diff --git a/cmd/kubeadm/app/cmd/phases/join/kubelet.go b/cmd/kubeadm/app/cmd/phases/join/kubelet.go
index 5aa5a67ee6b..b1e84321973 100644
--- a/cmd/kubeadm/app/cmd/phases/join/kubelet.go
+++ b/cmd/kubeadm/app/cmd/phases/join/kubelet.go
@@ -167,6 +167,11 @@ func runKubeletStartJoinPhase(c workflow.RunData) error {
 		return errors.Wrap(err, "error uploading crisocket")
 	}
 
+	// Deletes the bootstrapKubeConfigFile, so the credential used for TLS bootstrap are removed from disk
+	if err := os.Remove(bootstrapKubeConfigFile); err != nil {
+		return errors.Wrapf(err, "error deleting %s", bootstrapKubeConfigFile)
+	}
+
 	return nil
 }