diff --git a/pkg/cluster/services.go b/pkg/cluster/services.go
index 55b48c25a9c3387b8460873fca084a25363d3e52..c25d0c5911b37c9f97131ac6ac255968dafb1a34 100644
--- a/pkg/cluster/services.go
+++ b/pkg/cluster/services.go
@@ -125,6 +125,7 @@ func (c *Cluster) startK8sMaster() {
 		"--tls-cert-file", c.masterCerts.ControllersTLS.CertPath(),
 		"--tls-private-key-file", c.masterCerts.ControllersTLS.KeyPath(),
 		"--service-account-private-key-file", c.masterCerts.APITokens.KeyPath(),
+		"--root-ca-file", c.pki.TLS.CertPath(),
 		"--use-service-account-credentials",
 	})
 	if err != nil {