（一）二进制安装k8s-1.11版本之系统初始化及ca证书申请

环境规划

双机互信

ssh-keygen 
# cat >>/etc/hosts <<EOF
192.168.213.131 master01 
192.168.213.132 master02
192.168.213.133 node01
192.168.213.134 node02
EOF
ssh-copy-id master01
ssh-copy-id master02
ssh-copy-id node01
ssh-copy-id node02

系统初始化

systemctl stop firewalld
systemctl  disable firewalld
sed -ri '/^SELINUX=/cSELINUX=disabled' /etc/selinux/config
setenforce 0
\cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o  /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum makecache 
which ntpdate || yum install ntpdate -y 
ntpdate time.windows.com
curl -o /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install docker-ce-17.06.0.ce-1.el7.centos.x86_64 -y
systemctl enable docker
systemctl start docker 
cat >> /etc/docker/daemon.json <<EOF
{
     "registry-mirrors": ["https://ui5lsypg.mirror.aliyuncs.com"]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker
mkdir /opt/kubernetes/{ssl,bin,cfg} -pv
sed -ri 's/.*swap.*/#&/' /etc/fstab
swapoff -a

在中转机器上安装cfssl证书生成工具

which wget || yum install wget -y 
test -d /tools || mkdir /tools 
cd /tools 
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

在中转机器上生成ca证书

配置ca证书策略

mkdir -pv  /server/ssl && cd /server/ssl 

# cat >/server/ssl/ca-config.json <<EOF
{
"signing": {
    "default": {
      "expiry": "876000h"
    },
    "profiles": {
      "kubernetes": {
	"expiry": "876000h",
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "876000h"
      }
    }
}
}
EOF

生成ca证书签署请求

# cat >/server/ssl/ca-csr.json <<EOF
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Hangzhou",
      "L": "Hangzhou",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

生成ca证书 和私钥

#cfssl gencert -initca ca-csr.json | cfssljson -bare ca