k8s集群移除master再重新加入

从master集群移除master2节点

在master1上执行如下命令

# kubectl drain master2 --delete-local-data --force --ignore-daemonsets
node/master2 already cordoned
WARNING: ignoring DaemonSet-managed Pods: kube-system/calico-node-xcqp8, kube-system/kube-proxy-spclw, nginx-ingress/nginx-ingress-4g5x7
node/master2 drained
# kubectl delete node master2
node "master2" deleted
# kubectl get nodes
NAME      STATUS   ROLES    AGE    VERSION
master1   Ready    master   203d   v1.18.2
master3   Ready    master   203d   v1.18.2
work1     Ready    <none>   203d   v1.18.2
work2     Ready    <none>   203d   v1.18.2
work4     Ready    <none>   146d   v1.18.2

重置master2上所有相关服务，在master2上执行：

# kubeadm reset
[reset] Reading configuration from the cluster...
[reset] FYI: You can look at this config file with ‘kubectl -n kube-system get cm kubeadm-config -oyaml‘
[reset] WARNING: Changes made to this host by ‘kubeadm init‘ or ‘kubeadm join‘ will be reverted.
[reset] Are you sure you want to proceed? [y/N]:

master2节点重新加入master集群

需要在master1上重新生成相关的证书和token

# kubeadm init phase upload-certs --upload-certs
I1203 20:05:19.588980   10742 version.go:252] remote version is much newer: v1.19.4; falling back to: stable-1.18
W1203 20:05:20.625646   10742 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
[upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
[upload-certs] Using certificate key:
322175270bfde7b12f18c933ead856c7c7a9a666d596e8d48e7650c1cab20a56

# kubeadm token create --print-join-command
W1203 20:05:24.335760   10874 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
kubeadm join apiserver-lb:6443 --token o0d4f9.p7hrqt9nx3pyyfg4     --discovery-token-ca-cert-hash sha256:1f084d1ac878308635f1dbe8676bac33fe3df6d52fa212834787a0bc71f1db6d

在master2上执行初始化和加入master集群的命令

# kubeadm join apiserver-lb:6443 --token o0d4f9.p7hrqt9nx3pyyfg4     --discovery-token-ca-cert-hash sha256:1f084d1ac878308635f1dbe8676bac33fe3df6d52fa212834787a0bc71f1db6d --control-plane --certificate-key 322175270bfde7b12f18c933ead856c7c7a9a666d596e8d48e7650c1cab20a56

在master1上查看所有节点状态

# kubectl get nodes
NAME      STATUS   ROLES    AGE    VERSION
master1   Ready    master   203d   v1.18.2
master2   Ready    master   21s    v1.18.2
master3   Ready    master   203d   v1.18.2
work1     Ready    <none>   203d   v1.18.2
work2     Ready    <none>   203d   v1.18.2
work4     Ready    <none>   146d   v1.18.2

k8s集群移除master再重新加入

原文：https://blog.51cto.com/leejia/2559291