Set up an Extension API Server

    • You must and enable the apiserver flags.
    1. Make sure the APIService API is enabled (check --runtime-config). It should be on by default, unless it’s been deliberately turned off in your cluster.
    2. Create the Kubernetes namespace you want to run your extension api-service in.
    3. Create/get a CA cert to be used to sign the server cert the extension api-server uses for HTTPS.
    4. Create a server cert/key for the api-server to use for HTTPS. This cert should be signed by the above CA. It should also have a CN of the Kube DNS name. This is derived from the Kubernetes service and be of the form
    5. Create a Kubernetes secret with the server cert/key in your namespace.
    6. Create a Kubernetes deployment for the extension api-server and make sure you are loading the secret as a volume. It should contain a reference to a working image of your extension api-server. The deployment should also be in your namespace.
    7. Make sure that your extension-apiserver loads those certs from that volume and that they are used in the HTTPS handshake.
    8. Create a Kubernetes service account in your namespace.
    9. Create a Kubernetes cluster role binding from the service account in your namespace to the cluster role you created.
    10. Create a Kubernetes cluster role binding from the service account in your namespace to the system:auth-delegator cluster role to delegate auth decisions to the Kubernetes core API server.
    11. Create a Kubernetes role binding from the service account in your namespace to the role. This allows your extension api-server to access the extension-apiserver-authentication configmap.
    12. Create a Kubernetes apiservice. The CA cert above should be base64 encoded, stripped of new lines and used as the spec.caBundle in the apiservice. This should not be namespaced. If using the , only pass in the PEM encoded CA bundle because the base 64 encoding is done for you.
    13. Use kubectl to get your resource. When run, kubectl should return “No resources found.”. This message indicates that everything worked but you currently have no objects of that resource type created.