diff --git a/config/ks-core/templates/kubesphere-config.yaml b/config/ks-core/templates/kubesphere-config.yaml
index f8468869b..96fb32049 100644
--- a/config/ks-core/templates/kubesphere-config.yaml
+++ b/config/ks-core/templates/kubesphere-config.yaml
@@ -13,7 +13,7 @@ data:
       maximumClockSkew: {{ .Values.config.authentication.maximumClockSkew | default "10s" }}
       multipleLogin: {{ .Values.console.enableMultiLogin | default true }}
       kubectlImage: {{ .Values.image.ks_kubectl_repo }}:{{ .Values.image.ks_kubectl_tag | default "latest" }}
-      jwtSecret: "{{ .Values.jwtSecret }}"
+      jwtSecret: "{{ .Values.config.jwtSecret | default (randAlphaNum 32 ) }}"
 {{- if .Values.config.authentication.oauthOptions }}
       {{- with .Values.config.authentication.oauthOptions }}
       oauthOptions:
diff --git a/config/ks-core/values.yaml b/config/ks-core/values.yaml
index b66fa517d..bf29c87eb 100644
--- a/config/ks-core/values.yaml
+++ b/config/ks-core/values.yaml
@@ -39,7 +39,7 @@ config:
   # Specifies whether the kubesphere-config configmap should be created
   create: true
   authentication: {}
-  # Jwt Secret is required
+  # Jwt Secret is required by ks-apiserver, a random string would be generated if it's empty
   jwtSecret: ""
   multicluster: {}
   monitoring: {}