Rotating the initial join token

[alongwill]

I've created a new token and want to revoke the initial token.

There is a Talos 1.11 machine connected to Omni with the initial token. On clicking the revoke button the warning says:

1 of 1 machine won't be able to connect if the token is revoked/deleted
Details: Does not have the node unique token

Is there a way to update the existing node with the new token?

[Unix4ever]

Omni should have --join-tokens-mode= set to legacyAllowed or strict first.
Then the machine should have Talos installed (not the case here).
And the machine should have Talos >= 1.6.0.

Most likely this means that join tokens mode is not set or the machine is disconnected from Omni so Omni can't update the node unique token there.

[olehoglundrr]

Having the same "issue"
Not aware of having --join-tokens-mode= set to anything specfic.
The documentation only states it's an issue if you've specifically set the mode to legacy?
https://docs.siderolabs.com/omni/security-and-authentication/rotate-siderolink-join-token

If this setting is change will Omni then generate unique tokens for existing nodes?

[Unix4ever]

Currently it is legacy by default. So if you run Omni yourself you need to add --join-tokens-mode=strict flag (if not running Talos below 1.6).

[olehoglundrr]

What will happen with existing nodes once you add that?
Will they then generate node unique tokens.. or will I need to provision new nodes?