CKA Practice Question: Cluster Architecture, Installation & Configuration
A DevOps engineer notices that the kubelet on a node is unable to register with the Kubernetes API server. The kubelet logs show 'Failed to get bootstrap CA certificate' and the node is not yet part of the cluster. What is the most likely cause?
⚠ Common exam trap
CNCF often tests the distinction between authentication failures (expired token) and authorization failures (RBAC), leading candidates to incorrectly select RBAC misconfiguration when the actual issue is token expiry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bootstrap token used for TLS bootstrapping has expired.
The bootstrap token used for TLS bootstrapping has expired. During the TLS bootstrap process, the kubelet uses a limited-time bootstrap token to authenticate with the API server and request a client certificate. If the token expires before the kubelet completes registration, the kubelet will fail to obtain the bootstrap CA certificate and cannot join the cluster, as indicated by the error 'Failed to get bootstrap CA certificate'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The kubelet configuration file has incorrect node IP.
Why it's wrong here
An incorrect node IP in the kubelet configuration will cause connectivity or registration problems, such as the node failing to appear in the cluster or the API server being unable to reach the kubelet for health checks. However, it does not directly interfere with the bootstrap CA certificate retrieval, which is a distinct step where the kubelet authenticates to the API server to obtain a CA bundle. Since the question specifically identifies a bootstrap CA failure, an IP misconfiguration is not the root cause.
- ✗
The node's RBAC permissions are misconfigured.
Why it's wrong here
RBAC authorization is only evaluated after the kubelet has successfully authenticated and initiated a certificate signing request (CSR). If the bootstrap token were still valid, RBAC misconfigurations could prevent the CSR from being approved or the kubelet from being granted permission to request certificates. But a failure to retrieve the CA certificate occurs during the initial authenticated handshake, before RBAC checks are applied. Therefore, RBAC misconfiguration would manifest as a later-stage CSR failure, not a CA retrieval failure.
- ✗
The API server is not running.
Why it's wrong here
If the API server were down, the kubelet would be completely unable to reach the cluster and could not even initiate the TLS bootstrap handshake, let alone attempt to retrieve a CA certificate. The scenario implies that the kubelet is actively trying to bootstrap and encountering a CA retrieval error, which requires the API server to be running and reachable. Thus, the API server being down would produce a network-level failure, not a bootstrap CA failure.
- ✓
The bootstrap token used for TLS bootstrapping has expired.
Why this is correct
Bootstrap tokens used in TLS bootstrapping are intentionally short-lived and can expire, especially if they were created for a one-time node registration. When a token expires, the API server rejects the kubelet's authentication attempt, returning a 401 Unauthorized, and the kubelet cannot complete the bootstrap sequence or download the CA certificate. This precisely matches the observed symptom of a bootstrap CA retrieval failure, making it the correct root cause.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.