# KS in vcluster

## 环境
> 使用 kubekey 安装

- kubesphere 3.3.0
- kubernetes 1.22.10
## 安装
使用 **platform-regular**(admin)角色安装 vcluster 到 test 命名空间
vclsuer 的 k8s 版本 1.22.10
vlcuster 需要映射宿主集群的 storageclass 到 vcluster
## 模块
| 模块/服务 | 可安装 | 可使用 | 备注 |
| --- | --- | --- | --- |
| kubesphere | 是 | 是 | openldap 异常会影响 ks-controller-manager
启用 pod ip tools 组件会导致 ks-controller-manager 异常
 |
| app-store | 是 | 是 | |
| devops-system | 是 | 未验证 |
|
| logging-system | 是 | 是 | |
| events-system | 是 | 是 | |
| alerting | 否 | 否 | 依赖 metrics |
| audit logs | 是 | 未验证 | |
| service-mesh | 是 | 未验证 | |
| network policies | 是 | 未验证 |  |
| metrics-server | 否 | 否 | E1020 08:21:55.496943 1 server.go:132] unable to fully scrape metrics: unable to fully scrape metrics from node i-hkxlvd2q: unable to fetch metrics from node i-hkxlvd2q: request failed - "403 Forbidden". |
| service topology | 是 | 是 |  |
| pod ip tools | 是 | 否 | 启动会导致 ks-controller-manager 异常；原因是 ks-controller-manager 连接宿主集群查询 calico-node 查不到，导致 panic |
| kubeedge | 是 | 否 | 添加边缘节点，云端不显示节点 |
| | | | |

openldap 启用后 pod 会异常，副本-1再+1可以恢复正常

# 权限
## 需要 clusterrole 的功能及对应权限
| vcluster功能 | 默认启用 | 资源 | 具体权限 | 备注 |
| --- | --- | --- | --- | --- |
| sync.nodes | false | ["nodes", "nodes/status"]["pods", "nodes/proxy", "nodes/metrics", "nodes/stats"] | ["get", "watch", "list"] | |
| sync.nodes.syncNodeChanges | false | ["nodes", "nodes/status"] | ["update", "patch"] | |
| sync.nodes.enableScheduler | false | ["storageclasses","csinodes","csidrivers","csistoragecapacities"] | ["get", "watch", "list"] | |
| sync.persistentvolumes | false | ["persistentvolumes"] | ["create", "delete", "patch", "update", "get", "watch", "list"] | |
| sync.ingressclasses | false | ["ingressclasses"] | ["get", "watch", "list"] | |
| sync.storageclasses | false | ["storageclasses"] | ["create", "delete", "patch", "update", "get", "watch", "list"] | |
| sync.hoststorageclasses | false | ["storageclasses"] | ["get", "watch", "list"] | KS 必须启用 |
| sync.priorityclasses | false | ["priorityclasses"] | ["create", "delete", "patch", "update", "get", "list", "watch"] | |
| sync.volumesnapshots | false | ["volumesnapshotclasses"] ["volumesnapshotcontents"] | ["get", "list", "watch"] ["create", "delete", "patch", "update", "get", "list", "watch"] | |
| mapServices.fromHost | [] | ["services"] | ["get", "watch", "list"] | |
| plugin | {} | | | |