CKS Cluster Setup — 10 Questions

Question 1

A team needs to set up a highly available Kubernetes control plane across three availability zones. What is the minimum number of etcd members required to achieve fault tolerance against one zone failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

3. For a highly available Kubernetes control plane across three availability zones, the etcd cluster must tolerate the loss of one entire zone. With three etcd members, one per zone, the cluster requires a majority (2) to form quorum. If one zone fails, the remaining two members still constitute a majority, ensuring continued operation. This matches the minimum odd number greater than one that provides fault tolerance against a single failure.

Answer

5

Answer

1

Answer

7

Question 2

During a cluster upgrade, the kubelet on a worker node fails to start after updating the kubelet binary. The kubelet logs show: 'failed to load bootstrap client certificate: open /var/lib/kubelet/pki/kubelet-client-current.pem: no such file or directory'. What is the most likely cause?

Accepted Answer

The bootstrap kubeconfig file is missing or misconfigured. The error 'failed to load bootstrap client certificate: open /var/lib/kubelet/pki/kubelet-client-current.pem: no such file or directory' indicates that the kubelet cannot find the bootstrap client certificate file. This file is generated from the bootstrap kubeconfig file during the initial TLS bootstrapping process. If the bootstrap kubeconfig file is missing or misconfigured, the kubelet cannot request or renew its client certificate, leading to this failure.

Answer

The kubelet's node IP has changed

Answer

The kubelet's certificate has expired

Answer

The kubelet is using an outdated kubeconfig

Question 3

Which TWO of the following are valid methods to secure the etcd cluster in a Kubernetes setup?

Accepted Answer

Enable TLS with peer certificates for etcd member communication. Etcd uses the Raft consensus protocol for distributed coordination, and enabling TLS with peer certificates ensures that all communication between etcd members (nodes) is encrypted and authenticated. This prevents man-in-the-middle attacks and unauthorized nodes from joining the cluster, which is a core security requirement for the control plane's data store.

Answer

Enable encryption at rest for etcd data

Answer

Configure RBAC on etcd

Answer

Apply NetworkPolicies to etcd pods

Question 4

Which THREE of the following are required when setting up a Kubernetes control plane with kubeadm for a production environment?

Accepted Answer

Ensure the Kubernetes version is not downgraded. Kubeadm enforces a strict version skew policy: the kubelet version must not be newer than the control plane version, and downgrading the control plane (e.g., from v1.28 to v1.27) is not supported. Attempting a downgrade can lead to API version mismatches, schema incompatibilities, and cluster instability. In production, you must plan upgrades carefully and never downgrade the control plane components.

Answer

Specify --apiserver-advertise-address

Answer

Generate a bootstrap token with kubeadm token create

Question 5

A cluster is using kubeadm and the control plane components are running as static pods. Where are the static pod manifests for the API server located by default?

Accepted Answer

/etc/kubernetes/manifests/. In a kubeadm-deployed cluster, the control plane components (API server, controller manager, scheduler) run as static pods. The kubelet watches a specific directory for pod manifests to create these static pods. By default, kubeadm places the manifests for the API server (and other control plane components) in /etc/kubernetes/manifests/. This directory is specified via the --pod-manifest-path or staticPodPath in the kubelet configuration.

Answer

/var/lib/kubelet/

Answer

/etc/kubernetes/admin.conf

Answer

/etc/kubernetes/

Question 6

You are responsible for securing a multi-tenant Kubernetes cluster that uses kubeadm for bootstrapping. The cluster has three control plane nodes and five worker nodes, all running Ubuntu 22.04. A recent security scan discovered that the etcd data directory is not encrypted at rest. The cluster stores sensitive customer data in secrets. You plan to enable encryption at rest for etcd. You have already created an encryption configuration file and placed it at /etc/kubernetes/encryption-config.yaml. The cluster is currently running Kubernetes v1.28.0 with etcd v3.5.9. You need to ensure that all existing and new secrets are encrypted. You also want to minimize downtime. Which of the following steps should you take?

Accepted Answer

Add --encryption-provider-config=/etc/kubernetes/encryption-config.yaml to the kube-apiserver manifest, then kubelet will automatically restart the static pod. In Kubernetes v1.28, the `--experimental-encryption-provider-config` flag has been graduated to stable and renamed to `--encryption-provider-config`. Adding this flag to the kube-apiserver manifest (static pod YAML) causes the kubelet to automatically restart the static pod when the manifest file changes, minimizing downtime. This ensures both existing and new secrets are encrypted using the configured provider (e.g., AES-CBC or secretbox) as the apiserver rewrites existing secrets on startup.

Answer

Edit the etcd configuration to use the encryption config file directly

Answer

Add --experimental-encryption-provider-config=/etc/kubernetes/encryption-config.yaml to the kube-apiserver manifest and restart the kubelet

Answer

Move the etcd data directory to an encrypted filesystem using LUKS

Question 7

A security team wants to ensure that all communication between the kubelet and the API server is encrypted. Which flag must be set on the kubelet to enforce this?

Accepted Answer

--kubeconfig. The `--kubeconfig` flag on the kubelet specifies the path to a kubeconfig file that contains the credentials and server address for the API server. When this flag is set, the kubelet uses TLS to authenticate and encrypt all communication with the API server, as the kubeconfig file typically references an HTTPS endpoint and includes client certificates or tokens. Without this flag, the kubelet may fall back to insecure or unencrypted connections, violating the requirement for encrypted communication.

Answer

--tls-cert-file

Answer

--node-status-update-frequency

Answer

--require-kubeconfig

Question 8

Order the steps to rotate a Kubernetes API server certificate.

Accepted Answer

1. Generate a new certificate and key pair for the API server. 2. Replace the existing certificate files on the control plane node. 3. Restart the kube-apiserver process or container. 4. Verify the new certificate is serving correctly using curl or openssl.. Certificate rotation involves generating new certs, replacing files, restarting the service, and verifying. Kubeconfig updates may be needed if CA changes.

Answer

1. Restart the kube-apiserver process. 2. Generate a new certificate. 3. Replace the old certificates. 4. Verify.

Answer

1. Replace the existing certificate files. 2. Generate a new certificate. 3. Restart the API server. 4. Verify.

Answer

1. Generate new certificate. 2. Replace old files. 3. Verify using curl. 4. Restart API server.

Question 9

Match each Kubernetes admission controller to its role in security.

Accepted Answer

NodeRestriction: Limits the permissions of kubelet nodes to prevent unauthorized operations.. Admission controllers intercept requests to the API server and can enforce security policies.

Answer

NodeRestriction: Controls automounting of service account tokens to pods.

Answer

PodSecurity: Limits the permissions of kubelet nodes.

Question 10

A security audit reveals that the kube-apiserver is using the default insecure port 8080 on a production cluster. Which is the most secure and recommended remediation?

Accepted Answer

Set --insecure-port=0 and ensure --secure-port=6443 is configured. Setting `--insecure-port=0` disables the unencrypted HTTP port (default 8080), which eliminates the risk of unauthenticated access to the API server. Ensuring `--secure-port=6443` is configured enforces TLS-encrypted communication on the standard secure port, which is the only recommended and secure method for production clusters.

Answer

Change the --insecure-port flag to 0

Answer

Set --insecure-port=6443

Answer

Set --secure-port=8080