KCNA Ep 2: Kubernetes Fundamentals & Architecture

TL;DR (Quick Summary)

#

• Control Plane: kube-apiserver (API gateway), etcd (state storage), kube-scheduler (node assignment), kube-controller-manager (reconciliation loops).
• Worker Node: kubelet (node agent), kube-proxy (L4 network rules), containerd (container runtime).
• Declarative API: You specify what you want in YAML, and controllers continually work to make actual state match desired state.

1. Control Plane & Worker Node Topology

#

graph TD
    Client["kubectl / HTTP Client"] -->|HTTPS REST :6443| APIServer["kube-apiserver"]

    subgraph ControlPlane ["Control Plane (Master Node)"]
        APIServer <--> ETCD[("etcd Storage")]
        APIServer <--> Scheduler["kube-scheduler"]
        APIServer <--> ControllerManager["kube-controller-manager"]
    end

    subgraph WorkerNode ["Worker Node"]
        Kubelet["kubelet agent"] <--> APIServer
        Kubelet <--> Runtime["containerd"]
        KubeProxy["kube-proxy"] <--> APIServer
    end

2. Control Plane Components Breakdown

#

1. kube-apiserver

#

• Role: The central management hub and front-door of the Kubernetes cluster.
• Key Characteristics:
  • Exposes the Kubernetes REST API (default port 6443).
  • Evaluates authentication (certificates, bearer tokens), authorization (RBAC), and admission control webhooks.
  • Stateless: Scale horizontally across multiple control plane nodes.
  • The ONLY component in the entire cluster that communicates directly with etcd.

2. etcd

#

• Role: Consistent, highly-available key-value store holding the complete state and configuration of the cluster.
• Key Characteristics:
  • Uses the Raft consensus algorithm to ensure strong consistency (CP in CAP theorem).
  • All cluster data (Pod specs, Secrets, ConfigMaps, Node statuses) is persisted here.
  • Critical Operations: Requires regular snapshot backups (etcdctl snapshot save) for disaster recovery.

3. kube-scheduler

#

• Role: Responsible for assigning newly created Pods to appropriate Worker Nodes.
• Decision Criteria:
  • Evaluates node resource capacity (CPU, Memory).
  • Checks constraints: nodeSelector, nodeAffinity, taints & tolerations, and anti-affinity rules.
  • Note: The scheduler does not run or launch the containers; it simply updates the Pod’s spec.nodeName field in etcd.

4. kube-controller-manager

#

• Role: Runs continuous control loops (reconciliation loops) that regulate cluster state.
• Reconciliation Loop: $$\text{Actual State} \neq \text{Desired State} \implies \text{Take Corrective Action}$$
• Built-in Controllers: Node Controller, Deployment Controller, ReplicaSet Controller, ServiceAccount Controller.

3. Worker Node Agents Breakdown

#

1. kubelet

#

• Role: The primary node-agent running on every worker node.
• Responsibilities:
  • Watches the API Server for PodSpecs assigned to its local node.
  • Instructs the container runtime (containerd) to pull images and start/stop containers.
  • Executes container health checks (liveness, readiness, startup probes).
  • Reports local node status and resource usage back to the API Server.

2. kube-proxy

#

• Role: Network proxy running on each node, maintaining network rules (iptables or IPVS).
• Responsibilities:
  • Implements the Kubernetes Service abstraction.
  • Forwards TCP/UDP traffic sent to a Service IP (ClusterIP) directly to backing Pod IP addresses.

4. Key KCNA Exam Practice Questions

#

Question 1

#

Which control plane component is the ONLY one authorized to read from and write directly to the etcd database?

• A) kube-scheduler
• B) kube-apiserver (Correct)
• C) kubelet
• D) kube-controller-manager

Rationale: To preserve data consistency and security, all components must interact with etcd indirectly through the API Server REST interface.

Question 2

#

What consensus protocol does etcd use to ensure consistent data replication across control plane nodes?

• A) Paxos
• B) Gossip
• C) Raft (Correct)
• D) Two-Phase Commit (2PC)

Rationale: etcd uses the Raft consensus algorithm to maintain leader election and log replication.

Summary & Next Steps

#

In this episode, we covered:

• Control plane components (apiserver, etcd, scheduler, controller-manager).
• Worker node agents (kubelet, kube-proxy, containerd).
• How kube-apiserver acts as the single gateway to etcd.

In KCNA Episode 3: Container Orchestration & Workload Primitives, we will explore Pods, Deployments, StatefulSets, DaemonSets, Jobs, and Services!