在 基于 Docker 搭建开发环境（三）：链路追踪 等几篇文章中，D瓜哥分享了如何使用 Docker Compose 在本地搭建起来一套应用可观测性环境。感觉还不够好玩，毕竟正在在企业中，Kubernetes 已经是绝对的主流。要玩就玩最具挑战性的东西，玩最符合企业所需的技能和工具。所以，打算将上面那套简易玩具，按照企业级的要求，搬到 Kubernetes 上去。
如果想玩 Kubernetes，首先面临的一个问题就是 Kubernetes 集群的搭建。本来是一个非常简单的事情，但是由于众所周知的原因，变得非常具有挑战性。经过各种探索和多次试验，发现一种“离线”安装方式，感觉是一个不错的方式。
本方法是基于 Kubespray 的一种安装办法，Kubespray 是由 Kubernetes SIG 小组来负责维护的一整套安装方式。既可以支持在裸机环境上安装，也支持云上环境安装。而且，只需要简单几行可以复制粘贴的命令，即可完成安装工作。非常适合入门玩耍使用。
本安装方法所需的软件，D瓜哥都已经上传到 GitHub，如果需要下载，请移步： Kubespray-2.26.0 安装包大全。
搭建服务器集群 这里推荐使用 Vagrant 搭建集群。搭配 VirtualBox，只需要一个配置文件，就可以轻轻松松搭建一个 Linux 服务器集群。搭建集群的配置文件 Vagrantfile 如下：
# -*- mode: ruby -*- # vi: set ft=ruby : # @author D瓜哥 · https://www.diguage.com/ # All Vagrant configuration is done below. The "2" in Vagrant.configure # configures the configuration version (we support older styles for # backwards compatibility). Please don't change it unless you know what # you're doing. Vagrant.configure("2") do |config| # The most common configuration options are documented and commented below. # For a complete reference, please see the online documentation at # https://docs.vagrantup.com # 三节点集群 (1..3).each do |i| config.vm.define "node#{i}" do |node| # Every Vagrant development environment requires a box. You can search for # boxes at https://vagrantcloud.com/search node.vm.box = "alvistack/ubuntu-24.04" node.vm.box_version = "20250210.0.0" # 设置虚拟机的主机名 node.vm.hostname = "node#{i}" config.vm.boot_timeout = 600 # Disable automatic box update checking. If you disable this, then # boxes will only be checked for updates when the user runs # `vagrant box outdated`. This is not recommended. # config.vm.box_check_update = false # Create a forwarded port mapping which allows access to a specific port # within the machine from a port on the host machine. In the example below, # accessing "localhost:8080" will access port 80 on the guest machine. # NOTE: This will enable public access to the opened port # config.vm.network "forwarded_port", guest: 80, host: 8080 # Create a forwarded port mapping which allows access to a specific port # within the machine from a port on the host machine and only allow access # via 127.0.0.1 to disable public access # config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1" # Create a private network, which allows host-only access to the machine # using a specific IP. # 设置虚拟机的IP node.vm.network "private_network", ip: "10.0.2.#{20+i}", auto_config: true # Create a public network, which generally matched to bridged network. # Bridged networks make the machine appear as another physical device on # your network. # config.vm.network "public_network" # Share an additional folder to the guest VM. The first argument is # the path on the host to the actual folder. The second argument is # the path on the guest to mount the folder. And the optional third # argument is a set of non-required options. # 设置主机与虚拟机的共享目录，根据需要开启 node.vm.synced_folder "/path/to/#{i}", "/data" # Disable the default share of the current code directory. Doing this # provides improved isolation between the vagrant box and your host # by making sure your Vagrantfile isn't accessible to the vagrant box. # If you use this you may want to enable additional shared subfolders as # shown above. # config.vm.synced_folder ".", "/vagrant", disabled: true # Provider-specific configuration so you can fine-tune various # backing providers for Vagrant. These expose provider-specific options. # Example for VirtualBox: node.vm.provider "virtualbox" do |vb| # 设置虚拟机的名称 # vb.name = "node#{i}" # if node.vm.hostname == "node1" # # Display the VirtualBox GUI when booting the machine # vb.gui = true # end # Customize the amount of memory on the VM: vb.memory = "6144" # 设置虚拟机的CPU个数 vb.cpus = 2 end # View the documentation for the provider you are using for more # information on available options. # Enable provisioning with a shell script. Additional provisioners such as # Ansible, Chef, Docker, Puppet and Salt are also available. Please see the # documentation for more information about their specific syntax and use. # config.vm.provision "shell", inline: <<-SHELL # sudo yum makecache --refresh # sudo yum install -y tcpdump # sudo yum install -y nc # sudo yum install -y net-tools # SHELL end end end
1. Troubleshooting - Service account, role, role binding Issue Troubleshooting - Service account, role, role binding Issue
You have a service account named dev-sa, a Role named dev-role-cka, and a RoleBinding named dev-role-binding-cka. we are trying to create list and get the pods and services. However, using dev-sa service account is not able to perform these operations. fix this issue.
# @author D瓜哥 · https://www.diguage.com $ kubectl get serviceaccounts dev-sa -o yaml apiVersion: v1 kind: ServiceAccount metadata: creationTimestamp: "2025-01-22T09:48:06Z" name: dev-sa namespace: default resourceVersion: "2270" uid: 48b68f34-8c19-4477-9631-4f368f6ecc66 $ kubectl get role dev-role-cka NAME CREATED AT dev-role-cka 2025-01-22T09:48:06Z $ kubectl get role dev-role-cka -o yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: creationTimestamp: "2025-01-22T09:48:06Z" name: dev-role-cka namespace: default resourceVersion: "2271" uid: 7a011481-8edd-4417-a1b8-8d15290d3e9f rules: - apiGroups: - "" resources: - secrets verbs: - get $ kubectl get rolebindings dev-role-binding-cka -o yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: "2025-01-22T09:48:07Z" name: dev-role-binding-cka namespace: default resourceVersion: "2272" uid: 888af489-86b6-4d38-a723-a8ff13656d2b roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: dev-role-cka subjects: - kind: ServiceAccount name: dev-sa namespace: default # 将 Role 删掉，重建即可 $ kubectl delete role dev-role-cka --force --grace-period 0 Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely. role.rbac.authorization.k8s.io "dev-role-cka" force deleted $ kubectl create role dev-role-cka --resource=pods,services --verb=create,list,get role.rbac.authorization.k8s.io/dev-role-cka created $ kubectl get role dev-role-cka -o yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: creationTimestamp: "2025-01-22T09:49:46Z" name: dev-role-cka namespace: default resourceVersion: "2414" uid: b3d7fc62-f029-4f4b-88a5-99ee9840af05 rules: - apiGroups: - "" resources: - pods - services verbs: - create - list - get
