kubelet

kubelet
Name	kubelet
Developer	Kubernetes
Initial release	2014
Programming language	Go
License	Apache License 2.0

kubelet The kubelet is an agent that runs on each node in a Kubernetes cluster and ensures that containers described in Pod manifests are running and healthy. It interfaces with the Container Runtime Interface to manage container lifecycle, observes pod status for the API server, and reports node conditions to the control plane. Originating with early Google container orchestration work and formalized by the Cloud Native Computing Foundation, it is central to container orchestration in cloud-native environments.

Overview

The component acts as the primary node-level controller for pod execution, translating desired state from the API server into runtime actions through the Container Runtime Interface, cgroup management, and local health checks. It registers node metadata with the kube-apiserver and responds to scheduling decisions from the kube-scheduler. Historically influenced by cluster management systems at Google and proposals from the Kubernetes SIG Node community, it is bundled with many distributions such as OpenShift, EKS, GKE, and AKS. Operators rely on integrations with tooling like kubectl, kubeadm, and third-party providers including Rancher and Mirantis.

Architecture and Components

Key subcomponents include the node agent runtime, sync loop, pod lifecycle manager, volume manager, and device plugin handler. The sync loop reconciles pod specs from the API server against local state and invokes the configured container runtime, such as containerd, CRI-O, or Docker Engine. Volume management integrates with drivers like CSI and cloud provider block services (e.g., Amazon EBS, Google Persistent Disk, Azure Disk). Device plugins enable access to hardware from NVIDIA GPUs, FPGA vendors, and specialized accelerators. The node-level metrics and read-only or secured HTTP endpoints are consumed by tools like Prometheus and cAdvisor.

Pod Lifecycle and Workflows

The agent implements pod admission, init containers, ephemeral containers, and termination sequences. It enforces pod QoS classes as defined in Kubernetes Pod specifications and honors lifecycle hooks such as preStop. During pod startup, it sets up namespaces, mounts volumes, and configures networking via CNI implementations like Flannel, Calico, Weave Net, and Cilium. The readiness and liveness probe results are reported back to the API server to drive service endpoints and restart policies. Eviction decisions for node pressure utilize signals integrated from the kernel, cloud provider node controllers, and the kubelet’s own eviction manager.

Configuration and Deployment

Operators configure the agent with flags, a node configuration API, or via packaged systemd units provided by distributions like CoreOS and Ubuntu. Bootstrapping options include using kubeadm or managed offerings from Google Cloud Platform, Amazon Web Services, and Microsoft Azure. TLS credentials, kubeconfig files, and feature gates control behavior. Integration points include static pod manifests housed in well-known paths, DaemonSets scheduled by the kube-scheduler, and cloud-init scripts in IaaS deployments. Upgrades are coordinated with cluster lifecycle tools such as Cluster API to maintain version skew policies.

Security and Authentication

The component supports TLS client authentication, RBAC interactions via the API server, and Node authorizer policies. Workloads are isolated using Linux namespaces, SELinux policies from Red Hat, AppArmor profiles in Ubuntu, and seccomp filters. Credential management interacts with secrets APIs and external stores like HashiCorp Vault. Device plugin authorization, admission controllers, and PodSecurity admission enforce restrictions shaped by communities such as Kubernetes SIG Auth and vendors like Red Hat OpenShift.

Monitoring and Troubleshooting

Operators gather metrics exposed on the metrics endpoint for collection by Prometheus and visualize them with Grafana. Logs from the agent are parsed by systems like Fluentd, Elasticsearch, and Splunk; system-level traces may be collected with BPF tools or OpenTelemetry. Common troubleshooting workflows reference kubelet logs, inspect container runtime state (e.g., containerd shims), examine kube-proxy and CNI plugin logs, and check node conditions reported to the API server. Debugging features include verbose logging flags, ephemeral containers injected for live debugging, and health endpoints used by cloud provider autohealers like GKE Autopilot.

Performance and Scalability

Performance depends on pod density, pod churn rate, container image pull throughput, and underlying storage and network performance. Node-level tuning involves adjusting eviction thresholds, podCIDR sizes, and max-pods settings; large clusters leverage vertical and horizontal scaling patterns promoted by projects such as Kubernetes SIG Scalability and tooling like kube-scheduler performance profiles. High-scale environments integrate image registries proxied via Harbor or CDN-backed registries, use multi-queue network drivers from Linux Kernel features, and employ NUMA-aware placement promoted by Kubernetes Device Plugins.

Category:Kubernetes