Certified Kubernetes Administrator CKA (CKA) — Questions 601–675

Option C is correct because `kubectl rollout history deployment web-app` is the dedicated command to display the rollout history of a Deployment, including revision numbers and change-cause annotations. This command retrieves the stored ReplicaSet revisions associated with the Deployment, allowing you to see past rollout states.

The error indicates that CPU requests are too high for the available node resources. Reducing CPU requests or adding more nodes can fix it.

Adding a taint with effect NoSchedule to a node tells the Kubernetes scheduler not to schedule any pods onto that node unless they have a matching toleration. This is a core use of taints and tolerations to restrict pod placement, making option A correct.

First deploy the Deployment, then create and apply the Service, and finally verify endpoints.

When a PV with Retain policy is released (PVC deleted), it remains in Released state and cannot be bound to another PVC automatically. The administrator must manually delete the PV and recreate it, or delete the claimRef to make it Available again. The correct steps: delete the PV and then recreate it with the same spec, or manually edit the PV to remove the claimRef and change status to Available.

NetworkPolicy is implemented by the CNI plugin (network provider).

The pod cannot tolerate node taints and there is insufficient CPU. Either add tolerations or increase resources.

Option C is correct because the `--force` flag forces the drain to proceed even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet, or StatefulSet, or if there are unmanaged pods that would otherwise block the drain. This allows the node to be drained for maintenance even when some pods cannot be safely evicted through normal means.

Pending means the pod is not scheduled. Common reasons include resource constraints, taint/toleration mismatch, and unbound PVCs. Image pull errors and OOMKilled occur after scheduling.

etcd is a distributed key-value store that serves as the primary datastore for the Kubernetes cluster, storing all cluster state and configuration data. The kube-controller-manager runs controller processes that regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. Both are core control plane components that run on the master node(s).

Option B is correct because the recommended way to constrain Pods to nodes with a specific architecture is to label those nodes (e.g., with `kubernetes.io/arch: amd64`) and then use `nodeSelector` in the Pod spec. This ensures the scheduler only places Pods on nodes matching the label, which is a simple, declarative, and Kubernetes-native approach. The Deployment does not specify any scheduling constraints, so adding `nodeSelector` is the best practice to enforce architecture-specific placement.

The kubelet is the primary node agent that runs on every worker node, responsible for managing pods and their containers as directed by the control plane. kube-proxy runs on each node (including workers) to maintain network rules and handle service-to-pod traffic routing via iptables or IPVS.

The previous logs show a connection error to the database, indicating the application cannot reach the database service.

Option A is correct because `nodeSelector` is a simple, declarative way to constrain a pod to nodes with specific labels. By setting `nodeSelector` with `failure-domain.beta.kubernetes.io/zone: <zone>`, the scheduler will only consider nodes that have that exact label key-value pair, ensuring the pod lands in the desired availability zone.

Pod anti-affinity rules prevent the pod from being scheduled on nodes where certain other pods are running. In this case, all nodes have pods that violate the anti-affinity rules.

kubectl logs --previous retrieves logs from the previous instance of the container.

If the container fails very quickly (e.g., init error), it may not output any logs; only the previous instance's logs exist.

The kubelet is unable to communicate with the container runtime. Since the master uses containerd (common in kubeadm), checking the containerd service status and restarting it is the first step.

Option D is correct because it defines a RoleBinding in the 'dev' namespace that binds a User named 'dev-user' to a Role named 'pod-reader'. This grants the user read access to Pods within that specific namespace, which is exactly what the question requires. RoleBindings are namespace-scoped and must specify the target namespace in metadata.

Pending state means the pod has not been scheduled. Insufficient cluster resources and taint/toleration mismatch are common causes. ImagePullBackOff and OOMKilled are pod startup issues that occur after scheduling.

kubectl port-forward forwards a local port to a pod or Service. The syntax is kubectl port-forward <resource>/<name> <local-port>:<remote-port>.

Kubelet stopped, network plugin issues, and disk pressure can all cause a node to become NotReady.

