The Node Token
The node token is the shared secret that authenticates new nodes joining the cluster.
The node token proves that a machine is allowed to join your cluster. The server generates it automatically and stores it on disk.
Where to find it
Read it from the first server node:
/var/lib/rancher/k3s/server/node-tokenBringing your own token
You can also choose the token yourself with --token when starting the server. This is handy for automation, so you do not have to read it back after install.
Example
# Read the auto-generated token
sudo cat /var/lib/rancher/k3s/server/node-token
# Or set your own when starting the server
sudo k3s server --token "my-shared-secret"When to use it
- A bootstrap script reads the node token from the server and passes it as an environment variable when provisioning agent VMs.
- A security team rotates the node token annually and re-registers all agent nodes to limit the blast radius of a leaked token.
- An automated Terraform module stores the node token in a secrets manager after server creation and retrieves it during agent provisioning.
More examples
Read the node token
Displays the server's node token file whose contents agents must supply when joining the cluster.
cat /var/lib/rancher/k3s/server/node-token
# Output: K10abc...::server:xyzUse token in agent install
Fetches the token from the server over SSH and immediately uses it to register a new agent node.
TOKEN=$(ssh [email protected] 'cat /var/lib/rancher/k3s/server/node-token')
curl -sfL https://get.k3s.io | \
K3S_URL=https://192.168.1.10:6443 \
K3S_TOKEN=$TOKEN sh -Set a custom pre-shared token
Specifies a custom token at install time so agents can join with a known secret rather than a generated one.
# On the server during install:
curl -sfL https://get.k3s.io | \
INSTALL_K3S_EXEC='--token my-secure-shared-secret' sh -
cat /var/lib/rancher/k3s/server/node-token
Discussion