Security - API Groups

Question 1

In what groups are the Kubernetes apis grouped?

Answer 1

• /metrics
• /healthz
• /version
• /api (core)
• /apis (named)
• /logs

Question 2

What does the /api (core) group encompass?

Answer 2

Covers all core functionality. Like
- namespaces
- pods
- nodes
- PVs
- PVCs
- configmaps

Question 3

What does the /apis (named) group encompass?

Answer 3

• more organised
• future additions will be added here
  Covers:
• /apps (deployments, replicasets,…)
• /extensions
• /networking.k8s.io
• /storage.k8s.io
• /authentication.k8s.io
• /certificates.k8s.io

Question 4

What is special about the resources listed in the /api and /apis group?

Answer 4

• every resource has a set of actions, that can be done with them (verbs)
  For apps/v1/deployments for instance:
• list / get / create / delete / update / watch

Question 5

How can you ask all api groups from the kubeapi server?

Answer 5

curl http://localhost:6443 -k
–key admin.key
–cert admin.crt
–cacert ca.crt

Question 6

What does the ‘kubectl proxy’ command do?

Answer 6

Starts a proxy service locally on port 8001, using credentials and certificates from kubeconfig file for access
So that you don’t have to specify them in the curl http://localhost:8001 -k command