CKA Practice Question: Cluster Architecture, Installation and Configuration
You are setting up a new Kubernetes cluster using kubeadm. After running 'kubeadm init', you want to start using the cluster with kubectl. Which of the following commands should you run to configure kubectl for the admin user?
⚠ Common exam trap
The trap here is that candidates might mistakenly copy the admin.conf to /root/.kube/config (option C) thinking it works for any user, or confuse the admin.conf location with the pki directory (option D), while the correct approach requires copying to the current user's home directory and fixing ownership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
mkdir -p $HOME/.kube && sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config
After running 'kubeadm init', the admin kubeconfig file is generated at /etc/kubernetes/admin.conf. To use kubectl as a regular (non-root) user, you must copy this file to the user's $HOME/.kube/config directory and then change its ownership to the current user. This ensures kubectl can authenticate to the cluster using the admin certificate and key embedded in the config file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
mkdir -p $HOME/.kube && sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config
Why this is correct
This is the correct sequence: `mkdir -p $HOME/.kube` ensures the default kubeconfig directory exists, `sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config` copies the cluster-admin kubeconfig generated by kubeadm into the current user's home, and `sudo chown $(id -u):$(id -g) $HOME/.kube/config` makes the file readable/writable by the current user. Because the admin.conf file is owned by root (readable only by root), sudo is required for the copy; without the chown, kubectl would fail to read the kubeconfig. The resulting `~/.kube/config` is discovered automatically by kubectl, granting full cluster-admin privileges to the local user.
- ✗
sudo kubeadm reset --force
Why it's wrong here
`kubeadm reset --force` tears down the cluster: it stops and removes control-plane components, wipes etcd, and deletes CNI configuration and iptables rules. It does not create, copy, or set up any kubeconfig—in fact, it removes the very files that kubectl needs to authenticate. Running this command would leave the cluster non-functional and kubectl unable to connect; it is only useful when you want to reinitialize the cluster from scratch or clean up a broken node, not for configuring kubectl client access.
- ✗
sudo cp /etc/kubernetes/admin.conf /root/.kube/config
Why it's wrong here
This command copies the kubeconfig to `/root/.kube/config`, which is the kubeconfig location for the `root` user only. When you run `kubectl` as a non-root user, it looks for the config in `$HOME/.kube/config` (e.g., `/home/ubuntu/.kube/config`), not in `/root/.kube/config`, so it would fail to locate any cluster information. Additionally, even if the current user could read `/root/.kube/config`, kubectl would not use it because it only checks the current user's home directory. This mistake is common when users forget they are not running as root.
- ✗
sudo cp /etc/kubernetes/pki/admin.conf $HOME/.kube/config
Why it's wrong here
The admin kubeconfig is not located in `/etc/kubernetes/pki`—that directory holds the cluster's TLS certificates and keys (such as `ca.crt`, `apiserver-kubelet-client.crt`, and `sa.key`). The file named `admin.conf` is generated by kubeadm and placed in `/etc/kubernetes/admin.conf`, not in the `pki` subdirectory. If you attempted this command, `sudo cp` would fail with a 'No such file or directory' error because `/etc/kubernetes/pki/admin.conf` does not exist. A successful configuration must use the full correct path, `/etc/kubernetes/admin.conf`, or set `KUBECONFIG` to the appropriate file.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.