Kubernetes DaemonSets explained: What they are and when to use them

A DaemonSet ensures that one copy of a pod runs on every node in the cluster. When a new node joins, the DaemonSet pod is automatically scheduled on it. When a node is removed, the pod is cleaned up. The DaemonSet controller handles all of this without any manual intervention.

This makes DaemonSets the right choice for node-level infrastructure components that need to run everywhere: log collectors, monitoring agents, CNI plugins, and storage drivers.

Real-world use cases

Log collection with Fluentd or Filebeat

A log-shipping DaemonSet runs one collector per node, reading from /var/log/containers and forwarding logs to a centralised backend like Elasticsearch or a cloud logging service. Without a DaemonSet, you would need to manually deploy a log collector every time a node is added.

Node monitoring with Prometheus node-exporter

node-exporter reads hardware and OS-level metrics from /proc and /sys on each node and exposes them for Prometheus to scrape. It must run on every node to provide complete cluster coverage. A DaemonSet ensures this automatically.

CNI plugins like Flannel and Calico

Your cluster already uses DaemonSets for core networking. Run the following to see them:

1kubectl get ds -A

Expected output:

1NAMESPACE     NAME          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR
2kube-system   kube-flannel  3         3         3       3            3           <none>
3kube-system   kube-proxy    3         3         3       3            3           kubernetes.io/os=linux

Flannel and kube-proxy run on every node including control plane nodes. This is because they have tolerations for the control plane taint. More on this below.

Working example

This DaemonSet runs a memory-reporting script on every node, logging free memory every five seconds:

1apiVersion: apps/v1
2kind: DaemonSet
3metadata:
4  name: memory-reporter
5  labels:
6    app: memory-reporter
7spec:
8  selector:
9    matchLabels:
10      app: memory-reporter
11  template:
12    metadata:
13      labels:
14        app: memory-reporter
15    spec:
16      containers:
17      - name: memory-reporter
18        image: busybox
19        command:
20        - sh
21        - -c
22        - while true; do free -m; sleep 5; done

1kubectl create -f ds.yaml

Verify the DaemonSet was created:

1kubectl get ds

Expected output:

1NAME              DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE
2memory-reporter   2         2         2       2            2

Check the pods — one per node:

1kubectl get pods

Expected output:

1NAME                    READY   STATUS    RESTARTS   AGE
2memory-reporter-abc12   1/1     Running   0          15s
3memory-reporter-def34   1/1     Running   0          15s

View logs from one of the pods:

1kubectl logs -f memory-reporter-abc12

See which nodes each pod is running on:

1kubectl get pods -o wide

See selector and image details for the DaemonSet:

1kubectl get ds -o wide

Running a DaemonSet on specific nodes

By default a DaemonSet runs on all schedulable nodes. Use nodeSelector to restrict it to a subset of nodes:

1spec:
2  template:
3    spec:
4      nodeSelector:
5        disktype: ssd

This is useful for DaemonSets that only make sense on nodes with specific hardware. Label nodes with kubectl label node <node-name> disktype=ssd and the DaemonSet will only run there.

Running a DaemonSet on control plane nodes

By default, DaemonSets do not run on control plane nodes because they carry a node-role.kubernetes.io/control-plane:NoSchedule taint. This taint prevents regular pods from being scheduled there.

To run a DaemonSet on control plane nodes as well, add a toleration for that taint in the pod spec:

1spec:
2  template:
3    spec:
4      tolerations:
5      - key: node-role.kubernetes.io/control-plane
6        operator: Exists
7        effect: NoSchedule
8      containers:
9      - name: my-daemonset-container
10        image: busybox

This is how system DaemonSets like Flannel and kube-proxy run on every node including control plane nodes. Without the toleration, the DaemonSet would skip control plane nodes entirely.