When the IP address of the only control-plane node changes, the cluster’s PKI, static manifests, and client kubeconfigs all become invalid. The following procedure walks through the minimal set of changes required to bring the node back online with the new address.

1. Identify every file that stil references the old IP

cd /etc/kubernetes
grep -Rl '100.64.139.60' . | sort -u

The typical hits are:

• admin.conf, controller-manager.conf, kubelet.conf, scheduler.conf
• manifests/etcd.yaml
• manifests/kube-apiserver.yaml

2. Create or update the kubeadm configuraton file

If you do not already have one, create ~/kubeadm-new.yaml and set the new IP:

apiVersion: kubeadm.k8s.io/v1beta2
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 100.64.139.62   # <— new address
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  name: k8s-cp
  taints:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
---
apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
kubernetesVersion: v1.16.0
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
etcd:
  local:
    dataDir: /var/lib/etcd

3. Regenerate the affected certificates

You can regenerate only the certificates whose Subject or SAN contains the old IP, or you can recreate the entire PKI. The examples below show both approaches.

Option A – regenerate only the server certificates

cd /etc/kubernetes/pki
for f in apiserver apiserver-kubelet-client front-proxy-client; do
  mv "${f}.crt" "${f}.crt.bak"
  mv "${f}.key" "${f}.key.bak"
done

kubeadm init phase certs apiserver            --config ~/kubeadm-new.yaml
kubeadm init phase certs apiserver-kubelet-client --config ~/kubeadm-new.yaml
kubeadm init phase certs front-proxy-client   --config ~/kubeadm-new.yaml

Option B – recreate the whole PKI

mv /etc/kubernetes/pki /etc/kubernetes/pki.backup
kubeadm init phase certs all --config ~/kubeadm-new.yaml

4. Refresh the client kubeconfigs

Either regenerate each file individually:

kubeadm init phase kubeconfig admin            --config ~/kubeadm-new.yaml
kubeadm init phase kubeconfig controller-manager --config ~/kubeadm-new.yaml
kubeadm init phase kubeconfig kubelet          --config ~/kubeadm-new.yaml
kubeadm init phase kubeconfig scheduler        --config ~/kubeadm-new.yaml

or move the old ones aside and recreate them in one shot:

mv /etc/kubernetes/*.conf /tmp
kubeadm init phase kubeconfig all --config ~/kubeadm-new.yaml

5. Update the static Pod manifests

Edit /etc/kubernetes/manifests/etcd.yaml and /etc/kubernetes/manifests/kube-apiserver.yaml. Replace every occurrence of the old IP with the new one, paying special attention to:

• --advertise-client-urls
• --listen-client-urls
• --initial-advertise-peer-urls
• --advertise-address
• --etcd-servers

6. Verify certificate expiration

kubeadm alpha certs check-expiration

All certificates should now show a fresh one-year validity window.

7. Restart the daemons

systemctl restart docker
systemctl restart kubelet

After the containers restart, the node should rejoin itself as the control plane using the new IP address.