CKA Troubleshooting Practice Question
A worker node in your cluster has been marked NotReady for several minutes. You SSH into the node and find that the kubelet process is not running. You start the kubelet service, but it immediately exits. Running 'journalctl -u kubelet -n 50' shows repeated errors about being unable to load the kubeconfig file at /etc/kubernetes/kubelet.conf. Which of the following is the MOST likely cause?
⚠ Common exam trap
The trap here is assuming that any kubelet failure is due to the container runtime or network, when the specific error message clearly points to a kubeconfig problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The kubelet.conf file has incorrect file permissions or is missing, preventing the kubelet from authenticating to the API server.
The kubelet relies on a kubeconfig file to authenticate to the API server. When that file is missing or unreadable, the kubelet cannot establish its connection and exits with a clear error in its logs. The correct resolution is to restore the file from backup or regenerate it using kubeadm, ensuring proper permissions. Other issues like container runtime or network plugin would produce different error messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container runtime socket is not available, so the kubelet cannot manage pods.
Why it's wrong here
While a missing container runtime socket would cause kubelet failures, the error message specifically points to a kubeconfig loading issue. The kubelet would report a different error, such as 'failed to get container runtime' or 'failed to run kubelet: validate service connection: CRI v1 runtime API is not implemented'. This option does not match the observed error.
- ✓
The kubelet.conf file has incorrect file permissions or is missing, preventing the kubelet from authenticating to the API server.
Why this is correct
The kubelet requires a valid kubeconfig to authenticate to the API server. If the file is missing or has permissions that prevent the kubelet user from reading it, the kubelet will fail to start with an error referencing the kubeconfig path. This aligns with the journalctl output. Restoring or regenerating the file fixes the issue.
- ✗
The kubelet's systemd unit file has an incorrect path to the kubelet binary.
Why it's wrong here
If the systemd unit file pointed to a wrong binary path, the kubelet process would fail to start entirely, and journalctl would show an error about the executable not being found. The fact that the kubelet starts and then exits with a kubeconfig error indicates the binary is correct. The issue is with the kubeconfig file itself.
- ✗
The node's network plugin is misconfigured, preventing the kubelet from reaching the API server.
Why it's wrong here
A network plugin misconfiguration typically affects pod networking, not the kubelet's ability to load its kubeconfig. The kubelet would still start and then report errors about network plugin initialization or pod sandbox creation. The error about the kubeconfig file is a local file access issue, not a network connectivity problem.
Go deeper
Related to this question
Learn chapter
etcd Backup and Restore
Key term
Kubernetes Node Roles
Kubernetes Node Roles are labels assigned to machines in a cluster that define whether a node runs application containers (worker) or manages the cluster (control plane).
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
One of 726 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.