Skip to main content

Chapter 7.2 - DaemonSets

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand what a DaemonSet is
  • Deploy DaemonSets
  • Use node selectors and affinities
  • Manage DaemonSets with node updates
  • Understand typical use cases
  • Configure DaemonSets for specific nodes

Introduction​

A DaemonSet ensures that a Pod runs on all (or some) nodes in the cluster. Unlike Deployments that manage a specific number of Pods, DaemonSets create one Pod per node.

What is a DaemonSet?​

A DaemonSet guarantees that a copy of a Pod runs on each node (or on selected nodes) in the cluster.

Characteristics​

  • One Pod per node: Automatically deployed on each node
  • Self-managed: Creates/deletes Pods when nodes are added/removed
  • Node-specific: Can target specific nodes with selectors
  • System-level: Ideal for system services

Typical Use Cases​

1. Logging Agents​

Collect logs from all nodes:

2. Monitoring Agents​

Collect metrics from all nodes:

  • Prometheus Node Exporter
  • Datadog Agent
  • New Relic Agent

3. Security Agents​

  • Antivirus
  • Intrusion Detection
  • Compliance scanners

4. Networking​

  • kube-proxy (already a DaemonSet in Kubernetes)
  • CNI plugins
  • Network policies enforcement

5. Storage​

  • Storage drivers
  • Volume plugins

Example: Fluentd for Logging​

Fluentd DaemonSet​

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: fluentd
  template:
    metadata:
      labels:
        name: fluentd
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      containers:
      - name: fluentd
        image: fluent/fluentd-kubernetes-daemonset:v1-debian-elasticsearch
        env:
        - name: FLUENT_ELASTICSEARCH_HOST
          value: "elasticsearch.logging.svc.cluster.local"
        - name: FLUENT_ELASTICSEARCH_PORT
          value: "9200"
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /var/log
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers

Node Selectors​

Deploy only on specific nodes:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: monitoring-agent
spec:
  template:
    spec:
      nodeSelector:
        monitoring: "enabled"
      containers:
      - name: agent
        image: monitoring-agent:1.0

Result: The DaemonSet creates Pods only on nodes with the label monitoring=enabled.

Node Affinities​

More advanced control with affinities:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: gpu-monitor
spec:
  template:
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: accelerator
                operator: In
                values:
                - nvidia-tesla-k80
                - nvidia-tesla-v100
      containers:
      - name: gpu-monitor
        image: gpu-monitor:1.0

Tolerations​

DaemonSets can tolerate taints to run on tainted nodes:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: system-monitor
spec:
  template:
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      containers:
      - name: monitor
        image: system-monitor:1.0

Result: The DaemonSet also runs on master/control-plane nodes.

Example: Prometheus Node Exporter​

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-exporter
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: node-exporter
  template:
    metadata:
      labels:
        app: node-exporter
    spec:
      hostNetwork: true
      hostPID: true
      containers:
      - name: node-exporter
        image: prom/node-exporter:v1.5.0
        args:
        - --path.procfs=/host/proc
        - --path.sysfs=/host/sys
        - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($|/)
        volumeMounts:
        - name: proc
          mountPath: /host/proc
          readOnly: true
        - name: sys
          mountPath: /host/sys
          readOnly: true
      volumes:
      - name: proc
        hostPath:
          path: /proc
      - name: sys
        hostPath:
          path: /sys

Updates​

Rolling Update (Default)​

spec:
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1

Process: Progressive update of Pods on each node.

OnDelete​

spec:
  updateStrategy:
    type: OnDelete

Process: Update only when a Pod is manually deleted.

Useful Commands​

Management​

# View DaemonSets
kubectl get daemonset
kubectl get ds

# Details
kubectl describe daemonset fluentd

# View Pods
kubectl get pods -l name=fluentd

# Logs
kubectl logs -l name=fluentd

Updates​

# Update the image
kubectl set image daemonset/fluentd fluentd=fluent/fluentd:v2

# View status
kubectl rollout status daemonset/fluentd

# Rollback
kubectl rollout undo daemonset/fluentd

Differences: DaemonSet vs Deployment​

CharacteristicDeploymentDaemonSet
Number of PodsSpecified (replicas)One per node
PlacementRandomOn each node
Use CaseApplicationsSystem services
ScalingManualAutomatic (based on nodes)
Node updatesNot managedSelf-managed

Best Practices​

1. Use for System Services​

DaemonSets for system agents, not for business applications.

2. Appropriate Resources​

Define resource limits to prevent exhaustion.

3. Tolerations​

Add tolerations for tainted nodes if necessary.

4. Monitoring​

Ensure all nodes have a DaemonSet Pod running.

5. Namespace​

Place system DaemonSets in kube-system or a dedicated namespace.

Summary​

In this chapter, you learned:

DaemonSet: One Pod per cluster node
Use cases: Logging, monitoring, security, and networking agents
Node selectors: Deploy on specific nodes
Tolerations: Run on tainted nodes
Updates: RollingUpdate or OnDelete
Differences: One per node vs specific number
Best practices: System services, resources, monitoring

Next Steps​

Chapter 7.3: Jobs
Chapter 7.4: CronJobs

Chapter created: December 2024