Kubernetes Architecture
1 - Overview
The Kubernetes architecture is made up of two types of nodes: the Control Plane and the Worker Nodes.
2 - Control Plane
The Control Plane is the "brain" of the cluster. It makes all global decisions and detects/responds to cluster events.
2.1 API Server (kube-apiserver)
The single entry point for all communication with the cluster.
Characteristics:
- Exposes the Kubernetes REST API
- The only component that communicates with etcd
- Entry point for kubectl, dashboard, SDK
- Handles authentication and authorization
2.2 etcd
A distributed key-value database that stores the entire cluster state.
# Exemple de données stockées dans etcd
# Clé: /registry/deployments/default/nginx
{
"apiVersion": "apps/v1",
"kind": "Deployment",
"metadata": {
"name": "nginx",
"namespace": "default",
"uid": "abc123..."
},
"spec": {
"replicas": 3
}
}
Characteristics:
- Highly available storage
- Raft consensus for consistency
- Critical backup to plan for
- Performance: < 10ms latency recommended
2.3 Scheduler (kube-scheduler)
Responsible for assigning Pods to Nodes.
Scheduling criteria:
| Criterion | Description |
|---|---|
| Resources | Available CPU and memory |
| Taints/Tolerations | Restrictions on nodes |
| Node Affinity | Placement preferences |
| Pod Affinity | Co-locating Pods |
| Pod Anti-Affinity | Separating Pods |
2.4 Controller Manager (kube-controller-manager)
Runs the controllers that regulate the cluster state.
Main controllers:
- Deployment Controller: Manages Deployments and ReplicaSets
- ReplicaSet Controller: Maintains the desired number of Pods
- Node Controller: Monitors node health
- Job Controller: Manages Jobs and CronJobs
- Endpoint Controller: Populates Endpoints objects
2.5 Cloud Controller Manager
The interface between Kubernetes and the cloud provider APIs.
# Exemple : LoadBalancer Service sur AWS
apiVersion: v1
kind: Service
metadata:
name: mon-service
annotations:
# Annotations spécifiques AWS
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
spec:
type: LoadBalancer # Le CCM crée un ELB/NLB
ports:
- port: 80
selector:
app: mon-app
3 - Worker Nodes
Worker Nodes run the containerized applications.
3.1 Kubelet
An agent that runs on each node and ensures the containers are running in the Pods.
Kubelet functions:
- Receives PodSpecs from the API Server
- Ensures the described containers are running
- Mounts the volumes
- Runs the health probes
- Reports the state to the Control Plane
3.2 Kube-Proxy
Manages the network rules on each node.
Proxy modes:
| Mode | Description | Performance |
|---|---|---|
| iptables | Linux iptables rules | Good |
| IPVS | IP Virtual Server | Excellent |
| userspace | Userspace proxy | Low (legacy) |
3.3 Container Runtime
The software responsible for running the containers.
4 - Communication within the cluster
4.1 Communication flow
4.2 Important ports
| Component | Port | Protocol | Description |
|---|---|---|---|
| API Server | 6443 | HTTPS | Kubernetes API |
| etcd | 2379-2380 | HTTPS | Client and peer |
| Kubelet | 10250 | HTTPS | Kubelet API |
| Kube-Proxy | 10256 | HTTP | Health check |
| NodePort Services | 30000-32767 | TCP/UDP | Exposed services |
5 - High availability
5.1 Control Plane HA
5.2 HA best practices
| Component | Minimum HA | Recommended Production |
|---|---|---|
| Control Plane Nodes | 3 | 3 or 5 |
| etcd Members | 3 | 3 or 5 (odd) |
| Worker Nodes | 2+ | Based on load |
| Availability zones | 2 | 3 |
6 - Essential add-ons
6.1 DNS (CoreDNS)
Provides DNS resolution for Services.
# Exemple de résolution DNS
# Service: mon-service.default.svc.cluster.local
apiVersion: v1
kind: Service
metadata:
name: mon-service
namespace: default
spec:
selector:
app: mon-app
ports:
- port: 80
6.2 Networking (CNI)
CNI plugins manage network connectivity:
| Plugin | Characteristics |
|---|---|
| Calico | Network Policies, BGP |
| Cilium | eBPF, observability |
| Flannel | Simple, VXLAN overlay |
| Weave | Encryption, simplicity |
6.3 Dashboard
A web interface to manage the cluster:
# Installation du Dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
# Accès via proxy
kubectl proxy
# http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/
Summary
In this chapter, we explored:
- Control Plane: API Server, etcd, Scheduler, Controller Manager
- Worker Nodes: Kubelet, Kube-Proxy, Container Runtime
- Communication: Flow between components and ports used
- High availability: Multi-master configuration
- Add-ons: DNS, CNI, Dashboard
Next step
In the next chapter, we will install Kubernetes using different methods: Minikube, Kind, and kubeadm.