CKA Cluster Architecture, Installation, and Configuration 3 — Questions and Answers
Question 1: When upgrading a cluster with kubeadm, what is the correct order of operations?
- Upgrade workers first, then control plane
- Upgrade control plane first, then workers (Correct answer)
- Upgrade etcd first, then drain all nodes simultaneously
- Upgrade all nodes simultaneously using kubeadm upgrade all
Correct answer: Upgrade control plane first, then workers
You must upgrade the control plane components first with kubeadm upgrade apply, then upgrade each worker node individually.
Question 2: Which command drains a node and marks it as unschedulable before maintenance?
- kubectl cordon
- kubectl taint
- kubectl drain (Correct answer)
- kubectl delete node
Correct answer: kubectl drain
kubectl drain evicts all pods from a node and marks it unschedulable, making it safe for maintenance.
Question 3: In a high-availability control plane, how does the kube-scheduler ensure only one instance is active at a time?
- Round-robin DNS
- Leader election using a lease object (Correct answer)
- etcd distributed lock
- External load balancer sticky sessions
Correct answer: Leader election using a lease object
The kube-scheduler uses leader election via a Lease API object in the kube-system namespace so only one scheduler instance is active.
Question 4: What does the kubelet use to authenticate to the kube-apiserver in a kubeadm cluster?
- A static password file
- A client TLS certificate in /var/lib/kubelet/pki (Correct answer)
- A service account token
- HTTP Basic Auth
Correct answer: A client TLS certificate in /var/lib/kubelet/pki
The kubelet uses a client certificate (in /var/lib/kubelet/pki/kubelet-client-current.pem) generated during node bootstrapping to authenticate to the API server.
Question 5: Which ConfigMap in the kube-system namespace stores the kubeadm cluster configuration?
- kubeadm-config (Correct answer)
- cluster-config
- kube-config
- kubeadm-cluster
Correct answer: kubeadm-config
kubeadm stores its ClusterConfiguration in the kubeadm-config ConfigMap in the kube-system namespace.
Question 6: What is the role of the Node Authorizer in Kubernetes?
- Authorizes API calls made by kubelet based on the node's identity (Correct answer)
- Grants cluster-admin privileges to all nodes
- Validates node registration certificates
- Routes traffic between nodes
Correct answer: Authorizes API calls made by kubelet based on the node's identity
The Node Authorizer is a special-purpose authorization mode that grants kubelets permission to perform API operations for the objects bound to their specific node.
Question 7: Which kubeadm phase generates the kubeconfig files for cluster administrators?
- kubeadm init phase certs
- kubeadm init phase kubeconfig (Correct answer)
- kubeadm init phase etcd
- kubeadm init phase upload-config
Correct answer: kubeadm init phase kubeconfig
kubeadm init phase kubeconfig generates admin.conf, controller-manager.conf, and scheduler.conf kubeconfig files.
CKA Cluster Architecture, Installation, and Configuration 3
When upgrading a cluster with kubeadm, what is the correct order of operations?