A DaemonSet runs one Pod on each eligible cluster node, or on each node in a selected subset. It is useful for node-level agents that collect logs, monitor processes, or provide networking services. Unlike a Deployment, it has no replica count: the number of Pods follows the number of eligible nodes. A node with an untolerated taint is not eligible; this commonly excludes control-plane nodes. section 17.1 section 17.1.1 section 17.4
Listing 17.1 A DaemonSet manifest example
apiVersion: apps/v1 #1
kind: DaemonSet #1
metadata:
name: demo #2
spec:
selector: #3
matchLabels: #3
app: demo #3
template: #4
metadata: #4
labels: #4
app: demo #4
spec: #4
containers: #4
- name: demo #4
image: busybox #4
command: #4
- sleep #4
- infinity #4
A minimal apps/v1 manifest shows the two essential parts: a label selector and a Pod template whose labels match it. The example Pods run sleep so their placement is easy to inspect. section 17.1.2
The DaemonSet controller checks which Pods match its label selector and reconciles them against the nodes: it creates a Pod for a newly eligible node and removes one when a node leaves. To limit placement, set spec.template.spec.nodeSelector to match node labels. The node selector chooses nodes; the Pod label selector identifies Pods owned by the DaemonSet. section 17.1.1 section 17.1.3
Inspect and narrow placement
Apply a manifest with kubectl apply -f ds.demo.yaml, then run kubectl get ds to compare DESIRED, CURRENT, and READY. Use kubectl get pods -l app=demo -o wide to see each Pod’s node. Adding nodeSelector: {gpu: cuda} to the Pod template produces no Pods if no nodes have that label; labeling an eligible node gpu=cuda brings a Pod into scope, and removing the label takes it out. section 17.1.2 section 17.1.3
Changing the Pod template also changes the Pods. RollingUpdate replaces them automatically, normally stopping an old Pod before starting its replacement on that node. OnDelete waits until you delete each old Pod, letting you choose the pace. For node agents that need host resources, configure that access in the Pod template. A hostPort can forward a node port to its local agent Pod; unlike a NodePort Service, it does not send the connection to a Pod on another node. section 17.1.4 section 17.2 section 17.3.1
