Skip to main content

Chapter 2.2 - API Server

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand the role of the API Server
  • Explain how the API Server validates and processes requests
  • Understand authentication and authorization
  • Use kubectl to interact with the API Server

What is the API Server?​

The API Server (kube-apiserver) is the single entry point for all interactions with a Kubernetes cluster. It is the only component that users and other cluster components communicate with directly.

Roles of the API Server​

1. Single Entry Point​

All requests go through the API Server:

  • kubectl -> API Server
  • Dashboard -> API Server
  • Controllers -> API Server
  • kubelet -> API Server

2. Validation​

The API Server validates all requests:

  • Correct format (YAML/JSON)
  • Schema compliance
  • Constraints respected

3. Authentication and Authorization​

  • Authentication: Who are you? (certificates, tokens, etc.)
  • Authorization: What can you do? (RBAC, ABAC, etc.)

4. Admission Control​

Plugins that can modify or reject requests:

  • Resource validation
  • Mutations (adding default values)
  • Quotas and limits

Request Processing Flow​

Kubernetes REST API​

The API Server exposes a standard REST API:

Main Endpoints​

/api/v1/namespaces/{namespace}/pods
/api/v1/namespaces/{namespace}/services
/api/v1/namespaces/{namespace}/deployments
/apps/v1/namespaces/{namespace}/deployments

HTTP Methods​

  • GET: Read resources
  • POST: Create resources
  • PUT: Update resources
  • PATCH: Partially modify
  • DELETE: Delete resources

Example with kubectl​

# kubectl converts commands into REST API calls
kubectl get pods
# Becomes: GET /api/v1/namespaces/default/pods

kubectl create -f pod.yaml
# Becomes: POST /api/v1/namespaces/default/pods

Authentication​

The API Server supports multiple authentication methods:

1. X.509 Certificates​

2. Service Accounts​

Tokens for Pods that communicate with the API:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app

3. Static Tokens​

Token files for basic authentication.

Authorization (RBAC)​

Role-Based Access Control (RBAC) determines what a user can do:

Role Example:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

Admission Control​

Admission Controllers are plugins that intercept requests:

Types of Admission Controllers​

  1. Validating: Validate and can reject
  2. Mutating: Modify requests before storage

Examples​

  • ResourceQuota: Limits resources per namespace
  • LimitRanger: Applies default limits
  • PodSecurityPolicy: Enforces security policies

Performance and Scalability​

Optimizations​

  • Watch API: Real-time notifications instead of polling
  • Pagination: Limits the number of results
  • Field Selectors: Filters results server-side

Important Metrics​

  • Request latency
  • Throughput (requests/second)
  • Response size

Useful Commands​

# View API endpoints
kubectl get --raw /

# View available resources
kubectl api-resources

# View API versions
kubectl api-versions

# Test the API directly
kubectl proxy
# Then: curl http://localhost:8001/api/v1/pods

Summary​

In this chapter, you learned:

API Server: Single entry point for all interactions
Validation: Checks the format and schema of requests
Security: Authentication and authorization (RBAC)
Admission Control: Plugins for validation and mutation
REST API: Standard interface for interacting with Kubernetes

Next Steps​

Now that you understand the API Server:

Chapter 2.3: etcd - The Cluster Database
Chapter 2.4: Controller Manager

Chapter created: December 2024