90

I've lost the original 'kubeadm join' command when I previously ran kubeadm init.

How can I retrieve this value again?

7 Answers 7

209
kubeadm token create --print-join-command
4
  • I can get the token but it prints a warning. Is it possible to only print the token? without any warning, just the token itself? Jul 19, 2020 at 13:02
  • Possibly the error goes to stderr. You could try 2> /dev/null. Jul 19, 2020 at 13:14
  • wow! you are just awesome. It is working, but i am not sure if this will guarantee it is working everytime? Jul 19, 2020 at 13:43
  • I love you!! ❤️
    – lindhe
    Oct 16 at 12:23
34

To print a join command for a new worker node use:

  • kubeadm token create --print-join-command

But if you need to join a new control plane node, you need to recreate a new key for the control plane join command. This can be done with three simple steps:

  1. Re upload certificates in the already working master node with kubeadm init phase upload-certs --upload-certs. That will generate a new certificate key.

  2. Print join command in the already working master node with kubeadm token create --print-join-command.

  3. Join a new control plane node with $JOIN_COMMAND_FROM_STEP2 --control-plane --certificate-key $KEY_FROM_STEP1.

This might not work for the old Kubernetes versions but I tried with the new version and it worked for me.

1
  • This is such an awesome and elegant solution. Thank you it works flawlessly.
    – bluelurker
    May 16, 2021 at 20:25
17

To create kubeadm join command, please run the following commands:

Step 1 - Retrieve Token CA Hash:

openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt \
    | openssl rsa -pubin -outform der 2>/dev/null \
    | openssl dgst -sha256 -hex \
    | sed 's/^.* //'

This command will provide you public key.

Step 2 - Retrieve bootstrap Tokens:

kubeadm token list

This will print all tokens, so copy the token value under TOKEN with the description "The default bootstrap token generated by kubeadm init."

Step 3 - Creates kubeadm init command:

Now use following syntax to create join command without creating a new token:

kubeadm join <ip-address>:6443\
    --token=<token-from-step-2> \
    --discovery-token-ca-cert-hash sha256:<ca-hash-from-step-1>

kubeadm token create command creates a new token, in this case without any description, so for you not to create any additional tokens, just pick the token which has a DESCRIPTION as mentioned in Step 2.

2
  • 2
    Got this error in Step1: sed: -e expression #1, char 9: unknown option to `s' Jan 7, 2020 at 14:27
  • trailing couple of ** has to be removed from the command then it will work Feb 27, 2020 at 16:21
6

Run the below command on your master node machine.

kubeadm token create --print-join-command

This command will generate the new token as well as the join command which you can use at your worker node to join the cluster.

3

If you are joining control plane nodes, you will need a certificate key in the command too:

kubeadm token create \
--print-join-command \
--certificate-key \
$(kubeadm alpha certs certificate-key)

The kubeadm alpha certs certificate-key command will generate a new certificate key on demand as per the documentation here

To Join a worker node, the command kubeadm token create --print-join-command given in the accepted answer is sufficient

1
  • 1
    In the newer Kubernetes versions the certificate key command is without alpha - kubeadm certs certificate-key
    – Lirt
    May 26 at 13:57
2

Building off @Abhishek Jain's answer, here's a script to print the kubeadm join command with a little help from jq:

# get the join command from the kube master
CERT_HASH=$(openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt \
| openssl rsa -pubin -outform der 2>/dev/null \
| openssl dgst -sha256 -hex \
| sed 's/^.* //')
TOKEN=$(kubeadm token list -o json | jq -r '.token' | head -1)
IP=$(kubectl get nodes -lnode-role.kubernetes.io/master -o json \
| jq -r '.items[0].status.addresses[] | select(.type=="InternalIP") | .address')
PORT=6443
echo "sudo kubeadm join $IP:$PORT \
--token=$TOKEN --discovery-token-ca-cert-hash sha256:$CERT_HASH"
0

Here is a bash script that automate this task

read -p 'master ip address : ' ipaddr
sha_token = "$(openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //')"
token = "$(kubeadm token list | awk '{print $1}' | sed -n '2 p')"
echo "kubeadm join $ipaddr:6443 --token=$token --discovery-token-ca-cert-hash sha256:$sha_token"

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.