KUBERNETES(1)(kubernetes)

💖 KUBERNETES(1)(kubernetes) — the kubeadm token page, but make it make sense 💖

okay bestie, welcome to the kubeadm token manual, section 1 of the kubernetes manuals. pull up a chair, grab a boba, we're doing bootstrap tokens today and honestly? they're kinda iconic once you get it. 🧋✨

---

✨ NAME ✨

kubeadm token — Manage bootstrap tokens 🎀

---

🌸 SYNOPSIS 🌸

kubeadm token [OPTIONS]

---

🦋 DESCRIPTION 🦋

so this command manages bootstrap tokens. it's optional, and you only actually need it for advanced use cases. no cap. if you're just vibing on a normal cluster you might never touch this, and that's fine.

but let's talk about what bootstrap tokens even are, because it's giving trust issues in the best way. 💅

In short, bootstrap tokens are used for establishing bidirectional trust between a client and a server. A bootstrap token can be used when a client — for example, a node that's about to join the cluster — needs to trust the server it's talking to. That's when a bootstrap token with the "signing" usage comes in handy. Bootstrap tokens can also function as a way to allow short-lived authentication to the API Server (the token serves as a way for the API Server to trust the client), for example for doing the TLS Bootstrap. mutual trust, mutual slay. 🫶

What is a bootstrap token more exactly? bestie I'm so glad you asked:

• It is a Secret in the kube-system namespace of type "bootstrap.kubernetes.io/token".
• A bootstrap token must be of the form "[a-z0-9]{6}.[a-z0-9]{16}". The former part is the public token ID, while the latter is the Token Secret and it must be kept private at all circumstances!
• The name of the Secret must be named "bootstrap-token-(token-id)".

🚨 okay real talk for one sec: that second half? the [a-z0-9]{16} part? that is the Token Secret and it must be kept private at ALL circumstances. not "mostly". not "when you remember". all. guard it like it's your notes app. 🔒😭

You can read more about bootstrap tokens here:

https://kubernetes.io/docs/admin/bootstrap-tokens/

---

💅 OPTIONS 💅

• --dry-run=false — Whether to enable dry-run mode or not. (default is false, so by default it's not a dry run — it's really doing the thing, bestie. be normal about it.)
• --kubeconfig="/etc/kubernetes/admin.conf" — The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file. (yes the default is literally /etc/kubernetes/admin.conf, go off king.)

---

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

these ones are the family heirlooms, handed down from the parent command:

• --rootfs="" — The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path. (default is "", empty string, nothing, void, the blankie. 🛌)
• --version=false — --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version. (default false. yes it does three whole different jobs. multi-hyphenate queen. 🌟)

---

🌈 SEE ALSO 🌈

go read these next, they're all in the same friend group:

• kubeadm(1)
• kubeadm-token-create(1)
• kubeadm-token-delete(1)
• kubeadm-token-generate(1)
• kubeadm-token-list(1)

---

🎀 HISTORY 🎀

January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since! ✨ (like… the audacity of hand-writing these. icon behavior fr fr.)

---

and that's the whole page, bestie! 🍓 this one lives in the Manuals section, User subsection, under the KUBERNETES(1)(kubernetes) title, and the source material is dated January 2015 — shoutout to Eric Paris for the original compile, we love a pioneer. now go forth and manage those bootstrap tokens responsibly. mwah. 💖🦋💜