在master上操作
///把kubelet、kube-proxy拷贝到node节点上

[root@promote bin]# scp kubelet kube-proxy root@192.168.175.149:/opt/kubernetes/bin
[root@promote bin]# scp kubelet kube-proxy root@192.168.175.157:/opt/kubernetes/bin

///在node节点上操作

///将node.zip挂载到并解压
unzip node.zip

在master操作

cd /root/k8s
//创建mkdir kubeconfig目录
mkdir kubeconfig
cd kubeconfig
///将kubeconfig.sh挂载到目录中
//获取token信息（序列号部份并复制）
cat /opt/kubernetes/cfg/token.csv
20db5c7d39e2e5846a67c9c8aa66bcfa,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
///进入kubeconfig配置文件
[root@promote kubeconfig]# vim kubeconfig 
APISERVER=$1
SSL_DIR=$2

# 创建kubelet bootstrapping kubeconfig 
export KUBE_APISERVER="https://$APISERVER:6443"

# 设置集群参数
kubectl config set-cluster kubernetes \
  --certificate-authority=$SSL_DIR/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=bootstrap.kubeconfig
  
# 设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
  --token=20db5c7d39e2e5846a67c9c8aa66bcfa \     ///将复制的序列号写入
  --kubeconfig=bootstrap.kubeconfig

# 设置上下文参数
kubectl config set-context default \
  --cluster=kubernetes \
  --user=kubelet-bootstrap \
  --kubeconfig=bootstrap.kubeconfig

# 设置默认上下文
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
# 创建kube-proxy kubeconfig文件
kubectl config set-cluster kubernetes \
  --certificate-authority=$SSL_DIR/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-proxy.kubeconfig
kubectl config set-credentials kube-proxy \
  --client-certificate=$SSL_DIR/kube-proxy.pem \
  --client-key=$SSL_DIR/kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-proxy.kubeconfig
kubectl config set-context default \
  --cluster=kubernetes \
  --user=kube-proxy \
  --kubeconfig=kube-proxy.kubeconfig


kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

///更改环境变量
[root@promote kubeconfig]# vim /etc/profile
export PATH=$PATH:/opt/kubernetes/bin     ///在最后加入

///声明
source /etc/profile
kubectl可以使用
[root@promote ~]# kubectl get cs
///重命名
mv kubeconfig.sh kubeconfig
///生成配置文件
[root@promote kubeconfig]# bash kubeconfig 192.168.175.148/root/k8s/k8s-cert
///将生成的配置文件拷贝到node节点上
[root@promote kubeconfig]# scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.175.149:/opt/kubernetes/cfg
[root@promote kubeconfig]# scp bootstrap.kubeconfig kube-proxy.kubeconfig root@192.168.175.157:/opt/kubernetes/cfg
///创建bootstrap角色赋予权限用于连接apiserver请求签名
[root@promote kubeconfig]#  kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper --user=kubelet-bootstrap

