--- title: What happens inside the Kubernetes API server? | daily.dev description: A deep dive into how the Kubernetes API server processes a request end to end: the HTTP handler and OpenAPI schema, authentication and authorization (including... canonical: https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What happens inside the Kubernetes API server? | daily.dev og:description: A deep dive into how the Kubernetes API server processes a request end to end: the HTTP handler and OpenAPI schema, authentication and authorization (including... og:url: https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur og:image: https://api.daily.dev/og/posts/6NR5OUXur.png og:image:alt: What happens inside the Kubernetes API server? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What happens inside the Kubernetes API server? **[LearnKube](https://daily.dev/sources/learnkube)** · 19 min read · 0 upvotes · 0 comments ## Summary A deep dive into how the Kubernetes API server processes a request end to end: the HTTP handler and OpenAPI schema, authentication and authorization (including RBAC's Role/RoleBinding indirection), mutation and validation admission controllers, custom webhook-based admission controllers (Istio, Kyverno), the newer CEL-based ValidatingAdmissionPolicy (stable since 1.30) and alpha MutatingAdmissionPolicy (since 1.32), how resources are serialized and persisted to etcd using an internal storage version, Server-Side Apply and field ownership (default since kubectl 1.22), the Watch API and Shared Informer pattern used by controllers and the scheduler, API extension via the aggregation layer and CRDs, and the audit logging pipeline with its four verbosity levels. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between ValidatingAdmissionPolicy and a validating admission webhook in Kubernetes? ValidatingAdmissionPolicy runs CEL expressions directly inside the API server process, requiring no external webhook server, TLS certificates, or network call, and every expression is guaranteed to terminate in milliseconds since CEL disallows loops and unbounded recursion. Webhooks instead call an external Pod over HTTP and are better suited for complex logic like cross-resource checks or calling external systems. ValidatingAdmissionPolicy has been available since Kubernetes 1.30. _daily.dev surfaces Kubernetes admission-control changes like this for teams weighing webhooks against CEL policies._ ### When did Server-Side Apply become the default for kubectl apply? Server-Side Apply has been the default behavior for kubectl apply since Kubernetes 1.22. It replaced the older client-side approach that stored a bulky kubectl.kubernetes.io/last-applied-configuration JSON annotation on every resource, which only worked with kubectl. Server-Side Apply tracks field ownership per manager (kubectl, HPA, CI/CD pipelines, controllers) and detects conflicts when two managers try to set the same field. _Teams debugging apply conflicts can track Kubernetes field-ownership behavior changes on daily.dev._ ### Why doesn't a Kubernetes resource stored in etcd have an API version like apps/v1? Every resource is converted to a single internal storage version before being written to etcd, rather than keeping the version you submitted (like apps/v1 or apps/v1beta1). When a client requests the resource in a specific API version, the API server converts from that internal representation on the fly. This design lets Kubernetes deprecate and remove old API versions without losing any stored data, since only the conversion logic changes, not the data itself. _daily.dev helps engineers tracking Kubernetes API version deprecations understand what actually changes underneath._ ## Similar posts on daily.dev - [Inside the Kubernetes API Server: The Brain Behind Every Kubernetes Operation](https://daily.dev/posts/inside-the-kubernetes-api-server-the-brain-behind-every-kubernetes-operation-dmpyolvtj) · Medium · 0 upvotes · 0 comments - [Kubernetes Admission Controllers, Explained: What They Are and How They Actually Work](https://daily.dev/posts/kubernetes-admission-controllers-explained-what-they-are-and-how-they-actually-work-ypslwr8h1) · Medium · 3 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What happens inside the Kubernetes API server?","url":"https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur"},"datePublished":"2026-08-31T11:20:04.790Z","dateModified":"2026-08-31T11:20:50.367Z","description":"A deep dive into how the Kubernetes API server processes a request end to end: the HTTP handler and OpenAPI schema, authentication and authorization (including...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4668f5f05c721b72da05dd5c846d546?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4668f5f05c721b72da05dd5c846d546?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"LearnKube","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LearnKube","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/90786df1b5d44abb91a090a0b6c81517","url":"https://daily.dev/sources/learnkube"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LearnKube","item":"https://daily.dev/sources/learnkube"},{"@type":"ListItem","position":3,"name":"What happens inside the Kubernetes API server?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-happens-inside-the-kubernetes-api-server--6nr5ouxur#faq","mainEntity":[{"@type":"Question","name":"What is the difference between ValidatingAdmissionPolicy and a validating admission webhook in Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"ValidatingAdmissionPolicy runs CEL expressions directly inside the API server process, requiring no external webhook server, TLS certificates, or network call, and every expression is guaranteed to terminate in milliseconds since CEL disallows loops and unbounded recursion. Webhooks instead call an external Pod over HTTP and are better suited for complex logic like cross-resource checks or calling external systems. ValidatingAdmissionPolicy has been available since Kubernetes 1.30. daily.dev surfaces Kubernetes admission-control changes like this for teams weighing webhooks against CEL policies."}},{"@type":"Question","name":"When did Server-Side Apply become the default for kubectl apply?","acceptedAnswer":{"@type":"Answer","text":"Server-Side Apply has been the default behavior for kubectl apply since Kubernetes 1.22. It replaced the older client-side approach that stored a bulky kubectl.kubernetes.io/last-applied-configuration JSON annotation on every resource, which only worked with kubectl. Server-Side Apply tracks field ownership per manager (kubectl, HPA, CI/CD pipelines, controllers) and detects conflicts when two managers try to set the same field. Teams debugging apply conflicts can track Kubernetes field-ownership behavior changes on daily.dev."}},{"@type":"Question","name":"Why doesn't a Kubernetes resource stored in etcd have an API version like apps/v1?","acceptedAnswer":{"@type":"Answer","text":"Every resource is converted to a single internal storage version before being written to etcd, rather than keeping the version you submitted (like apps/v1 or apps/v1beta1). When a client requests the resource in a specific API version, the API server converts from that internal representation on the fly. This design lets Kubernetes deprecate and remove old API versions without losing any stored data, since only the conversion logic changes, not the data itself. daily.dev helps engineers tracking Kubernetes API version deprecations understand what actually changes underneath."}}]} ```