func main() {
 command := app.NewKubeletCommand()

 // kubelet 使用一个配置文件，并对标志和该配置文件进行自己的特殊解析。
    // 完成后，它会初始化日志记录。因此，它不像其他更简单的命令那样使用 cli.Run()
 code := run(command)
 os.Exit(code)
}

func run(command *cobra.Command) int {
 defer logs.FlushLogs()
 rand.Seed(time.Now().UnixNano())

 command.SetGlobalNormalizationFunc(cliflag.WordSepNormalizeFunc)
 if err := command.Execute(); err != nil {
  return 1
 }
 return 0
}

func NewKubeletCommand() *cobra.Command {
 cleanFlagSet := pflag.NewFlagSet(componentKubelet, pflag.ContinueOnError)
 cleanFlagSet.SetNormalizeFunc(cliflag.WordSepNormalizeFunc)

    // 1、kubelet 配置分两部分:
    // KubeletFlag: 指那些不允许在 kubelet 运行时进行修改的配置集，或者不能在集群中各个 Nodes 之间共享的配置集。
    // KubeletConfiguration: 指可以在集群中各个Nodes之间共享的配置集，可以进行动态配置。
    kubeletFlags := options.NewKubeletFlags()
    kubeletConfig, err := options.NewKubeletConfiguration()

    cmd := &cobra.Command{
        Use: componentKubelet,
        DisableFlagParsing: true,
        ......
        RunE: func(cmd *cobra.Command, args []string) error {
            // 2、解析命令行标志，这里禁用了 cobra 的标志解析
   if err := cleanFlagSet.Parse(args); err != nil {
    return fmt.Errorf("failed to parse kubelet flag: %w", err)
   }
            ...... // 一系列验证行为


            // 3、初始化 feature gates 配置
   if err := utilfeature.DefaultMutableFeatureGate.SetFromMap(kubeletConfig.FeatureGates); err != nil {
    return fmt.Errorf("failed to set feature gates from initial flags-based config: %w", err)
   }

   // 验证初始的 kubelet 标志
   if err := options.ValidateKubeletFlags(kubeletFlags); err != nil {
    return fmt.Errorf("failed to validate kubelet flags: %w", err)
   }

            if kubeletFlags.ContainerRuntime == "remote" && cleanFlagSet.Changed("pod-infra-container-image") {
                klog.Warning("Warning: For remote container runtime, --pod-infra-container-image is ignored in kubelet, which should be set in that      remote runtime instead")
            }

            // 4、加载 kubelet 配置文件
            if configFile := kubeletFlags.KubeletConfigFile; len(configFile) > 0 {
                kubeletConfig, err = loadConfigFile(configFile)
                ......
            }
            // 5、校验配置文件中的参数
   if err := kubeletconfigvalidation.ValidateKubeletConfiguration(kubeletConfig); err != nil {
    return fmt.Errorf("failed to validate kubelet configuration, error: %w, path: %s", err, kubeletConfig)
   }

            // 6、检查 kubelet 是否启用动态配置功能
   if utilfeature.DefaultFeatureGate.Enabled(features.DynamicKubeletConfig) {
    return fmt.Errorf("cannot set feature gate %v to %v, feature is locked to %v", features.DynamicKubeletConfig, true, false)
   }

            // 配置和标志解析完成后，开始初始化日志
            logs.InitLogs()

            // 从 kubeletFlags 和 kubeletConfig 构造一个 kubeletServer
            kubeletServer := &options.KubeletServer{
                KubeletFlags:         *kubeletFlags,
                KubeletConfiguration: *kubeletConfig,
            }

            // 7、初始化 kubeletDeps
            kubeletDeps, err := UnsecuredDependencies(kubeletServer, utilfeature.DefaultFeatureGate)

            // 检查 kubelet 是否以 root 权限启动
            if err := checkPermissions(); err != nil {
   }

