Introduction and Architecture

Borg (used inside Google since the mid-2000s) proved the core ideas: a central scheduler that packs many jobs from many teams onto a shared fleet of machines, and a declarative job specification that the system keeps satisfied rather than a script that runs once.

Omega generalized Borg’s scheduler around a shared-state, optimistic-concurrency data store, an idea that reappears in Kubernetes as resourceVersion-based optimistic concurrency against etcd (see Objects and the Kubernetes API).

Kubernetes, open-sourced by Google in 2014 and donated to the newly formed Cloud Native Computing Foundation in 2015, took those lessons and rebuilt them as an open, API-driven system that anyone can run, instead of an internal Google tool. The name (Greek for "helmsman") and its seven-spoke logo both allude to this steering role.

Velocity. The point of automating deployment is not novelty, it is being able to ship changes often and safely: rolling updates, canaries and instant rollbacks are only safe to do dozens of times a day because the system, not a person, verifies each step.

Immutable infrastructure. A running container’s image is never patched in place. A new version is built as a new image with a new tag, and the old Pods are replaced wholesale by new ones running that image (see ReplicaSets and Deployments). Rolling back means redeploying the previous image, not undoing a change on a live machine — there is no configuration drift to reason about, because nothing is ever mutated after it starts.

Declarative configuration. A manifest says the desired end state ("three replicas of this Pod template should exist"), not the steps to get there. The same YAML, checked into version control, can be re-applied at any time and Kubernetes computes the difference itself; an imperative script that issues "create three of these" cannot be replayed safely once one of them already exists.

Reconciliation loops. Declarative configuration is only useful if something keeps enforcing it. Kubernetes controllers do this by continuously repeating the same three steps: observe the current state (by watching the API server), diff it against the desired state stored in etcd, and act to close the gap (create, update or delete objects) — see [reconciliation-loop]. This is the mechanism the books call self-healing: a killed Pod, a node that disappears, or a manifest edited by hand are all just more state to reconcile away, with no special-cased recovery code.

The workload is a single application on a single machine (or a small, fixed number of machines) that does not need to scale, self-heal across hosts, or be scheduled dynamically — a systemd service, or Docker Compose, does the job with far less to operate.

The team has no one available to own cluster upgrades, node OS patching, etcd health and API-server security, and cannot buy that operational burden away with a managed offering (see Managed Kubernetes and Distributions).

The application is a long-lived batch pipeline better served by a dedicated data-processing scheduler, or a short-lived function better served by a serverless/FaaS platform, where per-invocation billing and cold-start behaviour matter more than always-on Pods.

The workload’s storage and networking requirements do not map onto Kubernetes' abstractions at all — for example, tightly coupled HPC jobs that need a specialized interconnect and scheduler.

CoreDNS provides cluster-internal DNS: it lets a Pod resolve <service>.<namespace>.svc.cluster.local to a Service’s virtual IP, which is how most applications discover each other (see DNS and Service Discovery). It replaced the earlier SkyDNS/kube2sky combination and is itself deployed as an ordinary Deployment and Service, reconciled the same way as any application workload.

A CNI (Container Network Interface) plugin gives every Pod its own network namespace, IP address and route into the cluster network — Kubernetes defines the interface but ships no default implementation; kind installs a minimal one (kindnet) automatically, while production clusters typically choose Calico, Cilium or a cloud provider’s own CNI.

The kubelet on each node periodically updates a Lease object for itself, in the kube-node-lease namespace, as a lightweight heartbeat — far cheaper to update frequently than the full Node object’s status.

The node controller (inside kube-controller-manager) watches those Leases. If a node’s Lease stops being renewed, the node is marked NotReady after a grace period, and eventually its Pods are evicted so their controllers can reschedule replacements elsewhere.

Every other controller (Deployment, Job, StatefulSet, endpoint-slice, …​) follows the exact same shape: watch the API server, compare against desired state, act. The node controller is simply the reconciliation loop that happens to watch node health instead of a workload.

All communication is control plane → API server ← node; the kubelet only ever calls out to the API server (to watch and to report status), and the API server never opens a connection into a node except through the kubelet’s exposed HTTPS endpoint, used for kubectl exec/logs/port-forward and for metrics scraping.

Book 1 calls a worker machine a "minion". That term was renamed to node before Kubernetes 1.0 and has not been used since; every current API object, flag and doc says "node".

Book 1 lists cAdvisor as a separate daemon running alongside the kubelet on each node. cAdvisor’s container-resource-usage collection has long since been embedded directly inside the kubelet rather than run as its own process; there is nothing separate to install or operate.

Neither book could mention it, since it postdates both, but it is worth flagging here because it is exactly this kind of node-level plumbing: dockershim — the kubelet shim that let Docker Engine itself act as a CRI runtime — was removed in Kubernetes 1.24. Docker-built images are completely unaffected (they are OCI images either way, see Docker Architecture and the OCI); what changed is that the kubelet now talks to containerd or CRI-O directly instead of through Docker Engine and dockershim.