**获得 certificate key**
在 demo-master-a-1 上执行
```sh
# 只在 第一个 master 节点 demo-master-a-1 上执行
kubeadm init phase upload-certs --upload-certs
```
输出结果如下：
``` sh {6}
[root@demo-master-a-1 ~]# kubeadm init phase upload-certs --upload-certs
W0902 09:05:28.355623 1046 version.go:98] could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.txt": Get https://dl.k8s.io/release/stable-1.txt: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
W0902 09:05:28.355718 1046 version.go:99] falling back to the local client version: v1.16.2
[upload-certs] Storing the certificates in Secret "kubeadm-certs" in the "kube-system" Namespace
[upload-certs] Using certificate key:
70eb87e62f052d2d5de759969d5b42f372d0ad798f98df38f7fe73efdf63a13c
```
**获得 join 命令**
在 demo-master-a-1 上执行
``` sh
# 只在 第一个 master 节点 demo-master-a-1 上执行
kubeadm token create --print-join-command
```
输出结果如下：
``` sh {2}
[root@demo-master-a-1 ~]# kubeadm token create --print-join-command
kubeadm join apiserver.demo:6443 --token bl80xo.hfewon9l5jlpmjft --discovery-token-ca-cert-hash sha256:b4d2bed371fe4603b83e7504051dcfcdebcbdcacd8be27884223c4ccc13059a4
```
则，第二、三个 master 节点的 join 命令如下：
* 命令行中，蓝色部分来自于前面获得的 join 命令，红色部分来自于前面获得的 certificate key
kubeadm join apiserver.demo:6443 --token ejwx62.vqwog6il5p83uk7y \
--discovery-token-ca-cert-hash sha256:6f7a8e40a810323672de5eee6f4d19aa2dbdb38411845a1bf5dd63485c43d303 \
--control-plane --certificate-key 70eb87e62f052d2d5de759969d5b42f372d0ad798f98df38f7fe73efdf63a13c
