easyMultiple ChoiceObjective-mapped
CKS Practice Question: Needs to ensure that all communication between…
A security engineer needs to ensure that all communication between nodes and the control plane is encrypted. Which component must be configured with a TLS certificate to achieve this?
⚠ Common exam trap
CNCF often tests the misconception that etcd is the primary component for encryption because it stores sensitive data, but the question specifically asks about encrypting communication between nodes and the control plane, which is handled by the kube-apiserver's TLS certificate, not etcd's internal encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kube-apiserver
The kube-apiserver is the central gateway for all cluster operations, and it must be configured with a TLS certificate to encrypt communication between nodes (kubelets) and the control plane. The kube-apiserver presents this certificate to authenticate itself and establish encrypted HTTPS connections, ensuring that all traffic from node components (e.g., kubelets, kube-proxy) and other control plane components is secured in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kube-proxy
Why it's wrong here
kube-proxy is a node-local network proxy that implements Service load balancing via iptables, ipvs, or userspace rules. It watches the API server for Service and Endpoint changes but does not serve as the TLS termination point for node-to-control-plane communication. Configuring a certificate on kube-proxy would not encrypt kubelet-to-apiserver traffic; only the API server's HTTPS endpoint handles that path.
- ✗
etcd
Why it's wrong here
etcd stores all cluster state and is a critical control-plane component, and it can be protected with client and peer TLS certificates. However, nodes (specifically kubelet) never communicate directly with etcd; only the kube-apiserver accesses etcd as its datastore. Securing etcd with TLS encrypts internal control-plane database traffic, but it does not provide the endpoint that nodes connect to for control-plane communication.
- ✗
kube-scheduler
Why it's wrong here
The kube-scheduler is a control-plane component responsible for assigning Pods to nodes; it creates binding decisions by writing to the Kubernetes API, never by connecting directly to nodes. Nodes do not initiate connections to the scheduler, and the scheduler exposes no node-facing TLS service. Adding a certificate to kube-scheduler would not affect the node-to-control-plane communication path, which begins with the kubelet's call to the API server.
- ✓
kube-apiserver
Why this is correct
The kube-apiserver is the single frontend of the control plane and serves the Kubernetes API over HTTPS on port 6443, which is the endpoint that every node's kubelet and kube-proxy contacts to manage workloads and report status. By configuring its TLS serving certificate via --tls-cert-file and --tls-private-key-file, and enforcing appropriate TLS versions, all communication between nodes and the control plane is encrypted in transit. Securing this endpoint is therefore the direct and necessary control to satisfy the requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.