DaemonSets
One pod per node, for agents and exporters.
In plain terms
A DaemonSet is “one first-aid kit on every floor.” Every node gets exactly one copy, and any new floor that opens automatically gets one too.
A DaemonSet runs exactly one copy of a pod on every node — or every node matching a selector — and automatically adds one to any new node that joins. It is the pattern for things that must be everywhere: log shippers, monitoring agents, CNI plugins, and kube-proxy itself.
terminal
$ kubectl get ds -ANAMESPACE NAME DESIRED CURRENT READY NODE SELECTORkube-system kube-proxy 3 3 3 <none>kube-system cilium 3 3 3 <none>
DaemonSet pods sidestep normal scheduling in spirit — one per node is the whole point — and they usually carry broad tolerations so they land even on tainted control-plane nodes. That is exactly how kube-proxy and the CNI manage to run everywhere.
DaemonSets respect nodeSelector
Scope one to a subset with a nodeSelector — say, only GPU nodes for a device plugin — and it runs on just those, growing and shrinking with them.