在node1节点上操作

//启动kubelet.sh文件
[root@promote ~]# bash kubelet.sh 192.168.175.149
Created symlink from /etc/systemd/system/multi-user.target.wants/kubelet.service to /usr/lib/systemd/system/kubelet.service.
//查看进程
[root@promote ~]# ps aux | grep kubelet
root      84858  7.4  1.0 468512 42052 ?        Ssl  11:16   0:03 /opt/kubernetes/bin/kubelet --logtostderr=true --v=4 --hostname-override=192.168.175.149 --kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig --bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig --config=/opt/kubernetes/cfg/kubelet.config --cert-dir=/opt/kubernetes/ssl --pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0
root      84885  0.0  0.0 112728   976 pts/0    S+   11:17   0:00 grep --color=auto kubelet
[root@promote ~]# systemctl status kubelet
///在master节点上查看node节点上的请求
[root@promote kubeconfig]# kubectl get csr
NAME                                                   AGE     REQUESTOR           CONDITION
node-csr-Fo9lDF4RXpQTXKRQi5DZwX5OSXdyizI_gqxm1hNvBpk   5m55s   kubelet-bootstrap   Pending
//同意添加证书（可以通过kubectl --help查看操作命令）
[root@promote kubeconfig]# kubectl certificate approve node-csr-Fo9lDF4RXpQTXKRQi5DZwX5OSXdyizI_gqxm1hNvBpk
certificatesigningrequest.certificates.k8s.io/node-csr-Fo9lDF4RXpQTXKRQi5DZwX5OSXdyizI_gqxm1hNvBpk approved
//查看状态
[root@promote kubeconfig]# kubectl get csr
NAME                                                   AGE   REQUESTOR           CONDITION
node-csr-Fo9lDF4RXpQTXKRQi5DZwX5OSXdyizI_gqxm1hNvBpk   12m   kubelet-bootstrap   Approved,Issued
///查看节点
[root@promote kubeconfig]# kubectl get node
NAME              STATUS   ROLES    AGE     VERSION
192.168.175.149   Ready    <none>   3m44s   v1.12.3

//在node1节点上操作
//启动porxy文件
[root@promote ~]# bash proxy.sh 192.168.175.169
Created symlink from /etc/systemd/system/multi-user.target.wants/kube-proxy.service to /usr/lib/systemd/system/kube-proxy.service.
//查看状态
[root@promote ~]# systemctl status kube-proxy
///把现有的/opt/kubernetes目录复制到其他节点进行修改（后面要把node1证书删除）
[root@promote ~]# scp -r /opt/kubernetes/ root@192.168.175.157:/opt
//将启动脚本拷贝到node2节点上
[root@promote ~]# scp /usr/lib/systemd/system/{kublet,kube-proxy}.service root@192.168.175.157:/usr/lib/systemd/system

node2操作

//删除node1节点上的证书
cd /opt/kubernetes/ssl
[root@promote ssl]# rm -rf *
//修改配置node1拷贝过来的kubelet，kubeket.config,kube-proxy配置文件
cd /opt/kubernetes/cfg
vim kubelet
KUBELET_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=192.168.175.157 \      ///修改成本机地址
--kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \
--bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \
--config=/opt/kubernetes/cfg/kubelet.config \
--cert-dir=/opt/kubernetes/ssl \
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"
[root@promote cfg]# vim kubelet.config
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: 192.168.175.157        修改成本机地址
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS:
- 10.0.0.2
clusterDomain: cluster.local.
failSwapOn: false
authentication:
  anonymous:
    enabled: true
[root@promote cfg]# vim kube-proxy
KUBE_PROXY_OPTS="--logtostderr=true \
--v=4 \
--hostname-override=192.168.175.157 \
--cluster-cidr=10.0.0.0/24 \
--proxy-mode=ipvs \
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig"
启动服务
[root@promote system]# systemctl start kubelet.service
[root@promote system]# systemctl enable kubelet.service 
[root@promote system]# systemctl start kube-proxy.service 
[root@promote system]# systemctl enable kube-proxy.service 
///在master操作
///查看node2发过来的请求
[root@promote kubeconfig]# kubectl get csr
NAME                                                   AGE     REQUESTOR           CONDITION
node-csr-59i2vWOKKCu_67pXGffIa3HkGDkxa1qkFV999Z-bA1s   5m21s   kubelet-bootstrap   Pending
node-csr-Fo9lDF4RXpQTXKRQi5DZwX5OSXdyizI_gqxm1hNvBpk   77m     kubelet-bootstrap   Approved,Issued
///同意许可
[root@promote kubeconfig]# kubectl certificate approve node-csr-59i2vWOKKCu_67pXGffIa3HkGDkxa1qkFV999Z-bA1s
certificatesigningrequest.certificates.k8s.io/node-csr-59i2vWOKKCu_67pXGffIa3HkGDkxa1qkFV999Z-bA1s approved
//查看node节点