Kubernetes Data Flow

commit c3c78e4355ac93436b4c95f39cf1ce576a3f8f41

End-to-End Request Flow

kubectl / client REST request
→
kube-apiserver authn · authz · admission
→
etcd
persisted state
→
kube-scheduler filter · score · bind
→
kubelet sync · CRI · volumes
Controllers (ReplicaSet, Deployment, etc.) watch and reconcile via API server
API Server watch
↔
kube-controller-manager

High-Level Flow

1 — User creates a Pod (kubectl apply)
kubectl serializes the Pod manifest to JSON/protobuf and sends a POST /api/v1/namespaces/{ns}/pods request to the API server.
  1. Authentication
    The API server verifies the caller's identity via client certificates, bearer tokens, or webhook authenticators.
    pkg/kubeapiserver/authenticator/config.go
  2. Authorization (RBAC / webhook)
    The request verb+resource+namespace is checked against RBAC policies or external webhook authorizers.
    pkg/kubeapiserver/authorizer/config.go
  3. Admission Control
    Mutating and validating admission webhooks (plus built-in plugins like LimitRanger, ResourceQuota) run before the object is persisted.
    pkg/admission/plugin/namespace/lifecycle/admission.go
  4. etcd Write
    The validated Pod object is serialized and stored in etcd. The API server returns 201 Created to the client.
    pkg/registry/core/pod/storage/storage.go
2 — Scheduler picks a node
The scheduler maintains a watch on unscheduled pods (spec.nodeName == ""). When a new pod appears it enters the scheduling queue.
  1. Queue — pod enters ActiveQ
    The scheduling queue prioritizes pods. The scheduling goroutine blocks on NextPod() until a pod is dequeued.
    schedule_one.go L67–96 ScheduleOne()
  2. Filter phase — feasible nodes
    Filter plugins (NodeAffinity, NodeUnschedulable, PodTopologySpread, etc.) prune infeasible nodes.
    schedule_one.go L175–198 schedulingCycle()
  3. Score phase — rank nodes
    Score plugins assign numeric scores to each feasible node. The node with the highest sum wins.
  4. Bind — write nodeName to API server
    The scheduler writes a Binding object (or PATCH on the Pod) setting spec.nodeName. This triggers the kubelet.
    schedule_one.go L150–170 runBindingCycle()
3 — Kubelet runs the Pod
Each kubelet watches pods where spec.nodeName == thisNode. When a pod lands it enters the pod-worker pipeline.
  1. syncLoop — multiplex sources
    Merges updates from API server watch, static pod files, and HTTP into a single configCh channel.
    kubelet.go L2630 syncLoop()
  2. Pod workers — concurrent SyncPod()
    A per-pod goroutine calls SyncPod() which mounts volumes, pulls images, and drives the CRI to create/start containers.
    kubelet.go L2029 SyncPod()
  3. CRI call — container runtime
    The Container Runtime Interface (containerd, CRI-O) creates the sandbox and containers via gRPC.
  4. PLEG — lifecycle events
    The Pod Lifecycle Event Generator polls the runtime and fires events (ContainerStarted, ContainerDied) back into the sync loop.
4 — Controllers maintain desired state
Controllers run in kube-controller-manager. Each controller watches one or more resource types via shared informers and reconciles actual state toward desired state.
  1. Shared informers — efficient watch
    All controllers share a single API server watch stream per resource type. Objects are cached locally in a thread-safe store.
  2. Work queue — rate-limited reconcile
    Event handlers enqueue changed object keys. Worker goroutines dequeue and call the reconcile function with backoff.
  3. ReplicaSet controller example
    Counts running pods. If count < replicas, creates new pods via API server. If count > replicas, deletes excess pods.
    pkg/controller/replicaset/replica_set.go

Components

kube-apiserver control plane

Central REST gateway. Validates, stores, and serves all Kubernetes objects. Every other component talks only to the API server — never directly to each other.

Explore API Server flow →

kube-scheduler control plane

Watches unscheduled pods and assigns them to nodes using a plugin-based filter/score pipeline. Writes the result as a Binding back to the API server.

Explore Scheduler flow →

kubelet node

Node agent. Runs one per node. Watches pods assigned to its node and drives the container runtime (CRI) to match actual state to desired state.

Explore Kubelet flow →

kube-controller-manager control plane

Hosts dozens of controllers (ReplicaSet, Deployment, Node lifecycle, ServiceAccount, …). Each runs an independent reconcile loop to maintain resource invariants.

Explore Controller Manager flow →