Cluster Architecture (CKA)

Follow one kubectl apply through every component until a container is running.

An interactive Kubernetes lesson: 23 steps, about 32 minutes, on a live simulation in your browser.

Your shop's frontend, web, needs a backend. You write a Deployment for three api pods and run kubectl apply -f api.yaml. A few seconds later three containers are running on two machines and web's requests come back 200.

Look at what you did not do. You did not pick a machine. You did not pull an image or start a process. You did not give anything an IP address.

What you will learn

1. One command, many hands

   • One command, three running pods: kubectl starts nothing. It hands over a description of what you want, and a chain of independent programs makes it true.
   • The API server is the only door: Every component is a client of the API server. They never talk to each other; they read and write shared objects.
   • etcd remembers, and only etcd: spec is what you asked for, status is what is true. The cluster's whole job is to keep making status match spec.

2. The loops that do the work

   • Who replaces a dead pod?
   • Reconciliation: compare, then act: A controller is a loop: read desired, read actual, act on the difference. It reacts to the state, not to the event.
   • Who picks the node?
   • The scheduler writes one field: The scheduler starts nothing. It fills in spec.nodeName, and the kubelet on that node takes it from there.

3. On the node

   • The kubelet: the agent on every node: The kubelet is the only component that touches containers. Everything above it only edits objects.
   • The kubelet on node-b stops
   • Break it: five minutes of silence
   • The kubelet is a systemd service
   • Static pods: who starts the API server?: A static pod is a file on a node. The kubelet runs it because the file exists, with or without an API server.
   • Delete a mirror pod

4. CRI, CNI, CSI

   • CRI: the kubelet does not run containers: CRI is the kubelet's contract with the runtime: pull this image, make this sandbox, start this container. Any runtime that speaks it fits.
   • Break it: no network plugin: CNI answers one question for the runtime: this sandbox needs an IP and a route. No plugin means no pod network and a NotReady node.
   • Break it: a claim nobody answers: CSI lets a storage vendor plug in without changing Kubernetes: create the volume, attach it to the node, mount it in the pod.
   • Three sockets for other people's code: Kubernetes decides what should exist. CRI, CNI and CSI are the sockets where someone else's code makes it real.

5. When the control plane goes dark

   • The API server goes down: The control plane decides, the nodes run. Lose the control plane and the nodes keep doing the last thing they were told.
   • Break it: debugging without kubectl
   • Drill: find the dead container
   • Drill: ask the kubelet why

6. Recap & playground

   • Cheat sheet
   • Playground