kube-apiserver

Learn that kube-apiserver serves the cluster API.

kube-apiserver

kube-apiserver is the cluster's single entry gate. Every request passes through these stages in order:

Authentication: certificates, tokens, OIDC.
Authorization: RBAC.
Admission controllers: mutating (e.g. adding defaults) and validating (e.g. quotas, policies) checks.
Validation and persistence: type-definition conformance and writing to etcd.

$ kubectl get --raw /api/v1/namespaces/default/pods | head -c 120
{"kind":"PodList","apiVersion":"v1","metadata":{"resourceVersion":"812345"},"items":[...

Using the raw API

kubectl is actually a REST client. -v=8 shows the HTTP requests it sends; kubectl proxy opens a local proxy, and the API is reached with curl without writing credentials:

$ kubectl get pods -v=8 2>&1 | grep "GET https"
GET https://192.168.49.2:8443/api/v1/namespaces/default/pods?limit=500
$ kubectl proxy --port=8001 &
$ curl -s localhost:8001/apis/apps/v1/namespaces/default/deployments | jq '.items[].metadata.name'

Exercise Use the API directly

Write three commands: run kubectl get --raw /api/v1/namespaces/default/pods; start kubectl proxy --port=8001 & in the background; get the deployments with curl -s localhost:8001/apis/apps/v1/namespaces/default/deployments.

Show example solution

kubectl get --raw /api/v1/namespaces/default/pods
kubectl proxy --port=8001 &
curl -s localhost:8001/apis/apps/v1/namespaces/default/deployments

Test yourself

Which stage adds default values to a request?
- etcd
- A mutating admission controller
- Authentication
- RBAC
Show answer

A mutating admission controller — E.g. adding the ServiceAccount and default StorageClass is done in admission.

Send a raw GET request to the API.

kubectl get ____ /api/v1/namespaces/default/pods

Show answer

kubectl get --raw /api/v1/namespaces/default/pods

Match the stages.

authentication

Who?
authorization

Allowed?
admission

Mutate and check
etcd

Persist

Next lesson: Reconcile loop

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies