diff --git a/cmd/kube-controller-manager/app/BUILD b/cmd/kube-controller-manager/app/BUILD
index 5138b40f062..55550e41058 100644
--- a/cmd/kube-controller-manager/app/BUILD
+++ b/cmd/kube-controller-manager/app/BUILD
@@ -14,6 +14,7 @@ go_library(
         "apps.go",
         "autoscaling.go",
         "batch.go",
+        "bootstrap.go",
         "certificates.go",
         "controllermanager.go",
         "core.go",
@@ -42,6 +43,7 @@ go_library(
         "//pkg/cloudprovider/providers/photon:go_default_library",
         "//pkg/cloudprovider/providers/vsphere:go_default_library",
         "//pkg/controller:go_default_library",
+        "//pkg/controller/bootstrap:go_default_library",
         "//pkg/controller/certificates:go_default_library",
         "//pkg/controller/cronjob:go_default_library",
         "//pkg/controller/daemon:go_default_library",
diff --git a/cmd/kube-controller-manager/app/bootstrap.go b/cmd/kube-controller-manager/app/bootstrap.go
new file mode 100644
index 00000000000..05ff566fd88
--- /dev/null
+++ b/cmd/kube-controller-manager/app/bootstrap.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import "k8s.io/kubernetes/pkg/controller/bootstrap"
+
+func startBootstrapSignerController(ctx ControllerContext) (bool, error) {
+	go bootstrap.NewBootstrapSigner(
+		ctx.ClientBuilder.ClientGoClientOrDie("bootstrap-signer"),
+		bootstrap.DefaultBootstrapSignerOptions(),
+	).Run(ctx.Stop)
+	return true, nil
+}
+
+func startTokenCleanerController(ctx ControllerContext) (bool, error) {
+	go bootstrap.NewTokenCleaner(
+		ctx.ClientBuilder.ClientGoClientOrDie("token-cleaner"),
+		bootstrap.DefaultTokenCleanerOptions(),
+	).Run(ctx.Stop)
+	return true, nil
+}
diff --git a/cmd/kube-controller-manager/app/controllermanager.go b/cmd/kube-controller-manager/app/controllermanager.go
index 19dc599bd49..0b34ae7e532 100644
--- a/cmd/kube-controller-manager/app/controllermanager.go
+++ b/cmd/kube-controller-manager/app/controllermanager.go
@@ -270,7 +270,10 @@ func KnownControllers() []string {
 	return sets.StringKeySet(newControllerInitializers()).List()
 }
 
-var ControllersDisabledByDefault = sets.NewString()
+var ControllersDisabledByDefault = sets.NewString(
+	"bootstrapsigner",
+	"tokencleaner",
+)
 
 func newControllerInitializers() map[string]InitFunc {
 	controllers := map[string]InitFunc{}
@@ -291,6 +294,8 @@ func newControllerInitializers() map[string]InitFunc {
 	controllers["cronjob"] = startCronJobController
 	controllers["certificatesigningrequests"] = startCSRController
 	controllers["ttl"] = startTTLController
+	controllers["bootstrapsigner"] = startBootstrapSignerController
+	controllers["tokencleaner"] = startTokenCleanerController
 
 	return controllers
 }