diff --git a/controllers/pkg/reconcilers/spire-bootstrap/reconciler.go b/controllers/pkg/reconcilers/spire-bootstrap/reconciler.go
index 5d77ae9f..5a8cd80f 100644
--- a/controllers/pkg/reconcilers/spire-bootstrap/reconciler.go
+++ b/controllers/pkg/reconcilers/spire-bootstrap/reconciler.go
@@ -368,7 +368,7 @@ func (r *reconciler) createKubeconfigConfigMap(ctx context.Context, clientset *k
 	}
 	caCert := configMap.Data["ca.crt"]
 
-	kubeconfig := fmt.Sprintf(`
+	kubeconfig := strings.TrimSpace(fmt.Sprintf(`
 	apiVersion: v1
 	kind: Config
 	clusters:
@@ -386,7 +386,7 @@ func (r *reconciler) createKubeconfigConfigMap(ctx context.Context, clientset *k
 	- name: spire-kubeconfig
 	  user:
 	    token: %s
-	`, base64.StdEncoding.EncodeToString([]byte(caCert)), clientset.RESTClient().Get().URL().String(), clustername, token)
+	`, base64.StdEncoding.EncodeToString([]byte(caCert)), clientset.RESTClient().Get().URL().String(), clustername, token))
 
 	// Generate a unique key for the new kubeconfig
 	newConfigKey := fmt.Sprintf("kubeconfig-%s", clustername)