CKA Practice Question: Cluster Architecture, Installation and Configuration
A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?
⚠ Common exam trap
Watch out — candidates often confuse the kubeconfig file (a YAML configuration) with a certificate file, leading them to incorrectly use `openssl` directly on the kubeconfig or grep for the certificate data without parsing its expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubeadm certs check-expiration
`kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubeadm upgrade plan --certificate-expiration
Why it's wrong here
The kubeadm upgrade plan command is intended to map out the upgrade path and show available Kubernetes versions, not to inspect certificate validity. There is no --certificate-expiration flag on this subcommand, and invoking it would produce an unknown flag error. Certificate expiration details are only exposed through the separate kubeadm certs commands.
- ✗
kubectl config view --raw | grep client-certificate
Why it's wrong here
This pipeline prints the raw, base64-encoded client certificate data from the kubeconfig file, but it does not decode the file or calculate an expiration date. To extract the expiry, you would need to base64-decode the data, save it as a .crt file, and run openssl x509 separately. As a one-liner it only confirms that a certificate exists, not whether it is still valid.
- ✗
openssl x509 -in /etc/kubernetes/admin.conf -text -noout
Why it's wrong here
The /etc/kubernetes/admin.conf file is a kubeconfig YAML document, not a PEM certificate, so openssl x509 cannot read it directly; you would first need to extract the client-certificate-data field and decode it. Even then, that command only inspects the admin client certificate, which is used by the default cluster administrator, not necessarily the certificate or token of the user who is reporting the authentication failure. This makes it a poor diagnostic for a specific user's issue.
- ✓
kubeadm certs check-expiration
Why this is correct
This subcommand is the authoritative way to inspect the lifetimes of all certificates managed by kubeadm, including the CA, apiserver, controller-manager, scheduler, kubelet, and the client certificate embedded in admin.conf. It prints a table showing the expiration date and remaining days for each component, giving immediate insight into whether certificate expiry is causing authentication problems. For kubeadm-based clusters, this is the correct first tool for diagnosing certificate-related authentication issues.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.