<p>I have a K8s cluster running under an OpenStack cloud provider.</p>

<p>The cluster is set up using <strong>kubeadm</strong> tool which contains a master node and slave node .</p>

<p>I'm trying to add  an other worker node by using the kubeadm join command, the command shows a positive response telling that the node is successfully added, But I can't find it using <code>kubectl get nodes</code> command.</p>

<p>I investigated and I've found that kubelet on the new slave node is not running showing <code>cannot create certificate signing request: Unauthorized</code>.</p>

<pre><code>-- The start-up result is done.
May 14 12:15:33 vm1 kubelet[17678]: W0514 12:15:33.715964   17678 cni.go:171] Unable to update cni config: No networks found in /etc/cni/net.d
May 14 12:15:33 vm1 kubelet[17678]: W0514 12:15:33.738398   17678 hostport_manager.go:68] The binary conntrack is not installed, this can cause failures in network connection cleanup.
May 14 12:15:33 vm1 kubelet[17678]: I0514 12:15:33.738669   17678 server.go:376] Version: v1.10.1
May 14 12:15:33 vm1 kubelet[17678]: I0514 12:15:33.738913   17678 feature_gate.go:226] feature gates: &amp;{{} map[]}
May 14 12:15:33 vm1 kubelet[17678]: I0514 12:15:33.739222   17678 plugins.go:89] No cloud provider specified.
May 14 12:15:33 vm1 kubelet[17678]: F0514 12:15:33.784257   17678 server.go:233] failed to run Kubelet: cannot create certificate signing request: Unauthorized
May 14 12:15:33 vm1 systemd[1]: kubelet.service: Main process exited, code=exited, status=255/n/a
May 14 12:15:33 vm1 systemd[1]: kubelet.service: Unit entered failed state.
May 14 12:15:33 vm1 systemd[1]: kubelet.service: Failed with result 'exit-code'.
</code></pre>

<p>version on worker node : <code>kubeadm version
kubeadm version: &amp;version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.1", GitCommit:"d4ab47518836c750f9949b9e0d387f20fb92260b", GitTreeState:"clean", BuildDate:"2018-04-12T14:14:26Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
</code></p>

<p>version on master node : </p>

<pre><code>kubeadm version
kubeadm version: &amp;version.Info{Major:"1", Minor:"10", 
GitVersion:"v1.10.1", 
GitCommit:"d4ab47518836c750f9949b9e0d387f20fb92260b", 
GitTreeState:"clean", BuildDate:"2018-04-12T14:14:26Z", 
GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>command used to make the join : </p>

<ul>
<li><p>get the token : <code>kubeadm token list | awk '/The default bootstrap token/ { print $1; }'</code></p></li>
<li><p>get the hash : <code>openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2&gt;/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'</code></p></li>
<li><p>join command:  <code>kubeadm join --skip-preflight-checks --token {{token}} --discovery-token-ca-cert-hash sha256:{{hash}} master_ip:6443</code></p></li>
</ul>

<p>thanks !</p>

Imed Aouidene
<p>It looks like your token has expired, but you can always generate a new one.</p>

<p>Run the following command on master:</p>

<pre><code>kubeadm token generate
</code></pre>

<p>Then run the next command on a new worker:</p>

<pre><code>kubeadm join --token=&lt;token&gt; &lt;master-ip&gt;
</code></pre>

<p>Example:</p>

<pre><code>kubeadm join --token=858698.51d1418b0490485a 192.168.0.13
</code></pre>
