diff --git a/cmd/kubeadm/app/phases/bootstraptoken/node/token.go b/cmd/kubeadm/app/phases/bootstraptoken/node/token.go
index 539d7ef623c..b8f3375de89 100644
--- a/cmd/kubeadm/app/phases/bootstraptoken/node/token.go
+++ b/cmd/kubeadm/app/phases/bootstraptoken/node/token.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/pkg/errors"
 
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	clientset "k8s.io/client-go/kubernetes"
 	bootstraputil "k8s.io/cluster-bootstrap/token/util"
@@ -41,7 +42,10 @@ func UpdateOrCreateTokens(client clientset.Interface, failIfExists bool, tokens
 
 		secretName := bootstraputil.BootstrapTokenSecretName(token.Token.ID)
 		secret, err := client.CoreV1().Secrets(metav1.NamespaceSystem).Get(context.TODO(), secretName, metav1.GetOptions{})
-		if secret != nil && err == nil && failIfExists {
+		if err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+		if secret != nil && failIfExists {
 			return errors.Errorf("a token with id %q already exists", token.Token.ID)
 		}