Understanding Kubernetes Architecture
1. Understanding Control Plane Components
The control plane manages cluster state, schedules workloads, and responds to events. Runs on master nodes (typically 3+ for HA).
| Component | Role | Port |
|---|
| kube-apiserver | REST API gateway, validates and persists objects to etcd | 6443 |
| etcd | Distributed key-value store; single source of truth for cluster state | 2379-2380 |
| kube-scheduler | Assigns Pods to Nodes based on resources, affinity, taints | 10259 |
| kube-controller-manager | Runs core controllers (Node, ReplicaSet, Endpoints, ServiceAccount) | 10257 |
| cloud-controller-manager | Integrates cloud-provider APIs (LB, Routes, Volumes) | 10258 |
2. Understanding Node Components
| Component | Purpose |
|---|
| kubelet | Node agent; ensures containers in PodSpecs run and are healthy |
| kube-proxy | Maintains network rules (iptables/IPVS/nftables) for Service routing |
| Container runtime | containerd (default), CRI-O, or Mirantis cri-dockerd; implements CRI |
| CNI plugin | Calico, Cilium, Flannel — sets up pod networking |
3. Understanding Pods as Deployment Units
| Property | Description |
|---|
| Atomic unit | Smallest deployable object; 1+ tightly-coupled containers |
| Shared network | Containers share IP, port space, localhost |
| Shared storage | Containers share mounted volumes |
| Ephemeral | Pods are not self-healing; managed by controllers |
4. Understanding Services and Networking
| Type | Scope | Use Case |
|---|
| ClusterIP | Internal VIP | Default; service-to-service in cluster |
| NodePort | Each node's IP:port (30000-32767) | External access for dev/testing |
| LoadBalancer | Cloud LB | Public-facing services with cloud provider |
| ExternalName | CNAME alias | Map service to external DNS |
| Headless | clusterIP: None | Direct pod DNS for StatefulSets |
5. Understanding Workload Resources
| Resource | Use For |
|---|
| Deployment | Stateless apps; rolling updates, rollback |
| StatefulSet | Stateful apps with stable network IDs and persistent storage |
| DaemonSet | One pod per node (log agents, CNI, monitoring) |
| Job | Run-to-completion batch tasks |
| CronJob | Scheduled jobs (cron syntax) |
| ReplicaSet | Maintain replica count (managed by Deployment) |
6. Understanding Storage Abstractions
| Object | Purpose |
|---|
| Volume | Storage attached to Pod lifecycle |
| PersistentVolume (PV) | Cluster-scoped storage resource |
| PersistentVolumeClaim (PVC) | User request for storage; binds to PV |
| StorageClass | Provisioner template for dynamic PV creation |
| CSI driver | Pluggable storage backend (EBS, GCE PD, Ceph) |
| VolumeSnapshot | Point-in-time snapshot for backup/clone |
7. Understanding Configuration Resources
| Resource | Purpose | Size Limit |
|---|
| ConfigMap | Non-confidential key-value config | 1 MiB |
| Secret | Sensitive data (base64-encoded, optionally encrypted at rest) | 1 MiB |
| Downward API | Expose pod/container metadata to containers | — |
8. Understanding Namespaces and Multi-Tenancy
| Namespace | Purpose |
|---|
| default | Used when no namespace specified |
| kube-system | Control-plane components |
| kube-public | Cluster-readable resources |
| kube-node-lease | Node heartbeats (lease objects) |
| User namespaces | RBAC, quota, network-policy isolation boundaries |
9. Understanding API Resources and Extensions
| Mechanism | Use |
|---|
| CustomResourceDefinition (CRD) | Add new resource types |
| API Aggregation Layer | Extend API server with custom APIs |
| Admission Webhooks | Validate/mutate objects on write |
| Operator | Custom controller + CRD for domain logic |
10. Understanding Cluster Add-Ons
| Add-On | Function |
|---|
| CoreDNS | Cluster DNS for service discovery |
| Metrics Server | Pod/Node resource metrics for HPA/VPA |
| Ingress Controller | L7 HTTP routing (NGINX, Traefik, HAProxy) |
| Dashboard | Web UI for cluster management |
| CNI plugin | Pod networking (Calico, Cilium) |
Cluster Architecture
┌──────────── Control Plane ─────────────┐
│ api-server ←→ etcd │
│ ↑ │
│ scheduler controller-manager │
└────────────────┬───────────────────────┘
│ (kubelet ↔ apiserver)
┌─────────────┼─────────────┐
▼ ▼ ▼
Node1 Node2 Node3
kubelet kubelet kubelet
kube-proxy kube-proxy kube-proxy
[Pods] [Pods] [Pods]