What's calling an API

[jedihomer]

Is there a way to work out what's calling an API?

All our GKE clusters are now not auto upgrading as they are using deprecated APIs.  In our case, all are calling

/apis/rbac.authorization.k8s.io/v1beta1/roles

At around 03:50 in the morning.   So this is some sort of automated system that must be calling them.  I've inherited the clusters/projects so didn't set them up, but we're mainly using just deployments/configmaps/secrets/ingres.  All the manifests are up-to-date  and don't reference and roles etc.

Deployments are done, usually during the day, via Helm or Kubectl, as the timings don't match up, I don't believe this culprit.

So then we're left with the kube-system namespace, which I assumed (possibly wrongly) is managed by GKE so cluster upgrades etc would keep these up-to-date.

So where should I be looking to find out what's calling this API so that it can be either upgraded, stopped or some other remedy so that we can continue upgrading the clusters etc.

Any help would be apreciated.

[cristianrm]

As shown in the documentation Locating API clients writing to deprecated APIs:

Clusters with Google Cloud's operations suite enabled can use the following Admin Activity log query to show the use of 1.22 deprecated APIs by users that are not Google-managed:

resource.type="k8s_cluster"
labels."k8s.io/removed-release"="1.22"
protoPayload.authenticationInfo.principalEmail:("system:serviceaccount" OR "@")
protoPayload.authenticationInfo.principalEmail!~("system:serviceaccount:kube-system:")

[jedihomer]

Ah, I'd meant to put in the initial post;  The cluster page shows:

APITotal calls (last 30 days)Last called

/apis/rbac.authorization.k8s.io/v1beta1/roles

128

23 Jun 2022, 00:41:00

And running that Activity Log filter returns no responses (currently set to look back 7 days)

In the end I just upgraded staging to 1.22 and am ensuring that it all still seems to work before upgrading our Live infrastructures.

[jedihomer · Accepted solution]

As an update, they've all stopped reporting the API call, so I assume it was an internal Google thing that's since auto-updated to the new endpoints