diff --git a/04.kube-master.yml b/04.kube-master.yml
index e62cdb427..def90cb85 100644
--- a/04.kube-master.yml
+++ b/04.kube-master.yml
@@ -6,9 +6,11 @@
   tasks:
   - name: 禁止业务 pod调度到 master节点
     shell: "{{ bin_dir }}/kubectl cordon {{ inventory_hostname }} "
+    delegate_to: "{{ groups.deploy[0] }}"
     when: DEPLOY_MODE != "allinone"
     ignore_errors: true
 
   - name: 设置master节点role
     shell: "{{ bin_dir }}/kubectl label node {{ inventory_hostname }} kubernetes.io/role=master --overwrite"
     ignore_errors: true
+    delegate_to: "{{ groups.deploy[0] }}"
diff --git a/21.addmaster.yml b/21.addmaster.yml
index 7983bd4fd..24804eab6 100644
--- a/21.addmaster.yml
+++ b/21.addmaster.yml
@@ -22,9 +22,11 @@
   tasks:
   - name: 禁止业务 pod调度到 master节点
     shell: "{{ bin_dir }}/kubectl cordon {{ inventory_hostname }} "
+    delegate_to: "{{ groups.deploy[0] }}"
     when: DEPLOY_MODE != "allinone"
     ignore_errors: true
 
   - name: 设置master节点role
     shell: "{{ bin_dir }}/kubectl label node {{ inventory_hostname }} kubernetes.io/role=master --overwrite"
     ignore_errors: true
+    delegate_to: "{{ groups.deploy[0] }}"
diff --git a/roles/kube-master/tasks/main.yml b/roles/kube-master/tasks/main.yml
index 504d53fe5..af656f24d 100644
--- a/roles/kube-master/tasks/main.yml
+++ b/roles/kube-master/tasks/main.yml
@@ -65,5 +65,6 @@
   until:    result.rc == 0
   retries:  5
   delay: 6
+  delegate_to: "{{ groups.deploy[0] }}"
   run_once: True
   tags: upgrade_k8s, restart_master
diff --git a/roles/kube-node/tasks/main.yml b/roles/kube-node/tasks/main.yml
index 88eebfaf8..7c129692a 100644
--- a/roles/kube-node/tasks/main.yml
+++ b/roles/kube-node/tasks/main.yml
@@ -97,6 +97,7 @@
 
 - name: 获取csr 请求信息
   shell: "sleep 3 && {{ bin_dir }}/kubectl get csr"
+  delegate_to: "{{ groups.deploy[0] }}"
   register: csr_info
   run_once: true
 
@@ -104,11 +105,13 @@
   shell: "{{ bin_dir }}/kubectl get csr|grep 'Pending' | awk 'NR>0{print $1}'| \
         xargs {{ bin_dir }}/kubectl certificate approve"
   when: '"Pending" in csr_info.stdout'
+  delegate_to: "{{ groups.deploy[0] }}"
   run_once: true
 
 - name: 轮询等待node达到Ready状态
   shell: "{{ bin_dir }}/kubectl get node {{ inventory_hostname }}|awk 'NR>1{print $2}'"
   register: node_status
+  delegate_to: "{{ groups.deploy[0] }}"
   until: node_status.stdout == "Ready" or node_status.stdout == "Ready,SchedulingDisabled"
   retries: 8 
   delay: 8
@@ -117,3 +120,4 @@
 - name: 设置node节点role
   shell: "{{ bin_dir }}/kubectl label node {{ inventory_hostname }} kubernetes.io/role=node --overwrite"
   ignore_errors: true
+  delegate_to: "{{ groups.deploy[0] }}"