Lesson 04 — Kubernetes Worker Nodes

Learning Objectives

By the end of this lesson, you will be able to:

Understand the purpose of Kubernetes Worker Nodes
Identify the components running on every Worker Node
Explain how workloads are executed
Understand the interaction between Worker Nodes and the Control Plane
Identify common security risks affecting Worker Nodes
Apply enterprise best practices for securing Worker Nodes

Why This Matters

The Control Plane makes decisions.

Worker Nodes perform the actual work.

Every application, microservice, API, and container running inside Kubernetes executes on a Worker Node.

If an attacker compromises a Worker Node, they may gain access to:

Running containers
Kubernetes Secrets
Service Account tokens
Customer workloads
Sensitive application data
Cloud credentials

This is why Worker Node security is one of the most critical responsibilities of a Kubernetes Security Engineer.

What is a Worker Node?

A Worker Node is a server—physical or virtual—that runs containerised applications.

Worker Nodes receive instructions from the Control Plane and execute workloads.

A Kubernetes cluster typically contains multiple Worker Nodes to provide:

High availability
Scalability
Load balancing
Fault tolerance
Resource optimisation

Kubernetes Cluster Architecture

                Control Plane
                     │
        ┌────────────┼────────────┐
        │            │            │
        ▼            ▼            ▼
   Worker 1     Worker 2     Worker 3
        │            │            │
      Pods         Pods         Pods

Applications run only on Worker Nodes.

Components of a Worker Node

Every Worker Node contains four primary components.

Component	Purpose
kubelet	Communicates with the Control Plane
kube-proxy	Manages networking
Container Runtime	Runs containers
Pods	Execute applications

Together these components enable Kubernetes to run workloads efficiently.

kubelet

The kubelet is the primary Kubernetes agent running on every Worker Node.

Its responsibilities include:

Registering the node with the Control Plane
Receiving instructions from the API Server
Starting containers
Monitoring Pod health
Restarting failed workloads
Reporting node status
Managing resource utilisation

Without kubelet, a Worker Node cannot participate in the cluster.

kubelet Communication

API Server

↓

kubelet

↓

Container Runtime

↓

Pods

The kubelet continuously communicates with the API Server to ensure that the node matches the desired cluster state.

Container Runtime

The Container Runtime is responsible for executing containers.

Modern Kubernetes environments commonly use:

containerd
CRI-O

Earlier Kubernetes versions frequently used Docker, but containerd is now the standard runtime for most enterprise deployments.

The Container Runtime:

Downloads images
Starts containers
Stops containers
Restarts containers
Reports container status

kube-proxy

kube-proxy manages networking on every Worker Node.

It is responsible for:

Routing traffic
Load balancing
Service discovery
Network forwarding
Maintaining network rules

Without kube-proxy, Pods would not be able to communicate reliably.

Pods on Worker Nodes

Worker Nodes execute Pods.

A Pod may contain:

One application container
Multiple tightly coupled containers

Example:

Worker Node

│

├── Pod A
│     ├── Web Server
│     └── Logging Sidecar
│
├── Pod B
│     └── API
│
└── Pod C
      └── Database Agent

Pods share resources such as networking and storage within the same Pod.

Worker Node Lifecycle

The lifecycle of a Worker Node follows these steps:

Node Created

↓

Registers with Control Plane

↓

Receives Workloads

↓

Runs Containers

↓

Reports Health

↓

Handles Updates

↓

Removed or Replaced

Modern Kubernetes environments frequently replace Worker Nodes automatically rather than repairing them.

Node Registration

When a Worker Node joins the cluster:

kubelet starts.
The node authenticates with the API Server.
The API Server validates the node.
The Scheduler begins assigning Pods.
Applications start running.

Only trusted Worker Nodes should be allowed to join the cluster.

Managed Worker Nodes in Amazon EKS

In Amazon EKS, Worker Nodes can be managed in several ways.

Managed Node Groups

AWS automatically manages:

Operating system updates
Node lifecycle
Scaling
Integration with EKS

Self-Managed Nodes

The organisation manages:

Operating system
Patching
Scaling
Security configuration
Maintenance

Managed Node Groups reduce operational overhead while still requiring workload-level security controls.

