Bootstrap tokens

454

Bootstrap tokens are a bearer token meant to be used when creating new Kubernetes clusters or joining new nodes to an existing cluster. These are tokens that are stored as secrets in the Kubernetes cluster, and then issued to the individual kubelet.

Stuff you wanna know:

  1. You can use a single token for an entire cluster, or issue one per worker node.
  2. Bootstrap tokens were built to support kubeadm, but can be used in other contexts.
  3. These tokens work via RBAC policy with the Kubelet TLS Bootstrapping system.
  4. Bootstrap Tokens are defined with a specific type (bootstrap.kubernetes.io/token) of secrets that lives in the kube-system namespace. These Secrets are then read by the Bootstrap Authenticator in the API Server.
  5. Bootstrap Tokens take the form of abcdef.0123456789abcdef.
  6. The first part of the token is the “Token ID” and is considered public information. It is used when referring to a token without leaking the secret part used for authentication.
  7. The second part is the “Token Secret” and should only be shared with trusted parties.
  8. When enabled, bootstrapping tokens can be used as bearer token credentials to authenticate requests against the API server.
  9. Each valid token is backed by a secret in the kube-system namespace.
  10. You can use the kubeadm tool to manage tokens on a running cluster.
  11. In addition to authentication, the tokens can be used to sign a ConfigMap.

More stuff: