What kubectl apply Actually Does: A Step-by-Step Journey to a Running Pod

When a user runs kubectl apply, the process begins with client-side YAML validation before the request is sent to the Kubernetes API server, where authentication, authorization, and admission control checks are performed. Only after passing these checks is the desired state written to etcd, at which point kubectl returns 'created' — though no containers have started yet. Controllers then detect the gap between desired and actual state, creating the necessary ReplicaSet and Pod objects, while the scheduler assigns each pod to a suitable worker node based on available resources. The kubelet on each assigned node pulls the container image and instructs the runtime to start it, with errors like ImagePullBackOff or CrashLoopBackOff surfacing at this stage. Finally, liveness and readiness probes determine when a pod is eligible to receive traffic, explaining why a pod can show as 'Running' yet remain unreachable.