CKA Troubleshooting Practice Question
Exhibit
Refer to the exhibit. $ kubectl describe pod nginx-pod ... Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 2m default-scheduler Successfully assigned default/nginx-pod to node-1 Warning FailedMount 2m kubelet MountVolume.SetUp failed for volume "config" : secrets "my-secret" not found Warning FailedMount 1m kubelet MountVolume.SetUp failed for volume "config" : secrets "my-secret" not found Warning FailedMount 30s kubelet MountVolume.SetUp failed for volume "config" : secrets "my-secret" not found
Based on the exhibit, what is the most likely cause of the pod not running?
⚠ Common exam trap
Many exam-takers assume the issue is node-level (disk pressure or driver) or resource-related, overlooking the specific error message about the missing Secret, which is a common misdirection in CKA troubleshooting questions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Secret 'my-secret' does not exist in the namespace.
The pod's status indicates it is waiting for a secret to be mounted, and the error message 'secret "my-secret" not found' directly points to the missing Secret resource. Without the Secret existing in the same namespace as the pod, the volume mount fails, preventing the pod from starting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The volume driver is not installed on node-1.
Why it's wrong here
A missing volume driver would produce a distinctly different failure signature: the kubelet would fail to mount the volume with errors like "failed to mount volume" or "rpc error: code = DeadlineExceeded" from the CSI driver. Here the event explicitly references a missing Secret object, and the container creation is blocked because the kubelet cannot retrieve 'my-secret' from the API server. There is no indication of storage-related issues in the exhibit, so the volume driver is not the cause.
- ✗
The pod has exceeded its resource limits.
Why it's wrong here
If the pod had exceeded its resource limits, the container would be killed by the kernel OOM killer, which Kubernetes surfaces as `OOMKilled` in the container status or as a `Killing` event with an OOM reason. Neither scenario matches the observed error, which is a failure to find a secret during speculative container configuration. Resource limits do not influence secret resolution—the kubelet must first fetch the secret before it can even attempt to start the container process.
- ✗
The node 'node-1' is experiencing disk pressure.
Why it's wrong here
Node disk pressure is reported as a node condition (`DiskPressure`) and typically causes the kubelet to evict pods or mark them as `Evicted`, not fail a single pod's container creation with a missing Secret message. The event shown in the exhibit describes the inability to find 'my-secret', which is an API object lookup failure, not a filesystem or storage capacity problem. Were the node under disk pressure, you would also expect additional events for all pods on that node, not an isolated secret error.
- ✓
The Secret 'my-secret' does not exist in the namespace.
Why this is correct
The exhibit's event message contains the exact Kubernetes error string: the secret `my-secret` could not be found in the pod's namespace, so the kubelet is unable to inject the environment variable or volume content required by the container spec. Every Secret reference is namespaced, and the kubelet queries the API server for the secret exactly as it appears in the pod manifest; any typo, wrong namespace, or omitted resource will immediately produce this failure. Because the error is explicit and points to a missing API object, the most likely cause is that `my-secret` simply does not exist in the namespace where the Pod is running.
Go deeper
Related to this question
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.