The pod is Pending because it cannot be scheduled: one node has an untolerated taint, and other nodes have resource pressure (e.g., insufficient memory/CPU). Both issues prevent scheduling.

The correct command is `kubeadm certs check-expiration`, which is a dedicated kubeadm subcommand that inspects all certificates managed by kubeadm and displays their expiration dates, remaining validity, and renewal status. This command reads the certificate files from `/etc/kubernetes/pki/` and parses their X.509 metadata, providing a concise summary without requiring external tools like OpenSSL.

Option C is correct because `kubectl config current-context` is the dedicated kubectl command that displays the currently active context from the kubeconfig file. This command directly queries the `current-context` field in the kubeconfig and outputs its value, allowing you to verify which cluster, user, and namespace combination is active without modifying any configuration.

Option D is correct because a DaemonSet's pods must tolerate a node's taints to be scheduled on that node. The taint 'dedicated=monitoring:NoSchedule' means pods without a matching toleration will not be scheduled. Adding a toleration with key 'dedicated', value 'monitoring', and effect 'NoSchedule' explicitly allows the DaemonSet pod to bypass this taint and run on the node.

Option D is correct because `kubeadm certs check-expiration` is the dedicated kubeadm command to display the expiration dates of all certificates managed by kubeadm in the cluster, including the kube-apiserver certificate. This command reads the certificate files from `/etc/kubernetes/pki/` and outputs the remaining validity period for each, making it the most direct and accurate method for checking certificate expiration in a kubeadm-deployed cluster.

Options A, C, and D are valid troubleshooting steps. Option B is a remediation action, not troubleshooting. Option E is a recovery step.

StorageClass defines a provisioner and parameters for dynamically provisioning PVs.

First create the Role, then bind it, generate config, test, and optionally revoke.

Option A is correct because kube-proxy is the component responsible for implementing the ClusterIP Service networking rules (e.g., iptables or IPVS) on each node. If kube-proxy is not running, traffic destined for the Service's ClusterIP will not be forwarded to the endpoints, even if the Service has valid endpoints. This is a common cause of unreachable Services.

The correct command to initialize a Kubernetes cluster using kubeadm is `kubeadm init`. This command performs the bootstrap process by setting up the control plane components (e.g., API server, etcd, controller manager, scheduler) on the node, generating certificates, and creating the necessary configuration files in `/etc/kubernetes/`. It is the standard first step after installing kubeadm, kubelet, and a container runtime.

The '0/1 nodes are available: 1 node has memory pressure' message in `kubectl describe pod` indicates that the kubelet on the node has set a memory pressure condition, which triggers eviction thresholds. When a node is under memory pressure, the kubelet refuses to admit new pods (except those with QoS class Guaranteed) to prevent further resource exhaustion, leaving the pod stuck in Pending state. This matches option C exactly.

Option D is correct because the `automountServiceAccountToken` field, when set to `true` (the default), causes Kubernetes to automatically project the ServiceAccount token into the pod as a volume mount at `/var/run/secrets/kubernetes.io/serviceaccount/token`. This field can be set at the pod spec level or overridden at the ServiceAccount level, enabling token projection for authentication to the Kubernetes API server.

NetworkPolicy are namespaced and can have both ingress and egress rules. Pods are selected using podSelector.

Option A is correct because setting `maxUnavailable: 0` ensures that during a rolling update, no Pods are taken down below the desired replica count, guaranteeing zero downtime. This is a valid strategy when you want to maintain full availability at the cost of potentially slower updates, as new Pods must be created before any old ones are terminated.

Option B is correct because after upgrading the control plane with kubeadm, worker nodes must be upgraded individually. The correct sequence is to SSH into the worker node, run 'kubeadm upgrade node' to upgrade the kubelet configuration and static pod manifests, then upgrade the kubelet and kubectl binaries (typically via the package manager), and finally restart the kubelet to pick up the new version. This ensures the node runs the same Kubernetes version as the control plane.

A PVC binds to a PV that satisfies its requested storage size and access modes (e.g., ReadWriteOnce, ReadOnlyMany, ReadWriteMany). The binding process matches a PVC to a PV that meets or exceeds the PVC's requirements, and once bound, the PVC consumes the PV's capacity. This is the core mechanism for dynamic or static storage provisioning in Kubernetes.