How Workloads Reach a Worker Node

Developer Deploys Application

↓

API Server

↓

Scheduler

↓

Worker Node Selected

↓

kubelet Receives Instructions

↓

Container Runtime Starts Pod

↓

Application Running

The Worker Node does not decide where Pods run—it only executes the assigned workload.

Worker Node Security Risks

Common risks include:

Unpatched operating systems
Privileged containers
Root access
Weak SSH controls
Container escape vulnerabilities
Exposed kubelet APIs
Excessive IAM permissions
Malware infections
Cryptomining attacks
Unencrypted disks

Compromising a Worker Node can often lead to broader cluster compromise.

Container Escape

One of the most serious threats is a container escape.

Container

↓

Operating System

↓

Worker Node

↓

Other Containers

↓

Entire Cluster

If an attacker escapes from a container to the underlying host, they may gain control of other workloads running on the same node.

Preventing container escape is a key security objective.

Worker Node Hardening

Enterprise security teams should:

Keep operating systems patched
Use hardened AMIs
Remove unnecessary software
Disable unused services
Restrict SSH access
Enable disk encryption
Protect kubelet
Apply least privilege IAM
Enable secure boot where available
Monitor system activity

Hardening significantly reduces the attack surface.

Enterprise Monitoring

Security teams continuously monitor Worker Nodes for:

Unusual processes
Cryptomining activity
Container escapes
High CPU utilisation
Unexpected network connections
Failed kubelet authentication
Suspicious file changes
Malware indicators
Unauthorised software installations

Runtime monitoring enables early detection of attacks.

Enterprise Example

A company hosts its online banking platform on Amazon EKS.

Each Worker Node runs:

Payment services
Customer APIs
Authentication services
Fraud detection applications

Security engineers implement:

Managed Node Groups
Encrypted EBS volumes
IAM Roles for Service Accounts (IRSA)
Runtime threat detection
Vulnerability scanning
Automated patching
Continuous monitoring

These controls reduce the risk of compromise while maintaining availability.

Best Practices

As a Kubernetes Security Engineer:

Use Managed Node Groups where appropriate
Patch Worker Nodes regularly
Disable unnecessary services
Encrypt storage volumes
Protect kubelet authentication
Restrict administrative access
Use least privilege IAM permissions
Monitor runtime behaviour
Scan workloads continuously
Replace compromised nodes instead of repairing them

Treat Worker Nodes as critical production infrastructure.

Key Takeaways

After completing this lesson, you should understand:

The purpose of Kubernetes Worker Nodes
The role of kubelet
The function of kube-proxy
How the Container Runtime executes workloads
How Worker Nodes communicate with the Control Plane
Common Worker Node security risks
Enterprise hardening and monitoring best practices

Understanding Worker Nodes provides the foundation for learning how Kubernetes schedules and secures workloads.

Knowledge Check

Question 1

Which component communicates directly with the Kubernetes API Server?

A. kube-proxy
B. kubelet
C. Pod
D. Deployment

Answer: B

Question 2

Which component is responsible for running containers?

A. Scheduler
B. API Server
C. Container Runtime
D. Deployment

Answer: C

Question 3

Which component manages networking on a Worker Node?

A. kubelet
B. kube-proxy
C. etcd
D. ReplicaSet

Answer: B

Question 4

Which of the following is a common security risk for Worker Nodes?

A. SQL Injection
B. Container Escape
C. DNS Spoofing
D. Cross-Site Scripting

Answer: B

Question 5

Which AWS feature simplifies the management of Kubernetes Worker Nodes?

A. AWS Lambda
B. Amazon RDS
C. Amazon EKS Managed Node Groups
D. Amazon CloudFront

Answer: C

What’s Next?

In the next lesson, you will learn about Pods, the smallest deployable unit in Kubernetes. You will explore Pod architecture, multi-container Pods, lifecycle management, and the security controls required to protect workloads running inside Pods.

➡️ Next Lesson: Lesson 05 — Pods, ReplicaSets & Deployments