Kubernetes kubelet

Kubernetes kubelet
Name	kubelet
Developer	Google LLC, Cloud Native Computing Foundation
Initial release	2014
Programming language	Go (programming language)
Operating system	Linux, Windows, macOS
License	Apache License

Kubernetes kubelet

Kubelet is the primary node agent that runs on each computer node participating in a Kubernetes cluster; it registers nodes, watches for Pod definitions, and ensures containers described by Container Runtime Interface implementations are running. It interfaces with the kube-apiserver and participates in scheduling, health reporting, and lifecycle hooks while integrating with platform projects and vendors such as Docker, Inc., CRI-O, containerd, and cloud providers including Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Kubelet’s behaviors have evolved alongside major projects and events like the Cloud Native Computing Foundation graduation processes and ecosystem shifts around Docker deprecation and the OCI runtime standards.

Overview

Kubelet acts as the node-level controller in the Kubernetes architecture, translating higher-level objects defined in the kube-apiserver into actions executed by container runtimes such as containerd and Docker Engine. It participates in node registration with controllers like kube-controller-manager and cooperates with the kube-scheduler decisions by reflecting pod admission state and status updates back to the control plane. Historically tied to contributions from Google LLC engineers and projects like rkt, kubelet supports features driven by SIGs including SIG Node and SIG Instrumentation.

Architecture and Components

Kubelet’s architecture includes the main process, a plugin system for the Container Runtime Interface, and interfaces to networking plugins such as CNI and storage plugins like CSI. Core components include the pod worker, status manager, runtime manager, and eviction manager which coordinate with subsystems such as the kube-proxy-related networking stack and cloud-controller-manager components maintained by vendors including Red Hat and VMware, Inc.. Kubelet integrates with cluster services such as etcd indirectly via the kube-apiserver and supports TLS artifacts, x509 certificates, and RBAC-driven access controls defined by projects like Kubernetes SIG Auth.

Node and Pod Lifecycle Management

Kubelet implements node lifecycle features including registration, heartbeats, conditions, and cordon/drain behaviors used by operators managing clusters with tools like kubectl and kops. For pod lifecycle, it reconciles declared PodSpec through the runtime, enforces liveness and readiness probes, and supports lifecycle hooks that relate to init containers and postStart/preStop handlers. Eviction policies for memory and disk pressure interact with scheduler decisions and are observable in projects such as Prometheus exporters and through node metrics exposed for tools like Grafana.

Configuration and Runtime Options

Kubelet can be configured via command-line flags, configuration files such as the kubelet configuration API, and dynamic kubelet configuration mechanisms promoted by SIG Node. Runtime options determine interaction with CRI implementations (containerd, CRI-O, Docker Engine) and networking via CNI plugins like Calico or Flannel. Authentication and authorization settings may reference certificate authorities managed through cert-manager workflows or cloud identity services like IAM (AWS), and options for feature gates follow release semantics from Kubernetes Release cycles.

Security and Authentication

Kubelet exposes endpoints that require strong authentication and authorization; recommended patterns use x509 client certificates, TLS bootstrapping workflows, and RBAC policies enforced by the kube-apiserver. Node attestation and machine identity integration often rely on cloud provider IAM systems such as AWS IAM or Google Cloud IAM and on projects like SPIFFE and SPIRE for workload identity. Hardening guidance references benchmarks from organizations such as Center for Internet Security and incorporates runtime isolation best practices advocated by NIST and vendors like Red Hat.

Monitoring, Logging, and Troubleshooting

Operational visibility is achieved through metrics exposed by kubelet endpoints consumable by Prometheus, with dashboards in Grafana and alerting integrations into systems like PagerDuty or Opsgenie. Logs produced by kubelet are collected by agents such as Fluentd or Logstash and indexed in platforms like Elasticsearch for forensic analysis. Troubleshooting workflows cross-reference events from the kube-apiserver, node systemd logs, container runtime logs, and network plugin diagnostics; community resources and incident reports by vendors such as CNCF members and cloud providers document common failure modes.

Deployment and Integration with Kubernetes Control Plane

Kubelet is deployed as a system agent via unit managers like systemd or as part of node provisioning tools such as kubespray, kops, and managed services including Amazon EKS, Google Kubernetes Engine, and Azure Kubernetes Service. Integration with the control plane includes node registration, serving node-proxied metrics consumed by control plane components, and participating in cluster upgrades coordinated by kubeadm or vendor upgrade tooling from Red Hat and VMware, Inc.. Ecosystem projects like Helm and operators managed by Operator Framework may influence the workloads that kubelet ultimately runs on each node.

Category:Kubernetes