CKA Cluster Architecture, Installation and Configuration Practice Questions

Explanation: The `--delete-local-data=false` flag prevents the eviction of pods that use emptyDir volumes or local data. By default, `kubectl drain` evicts all pods except those managed by DaemonSets, and the `--force` flag bypasses checks that would normally protect pods with local storage. Setting this flag to false ensures that pods with local data (like the critical application) are not evicted during the drain operation.

Explanation: After upgrading the control plane with kubeadm, worker nodes must be upgraded individually. The correct sequence is to SSH into the worker node, run 'kubeadm upgrade node' to upgrade the kubelet configuration and static pod manifests, then upgrade the kubelet and kubectl binaries (typically via the package manager), and finally restart the kubelet to pick up the new version. This ensures the node runs the same Kubernetes version as the control plane.

Explanation: `ETCDCTL_API=3 etcdctl snapshot save` is the proper command to take a snapshot backup of an etcd cluster using the v3 API. Since the cluster is running without TLS, the command does not require additional flags like `--cacert` or `--cert`, but the default endpoint is `http://127.0.0.1:2379`, which is used implicitly. The v3 API is required because etcd v3 stores data in a different format than v2, and `snapshot save` captures the full key-value store for disaster recovery.

Explanation: Option A (Bearer tokens, e.g., service account tokens) is correct because the API server accepts bearer tokens in the Authorization header, and service account tokens are a standard, built-in authentication method for workloads and users. Option C (Client certificates) is correct because the API server supports X.509 client certificate authentication, typically configured via --client-ca-file, where the certificate's CN becomes the username and O becomes the group. Option E (OpenID Connect (OIDC) tokens) is correct because the API server can validate OIDC ID tokens issued by an identity provider using flags such as --oidc-issuer-url and --oidc-client-id, making OIDC a supported authentication strategy. Option B (Username/password via HTTP Basic Auth) is not a valid method here because HTTP Basic Auth was deprecated and removed from Kubernetes, so it is no longer an accepted authentication mechanism. Option D (Static password file) is also not valid because the --basic-auth-file static password mechanism was deprecated and removed, so it cannot authenticate users to current API servers.

Explanation: Option A, `kubectl drain <node>`, is correct because it safely evicts all pods from a node (respecting PodDisruptionBudgets) and marks the node as unschedulable, which is the standard procedure before maintenance or decommissioning. Option C, `kubectl cordon <node>`, is correct because it marks a node as unschedulable so no new pods are scheduled onto it, while leaving existing pods running. Option B is not a valid node-management command in the sense tested here—`kubectl delete node` removes the Node object from the API server but does not perform graceful pod eviction, so it is not the intended answer. Option D is incomplete: `kubectl taint` requires a key/value/effect specification (e.g., `kubectl taint nodes <node> key=value:NoSchedule`) and is not a standalone valid command. Option E is invalid because `kubectl scale` operates on scalable resources like Deployments, ReplicaSets, and StatefulSets, not on nodes.