No kubectl command works any more on the Rabat Kubernetes cluster, deployments are blocked

The MasterLinux school runs its internal applications (enrolments, automatic lab grading, trainers' dashboard) on a Kubernetes cluster installed with kubeadm in its Rabat datacenter: one control plane node ml-k8s-cp-01 and three nodes ml-k8s-wk-01 to ml-k8s-wk-03. The cluster was installed last year by a contractor, and nobody has touched it since: “it runs by itself”.

Since yesterday morning, every release fails in the CI pipeline, and this morning no administrator can run a single kubectl command. Pods already started are still running, but an urgent fix for the lab grading application is waiting to be deployed.

The contractor mentions “a network problem towards port 6443”, a colleague suspects etcd or a clock drift.

You are the on-call Kubernetes administrator, connected over SSH to ml-k8s-cp-01 with the admin account (sudo).