DaemonSet

A DaemonSet is a Kubernetes workload that runs a copy of a pod on every node, or on a chosen subset of nodes. Unlike a Deployment, which targets a replica count, a DaemonSet targets nodes: the number of pods follows the number of eligible nodes.

How it works

The DaemonSet controller creates one pod for each eligible node and the default scheduler binds each pod to its node. When a node joins the cluster, it gets a pod. When a node is removed, its pod is garbage-collected. Deleting the DaemonSet deletes the pods it created.

To limit which nodes qualify, set nodeSelector or affinity in the pod template. The controller also adds some tolerations automatically, and you can add your own, for example to run on tainted control-plane nodes. See taints and tolerations and node affinity.

Typical uses are a log collector, a node monitoring agent, and storage or networking daemons that must exist on each node. Examples include Fluent Bit, the Prometheus node exporter, and the AWS VPC CNI plugin.

A practical example

This manifest runs a log agent on every node and mounts the host log directory.

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: log-agent
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: log-agent
  template:
    metadata:
      labels:
        name: log-agent
    spec:
      containers: [{name: agent, image: "quay.io/fluentd_elasticsearch/fluentd:v5.0.1", resources: {requests: {cpu: 100m, memory: 200Mi}, limits: {memory: 200Mi}}, volumeMounts: [{name: varlog, mountPath: /var/log}]}]
      volumes: [{name: varlog, hostPath: {path: /var/log}}]

Common mistakes

• Omitting resource requests and limits. The agent runs on every node, so an unbounded agent can starve workloads everywhere. See resource requests and limits.
• Forgetting tolerations, so the pod silently skips tainted nodes such as GPU or control-plane nodes.
• Assuming a DaemonSet works on every compute type. AWS documents that DaemonSets are not supported on Fargate, so the agent must run as a sidecar container instead.
• Using a DaemonSet for an ordinary application that only needs a fixed number of replicas.

When to use it and when not to

Use a DaemonSet when the workload is tied to the node itself: collecting host logs and metrics, enforcing node-level networking, or exposing node-local storage. Do not use one for stateless services (use a Deployment) or for workloads that need stable identity and storage (use a StatefulSet). For node-level agents, keep each pod small, because its cost is multiplied by the node count.

See also

• Kubernetes
• StatefulSet
• Fargate
• Taints and tolerations
• Fluent Bit on Kubernetes