Node Components

Node Component Overview

Every worker node in a Kubernetes cluster runs a set of agents that manage containers, networking, and storage. These components receive instructions from the control plane and execute them locally. Understanding them is essential for debugging node-level issues.

kubelet

kubelet is the primary node agent. It watches for Pods assigned to its node and ensures the containers described in those Pods are running and healthy. kubelet communicates with the container runtime through CRI (Container Runtime Interface) to pull images, create containers, and manage their lifecycle.

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
authorization:
  mode: Webhook
clusterDomain: cluster.local
clusterDNS:
- 10.96.0.10
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: "15m"
shutdownGracePeriod: "30s"
tlsCertFile: /var/lib/kubelet/pki/kubelet.crt
tlsPrivateKeyFile: /var/lib/kubelet/pki/kubelet.key

kube-proxy

kube-proxy maintains network rules on each node. It implements the Service abstraction by translating ClusterIP, NodePort, and LoadBalancer Services into iptables or IPVS rules that route traffic to the correct pods. It is being replaced by eBPF-based solutions like Cilium in modern clusters.

apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-proxy
  namespace: kube-system
data:
  config.conf: |
    mode: "ipvs"
    ipvs:
      scheduler: "rr"
      syncPeriod: "30s"
      strictARP: true
    conntrack:
      maxPerCore: 131072
      tcpEstablishedTimeout: "86400s"
    metricsBindAddress: "0.0.0.0:10249"

Container Runtime Interface

CRI is the standard interface between kubelet and container runtimes. It defines the gRPC API for image service and runtime service. Common CRI implementations include containerd (most common) and CRI-O. Docker (dockershim) was removed from Kubernetes in v1.24.

version = 2

[plugins."io.containerd.grpc.v1.cri"]
  sandbox_image = "k8s.gcr.io/pause:3.9"

[plugins."io.containerd.grpc.v1.cri".containerd]
  default_runtime_name = "runc"

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
  runtime_type = "io.containerd.runc.v2"

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
  SystemdCgroup = true

Container Networking Interface

CNI is the plugin-based networking standard. Each node runs a CNI plugin that assigns IPs to pods, sets up routes, and creates network interfaces. Popular CNI plugins include Calico (policy + networking), Cilium (eBPF), Flannel (simple overlay), and Weave (encrypted mesh).

apiVersion: v1
kind: ConfigMap
metadata:
  name: cni-config
  namespace: kube-system
data:
  cni_network_config: |
    {
      "cniVersion": "0.4.0",
      "name": "cilium",
      "plugins": [
        {
          "type": "cilium-cni",
          "enable-endpoint-health-check": true,
          "enable-health-checking": true,
          "log-file": "/var/run/cilium/cilium-cni.log"
        }
      ]
    }

Container Storage Interface

CSI is the standard for integrating storage systems with Kubernetes. CSI drivers handle volume creation, attachment, mounting, snapshots, and expansion. Each storage vendor (AWS EBS, GCE PD, Azure Disk, Ceph) provides its own CSI driver.

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: ebs.csi.aws.com
spec:
  attachRequired: true
  podInfoOnMount: true
  fsGroupPolicy: File
  volumeLifecycleModes:
  - Persistent
  - Ephemeral