Inside kubectl apply: Execution Flow from API Server to Container Runtime

1. kubectl apply -f deployment.yaml
   └── kubectl serializes the YAML → sends HTTP PATCH/POST to kube-apiserver

2. kube-apiserver
   └── Authenticates (who are you? — cert/token/OIDC)
   └── Authorizes (are you allowed? — RBAC check)
   └── Validates (is this valid YAML/schema? — admission controllers)
   └── Persists Deployment object to etcd
   └── Returns 200 OK to kubectl

3. Deployment Controller (inside kube-controller-manager)
   └── Watches etcd via API server for Deployment changes
   └── Detects new Deployment → creates a ReplicaSet object
   └── ReplicaSet controller detects ReplicaSet → creates Pod objects
   └── Pod objects stored in etcd with nodeName: "" (unscheduled)

4. kube-scheduler
   └── Watches for Pods with no nodeName assigned
   └── Evaluates all nodes: resources, affinity, taints, topology
   └── Picks best node → writes nodeName into Pod spec in etcd

5. kubelet (on the chosen node)
   └── Watches API server for pods assigned to its node
   └── Calls containerd to pull the image (if not cached)
   └── Starts the container(s)
   └── Reports pod status back to API server → etcd

6. kube-proxy (on all nodes)
   └── Watches for new Services/Endpoints
   └── Updates iptables/IPVS rules so traffic routes to new pod IP