fix: rke2 registration token generated twice

Signed-off-by: Carlos Salas <[email protected]>

bootstrap/internal/controllers/rke2config_controller.go

@@ -334,14 +334,28 @@ func (r *RKE2ConfigReconciler) handleClusterNotInitialized(ctx context.Context,
 
 	conditions.MarkTrue(scope.Config, bootstrapv1.CertificatesAvailableCondition)
 
-	token, err := r.generateAndStoreToken(ctx, scope)
-	if err != nil {
-		scope.Logger.Error(err, "unable to generate and store an RKE2 server token")
+	// RKE2 server token must only be generated once, so all nodes join the cluster with the same registration token.
+	var token string
 
-		return ctrl.Result{}, err
+	tokenSecret := &corev1.Secret{}
+	secretKey := types.NamespacedName{
+		Namespace: scope.Config.Namespace,
+		Name:      bsutil.TokenName(scope.Cluster.Name),
 	}
+	err := r.Client.Get(ctx, secretKey, tokenSecret)
+
+	if err != nil {
+		token, err = r.generateAndStoreToken(ctx, scope)
+		if err != nil {
+			scope.Logger.Error(err, "unable to generate and store an RKE2 server token")
 
-	scope.Logger.Info("RKE2 server token generated and stored in Secret!")
+			return ctrl.Result{}, err
+		}
+
+		scope.Logger.Info("RKE2 server token generated and stored in Secret!")
+	} else {
+		token = string(tokenSecret.Data["value"])
+	}
 
 	configStruct, configFiles, err := rke2.GenerateInitControlPlaneConfig(
 		rke2.ServerConfigOpts{