# kubeadm join phase

kubeadm join phasekubeadm join phase enables you to invoke atomic steps of the join process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm join phase is consistent with the kubeadm join workflow, and behind the scene both use the same code.kubeadm join phaseSynopsisUse this command to invoke single phase of the "join" workflowkubeadm join phase [flags] Options-h, --helphelp for phaseOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm join phase preflightUsing this phase you can execute preflight checks on a joining node.Run join pre-flight checksSynopsisRun pre-flight checks for kubeadm join.kubeadm join phase preflight [api-server-endpoint] [flags] Examples # Run join pre-flight checks using a config file. kubeadm join phase preflight --config kubeadm-config.yaml Options--apiserver-advertise-address stringIf the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443If the node should host a new control plane instance, the port for the API Server to bind to.--certificate-key stringUse this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--discovery-file stringFor file-based discovery, a file or URL from which to load cluster information.--discovery-token stringFor token-based discovery, the token used to validate cluster information fetched from the API server.--discovery-token-ca-cert-hash stringsFor token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").--discovery-token-unsafe-skip-ca-verificationFor token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.--node-name stringSpecify the node name.--tls-bootstrap-token stringSpecify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.--token stringUse this token for both discovery-token and tls-bootstrap-token when those values are not provided.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm join phase control-plane-prepareUsing this phase you can prepare a node for serving a control-plane.SynopsisPrepare the machine for serving a control planekubeadm join phase control-plane-prepare [flags] Examples # Prepares the machine for serving a control plane kubeadm join phase control-plane-prepare all Options-h, --helphelp for control-plane-prepareOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisPrepare the machine for serving a control planekubeadm join phase control-plane-prepare all [api-server-endpoint] [flags] Options--apiserver-advertise-address stringIf the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443If the node should host a new control plane instance, the port for the API Server to bind to.--certificate-key stringUse this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--discovery-file stringFor file-based discovery, a file or URL from which to load cluster information.--discovery-token stringFor token-based discovery, the token used to validate cluster information fetched from the API server.--discovery-token-ca-cert-hash stringsFor token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").--discovery-token-unsafe-skip-ca-verificationFor token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for all--node-name stringSpecify the node name.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.--tls-bootstrap-token stringSpecify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.--token stringUse this token for both discovery-token and tls-bootstrap-token when those values are not provided.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisDownload certificates shared among control-plane nodes from the kubeadm-certs Secretkubeadm join phase control-plane-prepare download-certs [api-server-endpoint] [flags] Options--certificate-key stringUse this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--discovery-file stringFor file-based discovery, a file or URL from which to load cluster information.--discovery-token stringFor token-based discovery, the token used to validate cluster information fetched from the API server.--discovery-token-ca-cert-hash stringsFor token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").--discovery-token-unsafe-skip-ca-verificationFor token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for download-certs--tls-bootstrap-token stringSpecify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.--token stringUse this token for both discovery-token and tls-bootstrap-token when those values are not provided.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the certificates for the new control plane componentskubeadm join phase control-plane-prepare certs [api-server-endpoint] [flags] Options--apiserver-advertise-address stringIf the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--discovery-file stringFor file-based discovery, a file or URL from which to load cluster information.--discovery-token stringFor token-based discovery, the token used to validate cluster information fetched from the API server.--discovery-token-ca-cert-hash stringsFor token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").--discovery-token-unsafe-skip-ca-verificationFor token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for certs--node-name stringSpecify the node name.--tls-bootstrap-token stringSpecify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.--token stringUse this token for both discovery-token and tls-bootstrap-token when those values are not provided.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the kubeconfig for the new control plane componentskubeadm join phase control-plane-prepare kubeconfig [api-server-endpoint] [flags] Options--certificate-key stringUse this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--discovery-file stringFor file-based discovery, a file or URL from which to load cluster information.--discovery-token stringFor token-based discovery, the token used to validate cluster information fetched from the API server.--discovery-token-ca-cert-hash stringsFor token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").--discovery-token-unsafe-skip-ca-verificationFor token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kubeconfig--tls-bootstrap-token stringSpecify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.--token stringUse this token for both discovery-token and tls-bootstrap-token when those values are not provided.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisGenerate the manifests for the new control plane componentskubeadm join phase control-plane-prepare control-plane [flags] Options--apiserver-advertise-address stringIf the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--apiserver-bind-port int32 Default: 6443If the node should host a new control plane instance, the port for the API Server to bind to.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for control-plane--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm join phase kubelet-startUsing this phase you can write the kubelet settings, certificates and (re)start the kubelet.Write kubelet settings, certificates and (re)start the kubeletSynopsisWrite a file with KubeletConfiguration and an environment file with node specific kubelet settings, and then (re)start kubelet.kubeadm join phase kubelet-start [api-server-endpoint] [flags] Options--config stringPath to a kubeadm configuration file.--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--discovery-file stringFor file-based discovery, a file or URL from which to load cluster information.--discovery-token stringFor token-based discovery, the token used to validate cluster information fetched from the API server.--discovery-token-ca-cert-hash stringsFor token-based discovery, validate that the root CA public key matches this hash (format: "<type>:<value>").--discovery-token-unsafe-skip-ca-verificationFor token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for kubelet-start--node-name stringSpecify the node name.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.--tls-bootstrap-token stringSpecify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.--token stringUse this token for both discovery-token and tls-bootstrap-token when those values are not provided.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm join phase control-plane-joinUsing this phase you can join a node as a control-plane instance.SynopsisJoin a machine as a control plane instancekubeadm join phase control-plane-join [flags] Examples # Joins a machine as a control plane instance kubeadm join phase control-plane-join all Options-h, --helphelp for control-plane-joinOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisJoin a machine as a control plane instancekubeadm join phase control-plane-join all [flags] Options--apiserver-advertise-address stringIf the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for all--node-name stringSpecify the node name.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisAdd a new local etcd memberkubeadm join phase control-plane-join etcd [flags] Options--apiserver-advertise-address stringIf the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for etcd--node-name stringSpecify the node name.--patches stringPath to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.SynopsisMark a node as a control-planekubeadm join phase control-plane-join mark-control-plane [flags] Options--config stringPath to a kubeadm configuration file.--control-planeCreate a new control plane instance on this node--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for mark-control-plane--node-name stringSpecify the node name.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to revert any changes made to this host by kubeadm init or kubeadm joinkubeadm alpha to try experimental functionality