Karmada纳管子集群手工方法（push模式）

一、数据面集群操作

cluster_name: qa135

cluster_namespace: fedcluster-8ljxfzgsrv8g

1. sub_kubectl create ns fedcluster-8ljxfzgsrv8g

2. sub_kubectl create sa -nfedcluster-8ljxfzgsrv8g karmada-impersonator

3. sub_kubectl -nfedcluster-8ljxfzgsrv8g apply -f karmada-impersonator.secret.yaml （如下）, 得到 impersonatorSecret

apiVersion: v1
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: karmada-impersonator  #关联sa
  name: karmada-impersonator
  namespace: fedcluster-8ljxfzgsrv8g
type: kubernetes.io/service-account-token

4. sub_kubectl create sa -nfedcluster-8ljxfzgsrv8g karmada-qa135

5. sub_kubectl apply -f karmada-controller-manager.cr.yaml（如下）

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: karmada-controller-manager:karmada-qa135
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - get

6. sub_kubectl apply -f karmada-controller-manager.crb.yaml（如下）

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: karmada-controller-manager:karmada-qa135
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: karmada-controller-manager:karmada-qa135
subjects:
- kind: ServiceAccount
  name: karmada-qa135
  namespace: fedcluster-8ljxfzgsrv8g

7. sub_kubectl -nfedcluster-8ljxfzgsrv8g apply -f karmada-qa135.secret.yaml （如下）, 得到secret

apiVersion: v1
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: karmada-qa135  #关联sa
  name: karmada-qa135
  namespace: fedcluster-8ljxfzgsrv8g
type: kubernetes.io/service-account-token

8. sub_kubectl get ns kube-system -oyaml，结果里面取uid作为clusterID

二、控制面集群操作

cluster_name: qa135

control_plane_namespace: fedcluster-8ljxfzgsrv8g

1. fed_kubectl create ns fedcluster-8ljxfzgsrv8g

2. fed_kubectl -nfedcluster-8ljxfzgsrv8g apply -f  control_plane_karmada-impersonator.secret.yaml （如下）

apiVersion: v1
kind: Secret
metadata:
  name: qa135-impersonator
  namespace: fedcluster-8ljxfzgsrv8g
data:
  token: ZXlKaGJHY2lPaUpTVXpJMU...  #值为一中第3步impersonatorSecret.data.token

3. fed_kubectl -nfedcluster-8ljxfzgsrv8g apply -f qa135.secret.yaml （如下）

apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSU...  #值为一中第7步secret.data["ca.crt"]
  token: ZXlKaGJHY2lPaUpTVXpJMU...   #值为一中第7步secret.data.token
kind: Secret
metadata:
  name: qa135
  namespace: fedcluster-8ljxfzgsrv8g

4. fed_kubectl apply -f qa135.cluster.yaml

apiVersion: cluster.karmada.io/v1alpha1
kind: Cluster
metadata:
  finalizers:
  - karmada.io/cluster-controller
  name: qa135
spec:
  syncMode: Push     #固定值
  apiEndpoint: https://11.127.33.7:6443     #qa135 kubeconfig里面的apiEndpoint
  id: 01a34b7b-f90f-413c-b944-8c0a8392d190  #一中第8步得到的clusterID
  secretRef:
    name: qa135
    namespace: fedcluster-8ljxfzgsrv8g
  impersonatorSecretRef:
    name: qa135-impersonator
    namespace: fedcluster-8ljxfzgsrv8g
  provider: baremetal      #固定值
  region: cn-north-1       #固定值
  insecureSkipTLSVerification: true   #固定值

5. fed_kubectl patch cluster qa135 --subresource=status --type=merge -p '{"status":{"conditions":[{"lastTransitionTime":"2025-12-09T14:17:53Z","message":"cluster is healthy and ready to accept workloads","reason":"ClusterReady","status":"True","type":"Ready"}],"kubernetesVersion":"v1.35.0-1-ecab2e3f556"}}'   #很重要，cluster必须是ready的

status:
  conditions:
  - lastTransitionTime: "2025-12-09T14:17:53Z"
    message: cluster is healthy and ready to accept workloads
    reason: ClusterReady
    status: "True"
    type: Ready
  kubernetesVersion: v1.35.0-1-ecab2e3f556  #qa135 version查询版本

6. 给secret添加cluster的ownerRefrences

fed_kubectl edit secret -nfedcluster-8ljxfzgsrv8g qa135

fed_kubectl edit secret -nfedcluster-8ljxfzgsrv8g qa135-impersonator

7. 给search添加集群，qafed edit resourceregistries global-search-config