Skip to content

Room 03

K8S ARCHITECTURE

The Blueprint Chamber

  • You’ve stumbled into the architect’s chamber where the blueprints of the entire K8s cluster are stored.
  • To escape, you must understand how the cluster is built - the control plane, worker nodes, and their components.

📜 Mission Briefing

  1. Use kubectl get componentstatuses (or kubectl get cs) to check the health of control plane components.
  2. Identify all control plane pods running in kube-system namespace.
  3. Exec into the etcd pod and list the keys stored under /registry/namespaces/.

    hint: use kubectl exec with etcdctl command

  4. Count the number of control plane components (API server, scheduler, controller-manager, etcd).
  5. The password is api + the word serve → apiserve
Key Commands
Command Purpose
kubectl get nodes -o wide Nodes with roles and IPs
kubectl get pods -n kube-system Control plane pods
kubectl describe node NODE Node details and capacity
kubectl get componentstatuses Health of cluster components
kubectl cluster-info Cluster API endpoint
kubectl get endpoints -n default kubernetes API server endpoint
kubectl exec -it POD -n NS -- CMD Execute command in pod
Kubernetes Architecture
┌─────────────────────── Control Plane ──────────────────────┐
│                                                             │
│  ┌──────────┐  ┌────────────┐  ┌───────────┐  ┌─────────┐ │
│  │ API      │  │ Controller │  │ Scheduler │  │  etcd   │ │
│  │ Server   │  │ Manager    │  │           │  │         │ │
│  └──────────┘  └────────────┘  └───────────┘  └─────────┘ │
│       ▲                                                     │
└───────┼─────────────────────────────────────────────────────┘
        │
        │  kubelet communicates with API Server
        │
┌───────┼─────────────── Worker Node ─────────────────────────┐
│       ▼                                                      │
│  ┌──────────┐  ┌───────────┐  ┌───────────┐                │
│  │ kubelet  │  │ kube-proxy│  │ Container │                │
│  │          │  │           │  │ Runtime   │                │
│  └──────────┘  └───────────┘  └───────────┘                │
│                                                              │
│  ┌─────┐ ┌─────┐ ┌─────┐                                   │
│  │ Pod │ │ Pod │ │ Pod │                                   │
│  └─────┘ └─────┘ └─────┘                                   │
└──────────────────────────────────────────────────────────────┘

API Server (kube-apiserver): The front door to Kubernetes. Every kubectl command hits the API server. It validates and processes REST requests, stores state in etcd.

etcd: Distributed key-value store. The single source of truth for cluster state - pods, services, secrets, configs.

Scheduler (kube-scheduler): Watches for unscheduled pods and assigns them to nodes based on resource requirements, affinity rules, and constraints.

Controller Manager (kube-controller-manager): Runs controller loops - ReplicaSet controller, Deployment controller, Node controller, etc. Ensures the cluster state matches the desired state.

kubelet: Agent on each node. Pulls pod specs from the API server and ensures containers are running. Reports node status back.

kube-proxy: Network proxy on each node. Maintains network rules (iptables/IPVS) for Service routing.

# See control plane pods
kubectl get pods -n kube-system -l tier=control-plane

# Check the API server pod
kubectl describe pod -n kube-system -l component=kube-apiserver

# View etcd pod
kubectl describe pod -n kube-system -l component=etcd

# See node roles
kubectl get nodes --show-labels | grep node-role
Hints

Hint 1

Control plane components run as static pods in kube-system. List them: 

kubectl get pods -n kube-system

Hint 2

Look for pods starting with kube-apiserver, kube-scheduler, kube-controller-manager, and etcd.

Hint 3

The password is simply apiserve - recognizing the API server as the central gateway.

🔓 Unlock Room 04

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_04/README             \
        -out ../room_04/README.txt        \
        -pass pass:PASSWORD
cat ../room_04/README.txt