Kubernetes Architecture Explained — A Complete Visual Guide

Why Kubernetes?

Docker lets you run a single container. But what happens when you have 100 containers? 1000? What if one crashes? How do you load balance? How do you roll out updates without downtime?

Kubernetes (K8s) answers all of these questions. It is an open-source container orchestration platform — originally built by Google, now maintained by the CNCF.

High-Level Architecture

┌─────────────────────────────────────────────────┐
│                KUBERNETES CLUSTER                │
│                                                 │
│  ┌────────────────────┐  ┌──────────────────┐  │
│  │   CONTROL PLANE    │  │   WORKER NODES   │  │
│  │                    │  │                  │  │
│  │  ┌──────────────┐  │  │  ┌────────────┐ │  │
│  │  │  API Server  │  │  │  │    Pod     │ │  │
│  │  └──────────────┘  │  │  │ ┌────────┐ │ │  │
│  │  ┌──────────────┐  │  │  │ │  App   │ │ │  │
│  │  │     etcd     │  │  │  │ └────────┘ │ │  │
│  │  └──────────────┘  │  │  └────────────┘ │  │
│  │  ┌──────────────┐  │  │  ┌────────────┐ │  │
│  │  │  Scheduler   │  │  │  │    Pod     │ │  │
│  │  └──────────────┘  │  │  └────────────┘ │  │
│  │  ┌──────────────┐  │  └──────────────────┘  │
│  │  │  Controller  │  │                         │
│  │  │  Manager     │  │                         │
│  │  └──────────────┘  │                         │
│  └────────────────────┘                         │
└─────────────────────────────────────────────────┘

Control Plane Components

The Control Plane is the brain of the cluster. It makes global decisions about the cluster state.

1. API Server

The central hub — all communication flows through it. Every kubectl command, every controller, every node communicates via the API Server.

# All kubectl commands are API calls
kubectl get pods  →  GET /api/v1/namespaces/default/pods
kubectl apply -f  →  POST /api/v1/...

2. etcd

A distributed key-value store that holds the entire cluster state. If you lose etcd without a backup, you lose your cluster.

• Highly available (runs as a cluster)
• Consistent (uses Raft consensus)
• Only the API Server talks to etcd directly

3. Scheduler

Watches for new Pods with no assigned node and assigns them to the best available node based on:

• Available CPU and memory
• Node affinity/anti-affinity rules
• Taints and tolerations
• Resource requests and limits

4. Controller Manager

Runs multiple control loops, each responsible for maintaining desired state:

Worker Node Components

kubelet

An agent running on every worker node. It receives Pod specifications and ensures the described containers are running and healthy.

# Check kubelet status on a node
systemctl status kubelet

kube-proxy

Maintains network rules on nodes. It enables communication to Pods from inside and outside the cluster, implementing the Kubernetes Service abstraction.

Container Runtime

The software that actually runs containers. Kubernetes supports:

• containerd (most common)
• CRI-O
• Docker Engine (via shim, deprecated)

Core Kubernetes Objects

Pod — The Smallest Deployable Unit

A Pod wraps one or more containers that share network and storage.

apiVersion: v1
kind: Pod
metadata:
  name: my-app
  labels:
    app: my-app
spec:
  containers:
  - name: app
    image: nginx:latest
    ports:
    - containerPort: 80
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"

You rarely create Pods directly. Use Deployments instead — they manage Pods for you.

Deployment — Managing Pod Lifecycle

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: my-app:v2
        ports:
        - containerPort: 3000

# Apply the deployment
kubectl apply -f deployment.yaml
 
# Watch rollout status
kubectl rollout status deployment/my-app
 
# Rolling update to new image
kubectl set image deployment/my-app app=my-app:v3
 
# Rollback to previous version
kubectl rollout undo deployment/my-app
 
# View rollout history
kubectl rollout history deployment/my-app

Service — Stable Network Access to Pods

Pods are ephemeral — they get new IP addresses when restarted. A Service provides a stable endpoint.

apiVersion: v1
kind: Service
metadata:
  name: my-app-service
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 3000
  type: LoadBalancer  # ClusterIP | NodePort | LoadBalancer

ConfigMap & Secret — Configuration Management

# ConfigMap for non-sensitive config
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: "production"
  LOG_LEVEL: "info"
  DB_HOST: "postgres-service"
 
---
# Secret for sensitive data (base64 encoded)
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  DB_PASSWORD: cGFzc3dvcmQxMjM=  # base64 encoded

Essential kubectl Commands

# View all resources in current namespace
kubectl get all
 
# Describe a resource (great for debugging)
kubectl describe pod my-app-xyz
 
# View pod logs
kubectl logs -f pod/my-app-xyz
 
# Execute a command inside a running pod
kubectl exec -it pod/my-app-xyz -- /bin/bash
 
# Check resource usage
kubectl top pods
kubectl top nodes
 
# Apply a manifest file
kubectl apply -f manifest.yaml
 
# Delete resources
kubectl delete -f manifest.yaml
 
# Get events (useful for debugging)
kubectl get events --sort-by='.lastTimestamp'
 
# Port-forward to access a pod locally
kubectl port-forward pod/my-app-xyz 8080:3000

What to Learn Next

1. Helm — Kubernetes package manager for templating manifests
2. Ingress — HTTP/HTTPS routing with TLS termination
3. Persistent Volumes — Stateful workload storage
4. RBAC — Role-based access control
5. Horizontal Pod Autoscaler — Auto-scaling based on metrics
6. ArgoCD / Flux — GitOps continuous delivery

Kubernetes has a steep learning curve upfront, but once the architecture clicks, it becomes the most powerful tool in your DevOps toolkit.

Recommended Course

If you want to truly master Kubernetes — from architecture through deployments, networking, RBAC, and CKA exam prep — KodeKloud is the most hands-on learning platform available. Every concept comes with labs you run in a real cluster right in your browser.