KCNA Kubernetes Fundamentals Practice Question
Which component runs on every worker node and ensures that containers are running in a Pod as specified in the Pod manifest?
⚠ Common exam trap
It's easy for candidates to confuse the container runtime with the kubelet, thinking the runtime directly reads Pod manifests, when in fact the kubelet is the orchestrator that interprets the manifest and delegates container operations to the runtime via the CRI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubelet
The kubelet is the primary node agent that runs on every worker node in a Kubernetes cluster. It receives Pod specifications (Pod manifests) from the API server, either directly or via the kube-apiserver, and ensures that the containers described in those manifests are running and healthy. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers as needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kube-controller-manager
Why it's wrong here
kube-controller-manager runs in the control plane, not on worker nodes, and reconciles cluster-level resources such as Deployments and ReplicaSets rather than individual Pod containers. It is tempting because it performs reconciliation loops, but node-local Pod enforcement belongs to kubelet.
- ✗
container runtime
Why it's wrong here
The container runtime (containerd, CRI-O) only executes and supervises containers once instructed; it does not reconcile Pod specs against actual state. It is tempting because it does start and stop containers, but kubelet is the node agent that watches PodSpecs and drives the runtime to match them.
- ✓
kubelet
Why this is correct
The kubelet is the node agent that watches the API server for pods bound to its node, then starts, monitors and restarts containers via the container runtime to match the manifest. It runs on every worker node.
- ✗
kube-proxy
Why it's wrong here
kube-proxy manages Service networking rules (iptables/IPVS) on nodes, not container lifecycle. It is tempting because it runs as a DaemonSet on every worker node, but it only implements Service VIP routing; kubelet is what ensures containers run per the Pod manifest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every KCNA question from scratch — 930 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.