CKA Practice Question: Cluster Architecture, Installation and Configuration
Which THREE are valid steps when upgrading a Kubernetes cluster using kubeadm? (Select 3)
⚠ Common exam trap
Watch out — candidates often confuse the 'kubeadm upgrade apply' command, thinking it can be run on any node, when in fact it must be executed on the control plane node, while worker nodes require 'kubeadm upgrade node'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade kubelet and kubectl on the node.
After upgrading kubeadm on the control plane, you must upgrade kubelet and kubectl on each node to match the target Kubernetes version. The kubelet is the primary node agent that communicates with the control plane, and kubectl is the CLI tool used to interact with the cluster. Without upgrading these components, the node may fail to register or report an incompatible version, causing the node to be in a NotReady state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Upgrade kubelet and kubectl on the node.
Why this is correct
kubelet and kubectl are not automatically upgraded by kubeadm; you must manually update these binaries on each node using your package manager (e.g., apt-get upgrade kubelet kubectl) or by replacing them in /usr/bin. This manual step is required because kubeadm upgrade node only handles the static pod manifests and kubeadm configuration, not the kubelet or kubectl client versions.
- ✓
Upgrade kubeadm on the node to the target version.
Why this is correct
kubeadm must be upgraded first on every node because the kubeadm upgrade commands rely on the version of the installed kubeadm binary to determine the target cluster version and generate the correct configuration. For example, you run apt-get upgrade kubeadm to fetch the desired version before executing kubeadm upgrade plan or apply on the control plane, and kubeadm upgrade node on workers, so that the tool itself understands the new version's migration steps.
- ✗
Upgrade the container runtime to a compatible version.
Why it's wrong here
The container runtime (e.g., containerd, CRI-O) is versioned independently of Kubernetes, and kubeadm does not upgrade it as part of the cluster upgrade process. You only need to ensure the runtime is within the supported version skew range for the new Kubernetes version; a runtime upgrade is not a predefined step and may be skipped entirely if the current runtime is still compatible.
- ✓
Drain the node before upgrading it.
Why this is correct
Draining the node correctly removes all pods via the Kubernetes API, respecting PodDisruptionBudgets, and marks the node as unschedulable with cordon. This is a mandatory step before upgrading either the kubelet or running kubeadm upgrade node, because it prevents workloads from being lost and ensures a controlled migration of applications to other nodes during the maintenance window.
- ✗
Run 'kubeadm upgrade apply' on the worker node.
Why it's wrong here
kubeadm upgrade apply is intended exclusively for control plane nodes, where it upgrades components like kube-apiserver, kube-controller-manager, and kube-scheduler. Worker nodes must run kubeadm upgrade node instead, which configures the local kubelet and kube-proxy for the new version; running apply on a worker will fail because there is no control plane stack to upgrade.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
kubectl Command Reference
kubectl is the command-line tool used to interact with and manage Kubernetes clusters by sending commands to the Kubernetes API.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.