Room 48

API AGGREGATION

The Extended Kingdom

Kubernetes lets you extend its API by registering custom API servers.
The aggregation layer proxies requests to your custom backends.

📜 Mission Briefing

Understand the API aggregation layer and APIService objects.
Study how metrics-server registers itself as an aggregated API.
Deploy metrics-server in the Kind cluster.
Verify the aggregated API is available with kubectl get --raw.
Query the metrics API - the response node name hides the password: apiaggr3.

Key Commands

Command	Purpose
`kubectl get apiservices`	List all registered API services
`kubectl get apiservices v1beta1.metrics.k8s.io`	Metrics API status
`kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes`	Raw metrics
`kubectl top nodes`	Node resource usage
`kubectl top pods`	Pod resource usage

How API Aggregation Works

# API Aggregation Layer:
# kube-apiserver → checks APIService registry
# If group/version matches → proxy to custom API server
# Otherwise → serve from built-in handlers

# Flow:
# Client → kube-apiserver → aggregation layer → custom API server
#                         → built-in APIs

# APIService conditions:
# Available: True  → custom server is reachable
# Available: False → custom server is down

# APIService registration
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1beta1.metrics.k8s.io
spec:
  service:
    name: metrics-server
    namespace: kube-system
  group: metrics.k8s.io
  version: v1beta1
  insecureSkipTLSVerify: true
  groupPriorityMinimum: 100
  versionPriority: 100

# Deploy metrics-server on Kind (needs --kubelet-insecure-tls)
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# Patch for Kind (kubelet uses self-signed certs)
kubectl patch deployment metrics-server -n kube-system \
  --type='json' \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'

# Verify the API is available
kubectl get apiservices | grep metrics
# v1beta1.metrics.k8s.io   kube-system/metrics-server   True   2m

# Query raw API
kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes | jq .

# Custom API servers can serve any resources
# Example: service catalog, custom metrics, external APIs

# Exploring all API groups
kubectl api-versions          # List all groups/versions
kubectl api-resources         # List all resource types
kubectl api-resources --api-group=apps  # Resources in apps group

# API discovery
kubectl get --raw /apis | jq '.groups[].name'

Hints

Hint 1

kubectl apply -f metrics-server.yaml
kubectl patch deployment metrics-server -n kube-system \
  --type='json' \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'

Hint 2

Wait for metrics-server to be ready, then query:

kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes | jq .

Hint 3

The password is apiaggr3.

🔓 Unlock Room 49

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_49/README -out ../room_49/README.txt -pass pass:PASSWORD
cat ../room_49/README.txt