CKA — Worker Node Components

Worker Node Overview

Worker nodes run your application workloads. Each worker node has three essential components: kubelet, kube-proxy, and a container runtime.

┌──────────────────────────────┐
│         Worker Node          │
│                              │
│  ┌────────────────────────┐  │
│  │       kubelet          │  │
│  │  (node agent)          │  │
│  └───────────┬────────────┘  │
│              │               │
│  ┌───────────┴────────────┐  │
│  │   Container Runtime    │  │
│  │  (containerd / CRI-O)  │  │
│  └────────────────────────┘  │
│                              │
│  ┌────────────────────────┐  │
│  │     kube-proxy         │  │
│  │  (network rules)       │  │
│  └────────────────────────┘  │
│                              │
│  ┌────────────────────────┐  │
│  │    Pods (containers)   │  │
│  └────────────────────────┘  │
└──────────────────────────────┘

kubelet

The kubelet is the node agent that runs on every node (including control plane nodes). It ensures that containers described in PodSpecs are running and healthy.

Aspect	Detail
Runs as	systemd service (not a static Pod)
Config	/var/lib/kubelet/config.yaml
Service	systemctl status kubelet
Purpose	Ensures Pods are running on the node
Reports to	kube-apiserver

Key kubelet Responsibilities

• Registers the node with the API server
• Watches for PodSpecs assigned to its node
• Pulls container images
• Starts and monitors containers via the container runtime
• Reports node and Pod status back to the API server
• Manages static Pods from /etc/kubernetes/manifests/

Inspecting kubelet

# Check kubelet status
systemctl status kubelet

# View kubelet logs
journalctl -u kubelet -f

# View kubelet configuration
cat /var/lib/kubelet/config.yaml

# Check kubelet version
kubelet --version

kubelet Certificate Rotation

# kubelet certificates are stored at:
ls /var/lib/kubelet/pki/

# Certificate rotation is enabled by default in modern Kubernetes
# Check in kubelet config:
cat /var/lib/kubelet/config.yaml | grep rotateCertificates

kube-proxy

kube-proxy maintains network rules on nodes that allow network communication to Pods from inside or outside the cluster.

Aspect	Detail
Runs as	DaemonSet in kube-system namespace
Modes	iptables (default), IPVS
Purpose	Implements Service networking rules
Config	ConfigMap kube-proxy in kube-system

How kube-proxy Works

When you create a Service, kube-proxy creates network rules on every node so that traffic to the Service’s ClusterIP gets forwarded to the correct Pod endpoints.

# Check kube-proxy DaemonSet
kubectl get daemonset kube-proxy -n kube-system

# View kube-proxy configuration
kubectl get configmap kube-proxy -n kube-system -o yaml

# Check iptables rules created by kube-proxy
sudo iptables -t nat -L KUBE-SERVICES | head -20

Container Runtime

The container runtime is responsible for pulling images and running containers. Kubernetes uses the Container Runtime Interface (CRI) to communicate with any compatible runtime.

Runtime	CRI Support	Default In	Notes
containerd	Native CRI	Most distributions	Industry standard, used by Docker
CRI-O	Native CRI	OpenShift	Lightweight, designed for Kubernetes
Docker	Via cri-dockerd	Legacy	Deprecated as direct runtime in Kubernetes 1.24+

Inspecting the Container Runtime

# Check which runtime is in use
kubectl get nodes -o wide
# Look at the CONTAINER-RUNTIME column

# Using crictl (works with containerd and CRI-O)
crictl ps                     # List running containers
crictl images                 # List images
crictl logs <container-id>    # View container logs
crictl inspect <container-id> # Inspect container details
crictl pods                   # List pods

crictl vs kubectl

Tool	Scope	Use When
kubectl	Cluster-wide, works through API server	Normal operations, resource management
crictl	Node-local, talks directly to container runtime	Troubleshooting node-level container issues

Exam tip: Use crictl when troubleshooting node-level issues where kubectl might not work (e.g., API server is down, kubelet issues).

Worker Node Component Summary

Component	Type	Key Commands
kubelet	systemd service	systemctl status kubelet, journalctl -u kubelet
kube-proxy	DaemonSet	kubectl get ds kube-proxy -n kube-system
Container runtime	systemd service	crictl ps, crictl images

---

Next: Communication Flow →