CKA — Communication Flow

API Server as the Central Hub

The kube-apiserver is the only component that talks directly to etcd. All other components communicate through the API server. This design provides a single point of authentication, authorization, and audit logging.

kubectl ──────┐
              │
scheduler ────┤
              │
controller ───┼──► kube-apiserver ──► etcd
manager       │
              │
kubelet ──────┤
              │
kube-proxy ───┘

Communication Flows

kubectl → API Server

User runs: kubectl get pods
  → kubectl reads ~/.kube/config for server address and credentials
  → HTTPS request to kube-apiserver:6443
  → API server authenticates (client certificate)
  → API server authorizes (RBAC check)
  → API server reads from etcd
  → Returns response to kubectl

Scheduler → API Server

Scheduler watches API server for unscheduled Pods (Pod.spec.nodeName is empty)
  → Finds suitable node (filter → score)
  → Updates Pod's nodeName via API server
  → API server writes to etcd

kubelet → API Server

kubelet watches API server for Pods assigned to its node
  → Pulls container images
  → Creates containers via container runtime (CRI)
  → Reports Pod status back to API server
  → API server writes status to etcd

Controller Manager → API Server

Controllers watch API server for state changes
  → Detect drift between desired and actual state
  → Create/update/delete resources via API server
  → Example: Deployment controller creates ReplicaSets
  → Example: ReplicaSet controller creates Pods

TLS Certificates

All communication in a Kubernetes cluster is secured with TLS certificates. The key certificates are:

Certificate	Location	Purpose
CA certificate	/etc/kubernetes/pki/ca.crt	Root certificate authority
API server cert	/etc/kubernetes/pki/apiserver.crt	API server identity
API server key	/etc/kubernetes/pki/apiserver.key	API server private key
etcd CA	/etc/kubernetes/pki/etcd/ca.crt	etcd certificate authority
etcd server cert	/etc/kubernetes/pki/etcd/server.crt	etcd server identity
kubelet client cert	/var/lib/kubelet/pki/kubelet-client-current.pem	kubelet → API server
Front proxy CA	/etc/kubernetes/pki/front-proxy-ca.crt	API aggregation

Checking Certificate Expiration

# Check all kubeadm-managed certificates
kubeadm certs check-expiration

# Check a specific certificate
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -dates

# Renew all certificates
kubeadm certs renew all

Exam tip: Certificate expiration is a common troubleshooting scenario. If the API server suddenly stops responding after a cluster has been running for a year, check certificate expiration first.

Authentication Methods

Method	Use Case	How It Works
Client certificates	kubectl, kubelet, components	X.509 cert in kubeconfig
Bearer tokens	ServiceAccounts, API access	Token mounted in Pod
OIDC	Enterprise SSO integration	External identity provider
Webhook	Custom authentication	External webhook service

Authorization Modes

The API server supports multiple authorization modes, configured via --authorization-mode:

Mode	Description
RBAC	Role-Based Access Control (default, most common)
Node	Authorizes kubelet API requests
Webhook	External authorization service
ABAC	Attribute-Based Access Control (legacy)

The default kubeadm configuration uses --authorization-mode=Node,RBAC.

---

Next: Static Pods →