Some services, such as Istio and Envoy's Secret Discovery Service (SDS), take advantage of a new feature in Kubernetes 1.12+, [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection).


1. In order to enable this feature for Kubernetes 1.12+, add the following config to your cluster spec:

```yaml
    kubeAPIServer:
        apiAudiences:
        - api
        - istio-ca
        serviceAccountIssuer: kubernetes.default.svc
        serviceAccountKeyFile:
        - /srv/kubernetes/server.key
        serviceAccountSigningKeyFile: /srv/kubernetes/server.key
```

Some services, such as Istio and Envoy's Secret Discovery Service (SDS), take advantage of a new feature in Kubernetes 1.12+, [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection).


1. In order to enable this feature for Kubernetes 1.12+, add the following config to your cluster spec:

```yaml
    kubeAPIServer:
        apiAudiences:
        - api
        - istio-ca
        serviceAccountIssuer: kubernetes.default.svc
```

Fix ServiceAccountVolume proposed configuration for Istio
Docs: Fix ServiceAccountVolume proposed configuration for Istio

Seems that after merging https://github.com/kubernetes/kops/pull/9534
there is no need to specify paths for key-files for service Account
Token Volume Projection. Instead, current configuration proposed is
making Istio unable to verify JWT token with errors.

In this commit, we remove the paths, letting Kops handles the default
ones that are working as expected.

Signed-off-by: dntosas <41127c15155ee9ceee779a16a31fb9e252e6ed0a@gmail.com>
