CKA Cluster Architecture, Installation and Configuration — 20 Questions

Question 1

An administrator runs 'kubectl drain node01 --ignore-daemonsets --force' to prepare node01 for maintenance. However, a pod running a critical application is evicted and becomes unschedulable. Which flag could prevent eviction of that specific pod?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--delete-local-data=false. The `--delete-local-data=false` flag prevents the eviction of pods that use emptyDir volumes or local data. By default, `kubectl drain` evicts all pods except those managed by DaemonSets, and the `--force` flag bypasses checks that would normally protect pods with local storage. Setting this flag to false ensures that pods with local data (like the critical application) are not evicted during the drain operation.

Answer

--grace-period=0

Answer

--pod-selector='app=critical'

Answer

--evict-unscheduled-pods

Question 2

An administrator creates a ServiceAccount named 'monitor' in the 'default' namespace. They want any pod using this ServiceAccount to be able to list pods cluster-wide. Which RBAC resource should be created and bound to this ServiceAccount?

Accepted Answer

ClusterRole and ClusterRoleBinding. A ClusterRole is required because listing pods cluster-wide is a cluster-scoped operation, not limited to a single namespace. A ClusterRoleBinding is needed to bind the ClusterRole to the ServiceAccount 'monitor' at the cluster level, granting permissions across all namespaces. RoleBindings can only grant permissions within a single namespace, so they cannot achieve cluster-wide access.

Answer

ClusterRole and RoleBinding in the default namespace

Answer

ClusterRole and RoleBinding in kube-system

Answer

Role and RoleBinding in the default namespace

Question 3

You want to upgrade the control plane from v1.28.0 to v1.29.0 using kubeadm. After upgrading kubeadm on the control plane node, which command should you run first?

Accepted Answer

kubeadm upgrade plan. After upgrading kubeadm on the control plane node, the first command to run is `kubeadm upgrade plan`. This command checks the current cluster version, validates that the upgrade path is supported (e.g., from v1.28.0 to v1.29.0), and displays the available versions to upgrade to, along with any manual steps required. It is a prerequisite to ensure the upgrade is safe before proceeding with `kubeadm upgrade apply`.

Answer

kubeadm upgrade apply v1.29.0

Answer

kubeadm upgrade node

Answer

kubeadm upgrade diff

Question 4

A cluster is running etcd without TLS. The admin wants to take a snapshot backup. Which command is correct?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. `ETCDCTL_API=3 etcdctl snapshot save` is the proper command to take a snapshot backup of an etcd cluster using the v3 API. Since the cluster is running without TLS, the command does not require additional flags like `--cacert` or `--cert`, but the default endpoint is `http://127.0.0.1:2379`, which is used implicitly. The v3 API is required because etcd v3 stores data in a different format than v2, and `snapshot save` captures the full key-value store for disaster recovery.

Answer

etcdctl backup --data-dir /var/lib/etcd

Answer

etcdctl export --data-dir /var/lib/etcd

Answer

etcdctl snapshot save --endpoints=http://127.0.0.1:2379 /backup/snapshot.db

Question 5

A pod's YAML specifies 'restartPolicy: Never' and the container exits with code 0. What state will the pod be in?

Accepted Answer

Succeeded. When a pod's restartPolicy is set to 'Never' and its container exits with code 0 (indicating a successful termination), the pod transitions to the 'Succeeded' phase. This is because Kubernetes treats a zero exit code as a successful completion, and with restartPolicy: Never, no restart is attempted, leaving the pod in a terminal Succeeded state.

Answer

Completed

Answer

Failed

Answer

Running

Question 6

Which THREE are valid methods to authenticate a user to the Kubernetes API server? (Select 3)

Accepted Answer

Bearer tokens (e.g., service account tokens). Bearer tokens, such as those used by service accounts, are a valid authentication method for the Kubernetes API server. The API server validates the token against the token authentication file or, for service accounts, against the TokenReview API, which verifies the token's validity and associated identity.

Answer

Username/password via HTTP Basic Auth

Answer

Static password file

Question 7

You are preparing to upgrade a Kubernetes cluster from v1.27 to v1.28 using kubeadm. What is the correct order of operations for upgrading the control plane nodes?

Accepted Answer

Upgrade the first control plane node, then upgrade the remaining control plane nodes, then upgrade worker nodes.. The recommended upgrade order for a kubeadm-managed cluster is to upgrade the first control plane node (using `kubeadm upgrade apply`), then the remaining control plane nodes (using `kubeadm upgrade node`), and finally the worker nodes. This ensures the cluster's control plane components (etcd, kube-apiserver, kube-controller-manager, kube-scheduler) are updated first, maintaining cluster stability and API server availability during the process.

Answer

Upgrade all worker nodes first, then upgrade the control plane nodes.

Answer

Upgrade all nodes simultaneously by running kubeadm upgrade apply on all nodes at once.

Answer

Upgrade worker nodes, then upgrade the control plane nodes, then drain the worker nodes.

Question 8

Which command is used to take a snapshot of etcd using etcdctl?

Accepted Answer

etcdctl snapshot save. `etcdctl snapshot save` is the official command to create a point-in-time snapshot of an etcd datastore, which is essential for backup and disaster recovery in Kubernetes clusters. This command writes the snapshot to a specified file path, preserving all keys and metadata for later restoration via `etcdctl snapshot restore`.

