The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Kubernetes orchestrates containers, but it does not act as one central program that directly runs every container. Its defining pattern is reconciliation: controllers and node agents repeatedly compare declared intent with observed conditions, then take steps toward the intended state. The distinction explains why an accepted API change is not the same as a completed rollout—and why the component that creates a Pod is not necessarily the component that runs its containers.
What Kubernetes reconciliation means
A Kubernetes resource commonly separates intent from observation. Its spec expresses desired state; its status reports what a controller or agent has observed about progress or current conditions. Reconciliation is the repeated process of observing state and acting to reduce the difference between the desired and current state.
As an Amazon Associate I earn from qualifying purchases.
Kubernetes describes controllers as control loops that watch cluster state and make or request changes when needed. The thermostat analogy is useful: a setting represents the target, a sensor reports the current temperature, and the thermostat acts to close the gap. Kubernetes is more distributed than a thermostat: separate loops handle different resources and actions, and one loop’s change can prompt work by another.
Reconciliation is not a single transaction with a guaranteed instant finish. Controllers act asynchronously, observations can lag, and a cluster may keep changing rather than reach one permanently stable global state.
#1 Best Overall
Who does what when a workload is created?
The distinction between a controller and a container runtime becomes clear in the path from a workload resource to a running container.
| Component | What it watches or receives | What it changes or does |
|---|---|---|
| Job controller | Job objects describing the requested work | Creates Pods to carry out the Job; it does not itself run those Pods or their containers. |
| Kubelet on a node | Pods assigned to that node and their specifications | Runs a node-level sync loop and works to bring the local Pod state toward the specification. |
| Container runtime | Requests from the kubelet through the Container Runtime Interface (CRI) | Performs local runtime operations, including creating a Pod sandbox and starting the specified containers. |
The API server is the coordination point through which controllers typically read and update Kubernetes resources. The kubelet is the primary agent on each node: it queues work for assigned Pods and invokes Pod synchronization logic. In Kubernetes documentation, the kubelet’s sync loop periodically reconciles a Pod specification with the actual state of running containers.
The kubelet also observes container lifecycle changes through its Pod Lifecycle Event Generator. Because this observation involves polling, the API-reported status can trail what has just happened on a node. A status field is therefore a report from a particular component, not necessarily a perfectly instantaneous view of the whole system.
Why Kubernetes uses many control loops
A single monolithic manager would have to handle many distinct kinds of desired state and operational work. Kubernetes instead uses specialized controllers, each responsible for an aspect of cluster state. One controller may watch one resource kind and manage another; different controllers can also work with the same resource kind, using ownership relationships and labels to distinguish what they manage.
Rank #3
Built-in controllers run in the control plane’s kube-controller-manager. Custom controllers can run as Pods or outside the cluster. Their implementations differ, but the pattern is similar: watch relevant state, take actions within the controller’s scope, and report results where applicable.
Custom resources extend the pattern
A custom resource adds an API for a domain-specific kind of desired state; it does not provide the behavior by itself. A controller must implement what happens when that resource is created or changed. The Kubernetes v1.35 documentation describes this controllers pattern as keeping current object state in sync with declared desired state. Depending on the controller, the work may involve Kubernetes objects, external infrastructure, or both.
Controllers are not limited to starting workloads. Kubernetes documents controllers that read desired state from the API server, communicate with an external system such as infrastructure services, and report resulting state back. A CNCF article dated January 18, 2024, likewise discusses GitOps and mutating-policy controllers as declarative control loops. The broader pattern is about coordinating desired state, not just launching containers.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat this means when operating a cluster
- An accepted change is not proof of completion. A successful API request means the change was accepted; reconciliation may still be in progress, or a controller may encounter a problem.
- Check resource-specific status and conditions. Use the status information provided by the relevant resource and controller to understand progress. There is no one status field that means the same thing across every Kubernetes API.
- Allow for observation delay. In particular, kubelet polling means reported status can lag immediate node reality.
- Identify a controller’s scope. Find out which resource it watches and what it owns or changes. Multiple controllers may act on the same kind of resource while managing different objects or responsibilities.
- Treat custom resources as APIs, not automatic behavior. The custom resource describes intent; its controller supplies the logic that acts on it.
- Account for external dependencies when a controller crosses system boundaries. If it calls an external service, network access, credentials, provider behavior, and cleanup may affect whether reconciliation succeeds. The details depend on that controller.
“Self-healing” can describe the result when a controller replaces or corrects something within its remit. It is not a promise that Kubernetes will automatically repair every failure: a controller can only take the actions it was designed and authorized to take.
Best Value
Why “container manager” is too narrow
Kubernetes is a container orchestration system, but orchestration is not the same as directly managing each container in one place. The API expresses intent; specialized controllers coordinate resource changes; kubelets reconcile Pods on individual nodes; and runtimes carry out local container operations through CRI. Other controllers may manage external systems instead.
Thinking in terms of reconciliation gives a more useful operational question than “Which Kubernetes component runs this container?” Ask instead: which resource declares the desired state, which controller watches it, what does that controller change, which node agent or external system acts next, and where is progress reported?
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
