Kubelet

The kubelet is the primary agent that runs on every Kubernetes worker node. Think of it as the node’s captain: it registers the node with the control plane, receives and enforces PodSpecs from the API server, instructs the container runtime to pull images and start containers, continuously monitors pods and containers, and reports node and pod status back to the kube-apiserver. Key responsibilities:

Registering and reporting node status to the control plane
Watching for PodSpecs and ensuring containers are running as described
Interacting with the container runtime (containerd, Docker, CRI implementations)
Performing liveness/readiness probe handling and pod lifecycle management
Optionally bootstrapping TLS credentials for secure communication with the control plane

A diagram of Kubernetes architecture showing the Master side (etcd cluster, kube-apiserver, controller-manager, kube-scheduler) and Worker nodes with kubelet, containerd and containers/pods. Buttons on the right list actions like Register Node, Create Pods, and Monitor Node & Pods.

Installing the kubelet

If you deploy Kubernetes with kubeadm, be aware that kubeadm does not install the kubelet for you. Each node must have a supported container runtime and the kubelet installed and running before you use kubeadm to initialize or join a cluster.

kubeadm expects the kubelet and a supported container runtime to already be present on each node. It will not automatically install the kubelet.

You can install the kubelet in multiple ways (package manager, distribution packages, or from distribution-provided repositories). For small labs or controlled environments, a manual binary example looks like this:

# download a specific kubelet release
wget https://storage.googleapis.com/kubernetes-release/release/v1.13.0/bin/linux/amd64/kubelet

# make it executable and move it into /usr/local/bin
chmod +x kubelet
sudo mv kubelet /usr/local/bin/

Next, run the kubelet as a systemd service. Below is a minimal example unit file — adapt paths, flags and the container runtime endpoint to match your environment and Kubernetes version:

# /etc/systemd/system/kubelet.service
[Unit]
Description=Kubernetes Kubelet
Documentation=https://kubernetes.io/docs/
After=network.target

[Service]
ExecStart=/usr/local/bin/kubelet \
  --config=/var/lib/kubelet/kubelet-config.yaml \
  --container-runtime=remote \
  --container-runtime-endpoint=unix:///var/run/containerd/containerd.sock \
  --image-pull-progress-deadline=2m \
  --kubeconfig=/var/lib/kubelet/kubeconfig \
  --network-plugin=cni \
  --register-node=true \
  --v=2
Restart=always
StartLimitInterval=0

[Install]
WantedBy=multi-user.target

Enable and start the kubelet service:

sudo systemctl daemon-reload
sudo systemctl enable --now kubelet

Verifying kubelet status

You can verify the kubelet using systemd, logs, or by inspecting the process:

Command	Purpose
`sudo systemctl status kubelet`	Check systemd service status and whether kubelet is running
`sudo journalctl -u kubelet -f`	Stream kubelet logs for troubleshooting
`ps aux \| grep kubelet`	Inspect the running kubelet process and command-line flags
`kubectl get nodes`	Verify node registration from the control plane (after kubelet joins)

Example verification commands:

# View unit status
sudo systemctl status kubelet

# Follow logs
sudo journalctl -u kubelet -f

# Inspect process
ps aux | grep kubelet

Common kubelet flags

Flag	Description
`--config`	Path to kubelet configuration file (kubelet-config.yaml)
`--kubeconfig`	Path to kubelet kubeconfig used to communicate with the API server
`--container-runtime`	Container runtime type (e.g., `remote`)
`--container-runtime-endpoint`	Endpoint for the CRI socket (e.g., `unix:///var/run/containerd/containerd.sock`)
`--network-plugin`	Network plugin type (e.g., `cni`)
`--register-node`	Whether kubelet should register the node with the API server
`--v`	Log verbosity level

Configuration and TLS bootstrapping

Kubelet configuration can be provided via a static file (--config) or a dynamic config mechanism. Production clusters typically use TLS credentials for kubelet <-> API server communication. Kubelet supports certificate rotation and TLS bootstrap; refer to the Kubernetes docs for the recommended secure setup and certificate bootstrapping process.

Ensure kubelet and control plane component versions are compatible. Running mismatched versions or using unsupported flags can prevent nodes from joining the cluster.

References and further reading

That’s it for now.

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Installing the kubelet

Verifying kubelet status

Common kubelet flags

Configuration and TLS bootstrapping

References and further reading

Watch Video

​Installing the kubelet

​Verifying kubelet status

​Common kubelet flags

​Configuration and TLS bootstrapping

​References and further reading

Watch Video

Installing the kubelet

Verifying kubelet status

Common kubelet flags

Configuration and TLS bootstrapping

References and further reading