CKA Practice Question: Cluster Architecture, Installation and Configuration
Which component on a worker node is responsible for maintaining network rules and enabling service abstraction?
⚠ Common exam trap
CNCF often tests the distinction between kubelet (Pod lifecycle) and kube-proxy (network rules), so the trap here is that candidates confuse kubelet's role in managing containers with the network abstraction provided by kube-proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kube-proxy
kube-proxy is the component on each worker node that maintains network rules (e.g., iptables, IPVS) and enables service abstraction by proxying traffic to the correct Pods. It watches the Kubernetes API server for Service and EndpointSlice changes, then updates the node's packet filtering rules to route cluster IP traffic to healthy backend Pods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kube-scheduler
Why it's wrong here
The kube-scheduler is a control-plane component that selects which node a newly created pod should run on based on resource availability, affinity rules, and other scheduling constraints. It does not run on worker nodes and has no role in maintaining node-local network rules or Service routing. Its responsibility ends once a pod is assigned to a node, so it cannot be the component maintaining network rules.
- ✓
kube-proxy
Why this is correct
kube-proxy runs on every worker node and is responsible for implementing the Kubernetes Service abstraction by maintaining network rules that govern traffic forwarding to backend pods. It watches the API server for Service and Endpoint changes and programs iptables, IPVS, or userspace rules to route packets correctly. This directly matches the task of maintaining network rules on a worker node, making it the correct answer.
- ✗
container runtime
Why it's wrong here
The container runtime, such as containerd or CRI-O, manages container images and the full lifecycle of containers on a node: pulling images, creating namespaces, starting and stopping processes, and reporting status to the kubelet. It does not handle cluster-level networking or Service proxying, and it does not maintain iptables or IPVS rules for Service traffic. Thus it is not the component responsible for maintaining network rules.
- ✗
kubelet
Why it's wrong here
The kubelet is the primary node agent that registers the worker node with the cluster, receives PodSpecs from the API server, and ensures that containers in those pods are running by interacting with the container runtime. It monitors pod health and enforces pod-level configuration, but it does not program network rules or manage Service traffic forwarding. Those duties belong to kube-proxy, so the kubelet is incorrect here.
Visual reference
Go deeper
Related to this question
Learn chapter
Installing Kubernetes with kubeadm
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Kubernetes Node Roles
Kubernetes Node Roles are labels assigned to machines in a cluster that define whether a node runs application containers (worker) or manages the cluster (control plane).
About these practice questions
One of 726 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.