1. Control Plane vs. Worker Nodes
A Kubernetes cluster consists of two main layers: the Control Plane, which coordinates cluster state and schedules containers, and the Worker Nodes, which host the running containers.
The Control Plane makes global decisions about the cluster (such as scheduling pods), detects cluster events, and responds to updates (like spinning up replicas when scale conditions are met).
2. Control Plane Components
The Control Plane runs several critical processes:
- kube-apiserver: The entrypoint of the cluster, exposing a REST API. All internal components and clients communicate exclusively through it.
- etcd: A highly available, distributed key-value database that stores the authoritative configuration and state of the cluster, utilizing the Raft consensus protocol.
- kube-scheduler: Matches newly created pods to optimal worker nodes by applying filters (checking memory, CPU, port availability) and scores (ranking node fitness).
- kube-controller-manager: Runs controller reconciliation loops (Node Controller, Replica Controller) that match current cluster states to desired states.
# Pod definition manifest
apiVersion: v1
kind: Pod
metadata:
name: secure-web
labels:
app: production
spec:
containers:
- name: web
image: nginx:alpine
resources:
limits:
memory: "256Mi"
cpu: "500m"3. Worker Node Daemons
Worker nodes run daemons that monitor the host and execute containers:
- kubelet: An agent that listens for instructions from the api-server. It ensures the container runtime spawns containers exactly matching PodSpecs.
- Container Runtime: The engine (like containerd or CRI-O) that manages the lifecycle of container sandboxes.
- kube-proxy: Manages virtual IP routing on each node by setting up iptables or IPVS netfilter rules, routing client requests dynamically to pod targets.
4. Network Interconnection & CNIs
Kubernetes requires that every pod gets a unique cluster-wide IP address, and pods must communicate with each other across nodes without NAT. This flat networking model is provisioned by Container Network Interface (CNI) plugins like Calico, Flannel, or Cilium.
Advanced CNIs like Cilium leverage eBPF inside the Linux kernel to bypass traditional iptables checks, optimizing packet routing speed and enforcing security policies directly inside kernel network sockets.
Written by Ajit KumarCloud & Security Specialist
BCA cloud computing and security student, studying kernel namespaces, networking protocols, security pipelines, and competitive programming solutions.