Room 13

DAEMONSETS

The Shadow Network

DaemonSets are the shadow agents of K8s - they ensure one pod runs on every node.
Used for monitoring, logging, and networking. Deploy a DaemonSet and verify coverage.

📜 Mission Briefing

Apply daemonset.yaml - a DaemonSet that runs a monitoring agent on every node.
Verify a pod is running on each node: kubectl get pods -o wide -l app=shadow-agent.
Count the number of DaemonSet pods - it should match the number of nodes.
Each pod logs the node name. Check the logs of any pod.
The DaemonSet has an annotation escape-password. Read it.
The password is daemonize.

Key Commands

Command	Purpose
`kubectl get ds`	List DaemonSets
`kubectl describe ds NAME`	DaemonSet details
`kubectl get pods -o wide`	See which node each pod runs on
`kubectl rollout status ds/NAME`	DaemonSet rollout status

How DaemonSets Work

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: monitoring-agent
  annotations:
    escape-password: "daemonize"
spec:
  selector:
    matchLabels:
      app: monitor
  template:
    metadata:
      labels:
        app: monitor
    spec:
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: agent
          image: busybox
          command: ['sh', '-c', 'echo "Node: $NODE_NAME"; sleep infinity']
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName

# DaemonSets ensure one pod per node (or per matching node)
# Common uses: log collectors, monitoring, network plugins

# Create DaemonSet
kubectl apply -f daemonset.yaml

# Check coverage
kubectl get ds
kubectl get pods -l app=monitor -o wide

# DaemonSets respect taints and tolerations
# To run on control plane nodes, add toleration for:
#   node-role.kubernetes.io/control-plane:NoSchedule

# Update strategy: RollingUpdate (default) or OnDelete
# OnDelete: new pods only when old ones are manually deleted

Hints

Hint 1

Check DaemonSet status:

kubectl get ds
kubectl get pods -l app=shadow-agent -o wide

Hint 2

Read the annotation:

kubectl get ds shadow-agent -o jsonpath='{.metadata.annotations.escape-password}'

Hint 3

The password is daemonize.

🔓 Unlock Room 14

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_14/README             \
        -out ../room_14/README.txt        \
        -pass pass:PASSWORD
cat ../room_14/README.txt