Why does kubeproxy, apiserver and etcd not need CNI plugins to start?

Question

I have initiated a k8s cluster on a server with the below configuration:

OS: Ubuntu 2022 LTS
Container Runtime: containerd
CNI: Absoloutley nothing installed!
Cluster initiator: Kubeadm
init-settings:

apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///var/run/containerd/containerd.sock
  imagePullPolicy: IfNotPresent
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
kind: ClusterConfiguration
kubernetesVersion: 1.29.0
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
scheduler: {}
---
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
cgroupDriver: systemd

The question that I have is as follows. I have read in many articles (as well as k8s docs) that CNI is responsible for assigning a network interface to a container (or a pod). My cluster doesn't have a CNI yet, but pods like kube-apiserver, kube-proxy, etcd and these init pods run without a CNI. How is that possible?

P.S. I will be really thankful if useful document links are provided.

Thanks in advance :)

score 0 · Accepted Answer · 2024-03-18T00:53:58.980

Static pods defined using a yaml file in /ect/kubernetes/manifests on the Kubernetes node are managed directly by the kubelet daemon on a specific node. etcd and kube-apiserver are examples of static pods.

kube-proxy is a DaemonSet and is installed when using kubeadm.

Static pods as well as pods running as part of a DaemonSet will have IP address of the node they are running on, so they don't rely on CNI in that sense. Think about it: if CNI installation requires use of kubectl, it wouldn't be possible without e.g. API server up and running.

https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/

https://kubernetes.io/docs/reference/setup-tools/kubeadm/implementation-details/

Why does kubeproxy, apiserver and etcd not need CNI plugins to start?

1 Answers1