Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Kubernetes architecture has two major domains: a control plane that stores desired state and makes cluster-wide decisions, and worker nodes that run Pods. The API server is the hub between users and components, etcd provides durable object storage, controllers continuously reconcile reality with the declarations, the scheduler selects a node for each eligible Pod, and the kubelet plus container runtime start and supervise its containers.
Once you understand those responsibilities and the communication boundaries between them, Kubernetes stops looking like a collection of daemons and becomes a set of cooperating control loops.
The cluster in one view
A Kubernetes cluster contains one control plane and one or more worker nodes. The control plane evaluates the cluster as a whole; nodes provide the compute where application Pods run. Development clusters may place control-plane and workload components on the same machine, while production designs commonly spread control-plane services across multiple machines and run several workers for fault tolerance.
| Layer | Component | Primary responsibility |
|---|---|---|
| Control plane | kube-apiserver | Exposes the Kubernetes HTTP API and coordinates access to cluster objects. |
| Control plane | etcd | Stores serialized Kubernetes API data in a consistent, highly available key-value store. |
| Control plane | kube-scheduler | Selects a suitable node for Pods that do not yet have a placement. |
| Control plane | kube-controller-manager | Runs built-in controllers that reconcile resources. |
| Control plane | cloud-controller-manager (optional) | Runs cloud-specific control logic when a provider integration is used. |
| Node | kubelet | Ensures containers described by PodSpecs run and remain healthy. |
| Node | Container runtime | Actually starts and stops containers for Pods. |
| Node | kube-proxy (optional) | Maintains node network rules for Services; a network plugin can provide equivalent proxying. |
| Add-ons | DNS, dashboard, monitoring, logging | Extend the core cluster with discovery, visibility and operational functions. |
The control plane: where decisions and state live
API server: the front door and hub
The API server exposes the Kubernetes API. Users, kubectl, controllers, schedulers, kubelets and external automation communicate through this HTTP endpoint rather than calling one another directly. It authenticates requests, applies authorization and admission processing, and serves the current API objects to readers and watchers.
#1 Best Overall
Because it is the common entry point, API-server reachability and protection are central design concerns. A failed API server prevents new control decisions even if already-running containers can continue for a time.
etcd: the durability boundary
etcd stores Kubernetes API-object state. Deployments, Pod specifications, Service definitions, node records and controller metadata are represented through the API and persisted there. etcd is a consistent, highly available key-value store; protecting its data and maintaining quorum are therefore control-plane responsibilities, not application-node tasks.
Scheduler: choosing a home for each Pod
The scheduler watches for newly created Pods whose node assignment is still empty. It filters and scores candidate nodes using the Pod’s resource requirements, hardware and software constraints, policy, affinity and anti-affinity, data locality, potential interference with other workloads and deadlines. It then records a node assignment through the API server. The scheduler does not run containers; it makes the placement decision that lets a node agent do so.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Controllers: continuous reconciliation
Controllers are control loops that watch cluster state and make or request changes when observed state differs from the desired declaration. A controller normally writes through the API server, creating or updating related objects. Other components watch those updates and react. This division allows many focused built-in controllers and supports custom controllers outside the built-in control plane.
Reconciliation is continuous rather than transactional. If a container, Pod or node disappears, the relevant controllers keep evaluating state and attempt to restore the declared outcome.
Cloud controller manager
The cloud-controller-manager is optional. When a cloud-provider integration is used, it contains provider-specific control logic while the rest of the Kubernetes control plane continues to use the standard API model.
Worker nodes: turning a PodSpec into running containers
Kubelet
The kubelet is the primary node agent. It receives PodSpecs through the control-plane API path and ensures that the described containers are running and healthy. It deliberately ignores containers it did not create, which keeps node-level reconciliation scoped to Kubernetes-managed workloads.
Recommended Free Tools
Container runtime
The runtime performs the container operations requested by the kubelet: create, start, monitor and stop. Kubernetes schedules a Pod, but the runtime is the process that executes its containers on the selected machine.
Kube-proxy and Service traffic
kube-proxy maintains node network rules that implement the Service abstraction, directing connections toward the appropriate Pods. It is optional: a network plugin may supply equivalent proxying, in which case kube-proxy need not run. This distinction matters when troubleshooting because Service behavior can be implemented by components other than the traditional kube-proxy process.
