CKA Practice Question: Cluster Architecture, Installation and Configuration
Which component is responsible for maintaining network rules on worker nodes?
⚠ Common exam trap
Watch out — candidates often confuse kubelet with kube-proxy because both run on worker nodes, but kubelet manages containers while kube-proxy manages network rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kube-proxy
kube-proxy is the component responsible for maintaining network rules on worker nodes. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or userspace rules on the node to route traffic to the correct Pods. This ensures that network traffic directed at a Service's ClusterIP or NodePort is properly forwarded to the backend Pods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kube-proxy
Why this is correct
kube-proxy is the component that directly maintains network rules on each node. It watches the Kubernetes API for Service and EndpointSlice objects, then programs iptables rules (or IPVS entries) to translate a Service's ClusterIP to the IP addresses of its backing Pods. This provides load-balanced, virtual-IP connectivity to Pods without a traditional proxy process in the data path.
- ✗
kube-scheduler
Why it's wrong here
kube-scheduler is responsible for selecting which Node a newly created Pod will run on, based on resource requirements, taints/tolerations, node affinity, and other constraints. It makes placement decisions only and does not touch network rules or packet filtering; once a Pod is scheduled, kube-proxy handles the node-level network programming. Its role ends before any network configuration is applied.
- ✗
kubelet
Why it's wrong here
kubelet is the node agent that manages the lifecycle of Pods and their containers, including starting and stopping containers and reporting node status. It does invoke CNI plugins so each Pod receives an IP address, but it does not maintain service-level network rules such as iptables DNAT/SNAT chains or IPVS virtual servers - those are configured and refreshed by kube-proxy on the node.
- ✗
kube-controller-manager
Why it's wrong here
kube-controller-manager runs a set of control loops (e.g., node controller, replication controller, endpoint slice controller) that reconcile cluster state toward the desired state. While the endpoint slice controller publishes the backend Pod IPs that kube-proxy consumes, the controller manager itself never installs or updates node-local network rules. Its controllers act on API objects, not on packet flow.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
ClusterIP NodePort LoadBalancer
ClusterIP, NodePort, and LoadBalancer are three types of Kubernetes Services that control how traffic reaches your application pods inside the cluster or from outside.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.