DaemonSets

One Pod Per Node

Some workloads are node-scoped: log shippers, metric agents, storage plugins, network helpers. A DaemonSet controller watches nodes and creates a pod on every node matching its node selector — including nodes added later, with no rescheduling help from you.

Placement uses a privileged path: the controller can bind pods directly to matched nodes, and DaemonSet pods receive default tolerations for node.kubernetes.io/not-ready, unreachable, and pressure taints so monitoring survives node trouble that would block ordinary pods.

Each pod carries an ownerReference to the DaemonSet, so kubectl delete ds removes them all. On node deletion its pod disappears with it; on mere node failure the pod lingers until eviction logic catches up.

Scoping and Upgrades

spec:
  selector: { matchLabels: { name: log-shipper } }
  updateStrategy:
    type: RollingUpdate
    rollingUpdate: { maxUnavailable: 1 }
  template:
    spec:
      nodeSelector: { node-role.kubernetes.io/worker: "" }
      tolerations:
      - { key: node-role.kubernetes.io/control-plane, effect: NoSchedule, operator: Exists }

Set updateStrategy: OnDelete when pods should restart only on your command — common for kernel-adjacent agents that must not all cycle at once. With RollingUpdate, maxUnavailable throttles disruption across hundreds of nodes; without it the default permits 10% (rounded up).

Pitfalls and Interview Angles

Pitfall 1 — double agents. Running a log shipper as both a DaemonSet and a pod sidecar duplicates every line; pick one scope. Manually editing pod counts is futile — the controller reconciles per matching node.

Pitfall 2 — taints hiding nodes. A custom taint without a matching toleration silently skips nodes; compare kubectl get pods -o wide against kubectl get nodes to find the gap. DaemonSets are also how you accidentally crash every node at once — a bad image rolls everywhere unless maxUnavailable is low.

Interview-ready: contrast DaemonSet (per-node) with Deployment (per-replica), name real users — kube-proxy runs as a DaemonSet on every node — and describe a safe upgrade with rolling maxUnavailable or staged OnDelete restarts.