CKA Cluster Maintenance 3 — Questions and Answers
Question 1: Which kubeadm command upgrades the kubelet and kubectl on a control plane node after kubeadm upgrade apply?
- kubeadm upgrade node
- apt-get upgrade kubelet kubectl (Correct answer)
- kubeadm upgrade kubelet
- systemctl restart kubelet
Correct answer: apt-get upgrade kubelet kubectl
After kubeadm upgrade apply, you must separately upgrade kubelet and kubectl using the package manager (apt/yum), then restart kubelet.
Question 2: What is the correct order of operations when upgrading a multi-node Kubernetes cluster using kubeadm?
- Upgrade workers first, then control plane
- Upgrade control plane first, then drain and upgrade each worker (Correct answer)
- Upgrade all nodes simultaneously
- Upgrade etcd first, then workers, then control plane
Correct answer: Upgrade control plane first, then drain and upgrade each worker
kubeadm requires upgrading the control plane before workers; then each worker is drained, upgraded, and uncordoned sequentially.
Question 3: Which command shows the upgrade plan and available versions for a kubeadm-managed cluster?
- kubeadm upgrade check
- kubeadm upgrade plan (Correct answer)
- kubeadm version --upgrade
- kubectl get upgrades
Correct answer: kubeadm upgrade plan
kubeadm upgrade plan shows the current cluster version, available target versions, and any component version skew warnings.
Question 4: How do you restore an etcd cluster from a snapshot taken with etcdctl?
- etcdctl snapshot load <file>
- etcdctl snapshot restore <file> --data-dir <path> (Correct answer)
- etcdctl restore --from-snapshot <file>
- systemctl restore etcd --snapshot <file>
Correct answer: etcdctl snapshot restore <file> --data-dir <path>
etcdctl snapshot restore creates a new data directory from the snapshot; you then point etcd at that directory to complete the restore.
Question 5: A PodDisruptionBudget specifies minAvailable: 3 for a Deployment with 4 replicas. How many pods can kubectl drain evict at once?
- All 4 pods
- 3 pods
- 1 pod (Correct answer)
- 2 pods
Correct answer: 1 pod
With minAvailable: 3, only 1 pod may be disrupted at a time (4 - 3 = 1), so drain can evict at most 1 pod.
Question 6: Which flag must be passed to etcdctl snapshot save to authenticate when etcd uses TLS?
- --tls-verify=true
- --cacert, --cert, --key flags pointing to etcd certificates (Correct answer)
- --auth-token <token>
- --endpoints only
Correct answer: --cacert, --cert, --key flags pointing to etcd certificates
etcdctl requires --cacert, --cert, and --key to authenticate to a TLS-secured etcd; without them the connection is rejected.
Question 7: What happens to pods managed by a DaemonSet when you run kubectl drain on a node?
- They are evicted and rescheduled on other nodes
- They are deleted and not replaced
- They are skipped unless --ignore-daemonsets is passed, and not evicted (Correct answer)
- The drain fails with an error
Correct answer: They are skipped unless --ignore-daemonsets is passed, and not evicted
DaemonSet pods cannot be evicted because they must run on every node; drain skips them when --ignore-daemonsets is specified.
CKA Cluster Maintenance 3
Which kubeadm command upgrades the kubelet and kubectl on a control plane node after kubeadm upgrade apply?