In-tree controllers reference

Every controller built into kube-controller-manager, what it does, and where it lives.

Controller (descriptor name)	Source	Watches	Writes	Notes
deployment	pkg/controller/deployment/	Deployment, ReplicaSet, Pod	ReplicaSet, Deployment status	Rolling-update orchestration
replicaset	pkg/controller/replicaset/	ReplicaSet, Pod	Pod, ReplicaSet status	Pod count enforcement
replicationcontroller	pkg/controller/replication/	RC, Pod	Pod, RC status	Legacy v1 RC; thin wrapper around the RS controller
statefulset	pkg/controller/statefulset/	StatefulSet, Pod, PVC	Pod, PVC, StatefulSet status	Ordered create/delete, stable identity
daemon	pkg/controller/daemon/	DaemonSet, Pod, Node	Pod, DaemonSet status	One pod per matching node
job	pkg/controller/job/	Job, Pod	Pod, Job status	Backoff, parallelism, completions
cronjob	pkg/controller/cronjob/	CronJob, Job	Job, CronJob status	Schedules and history bookkeeping
endpoint	pkg/controller/endpoint/	Service, Pod	Endpoints	Legacy; replaced by EndpointSlice for new clusters
endpointslice	pkg/controller/endpointslice/	Service, EndpointSlice, Pod	EndpointSlice	Modern slice-based alternative
endpointslice-mirroring	pkg/controller/endpointslicemirroring/	Custom Endpoints	EndpointSlice	Mirrors externally managed Endpoints into slices
garbage-collector	pkg/controller/garbagecollector/	All resources via dynamic informers	DELETE on cascade	Owner-ref-driven cascade delete
namespace	pkg/controller/namespace/	Namespace	DELETE in terminating namespaces	Walks every API resource to clean a terminating ns
node-lifecycle	pkg/controller/nodelifecycle/	Node, Pod	Node taints, Pod eviction	Marks NotReady nodes, taints them, evicts pods
node-ipam	pkg/controller/nodeipam/	Node	Node.Spec.PodCIDRs	Allocates pod CIDR blocks per node
taint-eviction	pkg/controller/tainteviction/	Node taints, Pod	Pod eviction	Evicts pods that violate NoExecute taints
device-taint-eviction	pkg/controller/devicetainteviction/	DRA devices, Pod	Pod eviction	DRA equivalent of taint eviction
horizontal-pod-autoscaler	pkg/controller/podautoscaler/	HPA, target Scale subresource, metrics	Scale subresource	Computes desired replicas from metrics
pod-gc	pkg/controller/podgc/	Pod	DELETE on terminated pods	Trims completed pods past threshold
resource-claim	pkg/controller/resourceclaim/	ResourceClaim, Pod	ResourceClaim	DRA: bind claims to pods, reservation lifecycle
resourcepoolstatus	pkg/controller/resourcepoolstatusrequest/	ResourcePool	ResourcePool status	DRA pool status reconciliation
resourcequota	pkg/controller/resourcequota/	ResourceQuota, all consuming resources	ResourceQuota status	Tracks usage vs hard limits
serviceaccount	pkg/controller/serviceaccount/	ServiceAccount, Namespace	Default SA per namespace	Creates default SA in new namespaces
serviceaccount-token	pkg/controller/serviceaccount/ (sub-controller)	SA, Secret	Secret	Legacy auto-generated SA token. Disabled by default in new clusters
service-cidr	pkg/controller/servicecidrs/	ServiceCIDR, Service	ServiceCIDR status	Multi-CIDR Service VIP allocation
storage-version-gc	pkg/controller/storageversiongc/	StorageVersion	StorageVersion delete	Cleans up dangling per-apiserver storage version records
storageversion-migrator	pkg/controller/storageversionmigrator/	StorageVersionMigration	Triggers re-encryption	Drives one-shot storage migrations
bootstrap-signer	pkg/controller/bootstrap/	Secret, ConfigMap	cluster-info ConfigMap	Signs the cluster-info config used by kubeadm join
token-cleaner	pkg/controller/bootstrap/	bootstrap-token Secret	DELETE expired	Deletes expired bootstrap tokens
cluster-role-aggregation	pkg/controller/clusterroleaggregation/	ClusterRole	ClusterRole rules	Aggregates rules from labeled ClusterRoles into the parent
disruption	pkg/controller/disruption/	PDB, Pod, ReplicaSet, Deployment, StatefulSet	PDB status	Tracks pods covered by PodDisruptionBudgets
ttl	pkg/controller/ttl/	Node	Node annotation	Annotates nodes with the cluster's TTL setting
ttl-after-finished	pkg/controller/ttlafterfinished/	Job	DELETE	Deletes jobs after ttlSecondsAfterFinished
validatingadmissionpolicy-status	pkg/controller/validatingadmissionpolicystatus/	VAP	VAP status	Reports type-check results
pv-protection, pvc-protection, attach-detach, pv-binder, expand, ephemeral-volume	pkg/controller/volume/...	PV, PVC, Pod	PV, PVC bindings; VolumeAttachment	The five-pronged volume control plane
certificate-signing	pkg/controller/certificates/signer/	CSR	CSR.Status.Certificate	Built-in signers for the kubelet client/serving certs
certificate-approval	pkg/controller/certificates/approver/	CSR	CSR.Status.Conditions	Auto-approves valid kubelet CSRs
certificate-cleanup	pkg/controller/certificates/cleaner/	CSR	CSR delete	Deletes old CSRs

The descriptor table that wires names to start-functions is in cmd/kube-controller-manager/app/controller_descriptor.go. Each entry is one row of the form {name, aliases, requiredFeatureGates, isCloud, defaultDisabled, startFn}.

Cross-component note

The cloud-controller-manager (CCM) re-uses three of these descriptors via the cloud-provider library: cloud-node, cloud-node-lifecycle, service-lb-controller, and route. Operators run the CCM alongside kube-controller-manager with the cloud-only controllers disabled in --controllers on the latter.