How to generate kubeadm token for secondary control plane node(s)

user_2418001 0
Viewed 6100

When we launch a master prime node the node creates tokens for worker and master nodes with a ttl.

According to documentation kubeadm token (I also have tested and it works) we can issue a command and get a new token (with default ttl 24h):

kubeadm token create --print-join-command

I am trying to figure out if I want to add a new plane node (secondary master) how can I create a relevant token?

I tried passing some flags e.g.:

kubeadm token create --print-join-command --control-plane

but it fails (of course) since this flag is not recognized.

I found also through the documentation that we can do it with a direct link to config file e.g. ref kubeadm-join/file or https based discovery:

kubeadm join --discovery-file path/to/file.conf # (local file)
kubeadm join --discovery-file https://url/file.conf # (remote HTTPS URL)

In my case I do not have a local conf file or planning to use a url link.

Is there any other way to create a new token using a command for plane nodes and not worker nodes?

kubectl kubernetes token
6 Answers

You need to run on master

kubeadm init phase upload-certs --upload-certs

Remember the output.

Then you need to run on master

kubeadm token create --print-join-command

Then compose joining command for joinning-master-node from this output and add to it --control-plane --certificate-key xxxx

See this video to explain with example: https://www.youtube.com/watch?v=27v36t-3afQ The most interesting is from 20:40. There are some 'experimental' words in video due to older version.

user_67884780

Based on the comments of the users it seems that when someone runs this command:

kubeadm token create --print-join-command

Should populate two strings sample:

kubeadm join loadBalancerIP:6443 --token xxxx --discovery-token-ca-cert-hash sha256:xxxx
kubeadm join loadBalancerIP:6443 --token xxxx --discovery-token-ca-cert-hash sha256:xxxx --control-plane --certificate-key xxxx

In my case unfortunately it did not. Maybe because I am using self signed certs from kubeadm or maybe because the deployment is on bare metal nodes.

Never the less I managed to resolve my problem with a different way.

According to the official documentation Steps for the first control plane node:

"You can also specify a custom --certificate-key during init that can later be used by join. To generate such a key you can use the following command:"

kubeadm alpha certs certificate-key

Once the user runs the command on indented master prime node (not started node yet) it should see something like that:

# kubeadm alpha certs certificate-key
xxxx

Then as the documentation says:

"Note: The kubeadm init flags --config and --certificate-key cannot be mixed, therefore if you want to use the kubeadm configuration you must add the certificateKey field in the appropriate config locations (under InitConfiguration and JoinConfiguration: controlPlane)."

In my case I use a conf file so I add the content into my file:

apiVersion: kubeadm.k8s.io/v1beta2
kind: InitConfiguration
certificateKey: xxxx
localAPIEndpoint:
  advertiseAddress:
  bindPort: 6443
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
---
etc etc

Once the user has this key and launches the prime master with this key (as shown above), the next step is to use exactly the same cert key for the secondary master nodes e.g.:

kubeadm join loadBalancerIP:6443 --token xxxx --discovery-token-ca-cert-hash sha256:xxxx --control-plane --certificate-key xxxx

Note: It is recommended to use a script to produce this data in order to use a new cert key when you destroy / create the master node(s).

Hope this helps someone else on the future in order not to spend so much as I did.

user_24180010

The following will create the join command for your additional controllers.

echo $(kubeadm token create --print-join-command) --control-plane --certificate-key $(kubeadm init phase upload-certs --upload-certs | grep -vw -e certificate -e Namespace)'
user_114987020

The command kubeadm token create does not have any flag --control-plane

From the docs

When you run the command kubeadm token create --print-join-command you get two commands in the output and you use the command with --control-plane flag to join the control plane node.

user_18394820

I believe there is no separate token for adding more control plane, you just have to add --control-plane while adding.

To get the join command kubeadm token create --print-join-command

Assuming certificates are already uploaded and set in place. More details can be found here. https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/

Edit: sorry for delayed update kubeadm alpha certs certificate-key can be used to create the key

then upload then using kubeadm init phase upload-certs --upload-certs --certificate-key=<above key>

and use this to create join command kubeadm token create --print-join-command --certificate-key <key created above>

You can pass --control-plane to above join command for additional control planes and ignore this flag for worker nodes

user_20391520

I think you want the commands below.

Display the command:

echo "$(kubeadm token create --print-join-command) --control-plane"
kubeadm join 192.168.5.50:8443 --token b99yno.3ju18t22w80ishlz --discovery-token-ca-cert-hash sha256:8f16b6d5304f070de0d32a6663ffaa30ac58163f9cfd38be4af405ac78c93b73  --control-plane

Run the command:

echo "$(kubeadm token create --print-join-command) --control-plane"|sh
user_176919340
Related