使用kubeadmin安装的 k8s集群， 3台master节点，2台work节点。
#3个master节点都执行
kubeadm certs renew all
# 现在修复 3台 master kubelet
kubeadm kubeconfig user \
--org system:nodes \
--client-name system:node:k8s-master01 \
> /root/kubelet-new.conf
kubeadm kubeconfig user \
--org system:nodes \
--client-name system:node:k8s-master02 \
> /root/kubelet-new.conf
kubeadm kubeconfig user \
--org system:nodes \
--client-name system:node:k8s-master03 \
> /root/kubelet-new.conf
cp -a /etc/kubernetes/kubelet.conf \
/etc/kubernetes/kubelet.conf.bak-20260824
cp -a /root/kubelet-new.conf /etc/kubernetes/kubelet.conf
systemctl restart kubelet
systemctl status kubelet --no-pager
# 检查 etcd 集群状态
ETCD_ID=$(crictl ps -q --name etcd | head -1)
crictl exec "$ETCD_ID" etcdctl \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt \
--key=/etc/kubernetes/pki/etcd/healthcheck-client.key \
endpoint health
crictl exec "$ETCD_ID" etcdctl \
--endpoints=https://192.168.124.60:2379,https://192.168.124.61:2379,https://192.168.124.62:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt \
--key=/etc/kubernetes/pki/etcd/healthcheck-client.key \
endpoint health
# 检查 Leader 和 Raft 状态
crictl exec "$ETCD_ID" etcdctl \
--endpoints=https://192.168.124.60:2379,https://192.168.124.61:2379,https://192.168.124.62:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt \
--key=/etc/kubernetes/pki/etcd/healthcheck-client.key \
endpoint status --cluster -w table
# 把 kubectl 使用的 kubeconfig 换成新的 `/etc/kubernetes/admin.conf`
mkdir -p /root/.kube
cp -a /root/.kube/config \
/root/.kube/config.bak-20260824 2>/dev/null || true
cp -f /etc/kubernetes/admin.conf /root/.kube/config
chmod 600 /root/.kube/config
# 在 node01 和node02上都执行 reset，重新加入集群
kubeadm reset -f
rm -rf /etc/kubernetes/*
rm -rf /var/lib/kubelet/pki/*
kubeadm token create --print-join-command