CKA Practice Question: Cluster Architecture, Installation and Configuration
A Kubernetes cluster was upgraded from v1.28 to v1.29. After the upgrade, nodes report NotReady. You check kubelet logs and see: 'error: failed to run Kubelet: misconfiguration: kubelet cgroup driver: "systemd" is different from docker cgroup driver: "cgroupfs"'. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently think the error is about API server connectivity or runtime version compatibility, but the specific error message directly points to a cgroup driver mismatch, which is a common misconfiguration after upgrades.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The kubelet configuration has a different cgroup driver than the container runtime
The error message explicitly states that the kubelet's cgroup driver (systemd) differs from the container runtime's cgroup driver (cgroupfs). In Kubernetes, the kubelet and the container runtime must use the same cgroup driver to manage resource limits correctly. After upgrading from v1.28 to v1.29, the kubelet configuration may have been reset or changed, causing this mismatch, which prevents the kubelet from starting and the node from becoming Ready.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container runtime version is incompatible with Kubernetes v1.29
Why it's wrong here
The error message indicating a cgroup driver mismatch specifically points to a configuration discrepancy, not a fundamental version incompatibility between the container runtime and Kubernetes v1.29. If the runtime's version itself were unsupported, the logs would explicitly state a version-related error, preventing the runtime from even attempting to manage cgroups. This issue is about how resources are managed, not whether the runtime can operate with the Kubernetes version.
- ✗
The kubelet cannot connect to the API server
Why it's wrong here
If the kubelet were unable to connect to the API server, the error logs would display distinct network-related messages such as connection refused, timeouts, or TLS handshake failures. The reported error, however, is specifically about a cgroup driver mismatch, which occurs *after* the kubelet has initiated and is attempting to manage resources on the node, indicating successful initial communication but a failure in resource isolation setup.
- ✗
The kubelet was not restarted after the upgrade
Why it's wrong here
Simply restarting the kubelet without first correcting the underlying cgroup driver configuration would not resolve the issue. The problem is a persistent misconfiguration where the kubelet and container runtime are using different cgroup drivers. A restart would only cause the kubelet to attempt initialization again with the same incorrect settings, leading to the identical failure rather than resolving the root cause.
- ✓
The kubelet configuration has a different cgroup driver than the container runtime
Why this is correct
Kubernetes strictly requires that the kubelet and the underlying container runtime (e.g., containerd, CRI-O) utilize the identical cgroup driver, either `systemd` or `cgroupfs`, for proper resource management and isolation. When the kubelet is configured to use one driver (e.g., `systemd`) and the container runtime is configured for another (e.g., `cgroupfs`), this fundamental mismatch prevents the kubelet from effectively managing pod resources, leading to critical operational failures.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Container Runtime
A container runtime is software that runs containers by using the host operating system's kernel to isolate processes, manage filesystem layers, and handle networking.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.