Andrew Mercer
on this page

What kubeadm reset does

kubeadm reset undoes most of what kubeadm init/kubeadm join did to a node. It stops the kubelet, removes the node's certificates and kubeconfig files under /etc/kubernetes/, removes the local etcd data on a control-plane node, and cleans up /var/lib/kubelet.

It does not:

  • Remove the Node object from the API server. Run kubectl delete node <name> from the control plane.
  • Clean up CNI configuration, virtual interfaces, or leftover iptables/IPVS rules. This is the usual cause of a node that was reset but still has broken networking.
  • Uninstall kubelet, kubeadm, or the container runtime. Only the cluster state is undone, not the package installs.

Dry run first

sudo kubeadm reset --dry-run

--dry-run prints what reset would do without doing it. Run it first on anything other than a disposable lab node, because reset is destructive and can't be undone.

Reset

sudo kubeadm reset --force

--force skips the "are you sure?" prompt. That's useful in scripts, but it removes the last safety pause on a real node.

Full teardown order (node in a live cluster)

If the node is part of a working cluster, rather than a broken lab node you're just wiping, follow this order so no stale state is left on the other nodes:

  1. Drain the node from the control plane: kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
  2. Delete the Node object: kubectl delete node <node-name>
  3. Run kubeadm reset on the node itself (above).
  4. Clean up CNI leftovers: sudo rm -rf /etc/cni/net.d sudo ip link delete cni0 2>/dev/null sudo ip link delete flannel.1 2>/dev/null # Flannel sudo ip link delete tunl0 2>/dev/null # Calico IPIP sudo ip link delete vxlan.calico 2>/dev/null # Calico VXLAN Check ip -br link for anything else your CNI created (cilium_*, cali*).
  5. Flush leftover iptables/IPVS rules. This is safe on a node being wiped and rejoined, and disruptive on a host that runs anything else: sudo iptables -F && sudo iptables -t nat -F && sudo iptables -t mangle -F && sudo iptables -X sudo ipvsadm --clear # only if kube-proxy ran in IPVS mode
  6. Remove the local kubeconfig if one was copied to a user's home directory: rm -rf ~/.kube

Re-joining or re-initializing

  • Rejoin an existing cluster: generate a fresh join command on the control plane (kubeadm token create --print-join-command) and run it on the reset node. Reset removed the old certificates, so the original join command won't work.
  • Re-initialize as a new control plane: run sudo kubeadm init as usual. If you're rebuilding a control-plane node into the same cluster, remove its old etcd member first (etcdctl member remove <id>). Otherwise the new node can fail to join etcd.

Common gotchas

  • In a multi-control-plane (stacked etcd) cluster, resetting a control-plane node without removing its etcd member can leave etcd degraded or without quorum. Check etcdctl member list before and after.
  • Skipping the CNI/iptables cleanup is the most common cause of "the node rejoined but pods can't reach each other".
  • kubeadm reset doesn't remove pulled images. Reclaim the disk with sudo crictl rmi --prune.