Free tools Windows power users keep installed
One-click scans. No signup required.
Step 08 of Kubernetes the Hard Way brings up the control plane on the controller machine: the API server, controller manager and scheduler. It also configures the API server to access worker kubelet APIs. The steps below follow the guide’s paths and commands; they describe that lab’s layout, not a universal Kubernetes installation method.
What the three control-plane components do
The Kubernetes project describes the API server as “the front end for the Kubernetes control plane.” The other components have distinct jobs: the scheduler chooses placement for eligible pods, while controllers repeatedly reconcile observed cluster state with desired state. etcd remains the consistent, highly available key-value backing store for cluster data.
As an Amazon Associate I earn from qualifying purchases.
API server: the Kubernetes API
kube-apiserver exposes the Kubernetes API through which clients and components interact with the cluster. In this guide, the controller machine serves that API on port 6443. The API server is not the backing store: the guide’s architecture uses etcd for cluster data.
Recommended Free Tools
Scheduler: choose a node for an unscheduled pod
kube-scheduler watches for newly created pods that do not yet have a node assignment. It selects a node, taking the pod’s resource requirements and constraints into account. The scheduler determines placement; it does not perform the API server’s API-handling role.
#1 Best Overall
Controller manager: run reconciliation loops
kube-controller-manager runs multiple controller processes compiled into one binary. Controllers are control loops, not a catch-all for everything the other components do. For example, the node controller notices and responds when nodes go down, and the job controller creates pods for Job objects.
etcd: keep cluster data
In this architecture, etcd is the consistent, highly available key-value store for Kubernetes cluster data. A cluster that uses etcd as its backing store needs a plan for backing it up.
These responsibilities and the architecture are described in the Kubernetes project’s Cluster Architecture documentation.
What Step 08 installs and configures
The Kubernetes the Hard Way Step 08 guide installs the three control-plane binaries and kubectl on the controller, configures credentials and service units, then starts and verifies the services. Its file locations and service commands belong to this guide’s deployment layout; other Kubernetes deployments may use different tooling and paths.
Rank #3
- Control-plane binaries and
kubectlgo in/usr/local/bin. - API-server certificates and encryption configuration go under
/var/lib/kubernetes. - Controller-manager and scheduler kubeconfigs are installed for their respective services.
- Scheduler configuration goes under
/etc/kubernetes/config. - Systemd unit files define the API server, controller manager and scheduler services.
After installing the files, the guide reloads systemd, enables and starts the three services, checks their state, and verifies the API with kubectl cluster-info --kubeconfig admin.kubeconfig. Use the exact unit names and commands in the guide for this lab rather than assuming its layout matches a different installation.
Authorize the API server to reach worker kubelets
The API server also needs permission to access worker kubelet APIs for tasks such as retrieving metrics and logs or executing commands in pods. Step 08 applies a ClusterRole and binding from kube-apiserver-to-kubelet.yaml. The setup uses kubelet webhook authorization, which consults SubjectAccessReview for authorization decisions. Kubernetes documents the RBAC mechanism in its Using RBAC Authorization reference; the specific role and binding come from the lab guide.
Verify that the API server is reachable over TLS
The guide checks the control plane with kubectl cluster-info --kubeconfig admin.kubeconfig. It also demonstrates a direct HTTPS request using the CA certificate:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutecurl --cacert ca.crt https://server.kubernetes.local:6443/versionThe guide’s sample response identifies Kubernetes v1.32.3, build date 2025-03-11, and platform linux/arm64. That is example output from the guide, not a statement of the latest Kubernetes release or a recommendation for what to install today.
Best Value
Troubleshoot an API-server bind error
In a Step 08 lab note published on 2026-09-23, Luger Lex Pit-og reported that kube-apiserver restarted after failing to bind 0.0.0.0:6443. On that machine, an earlier k3s installation had left k3s-server holding the port. The author stopped and disabled the leftover service, after which the API server started. This is one lab’s incident, not a general explanation for API-server startup failures.
- Inspect the service state with
systemctl status kube-apiserver. - Read recent service logs with
journalctl -u kube-apiserverand look for the exact bind error and address. - Check which process is listening on the reported port using a listener-inspection tool available on the controller, such as
ssorlsof. - Identify whether the process or service is intentional before stopping it. If it is a leftover service you no longer need, stop and disable that service, then recheck the API-server unit.
The incident and the author’s wording of the learning question—“what each of these components is for”—are from Luger Lex Pit-og’s Step 08 lab notes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
