes/kubernetes","slug":"service-account-signing-key-file-and-service-a","errorCode":null,"errorMessage":"--service-account-signing-key-file and --service-account-issuer are required flags","messagePattern":"--service-account-signing-key-file and --service-account-issuer are required flags","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/controlplane/apiserver/options/validation.go","lineNumber":44,"sourceCode":"\tapiserverfeatures \"k8s.io/apiserver/pkg/features\"\n\tutilfeature \"k8s.io/apiserver/pkg/util/feature\"\n\taggregatorscheme \"k8s.io/kube-aggregator/pkg/apiserver/scheme\"\n\t\"k8s.io/kubernetes/pkg/features\"\n\n\t\"k8s.io/kubernetes/pkg/api/legacyscheme\"\n)\n\nfunc validateTokenRequest(options *Options) []error {\n\tvar errs []error\n\n\tenableAttempted := options.ServiceAccountSigningKeyFile != \"\" ||\n\t\t(len(options.Authentication.ServiceAccounts.Issuers) != 0 && options.Authentication.ServiceAccounts.Issuers[0] != \"\") ||\n\t\tlen(options.Authentication.APIAudiences) != 0\n\n\tenableSucceeded := options.ServiceAccountIssuer != nil\n\n\tif !enableAttempted {\n\t\terrs = append(errs, errors.New(\"--service-account-signing-key-file and --service-account-issuer are required flags\"))\n\t}\n\n\tif enableAttempted && !enableSucceeded {\n\t\terrs = append(errs, errors.New(\"--service-account-signing-key-file, --service-account-issuer, and --api-audiences should be specified together\"))\n\t}\n\n\treturn errs\n}\n\nfunc validateAPIPriorityAndFairness(options *Options) []error {\n\tif options.Features.EnablePriorityAndFairness {\n\t\t// If none of the following runtime config options are specified,\n\t\t// APF is assumed to be turned on. The internal APF controller uses\n\t\t// v1 so it should be enabled.\n\t\tenabledAPIString := options.APIEnablement.RuntimeConfig.String()\n\t\ttestConfigs := []string{\"flowcontrol.apiserver.k8s.io/v1\", \"api/ga\", \"api/all\"} // in the order of precedence\n\t\tfor _, testConfig := range testConfigs {\n\t\t\tif strings.Contains(enabledAPIString, fmt.Sprintf(\"%s=false\", testConfig)) {","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/pkg/controlplane/apiserver/options/validation.go#L26-L62","documentation":"Thrown by validateTokenRequest during apiserver options validation when NONE of the service-account signing key file, issuer, or API audiences are configured (enableAttempted is false). The apiserver treats token request support as requiring explicit opt-in; total absence of these flags is rejected.","triggerScenarios":"Starting kube-apiserver with no --service-account-signing-key-file, no --service-account-issuer, and no --api-audiences. The validator flags this as an invalid configuration before boot.","commonSituations":"Misconfigured apiserver flags in custom/kubeadm deployments; flags stripped during config refactoring; embedded apiserver (test aggregation) missing SA options.","solutions":["Provide --service-account-signing-key-file=<key.pem> and --service-account-issuer=<issuer-url> at minimum.","Re-run apiserver startup; the validator should pass once both are set.","If using kubeadm, ensure the cluster CA / SA signing key is generated and referenced in the apiserver static pod spec."],"exampleFix":"// before\n// kube-apiserver (no SA flags)\n// after\n// kube-apiserver --service-account-signing-key-file=/etc/kubernetes/sa.key --service-account-issuer=https://kubernetes.default.svc","handlingStrategy":"validation","validationCode":"// Pre-flight apiserver flag check\nconst attempted = opts.serviceAccountSigningKeyFile !== '' || issuers.length > 0 && issuers[0] !== '' || apiAudiences.length > 0;\nif (!attempted) throw new Error('must set --service-account-signing-key-file and --service-account-issuer');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize apiserver flag templates so SA signing key + issuer are always present.","Add a startup config validator in CI for kube-apiserver static pod manifests."],"tags":["apiserver","service-account","authentication","kubernetes","configuration","startup"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}