CKA Practice Question: Cluster Architecture, Installation and Configuration
Which TWO components are part of the Kubernetes control plane? (Select two.)
⚠ Common exam trap
CNCF often tests the distinction between control plane components and node-level agents; the trap here is that candidates confuse kubelet or kube-proxy as control plane components because they are essential to cluster operation, but they actually run on every node and are not part of the control plane.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
etcd
etcd is a distributed key-value store that serves as the primary datastore for the Kubernetes cluster, storing all cluster state and configuration data. The kube-controller-manager runs controller processes that regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. Both are core control plane components that run on the master node(s).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubelet
Why it's wrong here
The kubelet is the node agent that runs on every node, registering nodes with the API server and managing the lifecycle of pods on that node. It ensures containers are running by interacting with the container runtime and reporting pod/container status back. However, it does not participate in cluster-level decisions, so it is a worker-node component, not a control plane component.
- ✓
etcd
Why this is correct
etcd is a distributed, strongly consistent key-value store that holds the authoritative state of the entire Kubernetes cluster, including all objects, configs, and secrets. It is a foundational control plane component because every API read/write is persisted there, and control plane controllers rely on its data. Without a healthy etcd quorum, the cluster cannot function correctly.
- ✗
kube-proxy
Why it's wrong here
kube-proxy is a per-node network proxy that implements Service abstraction by programming iptables, IPVS, or eBPF rules to route traffic from Service VIPs to pod endpoints. It runs on each worker node (and on control plane nodes if taints allow) and is considered a worker-node/data-plane component. Its function is traffic forwarding, not cluster management, so it is not part of the control plane.
- ✗
container runtime
Why it's wrong here
The container runtime (such as containerd or CRI-O) is the software that actually launches and manages containers from images on a node. It works under the kubelet and handles lower-level Linux primitives like cgroups, namespaces, and overlay filesystems. Because it is confined to executing containers on a single node and has no view of the cluster’s desired state, it is not a control plane component.
- ✓
kube-controller-manager
Why this is correct
The kube-controller-manager bundles several control loops that reconcile the cluster’s actual state with declared desired state. Examples include the node controller for health monitoring, the replication controller for pod counts, and the endpoints controller for service backends. As a central process that watches the API server and acts on changes, it is a core control plane component.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Kubernetes Architecture
Kubernetes architecture is the structural design of a system that automatically deploys, scales, and manages containerized applications across a cluster of machines.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.