Kubernetes Architecture

What is Kubernetes architecture?

Kubernetes (K8s) is an open-source container orchestration platform that automates deployment, scaling, and management of containerised applications. It abstracts away the underlying infrastructure and provides a declarative API for defining desired state.

Architecture Overview

Control Plane
├── kube-apiserver     (API gateway for all K8s operations)
├── etcd               (distributed key-value store for cluster state)
├── kube-scheduler     (assigns pods to nodes)
└── kube-controller-manager (runs reconciliation loops)

Worker Nodes
├── kubelet            (node agent, runs and monitors pods)
├── kube-proxy         (network rules, Service routing)
└── Container Runtime  (containerd, CRI-O  -  runs containers)

Control Plane Components

kube-apiserver

The front-end for the Kubernetes control plane. All interactions (kubectl, other controllers, nodes) go through the API server. It validates and persists state to etcd, and is the only component that talks directly to etcd.

etcd

Distributed key-value store using the Raft consensus algorithm. Stores all cluster state: node list, pod specs, config maps, secrets, service definitions. etcd is the single source of truth - if etcd is lost, the cluster state is lost.

kube-scheduler

Watches for newly created pods with no assigned node and assigns them based on:

• Resource requests/limits (CPU, memory)
• Node affinity/anti-affinity rules
• Taints and tolerations
• Pod topology spread constraints

kube-controller-manager

Runs multiple controller loops in a single binary:

• Deployment controller: ensures desired replicas match running replicas
• ReplicaSet controller: manages pod count
• Node controller: detects node failures and evicts pods
• Service Account controller: creates default service accounts

Worker Node Components

kubelet

An agent running on every worker node. Communicates with the API server, reads pod specs assigned to its node, and ensures the described containers are running and healthy. Reports node and pod status back to the control plane.

kube-proxy

Maintains network rules on each node to implement Kubernetes Service abstraction. Routes traffic to pod IPs based on Service selectors. Uses iptables or IPVS for routing rules.

Container Runtime

The software that runs containers (previously Docker, now typically containerd or CRI-O). Implements the Container Runtime Interface (CRI) that kubelet uses.

Pod Scheduling

When you create a Deployment:

1. kubectl sends spec to API server
2. API server persists to etcd
3. Deployment controller creates ReplicaSet
4. ReplicaSet controller creates Pod objects (in Pending state)
5. Scheduler watches for Pending pods -> assigns to suitable node -> updates pod spec with nodeName
6. Kubelet on that node watches for pods assigned to it -> pulls image -> starts container
7. Kubelet updates pod status to Running

Key Abstractions

Object	Purpose
Pod	Smallest deployable unit; 1+ containers
Deployment	Manages pod replicas + rolling updates
Service	Stable network endpoint for pods
ConfigMap	Non-sensitive configuration data
Secret	Sensitive data (base64-encoded; use encryption at rest)
Namespace	Virtual cluster / resource isolation
Ingress	HTTP routing rules to Services
PersistentVolumeClaim	Requests for persistent storage

Control Plane High Availability

For production, run the control plane in HA mode:

• Multiple API server replicas (stateless, load balanced)
• etcd cluster with 3 or 5 nodes (Raft quorum)
• Multiple scheduler + controller instances (only one active via leader election)

Interview Angle

Kubernetes architecture questions are common in cloud/DevOps interviews. Be able to trace a kubectl apply through the system: API server -> etcd -> controller manager -> scheduler -> kubelet. Explain why etcd is critical (it's the source of truth). Explain the role of each control plane component without confusing them.