CKA Practice Question: Cluster Architecture, Installation & Configuration
An administrator is tasked with setting up a new Kubernetes cluster using kubeadm. They have two nodes: one control plane and one worker. After initializing the control plane with 'kubeadm init', the worker node fails to join with the error 'error execution phase preflight: [preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running'. What should the administrator check first?
⚠ Common exam trap
Candidates often assume the error is related to the control plane or networking, but the CRI error specifically points to a missing or stopped container runtime on the node attempting to join.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that containerd is installed and running on the worker node.
The error 'container runtime is not running' on the worker node indicates that the CRI (Container Runtime Interface) implementation, typically containerd, is not active. Since kubelet relies on a running container runtime to manage pods, the administrator must first check that containerd is installed and running on the worker node using commands like 'systemctl status containerd' or 'systemctl start containerd'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that containerd is installed and running on the worker node.
Why this is correct
The kubelet on the worker node communicates with the container runtime through the Container Runtime Interface (CRI), typically over a Unix socket such as /run/containerd/containerd.sock. If containerd is not installed, the service is stopped, or the socket is missing, kubelet will fail with a CRI connection error and never start pods. Run `systemctl status containerd` and check the socket path configured in kubelet (--container-runtime-endpoint) to confirm the runtime is active.
- ✗
Verify that the control plane node is healthy.
Why it's wrong here
A CRI connection failure on the worker node is reported by the kubelet process that runs locally on that node; it does not involve the control plane's API server, etcd, or controller managers. Even if the control plane is perfectly healthy, the worker's kubelet still needs its own local container runtime to launch pod sandboxes. Checking the healthy control plane would only rule out cluster-level issues, which are irrelevant to a local socket connection to containerd.
- ✗
Check if the join token has expired.
Why it's wrong here
A join token is only used during the initial node bootstrap when kubeadm runs (or when `kubeadm token create` is used to generate a new one); an expired token causes a TLS bootstrap or authentication error such as "certificate signed by unknown authority" or "token expired", not a runtime connection failure. Once a node has joined, the kubelet does not use the join token for its continuous runtime operations. The described CRI error happens at the container runtime layer, independent of cluster authentication.
- ✗
Install a network plugin like Calico on the control plane.
Why it's wrong here
Calico is a CNI (Container Network Interface) plugin that configures pod networking, and it is installed on the cluster after the container runtime is already functioning. A missing or broken network plugin would manifest as pods stuck in ContainerCreating status with a network-related message, not as a kubelet-to-CRI connection error. Furthermore, Calico is typically deployed as a DaemonSet that requires the runtime to be operational before its pods can even run, so installing it would not resolve the containerd socket issue.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Container Runtime
A container runtime is software that runs containers by using the host operating system's kernel to isolate processes, manage filesystem layers, and handle networking.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.