Kubernetes
Beginner 15 min read Kubernetes

Kubernetes Architecture & the Control Plane

Declarative infrastructure with a reconciler brain

Kubernetes is a control plane + worker nodes: the API server is the source of truth, controllers reconcile desired vs current state, and the scheduler places Pods. Managed offers (EKS, AKS, GKE) run this for you.

api serveretcdschedulercontroller managerkubeletcontrol planenode
Prerequisites: Container Fundamentals
Before we start

What you will learn

  • Name the control-plane components and their jobs
  • Explain the reconciliation loop with a Deployment example
  • Understand what managed Kubernetes (EKS/AKS/GKE) gives you
In 60 seconds

You declare desired state (Deployment: 3 replicas of image X). The apiserver persists it in etcd; controllers watch and reconcile; the scheduler picks nodes; kubelets on each node run containers and report status. Managed plans hide the control plane and run a trusted version.

Introduction

What is this?

Control plane: kube-apiserver (REST, authN/authZ, validation, persists to etcd), etcd (key-value store of cluster state), kube-controller-manager (Deployment, Node, endpoints… 100s of controllers), kube-scheduler (filters+ranks pods). Worker: kubelet (node agent, runs Pods, health), kube-proxy, CRI runtime (containerd), CSI/CNI plugins. Workload layers: Pod (atomic scheduling unit, shared netNS), ReplicaSet, Deployment (rollout manager). Interaction: kubectl → apiserver → etcd/controller/scheduler → kubelet → runtime. Reconciliation: desired == current loop.

Motivation

Why do you need it?

  • No orchestration = drift: desired-vs-actual diverges and nothing fixes it.
  • The API server is a single, auditable interface — everything else is a client of it.
  • Multiple controllers own distinct concerns; nobody owns 'everything' and botches it.
  • Managed control planes have HA, upgrades and TLS rotation done for you.
Think about it

Mental model

Imagine

An airline's flight operations center

Think of

Kubernetes control plane

Dispatch (controller manager) tracks that every scheduled flight (Pod) has a crew (replica); the tower (scheduler) assigns gates (nodes); logs (etcd) are the paper trail for everything.

Mechanics

How it works

  • kubectl create -f deployment.yaml → apiserver validates + writes object to etcd.
  • Deployment controller sees desired 3 replicas, current 0 → creates ReplicaSets.
  • Scheduler filters unschedulable nodes, picks targets, writes binding.
  • kubelet on target node pulls image, runs container, reports Ready + metrics.
  • If a node dies, controllers detect missing replicas and re-schedule to keep desired state.

Control plane → nodes.

kubectl
apiserver
scheduler
controllers
kubelet
runtime/CNI/CSI
Hands-on

Examples

Declare and watch reconciliation

Declare and watch reconciliation
kubectl create deployment nginx --image=nginx:1.27 --replicas=3
kubectl get deploy,rs,pods
kubectl rollout status deploy/nginx
kubectl scale deploy/nginx --replicas=5   # controller makes it so
kubectl get pods -w

Every command is a declaration the controllers then reconcile — the mechanism behind 'it keeps 3 replicas up'.

Real world

In production

  • EKS/AKS/GKE cluster per environment with node pools and managed addons.
  • GitOps: desired state in git, ArgoCD/Flux reconciles the cluster to it.
  • RBAC + namespaces segment teams so each human/CI touches their own world.
Guidelines

Best practices

  • Declare everything as code (kubectl apply -f / GitOps); avoid imperative surgery.
  • Keep Control plane upgrades on managed cadence; test against a dev cluster first.
  • Give every workload resource requests/limits — noisy-neighbor leaks otherwise.
  • Backup etcd (or rely on managed) and rehearse restore before the real apology.
Watch out

Common mistakes

  • Interacting live with kubectl edit as the only change record.
  • Believing 'it's managed' means zero control-plane responsibility (policies, upgrades still matter).
  • Running etcd unsupported or losing quorum to a host crash.
  • Scheduling critical workloads with no requests/limits and without topology spread.
When things break

Debugging tips

  • kubectl get events -A and describe <pod> surface most reconcile reasons.
  • Control plane down → apiserver unreachable: check etcd health, not node ping.
  • Rollout stuck → Examine the Deployment's status fields, ReplicaSet, and pod events in that order.
  • Use kubectl get --raw=/healthz to sanity-check API server quickly.
Interviews

Interview checkpoint

Practice

Hands-on lab

Spin a Cluster and Watch Reconcile
40 min · beginner
In progress
Objectives
  • Bring up a local cluster (kind/k3s) or a managed one (EKS/AKS/GKE)
  • Deploy a workload and scale it
  • Observe controller reconciliation in events/status

Spin a Cluster and Watch Reconcile

40 min · beginner

0/4 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

Which component runs Pods on a node?

2

Cluster desired state is persisted in etcd, written only through the API server.

Go deeper

Official documentation

Kubernetes Components
docs
The reconciliation loop
docs