   // 8、调用 Run 方法，即开始运行 kubelet
   return Run(ctx, kubeletServer, kubeletDeps, utilfeature.DefaultFeatureGate)
        },
    }
    kubeletFlags.AddFlags(cleanFlagSet)
    options.AddKubeletConfigFlags(cleanFlagSet, kubeletConfig)
    options.AddGlobalFlags(cleanFlagSet)
    ......

    return cmd
}

const (
 // When these values are updated, also update test/utils/image/manifest.go
 defaultPodSandboxImageName    = "k8s.gcr.io/pause"
 defaultPodSandboxImageVersion = "3.5"
)

var (
 defaultPodSandboxImage = defaultPodSandboxImageName +
  ":" + defaultPodSandboxImageVersion
)

// NewContainerRuntimeOptions will create a new ContainerRuntimeOptions with
// default values.
func NewContainerRuntimeOptions() *config.ContainerRuntimeOptions {
 dockerEndpoint := ""
 if runtime.GOOS != "windows" {
  dockerEndpoint = "unix:///var/run/docker.sock"
 }

 return &config.ContainerRuntimeOptions{
  ContainerRuntime:          kubetypes.DockerContainerRuntime,
  DockerEndpoint:            dockerEndpoint,
  DockershimRootDirectory:   "/var/lib/dockershim",
  PodSandboxImage:           defaultPodSandboxImage,
  ImagePullProgressDeadline: metav1.Duration{Duration: 1 * time.Minute},

  CNIBinDir:   "/opt/cni/bin",
  CNIConfDir:  "/etc/cni/net.d",
  CNICacheDir: "/var/lib/cni/cache",
 }
}

func Run(ctx context.Context, s *options.KubeletServer, kubeDeps *kubelet.Dependencies, featureGate featuregate.FeatureGate) error {
 if err := initForOS(s.KubeletFlags.WindowsService, s.KubeletFlags.WindowsPriorityClass); err != nil {
  return fmt.Errorf("failed OS init: %w", err)
 }
 if err := run(ctx, s, kubeDeps, featureGate); err != nil {
  return fmt.Errorf("failed to run Kubelet: %w", err)
 }
 return nil
}

func run(ctx context.Context, s *options.KubeletServer, kubeDeps *kubelet.Dependencies, featureGate featuregate.FeatureGate) (err error) {
 // 1、根据初始 KubeletServer 设置默认的特性
 err = utilfeature.DefaultMutableFeatureGate.SetFromMap(s.KubeletConfiguration.FeatureGates)

    // 2、验证初始的 KubeletServer(我们先设置了特性，因为这个验证依赖于特性)
 err := options.ValidateKubeletServer(s)

 // 如果使用 cgroups v1 启用 MemoryQoS，则发出警告
 if utilfeature.DefaultFeatureGate.Enabled(features.MemoryQoS) && !isCgroup2UnifiedMode() {
 }
 // 3、获取 kubelet 的锁文件
 if s.ExitOnLockContention && s.LockFilePath == "" {
 }

 // 4、将当前的配置文件注册到 /configz 端点上，也就是说，通过 HTTP 访问 kubelet
 err = initConfigz(&s.KubeletConfiguration)

 // 5、即将获取 client，判断是否为 standalone 模式
 standaloneMode := true
 if len(s.KubeConfig) > 0 {
  standaloneMode = false
 }

    // 6、初始化 kubeDeps
 kubeDeps, err = UnsecuredDependencies(s, featureGate)
 hostName, err := nodeutil.GetHostname(s.HostnameOverride)
 nodeName, err := getNodeName(kubeDeps.Cloud, hostName)

