CKA Practice Question: Cluster Architecture, Installation and Configuration
A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?
⚠ Common exam trap
Many candidates assume all nodes can be upgraded in any order or simultaneously, but the CKA requires strict sequential upgrade of control plane first, then workers, with drain/uncordon steps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Drain control plane node, upgrade kubeadm and kubelet on control plane, uncordon, then repeat for worker nodes
The kubeadm upgrade process requires the control plane node to be upgraded first, as it hosts the core cluster components (API server, scheduler, controller-manager). Draining the node ensures workloads are evicted, then kubeadm and kubelet are upgraded on the control plane, followed by uncordoning. Worker nodes are upgraded afterward to maintain cluster stability and compatibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Drain each node, upgrade control plane, then upgrade worker nodes
Why it's wrong here
This approach omits the mandatory `kubectl uncordon` after each node’s upgrade, leaving nodes in a `SchedulingDisabled` state. While it correctly places the control plane before workers, draining every node up front is not the sequential per-node flow that `kubeadm upgrade` commands require; the control plane node itself must be drained, upgraded, and uncordoned before moving on.
- ✓
Drain control plane node, upgrade kubeadm and kubelet on control plane, uncordon, then repeat for worker nodes
Why this is correct
This is the exact procedure recommended by the official kubeadm upgrade documentation: for the control plane node, run `kubectl drain` (with `--ignore-daemonsets`), upgrade the `kubeadm` binary, run `kubeadm upgrade apply`, upgrade `kubelet`, restart it, then `uncordon` the node. Repeating the same drain-upgrade-uncordon cycle for worker nodes ensures they remain within the supported version skew and maintains cluster availability throughout the rolling upgrade.
- ✗
Upgrade worker nodes first, then control plane nodes
Why it's wrong here
Upgrading worker nodes before the control plane violates the Kubernetes version skew policy, which requires the API server to be at or above the kubelet versions. The `kubeadm upgrade plan` verifies the control plane version first, and `kubeadm upgrade apply` must be run on the control plane node before any `kubeadm upgrade node` commands on workers; doing otherwise can cause worker nodes to fail to join or report unsupported versions.
- ✗
Upgrade all nodes simultaneously
Why it's wrong here
A simultaneous upgrade is impossible with kubeadm's design because `kubeadm upgrade` commands are executed on each node individually, and the control plane must be upgraded first to validate the new version. Attempting to upgrade all nodes at once would also require draining nodes concurrently, defeating the purpose of the rolling procedure and risking downtime by breaking the one-node-at-a-time scheduling safety and the version skew checks.
Go deeper
Related to this question
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.