{"id":658,"date":"2020-10-22T23:44:17","date_gmt":"2020-10-22T15:44:17","guid":{"rendered":"https:\/\/www.myway5.com\/?p=658"},"modified":"2023-07-05T21:23:27","modified_gmt":"2023-07-05T13:23:27","slug":"apiserver-process-request","status":"publish","type":"post","link":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/","title":{"rendered":"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b"},"content":{"rendered":"<h2>1. \u6982\u8ff0<\/h2>\n<p>k8s \u7684 apiserver \u4f5c\u4e3a\u6240\u6709\u7ec4\u4ef6\u901a\u4fe1\u7684\u67a2\u7ebd\uff0c\u5176\u91cd\u8981\u6027\u4e0d\u8a00\u800c\u55bb\u3002apiserver \u53ef\u4ee5\u5bf9\u5916\u63d0\u4f9b\u57fa\u4e8e HTTP \u7684\u670d\u52a1\uff0c\u90a3\u4e48\u4e00\u4e2a\u8bf7\u6c42\u4ece\u53d1\u51fa\u5230\u5904\u7406\uff0c\u5177\u4f53\u8981\u7ecf\u8fc7\u54ea\u4e9b\u6b65\u9aa4\u5462\uff1f\u4e0b\u9762\u4f1a\u6839\u636e\u4ee3\u7801\u5c06\u6574\u4e2a\u8fc7\u7a0b\u7b80\u5355\u7684\u53d9\u8ff0\u4e00\u904d\uff0c\u8ba9\u5927\u5bb6\u53ef\u4ee5\u5bf9\u8fd9\u4e2a\u8fc7\u7a0b\u7531\u5927\u6982\u7684\u5370\u8c61\u3002<\/p>\n<p>\u56e0\u4e3a apiserver \u7684\u4ee3\u7801\u7ed3\u6784\u5e76\u4e0d\u7b80\u5355\uff0c\u56e0\u6b64\u4f1a\u5c3d\u91cf\u5c11\u7684\u8d34\u4ee3\u7801\u3002\u4ee5\u4e0b\u5206\u6790\u57fa\u4e8e k8s 1.18<\/p>\n<h2>2. \u8bf7\u6c42\u7684\u5904\u7406\u94fe<\/h2>\n<pre><code class=\"language-go line-numbers\">\/\/ \u6784\u5efa\u8bf7\u6c42\u7684\u5904\u7406\u94fe\nfunc DefaultBuildHandlerChain(apiHandler http.Handler, c *Config) http.Handler {\n   handler := genericapifilters.WithAuthorization(apiHandler, c.Authorization.Authorizer, c.Serializer)\n   if c.FlowControl != nil {\n      handler = genericfilters.WithPriorityAndFairness(handler, c.LongRunningFunc, c.FlowControl)\n   } else {\n      handler = genericfilters.WithMaxInFlightLimit(handler, c.MaxRequestsInFlight, c.MaxMutatingRequestsInFlight, c.LongRunningFunc)\n   }\n   handler = genericapifilters.WithImpersonation(handler, c.Authorization.Authorizer, c.Serializer)\n   handler = genericapifilters.WithAudit(handler, c.AuditBackend, c.AuditPolicyChecker, c.LongRunningFunc)\n   failedHandler := genericapifilters.Unauthorized(c.Serializer, c.Authentication.SupportsBasicAuth)\n   failedHandler = genericapifilters.WithFailedAuthenticationAudit(failedHandler, c.AuditBackend, c.AuditPolicyChecker)\n   handler = genericapifilters.WithAuthentication(handler, c.Authentication.Authenticator, failedHandler, c.Authentication.APIAudiences)\n   handler = genericfilters.WithCORS(handler, c.CorsAllowedOriginList, nil, nil, nil, \"true\")\n   handler = genericfilters.WithTimeoutForNonLongRunningRequests(handler, c.LongRunningFunc, c.RequestTimeout)\n   handler = genericfilters.WithWaitGroup(handler, c.LongRunningFunc, c.HandlerChainWaitGroup)\n   handler = genericapifilters.WithRequestInfo(handler, c.RequestInfoResolver)\n   if c.SecureServing != nil &amp;&amp; !c.SecureServing.DisableHTTP2 &amp;&amp; c.GoawayChance &gt; 0 {\n      handler = genericfilters.WithProbabilisticGoaway(handler, c.GoawayChance)\n   }\n   handler = genericfilters.WithPanicRecovery(handler)\n   return handler\n}\n<\/code><\/pre>\n<p>\u8fd9\u4e2a\u8bf7\u6c42\u7684\u5904\u7406\u94fe\u662f\u4ece\u540e\u5411\u524d\u6267\u884c\u7684\u3002\u56e0\u6b64\u8bf7\u6c42\u7ecf\u8fc7\u7684 handler \u4e3a:<\/p>\n<ul>\n<li>PanicRecovery<\/li>\n<li>ProbabilisticGoaway<\/li>\n<li>RequestInfo<\/li>\n<li>WaitGroup<\/li>\n<li>TimeoutForNonLongRunningRequests<\/li>\n<li>CORS<\/li>\n<li>Authentication<\/li>\n<li>failedHandler: FailedAuthenticationAudit<\/li>\n<li>failedHandler: Unauthorized<\/li>\n<li>Audit<\/li>\n<li>Impersonation<\/li>\n<li>PriorityAndFairness \/ MaxInFlightLimit<\/li>\n<li>Authorization<\/li>\n<\/ul>\n<p>\u4e4b\u540e\u4f20\u9012\u5230 director\uff0c\u7531 director \u5206\u5230 gorestfulContainer \u6216 nonGoRestfulMux\u3002gorestfulContainer \u662f apiserver \u4e3b\u8981\u90e8\u5206\u3002<\/p>\n<pre><code class=\"language-go line-numbers\">director := director{\n   name:               name,\n   goRestfulContainer: gorestfulContainer,\n   nonGoRestfulMux:    nonGoRestfulMux,\n}\n<\/code><\/pre>\n<h3>PanicRecovery<\/h3>\n<p>runtime.HandleCrash \u9632\u6b62 panic\uff0c\u5e76\u6253\u4e86\u65e5\u5fd7\u8bb0\u5f55 panic \u7684\u8bf7\u6c42\u8be6\u60c5<\/p>\n<h3>ProbabilisticGoaway<\/h3>\n<p>\u56e0\u4e3a client \u548c apiserver \u662f\u4f7f\u7528 http2 \u957f\u8fde\u63a5\u7684\u3002\u8fd9\u6837\u5373\u4f7f apiserver \u6709\u8d1f\u8f7d\u5747\u8861\uff0c\u90e8\u5206 client \u7684\u8bf7\u6c42\u4e5f\u4f1a\u4e00\u76f4\u547d\u4e2d\u5230\u540c\u4e00\u4e2a apiserver \u4e0a\u3002goaway \u4f1a\u914d\u7f6e\u4e00\u4e2a\u5f88\u5c0f\u7684\u51e0\u7387\uff0c\u5728 apiserver \u6536\u5230\u8bf7\u6c42\u540e\u54cd\u5e94 GOWAY \u7ed9 client\uff0c\u8fd9\u6837 client \u5c31\u4f1a\u65b0\u5efa\u4e00\u4e2a tcp \u8fde\u63a5\u8d1f\u8f7d\u5747\u8861\u5230\u4e0d\u540c\u7684 apiserver \u4e0a\u3002\u8fd9\u4e2a\u51e0\u7387\u7684\u53d6\u503c\u8303\u56f4\u662f 0~0.02<\/p>\n<p>\u76f8\u5173\u7684 PR\uff1ahttps:\/\/github.com\/kubernetes\/kubernetes\/pull\/88567<\/p>\n<h3>RequestInfo<\/h3>\n<p>RequestInfo \u4f1a\u6839\u636e HTTP \u8bf7\u6c42\u8fdb\u884c\u89e3\u6790\u5904\u7406\u3002\u5f97\u5230\u4ee5\u4e0b\u7684\u4fe1\u606f\uff1a<\/p>\n<pre><code class=\"language-go line-numbers\">\/\/ RequestInfo holds information parsed from the http.Request\ntype RequestInfo struct {\n    \/\/ IsResourceRequest indicates whether or not the request is for an API resource or subresource\n    IsResourceRequest bool\n    \/\/ Path is the URL path of the request\n    Path string\n    \/\/ Verb is the kube verb associated with the request for API requests, not the http verb.  This includes things like list and watch.\n    \/\/ for non-resource requests, this is the lowercase http verb\n    Verb string\n\n    APIPrefix  string\n    APIGroup   string\n    APIVersion string\n    Namespace  string\n    \/\/ Resource is the name of the resource being requested.  This is not the kind.  For example: pods\n    Resource string\n    \/\/ Subresource is the name of the subresource being requested.  This is a different resource, scoped to the parent resource, but it may have a different kind.\n    \/\/ For instance, \/pods has the resource \"pods\" and the kind \"Pod\", while \/pods\/foo\/status has the resource \"pods\", the sub resource \"status\", and the kind \"Pod\"\n    \/\/ (because status operates on pods). The binding resource for a pod though may be \/pods\/foo\/binding, which has resource \"pods\", subresource \"binding\", and kind \"Binding\".\n    Subresource string\n    \/\/ Name is empty for some verbs, but if the request directly indicates a name (not in body content) then this field is filled in.