Answer

etcdctl dump

Answer

etcdctl snapshot create

Answer

etcdctl backup

Question 9

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

Accepted Answer

kubectl cordon <node-name>. The `kubectl cordon` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing new pods onto the node, while existing pods continue to run unaffected. It is the correct tool for this specific maintenance task.

Answer

kubectl uncordon <node-name>

Answer

kubectl drain <node-name>

Answer

kubectl taint nodes <node-name> key=value:NoSchedule

Question 10

Which of the following is NOT a control plane component in Kubernetes?

Accepted Answer

kube-proxy. kube-proxy is not a control plane component; it is a node-level (worker) component responsible for implementing network rules and handling service-to-pod traffic via iptables or IPVS. The control plane consists of kube-apiserver, etcd, kube-scheduler, and kube-controller-manager.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 11

Which component is responsible for managing the network rules and forwarding on each node?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for managing network rules and forwarding traffic on each node. It implements the Kubernetes Service concept by maintaining iptables or IPVS rules that route packets to the correct backend pods, handling load balancing and service discovery at the network layer.

Answer

container runtime

Answer

kubelet

Answer

kube-scheduler

Question 12

An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?

Accepted Answer

kubeadm certs check-expiration. The `kubeadm certs check-expiration` command is the correct tool to inspect the expiration dates of all certificates generated by kubeadm for cluster components, such as the API server, controller-manager, scheduler, and etcd. It reads the certificate files from the default kubeadm certificate directory (`/etc/kubernetes/pki`) and displays their remaining validity period in a human-readable table. This command is part of the kubeadm certificate management suite and is specifically designed for this purpose.

Answer

kubeadm upgrade plan

Answer

kubeadm certs renew

Answer

kubectl get certificates

Question 13

Which THREE are valid methods to provide authentication to the Kubernetes API server? (Select three.)

Accepted Answer

Client certificates. Client certificates are a valid authentication method for the Kubernetes API server. The API server can be configured with the `--client-ca-file` flag to trust a Certificate Authority (CA), and then clients present a TLS certificate signed by that CA to authenticate. This is a common and secure method for user and component authentication.

Answer

Username and password

Answer

SSH keys

Question 14

Which TWO commands are valid for managing nodes in Kubernetes? (Select two.)

Accepted Answer

kubectl drain . `kubectl drain ` is valid because it safely evicts all pods from a node, marking it unschedulable and preparing it for maintenance. `kubectl cordon ` is valid because it marks a node as unschedulable, preventing new pods from being scheduled onto it while existing pods continue running.

Answer

kubectl delete node <node>

Answer

kubectl taint <node>

Answer

kubectl scale node <node>

Question 15

Which component is responsible for managing the lifecycle of pods on a node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a pod as expected, managing the pod lifecycle by communicating with the container runtime (e.g., containerd or CRI-O) and reporting the node and pod status back to the API server.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-proxy

Question 16

You have an etcd cluster with three members. You need to take a snapshot for disaster recovery. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key. It uses the etcdctl v3 API with the `snapshot save` command, which is the proper method for creating a consistent point-in-time backup of an etcd cluster. The command includes mandatory TLS authentication flags (`--cacert`, `--cert`, `--key`) and the `--endpoints` flag to target a specific etcd member, ensuring a secure and successful snapshot operation.

Answer

etcdctl snapshot restore /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl backup --data-dir /var/lib/etcd

Answer

etcdctl snapshot save /backup/snapshot.db

Question 17

A developer wants to create a ServiceAccount named 'app-sa' and mount its token into a pod. Which YAML snippet correctly configures the pod to use this ServiceAccount?

Accepted Answer

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: true. It uses the `serviceAccountName` field to assign the 'app-sa' ServiceAccount to the pod and sets `automountServiceAccountToken: true` to explicitly mount the token. By default, Kubernetes mounts the token if `automountServiceAccountToken` is not set, but setting it to `true` ensures the token is mounted even if the ServiceAccount itself has `automountServiceAccountToken: false`.

Answer

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: false

Answer

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: "true"

Answer

spec:
  serviceAccount: app-sa

Question 18

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

Accepted Answer

kubectl cordon node1. The `kubectl cordon node1` command marks the node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the correct approach when you need to isolate a node for maintenance without disrupting current workloads.

Answer

kubectl drain node1

Answer

kubectl taint nodes node1 key=value:NoSchedule

Answer

kubectl delete node node1

Question 19

An administrator runs 'kubeadm certs check-expiration' and sees that the kubelet client certificate expires in 7 days. What is the correct way to renew it?

Accepted Answer

Run 'kubeadm certs renew kubelet-client'. The `kubeadm certs renew kubelet-client` command is the correct way to renew only the kubelet client certificate without affecting other certificates. This targeted renewal is appropriate when only the kubelet client certificate is expiring, as it avoids unnecessary disruption to other components. The command regenerates the certificate using the existing CA, and the kubelet will automatically reload it.

Answer

Run 'kubeadm init phase certs kubelet-client'

Answer

Renew all certificates using 'kubeadm certs renew all'

Answer

Delete the old certificate and restart kubelet

Question 20

Which control plane component stores the entire cluster state?

Accepted Answer

etcd. Etcd because it is the distributed key-value store that serves as the single source of truth for the entire cluster state, including all objects, configurations, and secrets. The kube-apiserver is the only component that directly interacts with etcd, but it does not store the state itself—it reads from and writes to etcd on behalf of other components.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kube-apiserver