Skip to main content
Before we dive into authorization, it helps to understand Kubernetes API groups and how the API server organizes resources. What is the Kubernetes API? Everything you do with the cluster—whether via kubectl, client libraries, or direct curl requests—talks to the kube-apiserver. The server exposes resources organized by API group and version. For example, to check the cluster version you can query the API server directly:
To list pods via the API, access the pods resource under the core API at GET /api/v1/pods:
These examples show the URL structure used by the API server: core resources are mounted under api/v1, while named API groups appear under apis/<group>/<version>. Core (legacy) group vs named API groups
  • The core (legacy) group contains built-in primitives such as namespaces, pods, services, nodes, configmaps, secrets, persistentvolumes, persistentvolumeclaims, endpoints, replicationcontrollers, events, and bindings. Core resources are accessed under the path api/v1.
A diagram of the Kubernetes Core API showing /api -> /v1 branching into resource types. It lists resources like namespaces, pods, services, nodes, configmaps, secrets, PV/PVC, endpoints, replication controllers, events and bindings.
  • Named API groups host additional functionality and newer features. They are exposed under apis/ and typically follow the pattern apis/<group>/<version>. Examples include apps, networking.k8s.io, storage.k8s.io, authentication.k8s.io, authorization.k8s.io, and certificates.k8s.io.
Examples:
  • apps — resources like deployments, replicasets, statefulsets.
  • networking.k8s.io — resources like networkpolicies.
  • certificates.k8s.io — resources like certificatesigningrequests.
Each resource supports operations (also called verbs) such as list, get, create, delete, update, and watch. The Kubernetes API reference lists groups, versions, and supported verbs for each resource: https://kubernetes.io/docs/reference/ Discovery: Inspect available API groups on a cluster You can discover which top-level paths and API groups the server advertises (if you have access):
To list the named API groups and versions, query /apis (e.g., GET /apis), which returns the groups and versions supported by the cluster. Unauthenticated access and the kubectl proxy convenience If you call the API server without credentials, most endpoints will be forbidden. For example:
If you need to query the API from your workstation without manually supplying client certificates, use kubectl proxy. kubectl proxy runs a local HTTP proxy and forwards requests to the API server using the credentials in your kubeconfig.
Start a local kubectl proxy:
Now you can access the API via the proxy without specifying certificates:
A short terminology clarification
  • kube-proxy is a cluster-level component that programs networking rules on nodes to enable Service <-> Pod connectivity.
  • kubectl proxy is a client-side tool that exposes the API server to your local machine using your kubeconfig credentials.
API groups — quick reference table Key takeaways
  • The kube-apiserver serves resources organized by group and version: core resources under api/v1, named API groups under apis/<group>/<version>.
  • Named API groups are how Kubernetes adds functionality and newer APIs (e.g., apps, networking.k8s.io, storage.k8s.io).
  • Each resource exposes standard verbs (get, list, create, delete, update, watch); authorization is evaluated against these verbs and resources.
  • Use kubectl proxy for convenient, authenticated access to the API server from your workstation.
A dark-themed diagram titled "Key Takeaways" illustrating Kubernetes API structure and groups (e.g., /apis, /apps, /networking.k8s.io, /certificates.k8s.io). It also shows resources like /deployments, /replicasets, /statefulsets and common verbs such as list, get, create, delete, update and watch.
Authorization builds on this model: policies allow or deny users based on API group, resource, and verb. For detailed API documentation, see the Kubernetes API reference: https://kubernetes.io/docs/reference/ and the general docs: https://kubernetes.io/docs/.

Watch Video