Cluster Architecture, Installation & Configuration practice questions

kube-spray

Why wrong: kube-spray uses Ansible and is more complex for this requirement.

minikube

Why wrong: minikube is for local single-node clusters.

kops

Why wrong: kops is designed for cloud providers, not bare-metal.

The kubelet configuration file has incorrect node IP.

Why wrong: That would cause connection issues, not bootstrap CA failure.

The node's RBAC permissions are misconfigured.

Why wrong: RBAC is checked after the node is registered.

The API server is not running.

Why wrong: The API server is assumed running if the kubelet can connect.

Upgrade kubelet, upgrade kubeadm, drain node, uncordon node.

Why wrong: kubelet upgrade before kubeadm can cause version mismatch.

Upgrade kubeadm, drain node, upgrade kubelet, uncordon node.

Why wrong: Upgrading kubeadm before draining is acceptable but not best practice; however, the order of kubelet and uncordon is wrong.

Upgrade kubeadm, upgrade kubelet, drain node, uncordon node.

Why wrong: Draining should happen before any upgrade to prevent disruption.

The kubelet is not configured with the correct node IP.

Why wrong: Incorrect IP would cause registration failure, not intermittent deadline exceeded.

The new node does not have enough disk space for container images.

Why wrong: Disk space would cause image pull failures, not node status update failures.

The API server is overloaded and cannot handle the node update request.

Why wrong: Other nodes are fine, so API server is likely not overloaded.

The PodSecurityPolicy admission controller is not enabled.

Why wrong: If not enabled, the PSP would not be enforced.

The PSP is not set to enforce read-only root filesystem.

Why wrong: The error is about runAsNonRoot, not read-only filesystem.

The PSP is not being applied to the pod's service account.

Why wrong: If it weren't applied, the pod would start without error.

Verify that the control plane node is healthy.

Why wrong: The error is on the worker node.

Check if the join token has expired.

Why wrong: Token expiry would give a different error.

Install a network plugin like Calico on the control plane.

Why wrong: Network plugin is not related to CRI error.

Use LUKS to encrypt the disk partition where etcd data is stored.

Why wrong: This is a valid approach but not Kubernetes-native; also requires manual management.

Use TLS certificates to encrypt communication between etcd and the API server.

Why wrong: TLS encrypts in transit, not at rest.

Configure etcd to use encryption at rest by setting --experimental-encryption-provider.

Why wrong: etcd does not have such a flag; encryption is handled by Kubernetes.

--cloud-controller-manager

Why wrong: This is not a valid flag; cloud controller manager is a separate component.

--configure-cloud-routes

Why wrong: This is for route configuration, not enabling cloud provider.

--cloud-config

Why wrong: This specifies the cloud config file, but the main flag is --cloud-provider.

Generate a join token for worker nodes.

Why wrong: Join tokens are for adding nodes, not making the control plane ready.

Copy the kubeconfig to the user's home directory.

Why wrong: kubeconfig allows kubectl to communicate with the cluster, but does not affect node readiness.

Check that the kubelet is running on the control plane node.

Why wrong: kubelet is running; it would show NotReady if network plugin missing.

kubeadm upgrade node

Why wrong: This is used for upgrading worker nodes, not control plane.

kubeadm upgrade plan v1.23.0

Why wrong: 'plan' does not take a version argument; it shows available upgrades.

kubeadm upgrade diff

Why wrong: This command does not exist.

--client-cert-auth

Why wrong: This flag enables client certificate authentication, but is not a certificate file flag.

--peer-cert-file

Why wrong: This is for peer communication, not client authentication.

Using the --hostname-override flag.

Why wrong: This overrides the hostname, not the IP.

Setting the --address flag in kubelet command line.

Why wrong: --address is deprecated and used for binding address, not node IP.

Setting the node-ip in the kubeadm-config ConfigMap.

Why wrong: kubeadm config is for cluster initialization, not kubelet runtime configuration.

Store the audit policy in a ConfigMap and reference it via --audit-policy-configmap.

Why wrong: There is no such flag; the policy file is passed directly.

Restart the kubelet on the control plane node.

Why wrong: The API server is a static pod; the kubelet does not need restart.

The pod is requesting 2 CPUs as a request, but the quota limits requests.

Why wrong: The error says limits.cpu.

The pod is being created in the wrong namespace.

Why wrong: The error does not indicate a namespace mismatch.

The pod is trying to use more CPU than the node capacity.

Why wrong: The error is about ResourceQuota, not node capacity.

Manually delete the /etc/kubernetes/manifests/kube-apiserver.yaml file and kill the process using port 6443.

Why wrong: This is not the recommended approach; kubeadm reset is safer.

Use a different port for the API server by specifying --apiserver-bind-port.

Why wrong: This would workaround but not clean up the existing cluster state.

Run kubeadm init with --force flag to override the errors.

Why wrong: There is no --force flag for kubeadm init.

Re-drain the node to reset its state, then uncordon again.

Why wrong: The node is already drained; re-draining is unnecessary.

Restart the kubelet on the control plane node to refresh the node object.

Why wrong: The kubelet is already running; restarting could cause disruptions.

Generate a new bootstrap token and rejoin the node to the cluster.

Why wrong: The node is already part of the cluster; rejoining is not required.

The etcd cluster has a leader election issue

Why wrong: The etcd cluster is reported as healthy, so leader election is not the issue.

The kube-apiserver is using the wrong etcd client port (2380 instead of 2379)

Why wrong: Port 2380 is for etcd peer communication, not client requests.

The etcd client certificate is expired

Why wrong: An expired certificate would cause a TLS error, not a generic timeout.

kubeadm init --cidr=10.244.0.0/16

Why wrong: The flag --cidr does not exist; the correct flag is --pod-network-cidr.

kubeadm init --network-cidr=10.244.0.0/16

Why wrong: This is not a valid kubeadm flag.

kubeadm init --service-cidr=10.244.0.0/16

Why wrong: This sets the service CIDR, not the pod network CIDR.

Use kubectl create node command from the control plane

Why wrong: There is no kubectl create node command.

Install kubelet on the worker node and it will automatically join the cluster

Why wrong: kubelet needs to be configured with a bootstrap token or kubeconfig to join.

Run kubeadm init on the worker node and then join

Why wrong: kubeadm initializes a control plane, not a worker node.

The node has insufficient memory

Why wrong: MemoryPressure is False.

The node is experiencing disk pressure

Why wrong: DiskPressure is False.

The network plugin (Calico) is not running on worker2

Why wrong: The NetworkUnavailable condition is False, meaning Calico is running.