A DaemonSet is a Kubernetes workload that ensures one pod runs on each selected node in a cluster. As nodes are added or removed, Kubernetes automatically schedules or deletes those pods so coverage stays consistent across the environment.
DaemonSets matter in security because many agents need node-level visibility: runtime sensors, log shippers, network monitors, and host hardening tools are often deployed this way. A DaemonSet lets defenders collect events from every node without manually installing software on each machine. In attacks, the same pattern can be useful to an adversary who gains cluster control, because a malicious DaemonSet can place a container on every node for persistence, reconnaissance, or traffic interception. For that reason, teams should monitor who can create or modify DaemonSets, review their host mounts and privileges, and compare the running pods against approved security tooling.