 // 7、如果是 standalone 模式将所有 client 设置为 nil
 switch {
 case standaloneMode:
  kubeDeps.KubeClient = nil
  kubeDeps.EventClient = nil
  kubeDeps.HeartbeatClient = nil
  // 8、为 kubeDeps 初始化 KubeClient、EventClient、HeartbeatClient 模块
 case kubeDeps.KubeClient == nil, kubeDeps.EventClient == nil, kubeDeps.HeartbeatClient == nil:
        clientConfig, closeAllConns, err := buildKubeletClientConfig(ctx, s, nodeName)
        kubeDeps.KubeClient, err = clientset.NewForConfig(clientConfig)
        ......
 }
 // 9、初始化 auth 模块
 if kubeDeps.Auth == nil {
  auth, runAuthenticatorCAReload, err := BuildAuth(nodeName, kubeDeps.KubeClient, s.KubeletConfiguration)
  kubeDeps.Auth = auth
  runAuthenticatorCAReload(ctx.Done())
 }

    // 10、设置 CGroup Root
 var cgroupRoots []string
 nodeAllocatableRoot := cm.NodeAllocatableRoot(s.CgroupRoot, s.CgroupsPerQOS, s.CgroupDriver)
 cgroupRoots = append(cgroupRoots, nodeAllocatableRoot)
 kubeletCgroup, err := cm.GetKubeletContainer(s.KubeletCgroups)

 // 11、初始化 CAdvisor
 if kubeDeps.CAdvisorInterface == nil {
  imageFsInfoProvider := cadvisor.NewImageFsInfoProvider(s.RemoteRuntimeEndpoint)
  kubeDeps.CAdvisorInterface, err = cadvisor.New(imageFsInfoProvider, s.RootDirectory, cgroupRoots, cadvisor.UsingLegacyCadvisorStats(s.RemoteRuntimeEndpoint))
 }

 // Setup event recorder if required.
 makeEventRecorder(kubeDeps, nodeName)

    // 12、初始化 ContainerManager(即.容器管理器)
 if kubeDeps.ContainerManager == nil {
        ......
 }

    // 14、为 kubelet 进程设置 oom 分数
 // TODO(vmarmol): 通过container config执行此操作。
 oomAdjuster := kubeDeps.OOMAdjuster

    // 在 RunKubelet()(即.运行 kubelet) 初始化 runtime 服务
 err = kubelet.PreInitRuntimeService(&s.KubeletConfiguration, kubeDeps, s.RemoteRuntimeEndpoint, s.RemoteImageEndpoint)

    // 15、设置和运行 kubelet
 err := RunKubelet(s, kubeDeps, s.RunOnce)

    // 16、启动 Healthz http server
 if s.HealthzPort > 0 {
  mux := http.NewServeMux()
  healthz.InstallHandler(mux)
  go wait.Until(func() {
   err := http.ListenAndServe(net.JoinHostPort(s.HealthzBindAddress, strconv.Itoa(int(s.HealthzPort))), mux)
  }, 5*time.Second, wait.NeverStop)
 }

 if s.RunOnce {
  return nil
 }
 // 17、如果使用了 systemd，则向 systemd 发送启动信号
 go daemon.SdNotify(false, "READY=1")

 select {
 case <-done:
  break
 case <-ctx.Done():
  break
 }

 return nil
}

func RunKubelet(kubeServer *options.KubeletServer, kubeDeps *kubelet.Dependencies, runOnce bool) error {
 hostname, err := nodeutil.GetHostname(kubeServer.HostnameOverride)
 if err != nil {
  return err
 }
 // Query the cloud provider for our node name, default to hostname if kubeDeps.Cloud == nil
 nodeName, err := getNodeName(kubeDeps.Cloud, hostname)
 if err != nil {
  return err
 }
 hostnameOverridden := len(kubeServer.HostnameOverride) > 0
 // Setup event recorder if required.
 makeEventRecorder(kubeDeps, nodeName)

 var nodeIPs []net.IP
 if kubeServer.NodeIP != "" {
  for _, ip := range strings.Split(kubeServer.NodeIP, ",") {
   parsedNodeIP := netutils.ParseIPSloppy(strings.TrimSpace(ip))
   if parsedNodeIP == nil {
    klog.InfoS("Could not parse --node-ip ignoring", "IP", ip)
   } else {
    nodeIPs = append(nodeIPs, parsedNodeIP)
   }
  }
 }

