KUBERNETES(1)(kubernetes)

💖 kubeadm join phase control-plane-prepare download-certs 💖

okay bestie, welcome to the kubernetes(1) manual — this one's all about that one very specific little sub-sub-subcommand, and honestly? it's iconic. sit down, grab a boba, we're doing this. 🧋✨

---

🌸 NAME 🌸

kubeadm join phase control-plane-prepare download-certs — Download certificates shared among control-plane nodes from the kubeadm-certs Secret

like. the whole job. that's it. she downloads the shared control-plane certs, from the Secret, and the Secret's called kubeadm-certs. no cap. 💅

---

🎀 SYNOPSIS 🎀

kubeadm join phase control-plane-prepare download-certs [OPTIONS]

that's the whole vibe. command, plus options, plus nothing else. periodt. 🫶

---

✨ DESCRIPTION ✨

Download certificates shared among control-plane nodes from the kubeadm-certs Secret.

fr fr that's the entire description, and honestly it ate. this phase exists so that when you're joining a new control-plane node, you can pull down the certs the other control-plane besties already share, instead of making you hand-copy them like it's 2009. main character energy, lowkey. 👑

---

💅 OPTIONS 💅

• --certificate-key="" — Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes. so: hex, 32 bytes, AES, decrypt. that's the whole assignment bestie, don't freestyle it.
• --config="" — Path to a kubeadm configuration file.
• --control-plane=false — Create a new control plane instance on this node.
• --discovery-file="" — For file-based discovery, a file or URL from which to load cluster information.
• --discovery-token="" — For token-based discovery, the token used to validate cluster information fetched from the API server.
• --discovery-token-ca-cert-hash=[] — For token-based discovery, validate that the root CA public key matches this hash (format: ":"). yes, that's literally the format string in the original. we don't editorialize. we report. 🎀
• --discovery-token-unsafe-skip-ca-verification=false — For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning. the flag literally has "unsafe" in the name, bestie. it is telling you something. listen to it. 🚨
• --dry-run=false — Don't apply any changes; just output what would be done. rehearsal mode. no actual changes, just the vibes. 🌈
• --tls-bootstrap-token="" — Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.
• --token="" — Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

---

🦋 OPTIONS INHERITED FROM PARENT COMMANDS 🦋

these came from the parent, so they're like. the family heirlooms. 💜

• --rootfs="" — The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.
• --version=false — --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version.

---

🌈 SEE ALSO 🌈

• kubeadm-join-phase-control-plane-prepare(1),

go read the parent, she's the moment. 🫶

---

📜 HISTORY 📜

January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! we love a self-aware manpage author. he knew. he KNEW. 😭

---

heads up bestie: this page is from the kubernetes(1) manual set, and the version/date on the tin is January 2015, source Manuals — User, KUBERNETES(1)(kubernetes). that's the whole sign-off. go download those certs. slay. 💖✨🎀🦋🌸💅🫶👑🌈⭐