The kube-apiserver is the only component the others speak to: it authenticates, validates and admits every request, then persists the result. etcd is reached only by the API server, never by kubelets or controllers directly. The controller-manager is a client of the API server like everything else, and kube-proxy handles Service traffic on nodes — despite the name, it proxies nothing for the control plane.
Official docs