{"record":{"id":"2c66303220b92f4f","repo":"k3s-io/k3s","slug":"does-not-exist-please-pass-token-to-complete-t","errorCode":null,"errorMessage":" does not exist, please pass --token to complete the restoration","messagePattern":" does not exist, please pass --token to complete the restoration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cli/server/server.go","lineNumber":505,"sourceCode":"\t\t}\n\n\t\tdataDir, err := datadir.LocalHome(cfg.DataDir, false)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// delete local loadbalancers state for apiserver and supervisor servers\n\t\tloadbalancer.ResetLoadBalancer(filepath.Join(dataDir, \"agent\"), loadbalancer.SupervisorServiceName)\n\t\tloadbalancer.ResetLoadBalancer(filepath.Join(dataDir, \"agent\"), loadbalancer.APIServerServiceName)\n\n\t\tif cfg.ClusterResetRestorePath != \"\" {\n\t\t\t// at this point we're doing a restore. Check to see if we've\n\t\t\t// passed in a token and if not, check if the token file exists.\n\t\t\t// If it doesn't, return an error indicating the token is necessary.\n\t\t\tif cfg.Token == \"\" {\n\t\t\t\ttokenFile := filepath.Join(dataDir, \"server\", \"token\")\n\t\t\t\tif _, err := os.Stat(tokenFile); err != nil {\n\t\t\t\t\tif os.IsNotExist(err) {\n\t\t\t\t\t\treturn errors.New(tokenFile + \" does not exist, please pass --token to complete the restoration\")\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tlogrus.Info(\"Starting \" + version.Program + \" \" + app.App.Version)\n\n\tnotifySocket := os.Getenv(\"NOTIFY_SOCKET\")\n\tos.Unsetenv(\"NOTIFY_SOCKET\")\n\n\t// try setting advertise-ip from agent VPN\n\tif vpnInfo, _ := vpn.GetInfoFromExecutor(); vpnInfo != nil {\n\t\t// If we are in ipv6-only mode, we should pass the ipv6 address. Otherwise, ipv4\n\t\tif utilsnet.IsIPv6(nodeIPs[0]) {\n\t\t\tif vpnInfo.IPv6Address != nil {\n\t\t\t\tlogrus.Infof(\"Changed advertise-address to %v due to VPN\", vpnInfo.IPv6Address)\n\t\t\t\tif serverConfig.ControlConfig.AdvertiseIP != \"\" {","sourceCodeStart":487,"sourceCodeEnd":523,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/cli/server/server.go#L487-L523","documentation":"When restoring a cluster from a snapshot (--cluster-reset --cluster-reset-restore-path), k3s needs the original cluster token to seed the new cluster. If --token/K3S_TOKEN is empty it falls back to reading <data-dir>/server/token; when that file is also absent the restoration aborts before touching the datastore.","triggerScenarios":"`k3s server --cluster-reset --cluster-reset-restore-path=<snap>` with no --token and no <data-dir>/server/token file — typical when restoring onto a wiped or brand-new node.","commonSituations":"Disaster recovery onto new hardware where the data-dir was freshly created; cleanup scripts that deleted the token file; operators assuming the token is embedded in the snapshot.","solutions":["Pass the original cluster token: `--token <value>` or `K3S_TOKEN=<value>` (it must match the token used when the snapshot was taken for nodes to rejoin)","Restore <data-dir>/server/token from a backup copy if the original token value is unknown","Keep the cluster token in a secret manager at cluster creation time so restores are always possible"],"exampleFix":"# before\nk3s server --cluster-reset --cluster-reset-restore-path=/backups/etcd-snapshot.zip\n\n# after\nK3S_TOKEN=<original-cluster-token> k3s server --cluster-reset --cluster-reset-restore-path=/backups/etcd-snapshot.zip","handlingStrategy":"validation","validationCode":"# guard before restore\nif [ -n \"$RESTORE_PATH\" ] && [ -z \"$K3S_TOKEN\" ] && [ ! -s /var/lib/rancher/k3s/server/token ]; then\n  echo 'token required for cluster-reset restore'; exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store the cluster token in a password manager/secret at cluster creation","DR runbooks should verify token availability (env or <data-dir>/server/token) before invoking restore","Backup <data-dir>/server/token alongside etcd snapshots"],"tags":["cluster-reset","restore","token","recovery"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}