CKS Cluster Setup — 10 Questions

Question 1

During a cluster upgrade, the kubelet on a worker node fails to start after updating the kubelet binary. The kubelet logs show: 'failed to load bootstrap client certificate: open /var/lib/kubelet/pki/kubelet-client-current.pem: no such file or directory'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bootstrap kubeconfig file is missing or misconfigured. The error 'failed to load bootstrap client certificate: open /var/lib/kubelet/pki/kubelet-client-current.pem: no such file or directory' indicates that the kubelet cannot find the bootstrap client certificate file. This file is generated from the bootstrap kubeconfig file during the initial TLS bootstrapping process. If the bootstrap kubeconfig file is missing or misconfigured, the kubelet cannot request or renew its client certificate, leading to this failure.

Answer

The kubelet's node IP has changed

Answer

The kubelet's certificate has expired

Answer

The kubelet is using an outdated kubeconfig

Question 2

Which TWO of the following are valid methods to secure the etcd cluster in a Kubernetes setup?

Accepted Answer

Enable TLS with peer certificates for etcd member communication. Etcd uses the Raft consensus protocol for distributed coordination, and enabling TLS with peer certificates ensures that all communication between etcd members (nodes) is encrypted and authenticated. This prevents man-in-the-middle attacks and unauthorized nodes from joining the cluster, which is a core security requirement for the control plane's data store.

Answer

Enable encryption at rest for etcd data

Answer

Configure RBAC on etcd

Answer

Apply NetworkPolicies to etcd pods

Question 3

Which THREE of the following are required when setting up a Kubernetes control plane with kubeadm for a production environment?

Accepted Answer

Ensure the Kubernetes version is not downgraded. Kubeadm enforces a strict version skew policy: the kubelet version must not be newer than the control plane version, and downgrading the control plane (e.g., from v1.28 to v1.27) is not supported. Attempting a downgrade can lead to API version mismatches, schema incompatibilities, and cluster instability. In production, you must plan upgrades carefully and never downgrade the control plane components.

Answer

Specify --apiserver-advertise-address

Answer

Generate a bootstrap token with kubeadm token create

Question 4

You are responsible for securing a multi-tenant Kubernetes cluster that uses kubeadm for bootstrapping. The cluster has three control plane nodes and five worker nodes, all running Ubuntu 22.04. A recent security scan discovered that the etcd data directory is not encrypted at rest. The cluster stores sensitive customer data in secrets. You plan to enable encryption at rest for etcd. You have already created an encryption configuration file and placed it at /etc/kubernetes/encryption-config.yaml. The cluster is currently running Kubernetes v1.28.0 with etcd v3.5.9. You need to ensure that all existing and new secrets are encrypted. You also want to minimize downtime. Which of the following steps should you take?

Accepted Answer

Add --encryption-provider-config=/etc/kubernetes/encryption-config.yaml to the kube-apiserver manifest, then kubelet will automatically restart the static pod. In Kubernetes v1.28, the `--experimental-encryption-provider-config` flag has been graduated to stable and renamed to `--encryption-provider-config`. Adding this flag to the kube-apiserver manifest (static pod YAML) causes the kubelet to automatically restart the static pod when the manifest file changes, minimizing downtime. This ensures both existing and new secrets are encrypted using the configured provider (e.g., AES-CBC or secretbox) as the apiserver rewrites existing secrets on startup.

Answer

Edit the etcd configuration to use the encryption config file directly

Answer

Add --experimental-encryption-provider-config=/etc/kubernetes/encryption-config.yaml to the kube-apiserver manifest and restart the kubelet

Answer

Move the etcd data directory to an encrypted filesystem using LUKS

Question 5

A CKS candidate is asked to verify that the kube-apiserver on a production cluster does not expose any insecure endpoints. The candidate runs 'kubectl get pods -n kube-system -l component=kube-apiserver -o yaml' and inspects the container command. Which flag value should the candidate confirm is NOT present in the kube-apiserver command line to ensure the insecure port is disabled?

