Question

You are bootstrapping a highly-available cluster with kubeadm using the stacked etcd topology. After running 'kubeadm init --upload-certs' on the first control-plane node and successfully joining a second control-plane node, you attempt to join a third control-plane node two hours later using the same '--certificate-key' value printed during init. The join fails with an error indicating the certificate key cannot be used to decrypt the certificates. What is the cause and correct remediation?

Accepted Answer

The certificate key expired because uploaded certs in the kubeadm-certs Secret are deleted after two hours; run 'kubeadm init phase upload-certs --upload-certs' on an existing control-plane node to regenerate a new key, then join with that key.

Answer

The bootstrap token expired; regenerate a token with 'kubeadm token create' and reuse the original certificate key to join the node.

Answer

The CA certificate rotated automatically; renew all certificates with 'kubeadm certs renew all' on the first node before joining the third node.

Answer

Control-plane joins are limited to two nodes with stacked etcd; you must switch to an external etcd topology to add a third control-plane node.