Based on the comments of the users it seems that when someone runs this command:
kubeadm token create --print-join-command
Should populate two strings sample:
kubeadm join loadBalancerIP:6443 --token xxxx --discovery-token-ca-cert-hash sha256:xxxx
kubeadm join loadBalancerIP:6443 --token xxxx --discovery-token-ca-cert-hash sha256:xxxx --control-plane --certificate-key xxxx
In my case unfortunately it did not. Maybe because I am using self signed certs from kubeadm or maybe because the deployment is on bare metal nodes.
Never the less I managed to resolve my problem with a different way.
According to the official documentation Steps for the first control plane node:
"You can also specify a custom --certificate-key during init that can later be used by join. To generate such a key you can use the following command:"
kubeadm alpha certs certificate-key
Once the user runs the command on indented master prime node (not started node yet) it should see something like that:
# kubeadm alpha certs certificate-key
xxxx
Then as the documentation says:
"Note: The kubeadm init flags --config and --certificate-key cannot be mixed, therefore if you want to use the kubeadm configuration you must add the certificateKey field in the appropriate config locations (under InitConfiguration and JoinConfiguration: controlPlane)."
In my case I use a conf file so I add the content into my file:
apiVersion: kubeadm.k8s.io/v1beta2
kind: InitConfiguration
certificateKey: xxxx
localAPIEndpoint:
advertiseAddress:
bindPort: 6443
---
apiServer:
timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
---
etc etc
Once the user has this key and launches the prime master with this key (as shown above), the next step is to use exactly the same cert key for the secondary master nodes e.g.:
kubeadm join loadBalancerIP:6443 --token xxxx --discovery-token-ca-cert-hash sha256:xxxx --control-plane --certificate-key xxxx
Note: It is recommended to use a script to produce this data in order to use a new cert key when you destroy / create the master node(s).
Hope this helps someone else on the future in order not to spend so much as I did.