Skip to main content

Kube-ApiServer

πŸ“Œ What Is the Kubernetes API Server?​

The Kubernetes API Server (kube-apiserver) is the central control plane component in every Kubernetes cluster.
It acts as the gateway through which all components, users, and tools interact with the cluster.

Think of it as the front door to your Kubernetes brain.

🎯 Core Responsibilities​

RoleDescription
API FrontendExposes the Kubernetes API (RESTful, HTTP/JSON)
Authentication & AuthorizationValidates user identity and access rights (RBAC, ABAC, etc.)
Admission ControlEnforces policies (e.g., resource limits, quotas, security settings)
Data ValidationChecks schema correctness of submitted YAML/JSON
Etcd InteractionPersists the cluster's state in etcd (a distributed key-value store)
Cluster State ManagementOrchestrates updates and maintains consistency across the cluster
Serving ClientsResponds to kubectl, Controllers, Operators, and other external clients

πŸ” What Happens When You Run kubectl apply?​

Let's break down the process behind:

kubectl apply -f deployment.yaml

πŸ“¦ 1. kubectl parses the YAML​

  • Validates that the file is properly formatted.
  • Reads resource kind (Deployment, Service, etc.), metadata, and spec.

πŸ” 2. Authentication​

  • kubectl contacts the API server over HTTPS.
  • Uses your kubeconfig (typically located at ~/.kube/config) to:
    • Identify the cluster endpoint
    • Provide credentials (tokens, client certs, etc.)

βœ… 3. Authorization​

  • API Server checks what you're allowed to do (via RBAC or other mechanisms).
  • For example, are you allowed to create a Deployment in the default namespace?

🧰 4. Admission Controllers Run​

If you pass authorization, Admission Controllers kick in:

  • Examples:
    • LimitRanger: Ensures resource requests/limits.
    • PodSecurityPolicy: Blocks insecure specs.
    • NamespaceLifecycle: Prevents changes in terminating namespaces.

πŸ“– 5. Validation & Defaulting​

  • Checks your resource against its OpenAPI schema.
  • Adds default fields you didn't specify (e.g., restartPolicy: Always for Pods).

🧠 6. Storage in etcd​

  • The API Server persists the resource state in etcd, the cluster's source of truth.
  • etcd is a distributed key-value store optimized for fast reads/writes and versioning.

πŸ” 7. Controllers Start Acting​

  • Deployment controller sees a new Deployment object in etcd.
  • It creates a ReplicaSet, which in turn creates the desired number of Pods.
  • Each controller watches for state changes and reacts to meet the "desired state".

kubectl apply stores a last-applied-configuration annotation in the object metadata to track future diffs.

πŸ”’ Authentication & Authorization Layers​

πŸ” Authentication Methods​

πŸ” Authentication Methods​

  • X.509 Certificates
  • Bearer Tokens
  • OpenID Connect (OIDC)
  • Service Accounts

πŸ” Authorization Modes​

  • RBAC (Role-Based Access Control) βœ… most common
  • ABAC
  • Webhook
  • Node (for kubelets)

πŸ“š The Kubernetes Resource Model​

The API Server supports hundreds of resource types, grouped by API groups and versions.

KindAPI GroupVersion
Pod"" (core group)v1
Deploymentappsv1
Ingressnetworking.k8s.iov1
CustomResourceDefinitionapiextensions.k8s.iov1

You can list all resources and their endpoints with:

kubectl api-resources

πŸ“ˆ Monitoring the API Server​

Check logs:

kubectl logs -n kube-system kube-apiserver-<node-name>

Get the node's name using:

k get node

Use Prometheus metrics (if enabled):

https://<api-server-host>:port/metrics

πŸ” Security Best Practices​

  • Use RBAC to tightly control who can do what.
  • Enable audit logs for sensitive actions.
  • Use API server flags to restrict access (e.g., --anonymous-auth=false).
  • Protect etcd (encrypt secrets at rest via EncryptionConfiguration).

🧡 Final Summary​

RoleDescription
Entry point for all cluster actionsExposes the REST API for all Kubernetes resources
Central orchestration brainTalks to etcd, triggers controllers
Enforces access & policyAuthn, Authz, and Admission Controllers
Supports declarative workflowsPowers kubectl apply, CI/CD pipelines
Critical for cluster availabilityIf it’s down, no changes can be made

The API Server is the heart of Kubernetes, and understanding how it works is crucial to operating, securing, and automating any cluster.