\n    Name string\n    \/\/ Parts are the path parts for the request, always starting with \/{resource}\/{name}\n    Parts []string\n}\n<\/code><\/pre>\n<h3>WaitGroup<\/h3>\n<p>waitgroup \u7528\u6765\u5904\u7406\u77ed\u8fde\u63a5\u9000\u51fa\u7684\u3002<\/p>\n<p>\u5982\u4f55\u5224\u65ad\u662f\u4e0d\u662f\u4e00\u4e2a\u957f\u8fde\u63a5\u5462\uff1f\u8fd9\u91cc\u662f\u901a\u8fc7\u8bf7\u6c42\u7684\u52a8\u4f5c\u6216\u8005 subresource \u6765\u5224\u65ad\u7684\u3002watch \u548c proxy \u8fd9\u4e24\u4e2a\u52a8\u4f5c\u662f\u5728 requestinfo \u4e0a\u901a\u8fc7\u8bf7\u6c42\u7684 path \u6765\u5224\u65ad\u7684\u3002<\/p>\n<pre><code class=\"language-go line-numbers\">serverConfig.LongRunningFunc = filters.BasicLongRunningRequestCheck(\n  sets.NewString(\"watch\", \"proxy\"),\n  sets.NewString(\"attach\", \"exec\", \"proxy\", \"log\", \"portforward\"),\n)\n\n\/\/ BasicLongRunningRequestCheck returns true if the given request has one of the specified verbs or one of the specified subresources, or is a profiler request.\nfunc BasicLongRunningRequestCheck(longRunningVerbs, longRunningSubresources sets.String) apirequest.LongRunningRequestCheck {\n    return func(r *http.Request, requestInfo *apirequest.RequestInfo) bool {\n        if longRunningVerbs.Has(requestInfo.Verb) {\n            return true\n        }\n        if requestInfo.IsResourceRequest &amp;&amp; longRunningSubresources.Has(requestInfo.Subresource) {\n            return true\n        }\n        if !requestInfo.IsResourceRequest &amp;&amp; strings.HasPrefix(requestInfo.Path, \"\/debug\/pprof\/\") {\n            return true\n        }\n        return false\n    }\n}\n<\/code><\/pre>\n<p>\u8fd9\u6837\u4e4b\u540e\u7684 handler \u5168\u90e8\u9000\u51fa\u540e\uff0c\u8fd9\u4e2a waitgroup \u7684 handler \u624d\u4f1a done\u3002\u8fd9\u6837\u5c31\u80fd\u5b9e\u73b0\u4f18\u96c5\u9000\u51fa\u4e86\u3002<\/p>\n<h3>TimeoutForNonLongRunningRequests<\/h3>\n<p>\u5bf9\u4e8e\u975e\u957f\u8fde\u63a5\u7684\u8bf7\u6c42\uff0c\u4f7f\u7528 ctx \u7684 cancel \u6765\u5728\u8d85\u65f6\u540e\u53d6\u6d88\u8bf7\u6c42\u3002<\/p>\n<h3>CORS<\/h3>\n<p>\u8bbe\u7f6e\u4e00\u4e9b\u8de8\u57df\u7684\u54cd\u5e94\u5934<\/p>\n<h3>Authentication<\/h3>\n<p>\u5f00\u59cb\u8ba4\u8bc1\u7528\u6237\u3002\u8ba4\u8bc1\u6210\u529f\u4f1a\u4ece\u8bf7\u6c42\u4e2d\u79fb\u9664 <code>Authorization<\/code>\u3002\u7136\u540e\u5c06\u8bf7\u6c42\u4ea4\u7ed9\u4e0b\u4e00\u4e2a handler\uff0c\u5426\u5219\u5c06\u8bf7\u6c42\u4ea4\u7ed9\u4e0b\u4e00\u4e2a failed handler\u3002<\/p>\n<p>\u5904\u7406\u7684\u65b9\u5f0f\u6709\u5f88\u591a\u4e2d\u3002\u5305\u62ec\uff1a<\/p>\n<ul>\n<li>Requestheader\uff0c\u8d1f\u8d23\u4ece\u8bf7\u6c42\u4e2d\u53d6\u51fa X-Remote-User\uff0cX-Remote-Group\uff0cX-Remote-Extra<\/li>\n<li>X509 \u8bc1\u4e66\u6821\u9a8c\uff0c<\/li>\n<li>BearerToken<\/li>\n<li>WebSocket<\/li>\n<li>Anonymous: \u5728\u5141\u8bb8\u533f\u540d\u7684\u60c5\u51b5\u4e0b<\/li>\n<\/ul>\n<p>\u8fd8\u6709\u4e00\u90e8\u5206\u662f\u4ee5\u63d2\u4ef6\u7684\u5f62\u5f0f\u63d0\u4f9b\u4e86\u8ba4\u8bc1\uff1a<\/p>\n<ul>\n<li>bootstrap token<\/p>\n<\/li>\n<li>\n<p>Basic auth<\/p>\n<\/li>\n<li>password<\/li>\n<li>OIDC<\/li>\n<li>Webhook<\/li>\n<\/ul>\n<p>\u5982\u679c\u6709\u4e00\u4e2a\u8ba4\u8bc1\u6210\u529f\u7684\u8bdd\uff0c\u5c31\u8ba4\u4e3a\u8ba4\u8bc1\u6210\u529f\u3002\u5e76\u4e14\u5982\u679c\u7528\u6237\u662f <code>system:anonymous<\/code> \u6216 \u7528\u6237\u7ec4\u4e2d\u5305\u542b <code>system:unauthenticated<\/code> \u548c <code>system:authenticated<\/code>\u3002\u5c31\u76f4\u63a5\u8fd4\u56de\uff0c\u5426\u5219\u4fee\u6539\u7528\u6237\u4fe1\u606f\u5e76\u8fd4\u56de\uff1a<\/p>\n<pre><code class=\"language-go line-numbers\">r.User = &amp;user.DefaultInfo{\n        Name:   r.User.GetName(),\n        UID:    r.User.GetUID(),\n        Groups: append(r.User.GetGroups(), user.AllAuthenticated),\n        