Hi all! Iave a problem scaling up nodes: Problem Scaling up a worker node fails. The new node stays in

Pending

and never proceeds to provisioning/join. Environment Rancher

v2.12.3

• Local management cluster

k3s v1.33.6+k3s1

Evidence • A newly created

Machine

remains

Pending

•

Machine

conditions show:

BootstrapReady=False

• reason:

WaitingForDataSecret

• Rancher logs show: •

waiting for secret ... to be populated with token

handler rke-bootstrap: timed out waiting for the condition

The bootstrap Secret: exists type is

<http://kubernetes.io/service-account-token|kubernetes.io/service-account-token>

• has

<http://kubernetes.io/service-account.name|kubernetes.io/service-account.name>

• but is missing: •

<http://kubernetes.io/service-account.uid|kubernetes.io/service-account.uid>

•

token

•

ca.crt

namespace

Same issue was reproduced across multiple worker scale-up attempts today • Older working bootstrap Secrets do contain the expected populated fields, and their

RKEBootstrap

objects are

ready

Expected behavior After Rancher creates the bootstrap

ServiceAccount

and

<http://kubernetes.io/service-account-token|kubernetes.io/service-account-token>

Secret, Kubernetes should populate that Secret with token data, allowing

RKEBootstrap

to become

ready

and node provisioning to continue. Hypothesis This appears to be a management-cluster bootstrap-token issue, not an infrastructure-provider or downstream cluster issue. Best current hypothesis: Rancher

2.12.3

is relying on Secret-based service account token population for bootstrap, but on local

k3s 1.33.6

that token population is no longer occurring as expected for these Secrets. References • https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/ • https://kubernetes.io/docs/concepts/security/service-accounts/ Any ideas?