--service-account-signing-key-file and --service-account-iss

Error message

--service-account-signing-key-file and --service-account-issuer are required flags

What it means

Thrown by validateTokenRequest during apiserver options validation when NONE of the service-account signing key file, issuer, or API audiences are configured (enableAttempted is false). The apiserver treats token request support as requiring explicit opt-in; total absence of these flags is rejected.

Source

Thrown at pkg/controlplane/apiserver/options/validation.go:44

	apiserverfeatures "k8s.io/apiserver/pkg/features"
	utilfeature "k8s.io/apiserver/pkg/util/feature"
	aggregatorscheme "k8s.io/kube-aggregator/pkg/apiserver/scheme"
	"k8s.io/kubernetes/pkg/features"

	"k8s.io/kubernetes/pkg/api/legacyscheme"
)

func validateTokenRequest(options *Options) []error {
	var errs []error

	enableAttempted := options.ServiceAccountSigningKeyFile != "" ||
		(len(options.Authentication.ServiceAccounts.Issuers) != 0 && options.Authentication.ServiceAccounts.Issuers[0] != "") ||
		len(options.Authentication.APIAudiences) != 0

	enableSucceeded := options.ServiceAccountIssuer != nil

	if !enableAttempted {
		errs = append(errs, errors.New("--service-account-signing-key-file and --service-account-issuer are required flags"))
	}

	if enableAttempted && !enableSucceeded {
		errs = append(errs, errors.New("--service-account-signing-key-file, --service-account-issuer, and --api-audiences should be specified together"))
	}

	return errs
}

func validateAPIPriorityAndFairness(options *Options) []error {
	if options.Features.EnablePriorityAndFairness {
		// If none of the following runtime config options are specified,
		// APF is assumed to be turned on. The internal APF controller uses
		// v1 so it should be enabled.
		enabledAPIString := options.APIEnablement.RuntimeConfig.String()
		testConfigs := []string{"flowcontrol.apiserver.k8s.io/v1", "api/ga", "api/all"} // in the order of precedence
		for _, testConfig := range testConfigs {
			if strings.Contains(enabledAPIString, fmt.Sprintf("%s=false", testConfig)) {

View on GitHub (pinned to b882c60b40)

Solutions

Provide --service-account-signing-key-file=<key.pem> and --service-account-issuer=<issuer-url> at minimum.
Re-run apiserver startup; the validator should pass once both are set.
If using kubeadm, ensure the cluster CA / SA signing key is generated and referenced in the apiserver static pod spec.

Example fix

// before
// kube-apiserver (no SA flags)
// after
// kube-apiserver --service-account-signing-key-file=/etc/kubernetes/sa.key --service-account-issuer=https://kubernetes.default.svc

Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight apiserver flag check
const attempted = opts.serviceAccountSigningKeyFile !== '' || issuers.length > 0 && issuers[0] !== '' || apiAudiences.length > 0;
if (!attempted) throw new Error('must set --service-account-signing-key-file and --service-account-issuer');

Prevention

Standardize apiserver flag templates so SA signing key + issuer are always present.
Add a startup config validator in CI for kube-apiserver static pod manifests.

When it happens

Trigger: Starting kube-apiserver with no --service-account-signing-key-file, no --service-account-issuer, and no --api-audiences. The validator flags this as an invalid configuration before boot.

Common situations: Misconfigured apiserver flags in custom/kubeadm deployments; flags stripped during config refactoring; embedded apiserver (test aggregation) missing SA options.

Related errors

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/6f73ddbaf66e57bd. Report an issue: GitHub.