If the volumeBindingMode is set to WaitForFirstConsumer, the PV will not be provisioned until a pod using the PVC is scheduled. This is a common pitfall. The CSI driver may be working fine, but the binding mode delays provisioning.

NodePort exposes the Service on each Node's IP at a static port (the NodePort), allowing external traffic to reach the Service.

The iptables mode is the default for kube-proxy.

The 'Init:Error' status indicates that a pod's init container has failed to complete successfully. Init containers run sequentially before any main containers start, and if one exits with a non-zero exit code, the pod enters this error state. This is distinct from a main container crash, which would show as 'CrashLoopBackOff' or 'Error' after the pod has started.

A Kubernetes Job is designed to run a specified number of pods to successful completion. When the pod exits with a zero exit code, the Job is marked as complete and will not be restarted, making it the correct choice for a batch job that must run exactly once.

The `kubectl cordon` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing new pods onto the node, while existing pods continue to run unaffected. It is the correct tool for this specific maintenance task.

kubectl describe pod shows events, including the exact error from the image pull.

ExternalName Service maps a DNS name to an external name using CNAME. It does not have selectors or cluster IPs.

The error indicates that the user 'dev-user' is forbidden from listing 'pods/log' in the 'default' namespace. To access pod logs, you need a Role (or ClusterRole) that grants the 'get' verb on the 'pods/log' subresource, scoped to the specific namespace. Option B correctly specifies a Role with 'get' on 'pods/log' in the 'default' namespace, which is the minimal RBAC configuration required to resolve the Forbidden error.

The error 'Failed to create pod sandbox' indicates that the container runtime (e.g., containerd or CRI-O) was unable to set up the necessary Linux namespaces and cgroups for the pod. This is almost always caused by a CNI plugin issue, such as a misconfigured or missing network plugin (e.g., Calico, Flannel, Weave), which prevents the sandbox from being initialized. Image pull failures produce 'ErrImagePull' or 'ImagePullBackOff', not sandbox creation errors.

Option A is correct because the `kubectl get endpoints -n kube-system kube-dns` command verifies that the kube-dns service has at least one endpoint (i.e., a ready CoreDNS pod). If the service has no endpoints, DNS queries will fail because there is no backend to handle them. This is a fundamental step in troubleshooting DNS in Kubernetes, as it confirms the service is properly connected to running pods.

Option D is correct because `kubectl cordon` marks a node as unschedulable, preventing the Kubernetes scheduler from placing any new pods onto that node. This is achieved by setting the `node.kubernetes.io/unschedulable` taint or the `spec.unschedulable` field to true, which the scheduler checks during pod assignment. Existing pods on the node continue to run normally and are not affected by the cordon operation.

By default, pods can resolve services in other namespaces using the FQDN '<service>.<namespace>.svc.cluster.local'. If the pod's DNS policy is set to 'Default' (node's DNS) or 'None', it may not include the cluster domain. The default pod DNS policy is 'ClusterFirst' which uses CoreDNS for cluster DNS.

The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API. All administrative tasks and component interactions (e.g., from kubectl, the scheduler, the controller manager) go through the API server, which validates and processes RESTful requests before persisting state to etcd.

Option D is correct because the `kubectl scale` command with the `--replicas=5` flag directly sets the desired number of replicas for the Deployment named 'frontend' to 5. This updates the Deployment's `spec.replicas` field, causing the ReplicaSet controller to adjust the number of Pods to match the new desired count.

The --previous flag retrieves logs from the previous instance of a crashed container.

The DNS server IP might be wrong or CoreDNS might not be running. The resolver file in the pod typically points to the cluster DNS service IP.

A Service of type LoadBalancer in Kubernetes requires an external load balancer controller to provision an external IP address. In on-premises clusters without cloud integration, no such controller exists by default, so the EXTERNAL-IP remains <pending> until a bare-metal load balancer like MetalLB is installed and configured. Option C is correct because without a load balancer controller, Kubernetes cannot assign an external IP.