CKA Credential Overview 3 — Questions and Answers
Question 1: Which Kubernetes API group handles CertificateSigningRequest resources?
- certificates.k8s.io (Correct answer)
- auth.k8s.io
- security.k8s.io
- policy.k8s.io
Correct answer: certificates.k8s.io
CertificateSigningRequest resources belong to the certificates.k8s.io API group.
Question 2: When using OIDC authentication in Kubernetes, which token field contains the user's identity?
- access_token
- refresh_token
- id_token (Correct answer)
- bearer_token
Correct answer: id_token
The id_token issued by an OIDC provider contains the user's identity claims and is presented to the Kubernetes API server.
Question 3: What is the purpose of the --client-ca-file flag on the kube-apiserver?
- Specifies the CA certificate used to sign the API server's own TLS cert
- Specifies the CA used to verify client certificates presented during authentication (Correct answer)
- Sets the CA for validating webhook server certificates
- Defines the CA for etcd communication
Correct answer: Specifies the CA used to verify client certificates presented during authentication
The --client-ca-file flag tells the API server which CA to use when validating X.509 client certificates for mutual TLS authentication.
Question 4: Which subresource must be approved on a CertificateSigningRequest to issue the certificate?
- certificates/sign
- certificatesigningrequests/approval (Correct answer)
- csr/approve
- certificates/approval
Correct answer: certificatesigningrequests/approval
To approve a CSR, an approver must update the certificatesigningrequests/approval subresource, which triggers the signer to issue the certificate.
Question 5: A ServiceAccount named 'app-sa' in namespace 'prod' is referenced in a pod spec. Which Secret naming convention did older Kubernetes versions use for its auto-generated token?
- app-sa-secret
- app-sa-token-<random> (Correct answer)
- prod-app-sa-token
- serviceaccount-app-sa
Correct answer: app-sa-token-<random>
Kubernetes historically auto-created a Secret named <serviceaccount>-token-<random5chars> and mounted it into pods automatically.
Question 6: Which field in a kubeconfig user entry stores a base64-encoded client certificate?
- client-key-data
- client-certificate-data (Correct answer)
- certificate-authority-data
- token-data
Correct answer: client-certificate-data
The client-certificate-data field holds the base64-encoded PEM client certificate for X.509 user authentication.
Question 7: What is the minimum RBAC permission needed for a user to view their own CertificateSigningRequests?
- get on certificatesigningrequests in all namespaces
- list on certificatesigningrequests cluster-wide
- get on certificatesigningrequests cluster-scoped resource (Correct answer)
- watch on certificates in the kube-system namespace
Correct answer: get on certificatesigningrequests cluster-scoped resource
CertificateSigningRequest is a cluster-scoped resource; a user needs get permission on certificatesigningrequests at the cluster level to view them.
CKA Credential Overview 3
Which Kubernetes API group handles CertificateSigningRequest resources?