WorkerJoinToken

Overview

WorkerJoinToken is a custom resource that generates the bootstrap token that worker nodes use to join the cluster.

kind: WorkerJoinToken
metadata:
  name: worker-az1
spec:
  ttl: 3h

The ttl field is immutable after creation. WorkerJoinToken is intentionally one-shot rather than auto-renewing, to generate a token with a different TTL, delete this object and create a new one.

spec

Field	Type	Description	Default
ttl	duration	How long the generated token remains valid on the cluster, starting from the moment it is issued. Immutable	3h

Using the Token

Once status.conditions[Ready] is True, read the kubeconfig from the Secret named in status.secretRef.name, in the kube-system namespace, and pass it to heir provision worker.

JOIN_TOKEN=$(kubectl get secret worker-az1-jointoken -n kube-system -o jsonpath='{.data.jointoken}')
sudo heir provision worker --token="$JOIN_TOKEN"

Because the token is short-lived and one-shot by design, create a new WorkerJoinToken for each batch of nodes you provision rather than reusing one across separate provisioning runs.