版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
1、环境准备
192.168.1.38 3G node1 Master docker etcd
192.168.1.39 2G node2 Node docker etcd
192.168.1.40 2G node3 Node docker etcd
2、在Master节点上的命令拷贝到Node节点上
cd /root/kubernetes/server/bin
scp kubelet kube-proxy root@node2:/opt/kubernetes/bin/
scp kubelet kube-proxy root@node3:/opt/kubernetes/bin/
3、在主节点中生成kubeconfig(Master)
#修改命令配置
vim /etc/profile
export K8S_HOME=$PATH:/opt/kubernetes
export PATH=.:$JAVA_HOME/bin:$MAVEN_HOME/bin:$K8S_HOME/bin:$PATH
source /etc/profile
#创建kubeconfig生成脚本
cd /opt/bin
vim kubeconfig.sh
APISERVER=$1
SSL_DIR=$2
# 创建kubelet bootstrapping kubeconfig
export KUBE_APISERVER="https://$APISERVER:6443"
# 设置集群参数
kubectl config set-cluster kubernetes \
--certificate-authority=$SSL_DIR/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=bootstrap.kubeconfig
# 设置客户端认证参数
kubectl config set-credentials kubelet-bootstrap \
--token=0fb61c46f8991b718eb38d27b605b008 \
--kubeconfig=bootstrap.kubeconfig
# 设置上下文参数
kubectl config set-context default \
--cluster=kubernetes \
--user=kubelet-bootstrap \
--kubeconfig=bootstrap.kubeconfig
# 设置默认上下文
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
#----------------------
# 创建kube-proxy kubeconfig文件
kubectl config set-cluster kubernetes \
--certificate-authority=$SSL_DIR/ca.pem \
--embed-certs=true \
--server=${KUBE_APISERVER} \
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-credentials kube-proxy \
--client-certificate=$SSL_DIR/kube-proxy.pem \
--client-key=$SSL_DIR/kube-proxy-key.pem \
--embed-certs=true \
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-context default \
--cluster=kubernetes \
--user=kube-proxy \
--kubeconfig=kube-proxy.kubeconfig
kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
#执行脚本 本机IP 证书目录
bash kubeconfig.sh 192.168.1.38 /opt/k8s-cert 
4、拷贝文件(Master)
scp bootstrap.kubeconfig kube-proxy.kubeconfig root@node2:/opt/kubernetes/cfg/
scp bootstrap.kubeconfig kube-proxy.kubeconfig root@node3:/opt/kubernetes/cfg/5、创建用户（在Master执行）
kubectl create clusterrolebinding kubelet-bootstrap \
--clusterrole=system:node-bootstrapper \
--user=kubelet-bootstrap
6、创建脚本(从节点一)
#创建目录
mkdir -p /opt/bin
#创建脚本
vim kubelet.sh
#!/bin/bash
NODE_ADDRESS=$1
DNS_SERVER_IP=${2:-"10.0.0.2"}
cat <<EOF >/opt/kubernetes/cfg/kubelet
KUBELET_OPTS="--logtostderr=true \\
--v=4 \\
--hostname-override=${NODE_ADDRESS} \\
--kubeconfig=/opt/kubernetes/cfg/kubelet.kubeconfig \\
--bootstrap-kubeconfig=/opt/kubernetes/cfg/bootstrap.kubeconfig \\
--config=/opt/kubernetes/cfg/kubelet.config \\
--cert-dir=/opt/kubernetes/ssl \\
--pod-infra-container-image=registry.cn-hangzhou.aliyuncs.com/google-containers/pause-amd64:3.0"
EOF
cat <<EOF >/opt/kubernetes/cfg/kubelet.config
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
address: ${NODE_ADDRESS}
port: 10250
readOnlyPort: 10255
cgroupDriver: cgroupfs
clusterDNS:
- ${DNS_SERVER_IP}
clusterDomain: cluster.local.
failSwapOn: false
authentication:
anonymous:
enabled: true
EOF
cat <<EOF >/usr/lib/systemd/system/kubelet.service
[Unit]
Description=Kubernetes Kubelet
After=docker.service
Requires=docker.service
[Service]
EnvironmentFile=/opt/kubernetes/cfg/kubelet
ExecStart=/opt/kubernetes/bin/kubelet \$KUBELET_OPTS
Restart=on-failure
KillMode=process
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable kubelet
systemctl restart kubelet
#启动脚本 nodeIP地址
bash kubelet.sh 192.168.1.39
#查看
ps -ef | grep kube
7、主节点颁发证书
#查看node
kubectl get csr
#颁发证书
kubectl certificate approve node-csr-bzTNCeLQ1mwEzXCLmHY-4VwUwfPELxiNdNjwxLgEtMw
8、从节点部署proxy(从节点一)
vim proxy.sh
#!/bin/bash
NODE_ADDRESS=$1
cat <<EOF >/opt/kubernetes/cfg/kube-proxy
KUBE_PROXY_OPTS="--logtostderr=true \\
--v=4 \\
--hostname-override=${NODE_ADDRESS} \\
--cluster-cidr=10.0.0.0/24 \\
--proxy-mode=ipvs \\
--kubeconfig=/opt/kubernetes/cfg/kube-proxy.kubeconfig"
EOF
cat <<EOF >/usr/lib/systemd/system/kube-proxy.service
[Unit]
Description=Kubernetes Proxy
After=network.target
[Service]
EnvironmentFile=-/opt/kubernetes/cfg/kube-proxy
ExecStart=/opt/kubernetes/bin/kube-proxy \$KUBE_PROXY_OPTS
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable kube-proxy
systemctl restart kube-proxy
#执行脚本
bash proxy.sh 192.168.1.39
9、部署从节点（二）
#拷贝脚本
scp -r /opt/bin/ root@node3:/opt/
#执行脚本
cd /opt/bin
bash kubelet.sh 192.168.1.40
#执行脚本
bash proxy.sh 192.168.1.40
10、主节点赋权限
kubectl get csr
kubectl certificate approve node-csr--mP6OKebkyumAaQW6QxSy_REfL3icAdolbbklVHEinE
11、主节点测试
kubectl get cs
kubectl get node