CKA Practice Question: Cluster Architecture, Installation and Configuration
You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?
⚠ Common exam trap
Watch out — candidates often think worker nodes can be upgraded first to minimize control-plane downtime, but the CKA exam tests the strict version skew policy that requires the control plane to be upgraded first, and that draining all nodes simultaneously is a common misconception that would cause complete cluster unavailability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the control plane first, then drain each worker node, upgrade the kubelet and kube-proxy, then uncordon
Kubernetes requires the control plane to be upgraded first, as it is the source of truth for the cluster state and API version compatibility. After the control plane is upgraded, each worker node must be drained (to evict pods gracefully), upgraded (kubelet and kube-proxy), and then uncordoned to resume scheduling. This sequential process ensures that the cluster remains functional and that kubelet versions never exceed the kube-apiserver version, which is a strict compatibility requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade all worker nodes first, then upgrade the control plane
Why it's wrong here
Upgrading all worker nodes before the control plane is incorrect because Kubernetes enforces strict version skew policies. A newer kubelet on worker nodes might attempt to use API features or send requests that an older kube-apiserver does not understand or support, leading to communication failures and cluster instability. The kube-apiserver, as the central component, must always be at a version equal to or greater than its connected kubelets.
- ✗
Drain all nodes simultaneously, upgrade the control plane, then upgrade worker nodes
Why it's wrong here
Draining all nodes simultaneously is a critical error as it would immediately evict all running pods from the cluster, causing complete and unacceptable service downtime. While the control plane should be upgraded first, performing a full cluster drain at any point during a rolling upgrade negates the high-availability benefits of Kubernetes. Worker nodes must be drained, upgraded, and uncordoned one by one to maintain application availability.
- ✓
Upgrade the control plane first, then drain each worker node, upgrade the kubelet and kube-proxy, then uncordon
Why this is correct
This sequence is the recommended and correct procedure for a Kubernetes cluster upgrade. Upgrading the control plane first ensures that the central kube-apiserver can support newer worker node components and API versions. Subsequently, draining each worker node individually allows pods to gracefully migrate, minimizing downtime, before upgrading its kubelet and kube-proxy, and finally uncordoning it to rejoin the cluster.
- ✗
Upgrade the control plane and worker nodes at the same time
Why it's wrong here
Upgrading the control plane and worker nodes concurrently introduces significant risks of version incompatibility and unpredictable behavior. During a simultaneous upgrade, there would be a period where critical components like the kube-apiserver and kubelet are at different, potentially incompatible, versions, leading to API communication failures and cluster instability. The control plane must establish the new cluster version before worker components are updated to match it.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.