The Kubernetes API server, or kube-apiserver, exposes the RESTful Kubernetes API. It is the cluster’s entry point: communication with cluster components passes through it, and access requires authentication. It runs as a core system pod on the control plane, alongside the controller manager, scheduler, and etcd. Worker-node components also communicate through it. section 1.5 section 2.1.2
Keep the roles separate when troubleshooting. The API server exposes the interface; the controller manager works to match current and desired state, the scheduler assigns pods to nodes, and etcd stores cluster configuration data. An API server failure can therefore prevent you from using kubectl even when the underlying problem is another component, such as etcd. section 1.5 section 2.1.2 section 8.2.5
Find the API server pod
On a kind cluster, run `kubectl get po -o wide -A --field-selector spec.nodeName=kind-control-plane` to inspect pods on the control-plane node. Look for kube-apiserver among the core system pods. CoreDNS is a plugin rather than a core system pod, while kube-proxy runs on both control-plane and worker nodes. section 2.1.2
Diagnose an unavailable API server
If `kubectl -n kube-system get po` cannot reach the cluster, SSH to the control-plane node. Check `systemctl status kubelet`, then inspect `/etc/kubernetes/manifests`. Use `crictl ps -a | grep kube-apiserver` to find an exited container and `crictl logs <containerid>` to read its error. In one failure, the API server pointed to the nonexistent etcd address `127.0.0.2:2379`. After correcting `kube-apiserver.yaml`, verify that its container runs and `kubectl get ns` works. If workloads still have Pending pods, continue checking other control-plane components rather than assuming the cluster is fixed. section 8.2.5
The API server also controls the Service CIDR used for Service cluster IPs. In a fresh kind-cluster exercise requiring Kubernetes v1.34 or later, change `--service-cluster-ip-range` in `/etc/kubernetes/manifests/kube-apiserver.yaml` from `10.96.0.0/16` to `100.96.0.0/16`; saving the manifest restarts the API server. Check the ServiceCIDR and Service addresses afterward. The exercise also updates DNS-related configuration and verifies a pod’s resolver, so changing the API server flag alone is not the final check. section 6.1