Extra:  r.User.GetExtra(),\n    }\n<\/code><\/pre>\n<p>\u6ce8\u610f\u5230\uff0cuser \u73b0\u5728\u5df2\u7ecf\u5c5e\u4e8e <code>system:authenticated<\/code>\u3002\u4e5f\u5c31\u662f\u8ba4\u8bc1\u8fc7\u4e86\u3002<\/p>\n<h3>FailedAuthenticationAudit<\/h3>\n<p>\u8fd9\u4e2a\u53ea\u4f1a\u5728\u8ba4\u8bc1\u5931\u8d25\u540e\u624d\u4f1a\u6267\u884c\u3002\u4e3b\u8981\u662f\u63d0\u4f9b\u4e86\u5ba1\u8ba1\u7684\u529f\u80fd\u3002<\/p>\n<h3>Unauthorized<\/h3>\n<p>\u672a\u6388\u6743\u7684\u5904\u7406\uff0c\u5728 FailedAuthenticationAudit \u4e4b\u540e\u8c03\u7528<\/p>\n<h3>Audit<\/h3>\n<p>\u63d0\u4f9b\u8bf7\u6c42\u7684\u5ba1\u8ba1\u529f\u80fd<\/p>\n<h3>Impersonation<\/h3>\n<p>impersonation \u662f\u4e00\u4e2a\u5c06\u5f53\u524d\u7528\u6237\u626e\u6f14\u4e3a\u53e6\u5916\u4e00\u4e2a\u7528\u6237\u7684\u7279\u6027\uff0c\u8fd9\u4e2a\u7279\u6027\u6709\u52a9\u4e8e\u7ba1\u7406\u5458\u6765\u6d4b\u8bd5\u4e0d\u540c\u7528\u6237\u7684\u6743\u9650\u662f\u5426\u914d\u7f6e\u6b63\u786e\u7b49\u7b49\u3002\u53d6\u5f97 header \u7684 key \u662f\uff1a<\/p>\n<ul>\n<li>Impersonate-User\uff1a\u7528\u6237<\/li>\n<li>Impersonate-Group\uff1a\u7ec4<\/li>\n<li>Impersonate-Extra-\uff1a\u989d\u5916\u4fe1\u606f<\/li>\n<\/ul>\n<p>\u7528\u6237\u5206\u4e3a service account \u548c user\u3002\u6839\u636e\u683c\u5f0f\u533a\u5206\uff0cservice account \u7684\u683c\u5f0f\u662f namespace\/name\uff0c\u5426\u5219\u5c31\u662f\u5f53\u4f5c user \u5bf9\u5f85\u3002<\/p>\n<p>Service account \u6700\u7ec8\u7684\u683c\u5f0f\u662f\uff1a system:serviceaccount:namespace:name<\/p>\n<h3>PriorityAndFairness \/ MaxInFlightLimit<\/h3>\n<p>\u5982\u679c\u8bbe\u7f6e\u4e86\u6d41\u63a7\uff0c\u5c31\u4f7f\u7528 PriorityAndFairness\uff0c\u5426\u5219\u4f7f\u7528 MaxInFlightLimit\u3002<\/p>\n<p>PriorityAndFairness\uff1a\u4f1a\u5bf9\u8bf7\u6c42\u505a\u4f18\u5148\u7ea7\u7684\u6392\u5e8f\u3002\u540c\u4f18\u5148\u7ea7\u7684\u8bf7\u6c42\u4f1a\u6709\u516c\u5e73\u6027\u76f8\u5173\u7684\u63a7\u5236\u3002<\/p>\n<p>MaxInFlightLimit\uff1a\u5728\u7ed9\u5b9a\u65f6\u95f4\u5185\u8fdb\u884c\u4e2d\u4e0d\u53ef\u53d8\u8bf7\u6c42\u7684\u6700\u5927\u6570\u91cf\u3002\u5f53\u8d85\u8fc7\u8be5\u503c\u65f6\uff0c\u670d\u52a1\u5c06\u62d2\u7edd\u6240\u6709\u8bf7\u6c42\u30020 \u503c\u8868\u793a\u6ca1\u6709\u9650\u5236\u3002\uff08\u9ed8\u8ba4\u503c 400\uff09<\/p>\n<p>\u53c2\u8003\u8d44\u6599\uff1ahttps:\/\/kubernetes.io\/zh\/docs\/concepts\/cluster-administration\/flow-control\/<\/p>\n<h3>Authorization<\/h3>\n<pre><code class=\"language-go line-numbers\">\/\/ AttributesRecord implements Attributes interface.\ntype AttributesRecord struct {\n   User            user.Info\n   Verb            string\n   Namespace       string\n   APIGroup        string\n   APIVersion      string\n   Resource        string\n   Subresource     string\n   Name            string\n   ResourceRequest bool\n   Path            string\n}\n<\/code><\/pre>\n<p>\u9274\u6743\u7684\u65f6\u5019\u4f1a\u4ece context \u4e2d\u53d6\u51fa\u4e0a\u9762\u8fd9\u4e2a\u7ed3\u6784\u4f53\u9700\u8981\u7684\u4fe1\u606f\uff0c\u7136\u540e\u8fdb\u884c\u8ba4\u8bc1\u3002\u652f\u6301\u7684\u8ba4\u8bc1\u65b9\u5f0f\u6709\uff1a<\/p>\n<ul>\n<li>Always allow<\/li>\n<li>Always deny<\/li>\n<li>Path: \u5141\u8bb8\u90e8\u5206\u8def\u5f84\u603b\u662f\u53ef\u4ee5\u88ab\u8bbf\u95ee<\/li>\n<\/ul>\n<p>\u5176\u4ed6\u7684\u4e00\u4e9b\u5e38\u7528\u7684\u8ba4\u8bc1\u65b9\u5f0f\u4e3b\u8981\u662f\u901a\u8fc7\u63d2\u4ef6\u63d0\u4f9b\uff1a<\/p>\n<ul>\n<li>Webhook<\/li>\n<li>RBAC<\/li>\n<li>Node<\/li>\n<\/ul>\n<p>\u5176\u4e2d Node \u4e13\u95e8\u4e3a kubelet \u8bbe\u8ba1\u7684\uff0c\u8282\u70b9\u9274\u6743\u5668\u5141\u8bb8 kubelet \u6267\u884c API \u64cd\u4f5c\u3002\u5305\u62ec\uff1a<\/p>\n<p>\u8bfb\u53d6\u64cd\u4f5c\uff1a<\/p>\n<ul>\n<li>services<\/li>\n<li>endpoints<\/li>\n<li>nodes<\/li>\n<li>pods<\/li>\n<li>secrets\u3001configmaps\u3001pvcs \u4ee5\u53ca\u7ed1\u5b9a\u5230 kubelet \u8282\u70b9\u7684\u4e0e pod \u76f8\u5173\u7684\u6301\u4e45\u5377<\/li>\n<\/ul>\n<p>\u5199\u5165\u64cd\u4f5c\uff1a<\/p>\n<ul>\n<li>\u8282\u70b9\u548c\u8282\u70b9\u72b6\u6001\uff08\u542f\u7528 <code>NodeRestriction<\/code> \u51c6\u5165\u63d2\u4ef6\u4ee5\u9650\u5236 kubelet \u53ea\u80fd\u4fee\u6539\u81ea\u5df1\u7684\u8282\u70b9\uff09<\/li>\n<li>Pod \u548c Pod \u72b6\u6001 (\u542f\u7528 <code>NodeRestriction<\/code> \u51c6\u5165\u63d2\u4ef6\u4ee5\u9650\u5236 kubelet \u53ea\u80fd\u4fee\u6539\u7ed1\u5b9a\u5230\u81ea\u8eab\u7684 Pod)<\/li>\n<li>\u4e8b\u4ef6<\/li>\n<\/ul>\n<p>\u9274\u6743\u76f8\u5173\u64cd\u4f5c\uff1a<\/p>\n<ul>\n<li>\u5bf9\u4e8e\u57fa\u4e8e TLS \u7684\u542f\u52a8\u5f15\u5bfc\u8fc7\u7a0b\u65f6\u4f7f\u7528\u7684 certificationsigningrequests API \u7684\u8bfb\/\u5199\u6743\u9650<\/li>\n<li>\u4e3a\u59d4\u6d3e\u7684\u8eab\u4efd\u9a8c\u8bc1\/\u6388\u6743\u68c0\u67e5\u521b\u5efa tokenreviews \u548c subjectaccessreviews \u7684\u80fd\u529b<\/li>\n<\/ul>\n<p>\u5728\u5c06\u6765\u7684\u7248\u672c\u4e2d\uff0c\u8282\u70b9\u9274\u6743\u5668\u53ef\u80fd\u4f1a\u6dfb\u52a0\u6216\u5220\u9664\u6743\u9650\uff0c\u4ee5\u786e\u4fdd kubelet \u5177\u6709\u6b63\u786e\u64cd\u4f5c\u6240\u9700\u7684\u6700\u5c0f\u6743\u9650\u96c6\u3002<\/p>\n<p>\u4e3a\u4e86\u83b7\u5f97\u8282\u70b9\u9274\u6743\u5668\u7684\u6388\u6743\uff0ckubelet \u5fc5\u987b\u4f7f\u7528\u4e00\u4e2a\u51ed\u8bc1\u4ee5\u8868\u793a\u5b83\u5728 <code>system:nodes<\/code> \u7ec4\u4e2d\uff0c\u7528\u6237\u540d\u4e3a <code>system:node:&lt;nodeName&gt;<\/code>\u3002 \u4e0a\u8ff0\u7684\u7ec4\u540d\u548c\u7528\u6237\u540d\u683c\u5f0f\u8981\u4e0e <a class=\"wp-editor-md-post-content-link\" href=\"https:\/\/kubernetes.io\/zh\/docs\/reference\/command-line-tools-reference\/kubelet-tls-bootstrapping\/\">kubelet TLS \u542f\u52a8\u5f15\u5bfc<\/a>\u8fc7\u7a0b\u4e2d\u4e3a\u6bcf\u4e2a kubelet \u521b\u5efa\u7684\u6807\u8bc6\u76f8\u5339\u914d\u3002<\/p>\n<h3>director<\/h3>\n<p>director \u7684 ServeHTTP \u65b9\u6cd5\u5b9a\u4e49\u5982\u4e0b\uff0c\u4e5f\u5c31\u662f\u4f1a\u6839\u636e\u5b9a\u4e49\u7684 webservice \u5339\u914d\u89c4\u5219\u8fdb\u884c\u8f6c\u53d1\u3002\u5426\u5219\u5c31\u8c03\u7528 nonGoRestfulMux \u8fdb\u884c\u5904\u7406\u3002<\/p>\n<pre><code class=\"language-go line-numbers\">func (d director) ServeHTTP(w http.ResponseWriter, req *http.Request) {\n    path := req.URL.Path\n\n    \/\/ check to see if our webservices want to claim this path\n    for _, ws := range d.goRestfulContainer.RegisteredWebServices() { q \n        switch {\n        case ws.RootPath() == \"\/apis\":\n            \/\/ if we are exactly \/apis or \/apis\/, then we need special handling in loop.\n            \/\/ normally these are passed to the nonGoRestfulMux, but if discovery is enabled, it will go directly.