diff --git a/cmd/kubeadm/app/apis/kubeadm/BUILD b/cmd/kubeadm/app/apis/kubeadm/BUILD
index 93aa0cb90fa..5b7677ac134 100644
--- a/cmd/kubeadm/app/apis/kubeadm/BUILD
+++ b/cmd/kubeadm/app/apis/kubeadm/BUILD
@@ -26,6 +26,7 @@ go_library(
         "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
         "//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
         "//staging/src/k8s.io/cluster-bootstrap/token/util:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/util/secrets:go_default_library",
         "//vendor/github.com/pkg/errors:go_default_library",
     ],
 )
diff --git a/pkg/controller/bootstrap/BUILD b/pkg/controller/bootstrap/BUILD
index 922cbde6c13..ad839ca2b82 100644
--- a/pkg/controller/bootstrap/BUILD
+++ b/pkg/controller/bootstrap/BUILD
@@ -59,6 +59,7 @@ go_library(
         "//staging/src/k8s.io/client-go/tools/cache:go_default_library",
         "//staging/src/k8s.io/client-go/util/workqueue:go_default_library",
         "//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/util/secrets:go_default_library",
         "//vendor/gopkg.in/square/go-jose.v2:go_default_library",
         "//vendor/k8s.io/klog:go_default_library",
     ],
diff --git a/plugin/pkg/auth/authenticator/token/bootstrap/BUILD b/plugin/pkg/auth/authenticator/token/bootstrap/BUILD
index 4432fe3faa3..ddec1e72747 100644
--- a/plugin/pkg/auth/authenticator/token/bootstrap/BUILD
+++ b/plugin/pkg/auth/authenticator/token/bootstrap/BUILD
@@ -28,12 +28,12 @@ go_library(
     deps = [
         "//staging/src/k8s.io/api/core/v1:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/authentication/user:go_default_library",
         "//staging/src/k8s.io/client-go/listers/core/v1:go_default_library",
         "//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
-        "//staging/src/k8s.io/cluster-bootstrap/token/util:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/util/secrets:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/util/tokens:go_default_library",
         "//vendor/k8s.io/klog:go_default_library",
     ],
 )
diff --git a/staging/src/k8s.io/cluster-bootstrap/BUILD b/staging/src/k8s.io/cluster-bootstrap/BUILD
index 5fb64991c61..7ee736149e5 100644
--- a/staging/src/k8s.io/cluster-bootstrap/BUILD
+++ b/staging/src/k8s.io/cluster-bootstrap/BUILD
@@ -11,6 +11,8 @@ filegroup(
         ":package-srcs",
         "//staging/src/k8s.io/cluster-bootstrap/token/api:all-srcs",
         "//staging/src/k8s.io/cluster-bootstrap/token/util:all-srcs",
+        "//staging/src/k8s.io/cluster-bootstrap/util/secrets:all-srcs",
+        "//staging/src/k8s.io/cluster-bootstrap/util/tokens:all-srcs",
     ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],
diff --git a/staging/src/k8s.io/cluster-bootstrap/go.mod b/staging/src/k8s.io/cluster-bootstrap/go.mod
index 2cf44b33134..2260655ff69 100644
--- a/staging/src/k8s.io/cluster-bootstrap/go.mod
+++ b/staging/src/k8s.io/cluster-bootstrap/go.mod
@@ -7,6 +7,7 @@ go 1.12
 require (
 	k8s.io/api v0.0.0
 	k8s.io/apimachinery v0.0.0
+	k8s.io/klog v0.3.1
 )
 
 replace (
diff --git a/staging/src/k8s.io/cluster-bootstrap/util/secrets/BUILD b/staging/src/k8s.io/cluster-bootstrap/util/secrets/BUILD
new file mode 100644
index 00000000000..d077e5d8261
--- /dev/null
+++ b/staging/src/k8s.io/cluster-bootstrap/util/secrets/BUILD
@@ -0,0 +1,41 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["secrets.go"],
+    importmap = "k8s.io/kubernetes/vendor/k8s.io/cluster-bootstrap/util/secrets",
+    importpath = "k8s.io/cluster-bootstrap/util/secrets",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//staging/src/k8s.io/api/core/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/token/util:go_default_library",
+        "//vendor/k8s.io/klog:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["secrets_test.go"],
+    embed = [":go_default_library"],
+    deps = [
+        "//staging/src/k8s.io/api/core/v1:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)
diff --git a/staging/src/k8s.io/cluster-bootstrap/util/tokens/BUILD b/staging/src/k8s.io/cluster-bootstrap/util/tokens/BUILD
new file mode 100644
index 00000000000..6b0fc63f420
--- /dev/null
+++ b/staging/src/k8s.io/cluster-bootstrap/util/tokens/BUILD
@@ -0,0 +1,24 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["tokens.go"],
+    importmap = "k8s.io/kubernetes/vendor/k8s.io/cluster-bootstrap/util/tokens",
+    importpath = "k8s.io/cluster-bootstrap/util/tokens",
+    visibility = ["//visibility:public"],
+    deps = ["//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library"],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c77283b2dd0..1dc894f6f27 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1544,6 +1544,8 @@ k8s.io/cloud-provider/volume/helpers
 # k8s.io/cluster-bootstrap v0.0.0 => ./staging/src/k8s.io/cluster-bootstrap
 k8s.io/cluster-bootstrap/token/api
 k8s.io/cluster-bootstrap/token/util
+k8s.io/cluster-bootstrap/util/secrets
+k8s.io/cluster-bootstrap/util/tokens
 # k8s.io/code-generator v0.0.0 => ./staging/src/k8s.io/code-generator
 k8s.io/code-generator/cmd/go-to-protobuf
 k8s.io/code-generator/cmd/go-to-protobuf/protobuf