The correct option is kubelet.

The kubelet runs on each node and is the node agent that implements the PodSpec stored by the control plane. It watches the API server for Pods scheduled to its node and coordinates container lifecycle on that node. The kubelet uses the Container Runtime Interface to request image pulls and instructs the local runtime to download images and create containers.

The container runtime is the component that actually performs the network download and stores the image on disk, but it acts on requests from the kubelet and does not by itself decide or manage Pod lifecycle. That is why the runtime is not the correct answer in this question.

The kube-apiserver is a control plane component that exposes the Kubernetes API and stores cluster state. It does not run on every node and it does not perform image pulls for Pods.

The kube-scheduler chooses which node a Pod should run on but it is not involved in pulling container images or managing container lifecycle on the node.

Full AWS Practitioner Certification Question