| 1 | Now we drop into a single worker node. Three layers stack inside it. At the top, the kubelet acts as the node-level agent — it watches the apiserver for Pods scheduled to this node and instructs the runtime to make those Pods real. Below it, kube-proxy programs the network rules so that Service virtual IPs route to the correct backing Pods, using iptables, IPVS, or nftables depending on configuration. At the base, the container runtime — containerd or CRI-O — actually starts the containers through the CRI interface. The green cubes inside are the Pods, the smallest unit you can schedule. |