Question

You are adding a new worker node to an existing kubeadm cluster. On the worker, you run 'kubeadm join 10.0.0.5:6443 --token abc123.def4567890ghijkl' without any other flags. The join fails immediately with an error stating that the cluster CA could not be validated because no --discovery-token-ca-cert-hash was provided and --discovery-token-unsafe-skip-ca-verification was not set. You want to join securely without disabling verification. Which action correctly obtains the value needed to complete the join?

Accepted Answer

On a control plane node, compute the CA cert hash with: openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der | openssl dgst -sha256 -hex, then pass it as --discovery-token-ca-cert-hash sha256:<hash>

Answer

Regenerate the bootstrap token with 'kubeadm token create' and rerun join; the new token embeds the CA hash automatically

Answer

Copy /etc/kubernetes/admin.conf to the worker and pass it via --kubeconfig so the join trusts the CA implicitly

Answer

Add --discovery-token-unsafe-skip-ca-verification to bypass the CA check, which is the standard secure way to join production nodes