Question

You are bootstrapping a highly-available control plane with kubeadm. The first control-plane node was initialized several hours ago using 'kubeadm init' with a stacked etcd topology behind a load balancer. Now you want to join a second control-plane node using 'kubeadm join --control-plane'. The join command fails because it cannot download the required control-plane certificates from the cluster. What is the correct way to make those certificates available for the join?

Accepted Answer

Run 'kubeadm init phase upload-certs --upload-certs' on the first control-plane node to re-upload the certificates to a new kubeadm-certs Secret, then obtain the new certificate key and pass it to the join command with --certificate-key

Answer

Manually copy the /etc/kubernetes/pki directory from the first node to the second node and re-run the same join command, since kubeadm never distributes certificates over the network

Answer

Regenerate the bootstrap token with 'kubeadm token create' and pass it with --token; the certificate download uses the same token and no separate key is needed

Answer

Run 'kubeadm certs renew all' on the first node to refresh the certificates, which automatically re-populates the certificate cache used by joining control-plane nodes