kube-apiserver
- Docker & Kubernetes course
- Expert
- Lesson 4/47
- 4 min
Learn that kube-apiserver serves the cluster API.
kube-apiserver
kube-apiserver is the cluster's single entry gate. Every request passes through these stages in order:
- Authentication: certificates, tokens, OIDC.
- Authorization: RBAC.
- Admission controllers: mutating (e.g. adding defaults) and validating (e.g. quotas, policies) checks.
- Validation and persistence: type-definition conformance and writing to etcd.
$ kubectl get --raw /api/v1/namespaces/default/pods | head -c 120
{"kind":"PodList","apiVersion":"v1","metadata":{"resourceVersion":"812345"},"items":[...Using the raw API
kubectl is actually a REST client. -v=8 shows the HTTP requests it sends; kubectl proxy opens a local proxy, and the API is reached with curl without writing credentials:
$ kubectl get pods -v=8 2>&1 | grep "GET https"
GET https://192.168.49.2:8443/api/v1/namespaces/default/pods?limit=500
$ kubectl proxy --port=8001 &
$ curl -s localhost:8001/apis/apps/v1/namespaces/default/deployments | jq '.items[].metadata.name'Practice Use the API directly
Write three commands: run kubectl get --raw /api/v1/namespaces/default/pods; start kubectl proxy --port=8001 & in the background; get the deployments with curl -s localhost:8001/apis/apps/v1/namespaces/default/deployments.
Starter code
# buraya yazSample solution
kubectl get --raw /api/v1/namespaces/default/pods
kubectl proxy --port=8001 &
curl -s localhost:8001/apis/apps/v1/namespaces/default/deploymentsExpected output
{"kind":"PodList","apiVersion":"v1","metadata":{"resourceVersion":"812345"},"items":[...]}
Starting to serve on 127.0.0.1:8001
{"kind":"DeploymentList","apiVersion":"apps/v1","items":[{"metadata":{"name":"web",...}}]}
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Which stage adds default values to a request?
- etcd
- A mutating admission controller Correct answer
- Authentication
- RBAC
Explanation: E.g. adding the ServiceAccount and default StorageClass is done in admission.
2 Send a raw GET request to the API.
kubectl get ____ /api/v1/namespaces/default/podskubectl get --raw /api/v1/namespaces/default/podsExplanation: --raw sends the path straight to the API.
3 Match the stages.
| Term | Meaning |
|---|---|
authentication |
Who? |
authorization |
Allowed? |
admission |
Mutate and check |
etcd |
Persist |