diff --git a/api/v2/checluster_types.go b/api/v2/checluster_types.go
index 1f47f696b..d8a3f4f2b 100644
--- a/api/v2/checluster_types.go
+++ b/api/v2/checluster_types.go
@@ -500,6 +500,9 @@ type Auth struct {
 	// +optional
 	OAuthClientName string `json:"oAuthClientName,omitempty"`
 	// Name of the secret set in the OpenShift `OAuthClient` resource used to set up identity federation on the OpenShift side.
+	// For Kubernetes, this can either be the plain text oAuthSecret value, or the name of a kubernetes secret which contains a
+	// key 'oAuthSecret' and the value is the secret. NOTE: this secret must exist in the same namespace as the CheCluster
+	// resource and contain the label app.kubernetes.io/part-of=che.eclipse.org.
 	// +optional
 	OAuthSecret string `json:"oAuthSecret,omitempty"`
 	// Access Token Scope.