# kube-apiserver / Kubernetes 控制面内核：storage、cacher、Admission 与 APF

DevFeed: [kube-apiserver / Kubernetes 控制面内核：storage、cacher、Admission 与 APF](<https://devfeed.tech/articles/kube-apiserver-kubernetes-storage-cacher-admission-apf-33974.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/index.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: article

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [etcd](<https://devfeed.tech/topics/etcd.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [API](<https://devfeed.tech/topics/api.md>), [site-reliability-engineering](<https://devfeed.tech/topics/site-reliability-engineering.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [rbac](<https://devfeed.tech/topics/rbac.md>)

Tags: [admission](<https://devfeed.tech/tags/admission.md>), [apf](<https://devfeed.tech/tags/apf.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cacher](<https://devfeed.tech/tags/cacher.md>), [control-plane](<https://devfeed.tech/tags/control-plane.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [etcd](<https://devfeed.tech/tags/etcd.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pagination](<https://devfeed.tech/tags/pagination.md>), [plan](<https://devfeed.tech/tags/plan.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [resourceversion](<https://devfeed.tech/tags/resourceversion.md>), [storage](<https://devfeed.tech/tags/storage.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>), [watch](<https://devfeed.tech/tags/watch.md>), [watch-cache](<https://devfeed.tech/tags/watch-cache.md>), [webhook](<https://devfeed.tech/tags/webhook.md>)

## AI overview

This article introduces a 16-part series on the kube-apiserver production request path, covering storage.Interface and etcd3, resourceVersion, watch cache behavior, List and Watch operations, Admission and Webhooks, authentication, authorization, auditing, APF, and extension boundaries. It explains how to distinguish failures across these layers and when to investigate kube-apiserver instead of directly querying etcd. The discussion is anchored to Kubernetes v1.30.3 and etcd v3.5.33, with experiments explicitly noted as not yet run.

## Source excerpt

补齐 etcd 系列 K8s 耦合篇之上的 kube-apiserver 生产内核：storage.Interface、watch cache、resourceVersion、Admission/Webhook、APF，并以排障与相对 etcd 的分层收束。