Kube API server

Overview

The kube-apiserver validates and configures data for API objects, such as pods, Services, and ReplicationControllers. It serves REST operations and provides the frontend to the cluster's shared state that all other components use to interact.

Usage

The kube-apiserver component is installed by default and requires no additional configuration.

Release notes

The kube-apiserver component is updated with each Kubernetes version release. For more information, see Overview of Kubernetes versions supported by ACK.

• For new clusters running Kubernetes 1.20 or later created after February 2023, access to Kubernetes Services in the default namespace is optimized: traffic is directed through an elastic network interface (ENI) instead of a Classic Load Balancer (CLB). This change reduces the performance overhead by removing an intermediate forwarding layer.

  Important

  If the security group for nodes and their containers differs from the cluster's security group—and the cluster's security group restricts inbound traffic on port 6443—system components may fail to connect to the API server.

• For new clusters created after November 2024 with a version of 1.20 or later, when the kubelet and kube-proxy components on cluster nodes access the API Server service, their service discovery process for the API Server has been optimized from using a fixed Classic Load Balancer (CLB) IP address to resolving the API Server domain name (apiserver.{Your Cluster ID}.{Region ID}.cs.aliyuncs.com) to the IP address of an elastic network interface (ENI). This optimization further improves the cluster's high availability (HA).

  Important

  • If the cluster's security group restricts inbound traffic on port 6443, nodes cannot connect to the API server.

  • The API server domain name, apiserver.{Your-Cluster-ID}.{Region-ID}.cs.aliyuncs.com, is provided and managed by ACK through Private DNS. You can view this domain in the Cloud Service Defined Zones section of the Alibaba Cloud DNS console.

  • Resolving the API server domain name depends on the default Private DNS resolver addresses (100.100.2.136 and 100.100.2.138) in your Alibaba Cloud VPC. If you use a custom DNS server on your nodes, you must ensure the default Private DNS resolvers in the upstream VPC still resolve the API server domain name. Otherwise, your nodes may fail to access the API server. Proceed with caution.