Node health and eligibility
Node health is represented in Node status and heartbeats, including Lease objects in the kube-node-lease namespace. A node becomes eligible to run Pods only when the control plane considers its object valid and required services healthy. A machine that is powered on but no longer reporting correctly is not equivalent to a schedulable Kubernetes node.
Rank #3
How a Pod travels from declaration to execution
- Submit a declaration. A user or automation client sends a Pod, Deployment or another object through kubectl or an API client.
- Authenticate and persist. The API server authenticates and processes the request, then stores the resulting object state in etcd.
- Reconcile related objects. Controllers watch the API and create or update ReplicaSets, Pods and other dependent resources until observed state approaches the declaration.
- Assign a node. The scheduler notices an unscheduled Pod, evaluates eligible nodes and records the selected node through the API.
- Start and supervise. The kubelet on that node receives the PodSpec, asks the container runtime to start the containers and monitors their health.
- Route traffic. A Service reaches matching Pods through kube-proxy or an equivalent network-plugin implementation.
Every step is observable through API objects and can be retried. A scheduler restart, a transient API failure or a crashed container does not convert the process into a one-time deployment transaction; the remaining control loops continue working toward the declared state.
Free tools Windows power users keep installed
One-click scans. No signup required.
Communication paths and security boundaries
Hub-and-spoke API access
Kubernetes documents a hub-and-spoke pattern: node and Pod API usage terminates at the API server, while other control-plane components are not designed to expose remote services to arbitrary callers. Node-to-control-plane traffic normally uses the API server’s authenticated HTTPS endpoint.
API server to kubelet
The API server also reaches kubelet endpoints for logs, attach and port-forward operations. On an untrusted network, configure certificate verification and kubelet authentication and authorization deliberately. Treat this path separately from ordinary node-to-API traffic because it is the reverse direction and exposes operational capabilities.
Proxy paths are not identical
API-server proxy connections to nodes, Pods and Services have different default protection characteristics. Before exposing any of these paths across a public or otherwise untrusted network, review which identity is authenticated, how the destination is selected and whether encryption and authorization cover the complete route.
Default ports and firewall planning
The following are documented defaults, not performance limits. Components can be configured to use different ports, so firewall rules must follow the actual deployment configuration.
| Component or feature | Default port | Typical direction or use |
|---|---|---|
| API server | TCP 6443 | kubectl, nodes and control-plane clients connect to the Kubernetes API. |
| etcd | TCP 2379–2380 | Client access and member-to-member etcd communication. |
| Kubelet | TCP 10250 | Control-plane operations and node-agent communication. |
| Scheduler | TCP 10259 | Scheduler secure endpoint. |
| Controller manager | TCP 10257 | Controller-manager secure endpoint. |
| kube-proxy | TCP 10256 | Proxy health and metrics endpoint in configurations that expose it. |
| NodePort Services | TCP/UDP 30000–32767 | Externally reachable Service ports when NodePort is used. |
Control-plane deployment and availability choices
Single-machine control plane
A single control-plane machine is straightforward for learning and small development clusters. Its failure removes the cluster’s central decision and API path, even though some already-running workloads may continue until they need reconciliation or node communication.
Distributed self-managed control plane
Production self-managed clusters can spread control-plane components across dedicated machines. This improves tolerance of an individual-machine failure, but the operator owns patching, certificates, backups, etcd health and recovery procedures. The network between control-plane members and workers must also be engineered and monitored.
Static Pods and service processes
Control-plane components may run directly as operating-system services or as static Pods managed by a kubelet. Static Pods keep the component definitions on the host while still fitting the node-agent model. A self-hosted arrangement can extend Kubernetes management patterns further, at the cost of additional operational complexity.
Managed Kubernetes service
A managed Kubernetes service moves some control-plane operation to a provider. The provider typically abstracts control-plane provisioning and maintenance, while the customer still designs workloads, node capacity, identities, network policy and application availability. Compare options by operational ownership, failure tolerance, API reachability, customization, cost and staffing rather than assuming that “managed” removes every responsibility.