\n            \/\/ We can't rely on a prefix match since \/apis matches everything (see the big comment on Director above)\n            if path == \"\/apis\" || path == \"\/apis\/\" {\n                klog.V(5).Infof(\"%v: %v %q satisfied by gorestful with webservice %v\", d.name, req.Method, path, ws.RootPath())\n                \/\/ don't use servemux here because gorestful servemuxes get messed up when removing webservices\n                \/\/ TODO fix gorestful, remove TPRs, or stop using gorestful\n                d.goRestfulContainer.Dispatch(w, req)\n                return\n            }\n\n        case strings.HasPrefix(path, ws.RootPath()):\n            \/\/ ensure an exact match or a path boundary match\n            if len(path) == len(ws.RootPath()) || path[len(ws.RootPath())] == '\/' {\n                klog.V(5).Infof(\"%v: %v %q satisfied by gorestful with webservice %v\", d.name, req.Method, path, ws.RootPath())\n                \/\/ don't use servemux here because gorestful servemuxes get messed up when removing webservices\n                \/\/ TODO fix gorestful, remove TPRs, or stop using gorestful\n                d.goRestfulContainer.Dispatch(w, req)\n                return\n            }\n        }\n    }\n\n    \/\/ if we didn't find a match, then we just skip gorestful altogether\n    klog.V(5).Infof(\"%v: %v %q satisfied by nonGoRestful\", d.name, req.Method, path)\n    d.nonGoRestfulMux.ServeHTTP(w, req)\n}\n<\/code><\/pre>\n<h3>admission webhook<\/h3>\n<p>\u5728\u8bf7\u6c42\u771f\u6b63\u88ab\u5904\u7406\u524d\uff0c\u8fd8\u5dee\u6700\u540e\u4e00\u6b65\uff0c\u5c31\u662f\u6211\u4eec\u7684 admission webhook\u3002admission \u7684\u8c03\u7528\u662f\u5728\u5177\u4f53\u7684 REST \u7684\u5904\u7406\u4ee3\u7801\u4e2d\uff0c\u5728 create, update \u548c delete \u65f6\uff0c\u4f1a\u5148\u8c03\u7528 mutate\uff0c\u7136\u540e\u518d\u8c03\u7528 validating\u3002k8s \u672c\u8eab\u5c31\u5185\u7f6e\u4e86\u5f88\u591a\u7684 admission\uff0c\u4ee5\u63d2\u4ef6\u7684\u5f62\u5f0f\u63d0\u4f9b\uff0c\u5177\u4f53\u5982\u4e0b\uff1a<\/p>\n<ul>\n<li>AlwaysAdmit<\/li>\n<li>AlwaysPullImages<\/li>\n<li>LimitPodHardAntiAffinityTopology<\/li>\n<li>CertificateApproval\/CertificateSigning\/CertificateSubjectRestriction<\/li>\n<li>DefaultIngressClass<\/li>\n<li>DefaultTolerationSeconds<\/li>\n<li>ExtendedResourceToleration<\/li>\n<li>OwnerReferencesPermissionEnforcement<\/li>\n<li>ImagePolicyWebhook<\/li>\n<li>LimitRanger<\/li>\n<li>NamespaceAutoProvision<\/li>\n<li>NamespaceExists<\/li>\n<li>NodeRestriction<\/li>\n<li>TaintNodesByCondition<\/li>\n<li>PodNodeSelector<\/li>\n<li>PodPreset<\/li>\n<li>PodTolerationRestriction<\/li>\n<li>Priority<\/li>\n<li>ResourceQuota<\/li>\n<li>RuntimeClass<\/li>\n<li>PodSecurityPolicy<\/li>\n<li>SecurityContextDeny<\/li>\n<li>ServiceAccount<\/li>\n<li>PersistentVolumeLabel<\/li>\n<li>PersistentVolumeClaimResize<\/li>\n<li>DefaultStorageClass<\/li>\n<li>StorageObjectInUseProtection<\/li>\n<\/ul>\n<h2>3. \u5982\u4f55\u9605\u8bfb apiserver \u7684\u76f8\u5173\u4ee3\u7801<\/h2>\n<p>\u6211\u770b\u7684\u662f\u4ed3\u5e93\u662f https:\/\/github.com\/kubernetes\/kubernetes\u3002apiserver \u7684\u4ee3\u7801\u4e3b\u8981\u5206\u6563\u5728\u4ee5\u4e0b\u51e0\u4e2a\u4f4d\u7f6e\uff1a<\/p>\n<ul>\n<li>cmd\/kube-apiserver: apiserver main \u51fd\u6570\u5165\u53e3\u3002\u4e3b\u8981\u5c01\u88c5\u4e86\u5f88\u591a\u7684\u542f\u52a8\u53c2\u6570\u3002<\/li>\n<li>pkg\/kubeapiserver: \u63d0\u4f9b\u4e86 kube-apiserver \u548c federation-apiserve \u5171\u7528\u7684\u4ee3\u7801\uff0c\u4f46\u662f\u4e0d\u5c5e\u4e8e generic API server\u3002<\/li>\n<li>plugin\/pkg: \u8fd9\u4e0b\u9762\u90fd\u662f\u548c\u8ba4\u8bc1\uff0c\u9274\u6743\u4ee5\u53ca\u51c6\u5165\u63a7\u5236\u76f8\u5173\u7684\u63d2\u4ef6\u4ee3\u7801<\/li>\n<li>staging\/src\/apiserver: \u8fd9\u91cc\u9762\u662f apiserver \u7684\u6838\u5fc3\u4ee3\u7801\u3002\u5176\u4e0b\u9762\u7684 