Three Valid Ways to Authenticate to the Kubernetes API Server
Which THREE of the following are valid methods to authenticate to the Kubernetes API server? (Select 3)
Quick Answer
The answer is X.509 client certificates, which are one of three valid authentication methods to the Kubernetes API server. This method works by having the API server validate a TLS certificate presented by the client against a trusted Certificate Authority, typically configured via the --client-ca-file flag on the API server. Service account bearer tokens are another valid method, where a signed JWT token is automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token and validated through the TokenReview API. On the CKA exam, this question tests your understanding of the authentication layer before authorization occurs, and a common trap is confusing authentication methods like HTTP basic auth or static token files, which are deprecated or less common. Remember the memory tip: “Certs, Tokens, and OpenID” — the three pillars of API server authentication.
⚠ Common exam trap
CNCF often tests the misconception that static token files and password files are equivalent, but static token files (option C) are valid while password files (option D) were deprecated and removed, so candidates must remember the deprecation timeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service account bearer tokens
Service account bearer tokens are a valid authentication method to the Kubernetes API server. When a pod is associated with a service account, Kubernetes automatically mounts a token into the pod at /var/run/secrets/kubernetes.io/serviceaccount/token. This token is a signed JWT that the API server validates against the TokenReview API, allowing the pod to authenticate as that service account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Service account bearer tokens
Why this is correct
Used by pods to authenticate.
- ✗
Anonymous requests
Why it's wrong here
While possible, it's not a recommended authentication method and is often disabled.
- ✓
Static token file
Why this is correct
Tokens from a static file can be used for authentication.
- ✗
Password file with usernames and passwords
Why it's wrong here
Kubernetes does not support password file authentication; it uses tokens or certificates.
- ✓
X.509 client certificates
Why this is correct
Common authentication method.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CKA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid methods to authenticate to the Kubernetes API server?
medium- ✓ A.Client certificate
- ✓ B.ServiceAccount token
- C.Secrets
- D.RBAC
- E.Node authorization
Why A: Client certificate authentication (option A) is valid because the Kubernetes API server can be configured with TLS to require clients to present a valid X.509 certificate signed by the cluster's Certificate Authority (CA). The API server verifies the certificate's Common Name (CN) or Subject Alternative Name (SAN) against the user identity, and the 'organizational unit' (O) field can map to Kubernetes groups. This is a core authentication method used by tools like kubectl and kubelet.
Variation 2. Which THREE are valid methods to authenticate a user to the Kubernetes API server? (Select 3)
hard- ✓ A.Bearer tokens (e.g., service account tokens)
- B.Username/password via HTTP Basic Auth
- ✓ C.Client certificates
- D.Static password file
- ✓ E.OpenID Connect (OIDC) tokens
Why A: Bearer tokens, such as those used by service accounts, are a valid authentication method for the Kubernetes API server. The API server validates the token against the token authentication file or, for service accounts, against the TokenReview API, which verifies the token's validity and associated identity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.