Dedicated versus shared machines
Small clusters may run control-plane and user workloads together. Larger production environments often dedicate machines to control-plane duties so application CPU, memory or disk pressure is less likely to interfere with API responsiveness and stateful control-plane services.
Best Value
Diagnosing architecture problems
The API is unreachable
- Check the API endpoint’s network path and the configured secure port, normally TCP 6443.
- Separate authentication or authorization failures from transport failures; a reachable API can still reject credentials or policy.
- Inspect control-plane process health and etcd availability before investigating individual Pods.
Pods remain Pending
- Determine whether the Pod has a node assignment. If not, examine resource requests, node selectors, affinity or anti-affinity, taints, policy constraints and data-locality requirements.
- If a suitable node exists but the Pod still does not start, move the investigation to the kubelet and container runtime on that node.
A node is NotReady
- Inspect Node status and heartbeat or Lease updates.
- Verify kubelet and runtime health, then check the node’s API connectivity and resource pressure.
- Do not treat a running virtual machine as proof that Kubernetes considers the node valid and schedulable.
A Service has no usable endpoints
- Confirm that the Service selector matches the intended Pods and that those Pods are healthy.
- Identify whether kube-proxy is responsible for the cluster’s Service rules or whether a network plugin replaces it.
- Check network-policy and firewall boundaries separately from application listening behavior.
Capturing architecture evidence for reviews
Architecture discussions often rely on a Kubernetes dashboard, API view or documentation page. A do-it-yourself browser workflow is to open the target page, wait until client-rendered panels finish loading, dismiss consent dialogs, hide chat or newsletter overlays, set the viewport and device scale, then capture the full page or selected element. For repeatable reviews, record the URL, viewport, color scheme, wait condition and capture time so two diagrams are comparable.
Or skip the browser setup
ScreenshotNeo provides a single-call website screenshot API and MCP server. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing status.
Using the API documented at https://screenshotneo.com/docs/:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://kubernetes.io/docs/concepts/architecture/ -o architecture.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://kubernetes.io/docs/concepts/architecture/"}, timeout=90)
open("architecture.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://kubernetes.io/docs/concepts/architecture/' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The same service supports full-page captures with lazy-image loading, CSS-selector element shots, dark mode, device presets or custom viewports, retina scale, PDF output, custom CSS and JavaScript, click-before-capture actions, selector hiding, selector or network-idle waits, request blocking, custom headers and cookies, timezone and geolocation, transparent backgrounds, resizing, chosen cache TTLs, signed image links, asynchronous jobs with signed webhooks, bulk capture for up to 100 URLs per call, usage reporting and an OpenAPI specification. Parameter names used by other screenshot APIs also work, which can simplify migration.
An MCP server exposes take_screenshot, get_page_info and capture_pdf to Claude, Cursor and other MCP clients. The Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Other plans are Starter $5/3,000, Growth $15/15,000, Pro $39/60,000, Scale $99/250,000 and Business $249/1,000,000, with two months free on yearly billing. Every feature is available on every plan. Create a free ScreenshotNeo account to capture up to 1,000 screenshots a month without a card.
What to retain
- The API server is the cluster’s communication and state-management interface.
- etcd stores API-object state and defines a critical durability boundary.
- Controllers continuously reconcile observed state toward the declaration.
- The scheduler chooses a node; the kubelet and runtime run the Pod there.
- kube-proxy is optional when a network plugin supplies equivalent Service proxying.
- Control-plane placement changes who owns patching, backups, security, failure recovery and cost.
Frequently Asked Questions
What happens if the scheduler is temporarily unavailable?
Existing Pods can continue running on their nodes, but newly created unscheduled Pods remain without placement until a scheduler is available or another scheduler performs that work.
Can a custom controller run outside the Kubernetes control-plane machines?
Yes. Controllers use the Kubernetes API and can be deployed as workloads or external processes, provided they have suitable network access and authorization.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why can a node be reachable but still unable to receive Pods?
Kubernetes eligibility depends on Node status, heartbeats or Lease updates, kubelet and runtime health, and control-plane validation—not merely whether the underlying machine responds to a network ping.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
