How to fix token is invalid in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 194 views

The kubeadm join token used to add a node to the cluster is invalid, expired, or was malformed.

Quick fix

Fixes token is invalid

kubectl -n kube-system get secrets | grep bootstrap-token
kubectl -n kube-system describe secret bootstrap-token-XXXXX
  1. Check token expiry on control plane
  2. Generate a new token if expired
  3. Get the CA certificate hash
  4. Run kubeadm join with new token
kubernetes — error
kubectl -n kube-system get secrets | grep bootstrap-token
kubectl -n kube-system describe secret bootstrap-token-XXXXX
token is invalid

What this error means

Kubeadm uses short-lived tokens (default 24 hours) to allow new nodes to securely join the cluster. If the token has expired, is malformed, or was already used, kubeadm join will fail. This is a security mechanism to prevent unauthorized nodes from joining.

Typical symptoms

  • kubeadm join fails with "token is invalid"
  • Cannot add new nodes to cluster
  • Error mentions token validation failure
  • Token was created more than 24 hours ago
  • Token contains invalid characters or format
  • Node appears in cluster but not healthy

Common causes

  1. Token has expired (default TTL 24 hours)
  2. Token was already used and consumed
  3. Token format is invalid (not 6.16 format)
  4. Token was generated with wrong cluster hash
  5. Typo in the join command
  6. Token revoked manually

How to fix "token is invalid"

1Check token expiry on control plane

List valid tokens:

bash
kubectl -n kube-system get secrets | grep bootstrap-token
kubectl -n kube-system describe secret bootstrap-token-XXXXX

Or use kubeadm:

bash
kubeadm token list
2Generate a new token if expired

Create a new token on the control plane:

bash
kubeadm token create

# Or create a long-lived token
kubeadm token create --ttl 24h

This outputs the token to use in kubeadm join.

3Get the CA certificate hash

You also need the CA hash:

bash
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'
4Run kubeadm join with new token

On the worker node:

bash
kubeadm join YOUR_CP_IP:6443 --token NEW_TOKEN --discovery-token-ca-cert-hash sha256:HASH

Ensure token and hash are correct (no typos).

5Verify node joined successfully

On the control plane:

bash
kubectl get nodes

The new node should appear and transition to Ready status.

Advanced notes

For production clusters, consider creating tokens with longer TTL or managing them programmatically. Bootstrap tokens are stored as secrets in kube-system namespace. You can revoke a token by deleting its secret: kubectl delete secret -n kube-system bootstrap-token-XXXXX. For automated node joining, integrate with your infrastructure provisioning system.

Frequently asked questions

What does "token is invalid" mean?
Kubeadm uses short-lived tokens (default 24 hours) to allow new nodes to securely join the cluster. If the token has expired, is malformed, or was already used, kubeadm join will fail. This is a security mechanism to prevent unauthorized nodes from joining.
How do I fix "token is invalid"?
The kubeadm join token used to add a node to the cluster is invalid, expired, or was malformed.
What causes "token is invalid"?
Token has expired (default TTL 24 hours) Token was already used and consumed Token format is invalid (not 6.16 format)
Is the "token is invalid" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading