Interactive · Kubernetes architecture

Five pieces — five ways of working

Stage 1 / 6

Tip click a numbered piece on the map, or step with the ← / → arrows.

The five pieces of Kubernetes around the control plane core etcd and kube-apiserver form the control plane core in the centre. Webhooks sit above it (apiserver calls them synchronously); controllers sit to the left and node agents to the right (both hold watch connections); plugins sit far right and are invoked locally by node agents, never by apiserver. Stepping isolates one piece at a time and lights its connection. call + wait watch watch exec / socket Webhooksaws-iam-authIRSA webhookIstio injector Control plane corekube-apiserverthe one dooretcdall state Controllerskube-schedulerassigns nodesReplicaSet ctrlkeeps N podsKarpenterprovisions nodes Node agentskubeletruns the podkube-proxyservice routingipamdhands out IPs Pluginscontainerdruncaws-cniebs-csi-node
Legend control plane core webhooks controllers node agents plugins

How to read this

    Read-outs · this piece

    Lifecycle

    —

    —

    Told about work by

    —

    —

    Who invokes it

    —

    —

    Talks over

    —

    —

    The five pieces, side by side

    The real dividing lines: continuous loop vs one-shot call, and network-watched vs locally-invoked.

    PieceLifecycleTold about work byWho invokes itTalks overExamples
    Control plane coreAlways up — the hubIt is the stateEverything, through apiserverHTTPS API; etcd stays privateetcd, kube-apiserver
    WebhooksOne-shot · per requestAuth: startup flag (static) · Admission: watched API object (dynamic)kube-apiserverHTTPS, synchronous — apiserver blocksaws-iam-auth, IRSA webhook, Istio injector
    ControllersContinuous · never completesWatch subscription (Informer cache) + periodic resyncNothing — self-drivenWatch stream in; writes back through apiserverkube-scheduler, ReplicaSet ctrl, Karpenter
    Node agentsContinuous · one per nodeStartup config + watch (its own node's pods)Nothing — a daemonWatch apiserver; exec/socket to pluginskubelet, kube-proxy, ipamd
    PluginsOne-shot · per callFile/socket discovery, locallyA node agent — never apiserverexec (CNI) · local gRPC socket (CSI/CRI)containerd, runc, aws-cni, ebs-csi-node