---
name: "kubeadm-join-phase-preflight"
section: "1"
platform: "linux"
package: "kubeadm"
version: "1.37.2-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/kubeadm-join-phase-preflight"
---

# kubeadm-join-phase-preflight(1)

Run join pre-flight checks

Eric Paris Jan 2015

## NAME

kubeadm join phase preflight - Run join pre-flight checks

## SYNOPSIS

**kubeadm join phase preflight** \[OPTIONS\]

## DESCRIPTION

Run pre-flight checks for kubeadm join.

## OPTIONS

**--apiserver-advertise-address**=""\
 	If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

**--apiserver-bind-port**=6443\
 	If the node should host a new control plane instance, the port for the API Server to bind to.

**--certificate-key**=""\
 	Use this key to decrypt the certificate secrets uploaded by init. The certificate key is a hex encoded string that is an AES key of size 32 bytes.

**--config**=""\
 	Path to a kubeadm configuration file.

**--control-plane**=false\
 	Create a new control plane instance on this node

**--cri-socket**=""\
 	Path to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.

**--discovery-file**=""\
 	For file-based discovery, a file or URL from which to load cluster information.

**--discovery-token**=""\
 	For token-based discovery, the token used to validate cluster information fetched from the API server.

**--discovery-token-ca-cert-hash**=\[\]\
 	For token-based discovery, validate that the root CA public key matches this hash (format: ":").

**--discovery-token-unsafe-skip-ca-verification**=false\
 	For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

**--dry-run**=false\
 	Don't apply any changes; just output what would be done.

**--ignore-preflight-errors**=\[\]\
 	A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.

**--node-name**=""\
 	Specify the node name.

**--tls-bootstrap-token**=""\
 	Specify the token used to temporarily authenticate with the Kubernetes Control Plane while joining the node.

**--token**=""\
 	Use this token for both discovery-token and tls-bootstrap-token when those values are not provided.

## OPTIONS INHERITED FROM PARENT COMMANDS

**--rootfs**=""\
 	The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

**--version**=false\
 	\--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

## EXAMPLE

```
  # Run join pre-flight checks using a config file.
  kubeadm join phase preflight --config kubeadm-config.yaml
```

## SEE ALSO

**[kubeadm-join-phase(1)](/kubeadm-join-phase/1.md)**,

## HISTORY

January 2015, Originally compiled by Eric Paris (eparis at redhat dot com) based on the kubernetes source material, but hopefully they have been automatically generated since!