The kube-apiserver is the sole component that reads and writes etcd; everything else goes through the apiserver's API. The scheduler, controllers, kubelet and kube-proxy never connect to etcd directly — routing all access through one gateway preserves consistency and security.
Official docs