Can bootstrap tokens be used to join servers?

[lindhe]

It says in the docs that "Bootstrap tokens can only be used to join agents":

https://github.com/k3s-io/docs/blob/9d0f09192d38602542462ab982c3606f71d9524c/docs/cli/token.md?plain=1#L77

Is that true? I was under the impression that the token can be used to join servers too.

[brandond]

The docs are accurate. Maybe you can with kubeadm, but not k3s.

You must use a token to join servers, but it cannot be a bootstrap token. It must be the server token, as covered at https://docs.k3s.io/cli/token#server

[lindhe]

Thanks for the answer. Good that the docs are accurate. But then I wonder about the token rotate command, which says "Rotate original server token with a new bootstrap token". When I try it on rke2, that seems to rotate with new basic auth, not bootstrap token. I'm probably just misunderstanding here.

[brandond]

yes, that rotates the static server secret. I see how the wording could be confusing, as we internally refer to the server token as the bootstrap token because it is used to encrypt the bootstrap data that stores the cluster CA keys within the datastore. Our use of that language within our codebase predates our support for kubeadm bootstrap tokens, and is an unfortunate overlap in terminology.

Agent bootstrap tokens are stored in kubernetes secrets, and do not need to be rotated using a dedicated command.

[lindhe]

Ah, yes that explains it. Impossible to avoid overloaded terms across domains, but unfortunate to have the exact same word within the same document and command help text. I'd be happy to contribute and try to clarify things, but I just need to figure out what's what first before I can try and help.

Anyway, thanks for clarifying!