CKA — Join Worker Nodes

kubeadm join

After initializing the control plane, join worker nodes to the cluster using the join command from the kubeadm init output:

sudo kubeadm join 192.168.1.10:6443 \
  --token abcdef.0123456789abcdef \
  --discovery-token-ca-cert-hash sha256:abc123...

Join Command Components

Component	Purpose
192.168.1.10:6443	Control plane API server address
–token	Bootstrap token (valid 24h by default)
–discovery-token-ca-cert-hash	SHA256 hash of the CA cert (secure discovery)

Token Management

Tokens expire after 24 hours by default. If the token has expired, generate a new one.

Generate a New Join Command

# On the control plane node
kubeadm token create --print-join-command

This outputs the complete join command with a new token and the CA cert hash.

List Existing Tokens

kubeadm token list

Create a Token with Custom TTL

# Token that lasts 2 hours
kubeadm token create --ttl 2h --print-join-command

# Token that never expires (use with caution)
kubeadm token create --ttl 0 --print-join-command

Verify Node Join

From the control plane:

kubectl get nodes -o wide

NAME           STATUS   ROLES           AGE   VERSION    INTERNAL-IP
controlplane   Ready    control-plane   5m    v1.30.0    192.168.1.10
worker01       Ready    <none>          2m    v1.30.0    192.168.1.11
worker02       Ready    <none>          1m    v1.30.0    192.168.1.12

Add Node Role Labels

Worker nodes show for roles. Optionally label them:

kubectl label node worker01 node-role.kubernetes.io/worker=
kubectl label node worker02 node-role.kubernetes.io/worker=

Now kubectl get nodes shows:

NAME           STATUS   ROLES           AGE   VERSION
controlplane   Ready    control-plane   5m    v1.30.0
worker01       Ready    worker          2m    v1.30.0
worker02       Ready    worker          1m    v1.30.0

Troubleshooting Join Failures

Issue	Cause	Fix
Token expired	Tokens are valid 24h	kubeadm token create –print-join-command
Connection refused	API server not reachable	Check firewall, port 6443, VPN/DNS
CA hash mismatch	Wrong CA cert hash	Re-copy the hash from kubeadm init output
Node already joined	kubeadm reset was not run	Run sudo kubeadm reset first, then join again
kubelet not starting	Container runtime not running	Check systemctl status containerd

Removing a Node

To remove a worker from the cluster:

# From control plane: drain the node first
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

# Delete the node object
kubectl delete node <node-name>

# On the worker node: reset kubeadm
sudo kubeadm reset

# Clean up CNI and iptables
sudo rm -rf /etc/cni/net.d
sudo iptables -F && sudo iptables -t nat -F && sudo iptables -t mangle -F && sudo iptables -X

---

Next: CNI Plugins →