Certified Kubernetes Administrator CKA (CKA) — Questions 976–1005

The `kubectl config set-credentials` command creates or updates a user entry in a kubeconfig file, allowing you to specify authentication credentials such as a client certificate, token, or username/password for a specific user. This is the correct way to define a user identity that can later be associated with a context via `kubectl config set-context`.

The container runtime is the software responsible for actually running containers on a node. It pulls container images, creates container namespaces, and manages the container lifecycle (start, stop, delete). In Kubernetes, the kubelet delegates container execution to the container runtime via the CRI (Container Runtime Interface), but the runtime itself performs the low-level operations using technologies like runc or containerd.

Option A is correct because it describes the standard procedure for replacing a failed etcd member using a snapshot: you restore the snapshot on a new node (using `etcdctl snapshot restore`), start the new etcd instance, add it as a member to the existing cluster, and then remove the old, failed member. This ensures the new node joins with the correct data and the cluster quorum is maintained.

An Ingress controller must be running, the Ingress must have rules, and the backend services must exist.

Option A is correct because the Running phase in Kubernetes indicates that all containers in the pod are running and at least one container is in the running state. This phase is part of the pod lifecycle as defined in the Kubernetes API, where the pod has been bound to a node and all containers have been started successfully.

kubectl describe pod shows the last state and exit code, and kubectl logs shows application output; but for a crash loop, describe gives the last state details.

etcd is the core control plane component responsible for persisting cluster state. It is a distributed, consistent key-value store that stores all cluster data, including configuration, state, and metadata. The kube-apiserver is the only component that interacts directly with etcd, ensuring that all state changes are recorded durably.

The --expose flag creates a ClusterIP service in addition to the pod. Option A correctly states both a pod and a ClusterIP service are created. Options B-D misstate the service type or omit resources.

Services resolve to A (IPv4) or AAAA (IPv6) records.

Option A is correct because `kubeadm token create` generates a bootstrap token that is used by `kubeadm join` to authenticate the new node with the control plane. This is the standard, documented method for adding worker nodes to a cluster initialized with kubeadm, leveraging TLS bootstrap and the Bootstrap Token Authentication protocol.

'kubectl get pods -n kube-system' lists system pods including the kube-apiserver, if it runs as a static pod or deployed by kubeadm.

A is correct because `systemctl status kubelet` directly queries the systemd service manager to report whether the kubelet process is running, its current state (active/inactive/failed), and recent log entries. Since the kubelet is the primary node agent responsible for registering the node and reporting status to the control plane, checking its service status is the most immediate step when a node is NotReady.

'kubectl rollout history' shows revision history and details of each ReplicaSet, which helps in troubleshooting rollout issues.

Storage in Kubernetes is managed through volumes, claims, and classes.

Within the same namespace, the service can be reached by its name.

A Pod stuck in Pending state indicates the scheduler cannot find a suitable node. The cluster has a worker node with the taint 'node.kubernetes.io/disk-pressure:NoSchedule', and the Pod has no tolerations. Since taints with effect NoSchedule prevent scheduling of Pods that do not tolerate them, the Pod cannot be placed on that node, leaving it in Pending.

Option C is correct because the standard kubeadm upgrade workflow for worker nodes requires first draining the node to safely evict all pods, then running 'kubeadm upgrade node' to upgrade the kubelet and kube-proxy configuration, and finally uncordoning the node to make it schedulable again. This sequence ensures minimal disruption to workloads and follows the official Kubernetes upgrade documentation.

Option D is correct because creating a ServiceAccount named 'build-bot' is the foundational step; without the ServiceAccount object, no pods can be assigned a service account identity. Option E is correct because a Secret of type 'kubernetes.io/service-account-token' with an annotation referencing the ServiceAccount causes the Kubernetes controller manager to automatically generate and populate a long-lived token, which pods can mount and use to authenticate to the API server.

The 'kubectl expose' command with '--type=NodePort' and '--port=80' creates a service. The '--target-port' can specify the container port.

On static-pod clusters, kubectl get pods -n kube-system shows apiserver status. On systemd systems, systemctl status kube-apiserver works.

Using kubectl exec to run a command like curl or telnet from a running pod in the same namespace can test connectivity to the database service.

Option C is correct because `openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A2 Validity` directly reads the X.509 certificate file on disk and displays its validity period (Not Before and Not After dates). This is a manual, low-level method to check certificate expiration without relying on kubeadm utilities. Option E is correct because `kubeadm certs check-expiration` is the dedicated kubeadm command that lists all certificates managed by kubeadm along with their remaining validity, providing a comprehensive and automated check.