End-to-End Kubernetes Pod Creation Workflow — DevOps Interview Answer

This is one of the most important senior DevOps interview topics.

Example Command

kubectl apply -f pod.yaml

Example pod manifest:

apiVersion: v1

kind: Pod

metadata:

name: nginx-pod

spec:

containers:

• name: nginx

image: nginx

COMPLETE FLOW

1. kubectl Reads kubeconfig File

First thing: kubectl checks kubeconfig file.

Default location:

~/.kube/config

Check current config:

kubectl config view

Check current context:

kubectl config current-context

kubeconfig Contains

1. Cluster details
2. User credentials
3. Context

2. Authentication Happens

kubectl authenticates with API Server using:

Possible methods:

• client certificates
• token
• IAM auth (EKS)
• OIDC
• service account

3. kubectl Sends REST API Request

kubectl converts YAML into JSON internally.

Then sends HTTPS REST request to:

kube-apiserver

4. API Server Receives Request

kube-apiserver is the ENTRY POINT of Kubernetes.

Everything talks through API server.

5. Authentication

API server validates:

• user
• token
• certificate

6. Authorization (RBAC)

Checks permissions.

Example: Can this user create pods?

Objects checked:

• Role
• ClusterRole
• RoleBinding

Command:

kubectl auth can-i create pods

7. Admission Controllers

After RBAC passes:

Admission Controllers inspect request.

Examples:

• ResourceQuota
• LimitRanger
• PodSecurity
• MutatingAdmissionWebhook

Can:

• reject request
• modify request

Example: Automatically inject sidecar container.

8. Object Stored in etcd

After validation:

Pod object stored in:

etcd

etcd is Kubernetes database.

Stores:

• cluster state
• configs
• secrets
• pod definitions

At this point: POD NOT RUNNING YET.

Only metadata stored.

9. Scheduler Detects Unscheduled Pod

kube-scheduler continuously watches API server.

It sees:

Pod has no node assigned

10. Scheduler Selects Best Node

Scheduler checks:

• CPU requests
• memory requests
• taints/tolerations
• node affinity
• anti-affinity
• topology rules
• resource availability

Example

If pod requests:

resources:

requests:

cpu: “1”

memory: “1Gi”

scheduler finds matching node.

11. Scheduler Binds Pod to Node

Scheduler updates pod object:

spec.nodeName=worker-node-1

Stored again in etcd.

12. kubelet Watches API Server

kubelet runs on every worker node.

kubelet sees:

New pod assigned to my node

13. kubelet Starts Pod Creation

kubelet communicates with:

Container Runtime

Examples:

• containerd
• CRI-O
• Docker (old)

Using:

CRI (Container Runtime Interface)

14. Image Pull Starts

Container runtime checks:

Is image already present?

If not: pulls from registry.

Examples:

• DockerHub
• ECR
• GCR

Commands:

crictl images

or

docker images

15. CNI Plugin Configures Networking

Before container starts: network setup happens.

CNI plugins:

• Calico
• Flannel
• Cilium
• Weave

CNI does:

• assign pod IP
• setup routes
• configure veth pair
• connect pod namespace

Important Internal Networking

Linux namespaces created:

• network namespace
• process namespace
• mount namespace

veth pair created:

Pod ↔ Node bridge

16. Pause Container Created First

Kubernetes first creates:

pause container

Purpose: holds pod network namespace.

All containers inside pod share:

• same IP
• same network namespace

17. Main Container Starts

Then actual application container starts.

Example:

nginx container

18. Volume Mounting Happens

kubelet mounts:

• ConfigMap
• Secret
• PVC
• hostPath

before container startup.

19. Probes Start

If configured:

• liveness probe
• readiness probe
• startup probe

Example:

livenessProbe:

httpGet:

path: /

port: 80

20. Pod Status Changes

Stages:

Pending

ContainerCreating

Running

Check:

kubectl get pods

Detailed:

kubectl describe pod nginx-pod

21. Service Discovery Updates

CoreDNS updated.

Pod reachable via:

• service
• DNS name

Example:

myservice.default.svc.cluster.local

22. kube-proxy Updates Rules

kube-proxy updates:

• iptables or
• IPVS rules

for service routing.

23. Pod Becomes Ready

If readiness probe passes:

Pod added to:

• Service endpoints
• Load balancer targets

Traffic starts flowing.

Summary: When kubectl apply is executed, kubectl reads kubeconfig, authenticates with kube-apiserver, and sends REST request. API server performs authentication, RBAC authorization, admission controller validation, then stores object in etcd. Scheduler detects unscheduled pod and assigns a node. kubelet on that node communicates with container runtime to pull image and create containers. CNI configures networking, kube-proxy updates routing, CoreDNS updates discovery, probes validate health, and finally pod becomes Running and Ready.