Which component do kubectl, kubelets and controllers all talk to?

Why this is the answer

The kube-apiserver is the only component the others speak to: it authenticates, validates and admits every request, then persists the result. etcd is reached only by the API server, never by kubelets or controllers directly. The controller-manager is a client of the API server like everything else, and kube-proxy handles Service traffic on nodes — despite the name, it proxies nothing for the control plane.