一、问题场景：参考课程kubespray方式部署好了两个节点的master+worker节点的k8s可用集群，后续参考教程运维方式在原来的基础上添加一个worker节点。按照教程的方式如下：
#1、刷新缓存
$ ansible-playbook -i inventory/mycluster/hosts.yaml facts.yml -b -v
#2、在原来的hosts.yaml文件加上当前的worker信息。
$ vi inventory/mycluster/hosts.yaml
#3、执行scale添加节点
$ ansible-playbook -i inventory/mycluster/hosts.yaml scale.yml --limit=k8s-node3 -b -v
二、出现问题：
TASK [kubernetes/kubeadm : Set ca.crt file permission] ********************************************************************************************************************
task path: /usr/local/kubespray/kubespray-2.15.0/roles/kubernetes/kubeadm/tasks/main.yml:130
fatal: [k8s-node3]: FAILED! => {
“changed”: false,
“invocation”: {
“module_args”: {
"_diff_peek": null,
"_original_basename": null,
“access_time”: null,
“access_time_format”: “%Y%m%d%H%M.%S”,
“attributes”: null,
“backup”: null,
“content”: null,
“delimiter”: null,
“directory_mode”: null,
“follow”: true,
“force”: false,
“group”: “root”,
“mode”: “0644”,
“modification_time”: null,
“modification_time_format”: “%Y%m%d%H%M.%S”,
“owner”: “root”,
“path”: “/etc/kubernetes/ssl/ca.crt”,
“recurse”: false,
“regexp”: null,
“remote_src”: null,
“selevel”: null,
“serole”: null,
“setype”: null,
“seuser”: null,
“src”: null,
“state”: “file”,
“unsafe_writes”: null
}
},
"msg": “file (/etc/kubernetes/ssl/ca.crt) is absent, cannot continue”,
"path": “/etc/kubernetes/ssl/ca.crt”,
“state”: “absent”
}

NO MORE HOSTS LEFT ********************************************************************************************************************
PLAY RECAP ********************************************************************************************************************
k8s-node3 : ok=317 changed=9 unreachable=0 failed=1 skipped=368 rescued=0 ignored=0
三、思考问题解决问题
思考：
1、为什么原来集群部署的时候证书都能正常生成，现在新加入的节点生成出故障，是不是新加节点不仅仅做好上面的3步还有什么其他细节配置没有考虑到，需要重新处理？
-rw-r–r-- 1 root root 1428 Aug 10 14:40 apiserver.crt
-rw-r----- 1 root root 1428 Aug 10 14:40 apiserver.crt.old
-rw------- 1 root root 1675 Aug 10 14:40 apiserver.key
-rw-r----- 1 root root 1675 Aug 10 14:40 apiserver.key.old
-rw-r–r-- 1 root root 1143 Aug 10 14:40 apiserver-kubelet-client.crt
-rw-r----- 1 root root 1143 Aug 10 14:40 apiserver-kubelet-client.crt.old
-rw------- 1 root root 1675 Aug 10 14:40 apiserver-kubelet-client.key
-rw-r----- 1 root root 1675 Aug 10 14:40 apiserver-kubelet-client.key.old
-rw-r–r-- 1 root root 1066 Aug 10 14:40 ca.crt
-rw------- 1 root root 1675 Aug 10 14:40 ca.key
-rw------- 1 root root 1078 Aug 10 14:40 front-proxy-ca.crt
-rw------- 1 root root 1679 Aug 10 14:40 front-proxy-ca.key
-rw-r–r-- 1 root root 1103 Aug 10 14:40 front-proxy-client.crt
-rw-r----- 1 root root 1103 Aug 10 14:40 front-proxy-client.crt.old
-rw------- 1 root root 1679 Aug 10 14:40 front-proxy-client.key
-rw-r----- 1 root root 1679 Aug 10 14:40 front-proxy-client.key.old
-rw------- 1 root root 1679 Aug 10 14:40 sa.key
-rw------- 1 root root 451 Aug 10 14:40 sa.pub