 if len(nodeIPs) > 2 || (len(nodeIPs) == 2 && netutils.IsIPv6(nodeIPs[0]) == netutils.IsIPv6(nodeIPs[1])) {
  return fmt.Errorf("bad --node-ip %q; must contain either a single IP or a dual-stack pair of IPs", kubeServer.NodeIP)
 } else if len(nodeIPs) == 2 && kubeServer.CloudProvider != "" {
  return fmt.Errorf("dual-stack --node-ip %q not supported when using a cloud provider", kubeServer.NodeIP)
 } else if len(nodeIPs) == 2 && (nodeIPs[0].IsUnspecified() || nodeIPs[1].IsUnspecified()) {
  return fmt.Errorf("dual-stack --node-ip %q cannot include '0.0.0.0' or '::'", kubeServer.NodeIP)
 }
 // 1、默认启动特权模式
 capabilities.Initialize(capabilities.Capabilities{
  AllowPrivileged: true,
 })

 credentialprovider.SetPreferredDockercfgPath(kubeServer.RootDirectory)
 klog.V(2).InfoS("Using root directory", "path", kubeServer.RootDirectory)

 if kubeDeps.OSInterface == nil {
  kubeDeps.OSInterface = kubecontainer.RealOS{}
 }

 if kubeServer.KubeletConfiguration.SeccompDefault && !utilfeature.DefaultFeatureGate.Enabled(features.SeccompDefault) {
  return fmt.Errorf("the SeccompDefault feature gate must be enabled in order to use the SeccompDefault configuration")
 }

    // 2、调用 createAndInitKubelet() 函数，以初始化 kubelet
 k, err := createAndInitKubelet(&kubeServer.KubeletConfiguration,
  kubeDeps,
  &kubeServer.ContainerRuntimeOptions,
  hostname,
  hostnameOverridden,
  nodeName,
  nodeIPs,
  kubeServer.ProviderID,
  kubeServer.CloudProvider,
  kubeServer.CertDirectory,
  kubeServer.RootDirectory,
  kubeServer.ImageCredentialProviderConfigFile,
  kubeServer.ImageCredentialProviderBinDir,
  kubeServer.RegisterNode,
  kubeServer.RegisterWithTaints,
  kubeServer.AllowedUnsafeSysctls,
  kubeServer.ExperimentalMounterPath,
  kubeServer.KernelMemcgNotification,
  kubeServer.ExperimentalCheckNodeCapabilitiesBeforeMount,
  kubeServer.ExperimentalNodeAllocatableIgnoreEvictionThreshold,
  kubeServer.MinimumGCAge,
  kubeServer.MaxPerPodContainerCount,
  kubeServer.MaxContainerCount,
  kubeServer.MasterServiceNamespace,
  kubeServer.RegisterSchedulable,
  kubeServer.KeepTerminatedPodVolumes,
  kubeServer.NodeLabels,
  kubeServer.NodeStatusMaxImages,
  kubeServer.KubeletFlags.SeccompDefault || kubeServer.KubeletConfiguration.SeccompDefault,
 )
 if err != nil {
  return fmt.Errorf("failed to create kubelet: %w", err)
 }

 // NewMainKubelet should have set up a pod source config if one didn't exist
 // when the builder was run. This is just a precaution.
 if kubeDeps.PodConfig == nil {
  return fmt.Errorf("failed to create kubelet, pod source config was nil")
 }
 podCfg := kubeDeps.PodConfig

 if err := rlimit.SetNumFiles(uint64(kubeServer.MaxOpenFiles)); err != nil {
  klog.ErrorS(err, "Failed to set rlimit on max file handles")
 }

