Turned out it's due to one master of 5 in the k8s has expired kube-apiserver certificates.

1/5 possibility the jenkins connected to this master thus get 401 Unauthorized.

Ran kubeadm certs renew all then restarted the k8s components, everything went okay now.