创建kubeconfig文件 kubelet 、 kube-proxy 等 Node 机器上的进程与 Master 机器的 kubeapiserver进程通信时需要认证和授权；
1、创建 TLS Bootstrapping Token
export BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x |tr -d ' ')
root@ubuntu132:~/dnsyaml# cat /etc/kubernetes/token.csv
3a272deb721d9dcd30eb0b5d7039174d,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
把BOOTSTRAP_TOKEN值写进去，拷贝到所有节点，进行api认证验证
2、创建 kubelet bootstrapping kubeconfig 文件 root@ubuntu132:~/scripts# cat bootstrapping.sh #!/bin/bash
cd /etc/kubernetes
export KUBE_APISERVER="https://192.168.15.132:6443"
kubectl config set-cluster kubernetes
--certificate-authority=/etc/kubernetes/ssl/ca.pem
--embed-certs=true
--server=${KUBE_APISERVER}
--kubeconfig=/etc/kubernetes/bootstrap.kubeconfig
kubectl config set-credentials kubelet-bootstrap
--token=${BOOTSTRAP_TOKEN}
--kubeconfig=/etc/kubernetes/bootstrap.kubeconfig
kubectl config set-context default
--cluster=kubernetes
--user=kubelet-bootstrap
--kubeconfig=/etc/kubernetes/bootstrap.kubeconfig
3、创建 kube-proxy kubeconfig 文件 root@ubuntu132:~/scripts# cat kube-proxy-config.sh #!/bin/bash
kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/ssl/ca.pem --embed-certs=true --server=${KUBE_APISERVER} --kubeconfig=/etc/kuernetes/kube-proxy.kubeconfig
kubectl config set-credentials kube-proxy --client-certificate=/etc/kubernetes/ssl/kube-proxy.pem --client-key=/etc/kubernetes/ssl/kube-proxy-key.pem --embed-certs=true --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig
kubectl config set-context default
--cluster=kubernetes
--user=kube-proxy
--kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig
kubectl config use-context default --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig
cp bootstrap.kubeconfig kube-proxy.kubeconfig /etc/kubernetes/ 拷贝到所有节点
