Node Registration
How does a machine turn into a Node that can take Pods? With --register-node at its default the Kubelet creates the Node object itself and fills in the addresses, capacity and nodeInfo it reads off the machine. The object existing is not the same as the Node being usable: Ready stays False and the not-ready taint keeps ordinary Pods off until the runtime is up, and a Lease renewed every 10 seconds by default is what says the machine is still alive.
Play the animation 6 steps, animated, best on a wide screen
Node Registration, step by step
-
A machine joins a cluster by running a Kubelet on it. With --register-node left at its default of true, the Kubelet registers itself with the API rather than waiting for an operator to create the object, which is how most distributions bring a Node in. Nothing in the cluster knows this machine yet.
Play from step 1 -
The Kubelet creates the Node object through the API, named after the machine, and the POST already carries its status: addresses, capacity, nodeInfo and Ready False. The TaintNodesByCondition admission plugin, on by default, adds the not-ready taint as the object is created. The name identifies the Node: two Nodes cannot carry the same name at the same time.
Play from step 2 -
From then on the Kubelet PATCHes that status whenever it changes, and every 5 minutes by default when nothing does. Its own labels sit on the object, not the status, and the NodeRestriction admission plugin holds the kubernetes.io ones to a fixed list, so a Kubelet can label itself with a hostname or a zone but never with a node-role.
Play from step 3 -
The object exists and takes no ordinary Pod yet. Each status report still says Ready False while the machine is not healthy, and healthy means everything a Pod needs on it is up, the runtime included. Ready False keeps node.kubernetes.io/not-ready on the Node, and scheduling reads taints and not conditions, so only a Pod that tolerates it lands here.
Play from step 4 -
The container runtime comes up, the Kubelet flips Ready to True, and the not-ready taint is taken back off the Node. Node-1 can be chosen now: the first binding names it in spec.nodeName, and the Kubelet that registered the machine starts the containers on it.
Play from step 5 -
Alive is a separate question from Ready, and the Kubelet answers it on two clocks. It renews a Lease in the kube-node-lease namespace every 10 seconds, and PATCHes its status when it changes or else every 5 minutes, both of them defaults. The fast one is the signal, and the Node Failure and Pod Recovery card is about losing it.
Play from step 6