 // process pods and exit.
 if runOnce {
  if _, err := k.RunOnce(podCfg.Updates()); err != nil {
   return fmt.Errorf("runonce failed: %w", err)
  }
  klog.InfoS("Started kubelet as runonce")
 } else {
        // 3、调用 startKubelet() 函数继续执行后续 kubelet 启动逻辑
  startKubelet(k, podCfg, &kubeServer.KubeletConfiguration, kubeDeps, kubeServer.EnableServer)
  klog.InfoS("Started kubelet")
 }
 return nil
}

func startKubelet(k kubelet.Bootstrap, podCfg *config.PodConfig, kubeCfg *kubeletconfiginternal.KubeletConfiguration, kubeDeps *kubelet.Dependencies, enableServer bool) {
 // kubelet 真正启动，在这里面会有开始同步循环并监听 Pod 的逻辑调用，即启动 syncLoop
 go k.Run(podCfg.Updates())

 // 同时启动 kubelet 的 HTTP 服务，并开始监听端口
 if enableServer {
  go k.ListenAndServe(kubeCfg, kubeDeps.TLSOptions, kubeDeps.Auth)
 }
 if kubeCfg.ReadOnlyPort > 0 {
  go k.ListenAndServeReadOnly(netutils.ParseIPSloppy(kubeCfg.Address), uint(kubeCfg.ReadOnlyPort))
 }
 if utilfeature.DefaultFeatureGate.Enabled(features.KubeletPodResources) {
  go k.ListenAndServePodResources()
 }
}

func (kl *Kubelet) Run(updates <-chan kubetypes.PodUpdate) {
    // 1、在 HTTP Server 的 /logs/ 端点上注册日志服务
 kl.logServer = http.StripPrefix("/logs/", http.FileServer(http.Dir("/var/log/")))

 // 2、判断是否需要启动云提供商的同步管理器
 if kl.cloudResourceSyncManager != nil {
  go kl.cloudResourceSyncManager.Run(wait.NeverStop)
 }

    // 3、调用 kubelet.initializeModules 首先启动不依赖容器 runtime 的一些模块
 if err := kl.initializeModules(); err != nil {
  kl.recorder.Eventf(kl.nodeRef, v1.EventTypeWarning, events.KubeletSetupFailed, err.Error())
 }

 // 4、启动 Volume 管理器
 go kl.volumeManager.Run(kl.sourcesReady, wait.NeverStop)

 if kl.kubeClient != nil {
  // Introduce some small jittering to ensure that over time the requests won't start
  // accumulating at approximately the same time from the set of nodes due to priority and
  // fairness effect.
        // 5、执行 kl.syncNodeStatus 定时同步 Node 状态
  go wait.JitterUntil(kl.syncNodeStatus, kl.nodeStatusUpdateFrequency, 0.04, true, wait.NeverStop)
  // 6、调用 kl.fastStatusUpdateOnce 更新容器运行时启动时间以及执行首次状态同步
        go kl.fastStatusUpdateOnce()

  // 7、弃用 NodeLease 机制
  go kl.nodeLeaseController.Run(wait.NeverStop)
 }
    // 8、执行 kl.updateRuntimeUp 定时更新 Runtime 状态
 go wait.Until(kl.updateRuntimeUp, 5*time.Second, wait.NeverStop)

 // 9、执行 kl.syncNetworkUtil 定时同步 iptables 规则
 if kl.makeIPTablesUtilChains {
  kl.initNetworkUtil()
 }

    // Start component sync loops.(启动组件的同步循环)
 kl.statusManager.Start()

 // 启动 runtime 类管理器
 if kl.runtimeClassManager != nil {
  kl.runtimeClassManager.Start(wait.NeverStop)
 }

 // 启动 Pod 生命周期事件生成器
 kl.pleg.Start()
    // 13、调用 kubelet.syncLoop 监听 Pod 变化
 kl.syncLoop(updates, kl)
}