Accepted Answer

--insecure-port=8080. The kube-apiserver once supported a plain HTTP endpoint controlled by --insecure-port, which bypassed authentication and TLS. Modern Kubernetes defaults this flag to 0, meaning disabled. To verify a cluster is not exposing that endpoint, a candidate checks that the flag is either absent or explicitly set to 0, and never to a real port such as 8080.

Answer

--authorization-mode=Node,RBAC

Answer

--insecure-port=0

Answer

--secure-port=6443

Question 6

A security engineer is reviewing a cluster's NetworkPolicy configuration to reduce lateral movement. The engineer wants to confirm that a default-deny posture is in place for a namespace called 'backend'. Which TWO actions should the engineer take to establish a default-deny for both ingress and egress traffic in that namespace? (Choose two.)

Accepted Answer

Create two separate NetworkPolicy objects, one with policyTypes Ingress only and one with policyTypes Egress only, each using an empty podSelector and no rules.. A default-deny in Kubernetes is expressed by a NetworkPolicy whose podSelector matches all Pods and whose policyTypes include Ingress and Egress with no corresponding rules. This can be done in a single object covering both directions, or as two objects, one per direction, since policies are additive and each denies its own traffic type. Both approaches produce an equivalent deny-by-default posture.

Answer

Create a NetworkPolicy with podSelector matching all Pods and policyTypes Ingress only, plus an ingress rule allowing traffic from all namespaces.

Answer

Apply a podSelector that matches the label 'tier=backend' and set policyTypes to Egress only, with no egress rules.

Answer

Set the namespace annotation 'network-policy.backend/default-deny=true' to instruct the CNI plugin to deny all traffic.

Question 7

A Kubernetes administrator needs to verify that the kubelet is configured to use a secure TLS certificate for its API server. Which file should be checked for the kubelet's certificate authority and client certificate settings?

Accepted Answer

/var/lib/kubelet/config.yaml. The kubelet's configuration file, typically at /var/lib/kubelet/config.yaml, holds the KubeletConfiguration including authentication, authorization, and TLS settings. It is the authoritative source for the kubelet's certificate authority and client certificate paths. Other files like kubelet.conf are kubeconfigs for client authentication, not server TLS config.

Answer

/etc/kubernetes/kubelet.conf

Answer

/etc/kubernetes/pki/ca.crt

Answer

/var/lib/kubelet/kubeadm-flags.env

Question 8

A team needs to set up a highly available Kubernetes control plane across three availability zones. What is the minimum number of etcd members required to achieve fault tolerance against one zone failure?

Accepted Answer

3. For a highly available Kubernetes control plane across three availability zones, the etcd cluster must tolerate the loss of one entire zone. With three etcd members, one per zone, the cluster requires a majority (2) to form quorum. If one zone fails, the remaining two members still constitute a majority, ensuring continued operation. This matches the minimum odd number greater than one that provides fault tolerance against a single failure.

Answer

5

Answer

1

Answer

7

Question 9

A security audit reveals that the kube-apiserver is using the default insecure port 8080 on a production cluster. Which is the most secure and recommended remediation?

Accepted Answer

Set --insecure-port=0 and ensure --secure-port=6443 is configured. Setting `--insecure-port=0` disables the unencrypted HTTP port (default 8080), which eliminates the risk of unauthenticated access to the API server. Ensuring `--secure-port=6443` is configured enforces TLS-encrypted communication on the standard secure port, which is the only recommended and secure method for production clusters.

Answer

Change the --insecure-port flag to 0

Answer

Set --insecure-port=6443

Answer

Set --secure-port=8080

Question 10

A cluster is using kubeadm and the control plane components are running as static pods. Where are the static pod manifests for the API server located by default?

Accepted Answer

/etc/kubernetes/manifests/. In a kubeadm-deployed cluster, the control plane components (API server, controller manager, scheduler) run as static pods. The kubelet watches a specific directory for pod manifests to create these static pods. By default, kubeadm places the manifests for the API server (and other control plane components) in /etc/kubernetes/manifests/. This directory is specified via the --pod-manifest-path or staticPodPath in the kubelet configuration.

Answer

/var/lib/kubelet/

Answer

/etc/kubernetes/admin.conf

Answer

/etc/kubernetes/