pkg\/server \u662f\u670d\u52a1\u7684\u542f\u52a8\u5165\u53e3\u3002<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>1. \u6982\u8ff0 k8s \u7684 apiserver \u4f5c\u4e3a\u6240\u6709\u7ec4\u4ef6\u901a\u4fe1\u7684\u67a2\u7ebd\uff0c\u5176\u91cd\u8981\u6027\u4e0d\u8a00\u800c\u55bb\u3002apiserver \u53ef\u4ee5 &hellip; <a href=\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\" class=\"more-link\">\u7ee7\u7eed\u9605\u8bfb<span class=\"screen-reader-text\">apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89],"tags":[],"class_list":["post-658","post","type-post","status-publish","format-standard","hentry","category-k8s"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b - \u4e00\u53ea\u5b89\u9759\u7684\u732b<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b - \u4e00\u53ea\u5b89\u9759\u7684\u732b\" \/>\n<meta property=\"og:description\" content=\"1. \u6982\u8ff0 k8s \u7684 apiserver \u4f5c\u4e3a\u6240\u6709\u7ec4\u4ef6\u901a\u4fe1\u7684\u67a2\u7ebd\uff0c\u5176\u91cd\u8981\u6027\u4e0d\u8a00\u800c\u55bb\u3002apiserver \u53ef\u4ee5 &hellip; \u7ee7\u7eed\u9605\u8bfbapiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\" \/>\n<meta property=\"og:site_name\" content=\"\u4e00\u53ea\u5b89\u9759\u7684\u732b\" \/>\n<meta property=\"article:published_time\" content=\"2020-10-22T15:44:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-05T13:23:27+00:00\" \/>\n<meta name=\"author\" content=\"jiangpengfei\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"jiangpengfei\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\"},\"author\":{\"name\":\"jiangpengfei\",\"@id\":\"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685\"},\"headline\":\"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b\",\"datePublished\":\"2020-10-22T15:44:17+00:00\",\"dateModified\":\"2023-07-05T13:23:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\"},\"wordCount\":247,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685\"},\"articleSection\":[\"k8s\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\",\"url\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\",\"name\":\"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b - \u4e00\u53ea\u5b89\u9759\u7684\u732b\",\"isPartOf\":{\"@id\":\"https:\/\/www.myway5.com\/#website\"},\"datePublished\":\"2020-10-22T15:44:17+00:00\",\"dateModified\":\"2023-07-05T13:23:27+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.myway5.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.myway5.com\/#website\",\"url\":\"https:\/\/www.myway5.com\/\",\"name\":\"\u4e00\u53ea\u5b89\u9759\u7684\u732b\",\"description\":\"\u60f3\u5565\u5462\",\"publisher\":{\"@id\":\"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.myway5.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685\",\"name\":\"jiangpengfei\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.myway5.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f8c7de757f6e0247412bcfd31b7c2271?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f8c7de757f6e0247412bcfd31b7c2271?s=96&d=monsterid&r=g\",\"caption\":\"jiangpengfei\"},\"logo\":{\"@id\":\"https:\/\/www.myway5.com\/#\/schema\/person\/image\/\"},\"url\":\"https:\/\/www.myway5.com\/index.php\/author\/joyme\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b - \u4e00\u53ea\u5b89\u9759\u7684\u732b","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/","og_locale":"zh_CN","og_type":"article","og_title":"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b - \u4e00\u53ea\u5b89\u9759\u7684\u732b","og_description":"1. \u6982\u8ff0 k8s \u7684 apiserver \u4f5c\u4e3a\u6240\u6709\u7ec4\u4ef6\u901a\u4fe1\u7684\u67a2\u7ebd\uff0c\u5176\u91cd\u8981\u6027\u4e0d\u8a00\u800c\u55bb\u3002apiserver \u53ef\u4ee5 &hellip; \u7ee7\u7eed\u9605\u8bfbapiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b","og_url":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/","og_site_name":"\u4e00\u53ea\u5b89\u9759\u7684\u732b","article_published_time":"2020-10-22T15:44:17+00:00","article_modified_time":"2023-07-05T13:23:27+00:00","author":"jiangpengfei","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"jiangpengfei","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"6 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#article","isPartOf":{"@id":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/"},"author":{"name":"jiangpengfei","@id":"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685"},"headline":"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b","datePublished":"2020-10-22T15:44:17+00:00","dateModified":"2023-07-05T13:23:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/"},"wordCount":247,"commentCount":0,"publisher":{"@id":"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685"},"articleSection":["k8s"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/","url":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/","name":"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b - \u4e00\u53ea\u5b89\u9759\u7684\u732b","isPartOf":{"@id":"https:\/\/www.myway5.com\/#website"},"datePublished":"2020-10-22T15:44:17+00:00","dateModified":"2023-07-05T13:23:27+00:00","breadcrumb":{"@id":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.myway5.com\/index.php\/2020\/10\/22\/apiserver-process-request\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.myway5.com\/"},{"@type":"ListItem","position":2,"name":"apiserver \u5904\u7406\u8bf7\u6c42\u7684\u8fc7\u7a0b"}]},{"@type":"WebSite","@id":"https:\/\/www.myway5.com\/#website","url":"https:\/\/www.myway5.com\/","name":"\u4e00\u53ea\u5b89\u9759\u7684\u732b","description":"\u60f3\u5565\u5462","publisher":{"@id":"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.myway5.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":["Person","Organization"],"@id":"https:\/\/www.myway5.com\/#\/schema\/person\/b19267e8b106343431e163ec96950685","name":"jiangpengfei","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.myway5.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f8c7de757f6e0247412bcfd31b7c2271?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f8c7de757f6e0247412bcfd31b7c2271?s=96&d=monsterid&r=g","caption":"jiangpengfei"},"logo":{"@id":"https:\/\/www.myway5.com\/#\/schema\/person\/image\/"},"url":"https:\/\/www.myway5.com\/index.php\/author\/joyme\/"}]}},"views":5857,"_links":{"self":[{"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/posts\/658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/comments?post=658"}],"version-history":[{"count":1,"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/posts\/658\/revisions"}],"predecessor-version":[{"id":659,"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/posts\/658\/revisions\/659"}],"wp:attachment":[{"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/media?parent=658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/categories?post=658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.myway5.com\/index.php\/wp-json\/wp\/v2\/tags?post=658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}