CKA Credential Overview 3

Question 1

Which Kubernetes API group handles CertificateSigningRequest resources?

Accepted Answer

certificates.k8s.io

Answer

CertificateSigningRequest resources belong to the certificates.k8s.io API group.

Question 2

When using OIDC authentication in Kubernetes, which token field contains the user's identity?

Accepted Answer

id_token

Answer

The id_token issued by an OIDC provider contains the user's identity claims and is presented to the Kubernetes API server.

Question 3

What is the purpose of the --client-ca-file flag on the kube-apiserver?

Accepted Answer

Specifies the CA used to verify client certificates presented during authentication

Answer

The --client-ca-file flag tells the API server which CA to use when validating X.509 client certificates for mutual TLS authentication.

Question 4

Which subresource must be approved on a CertificateSigningRequest to issue the certificate?

Accepted Answer

certificatesigningrequests/approval

Answer

To approve a CSR, an approver must update the certificatesigningrequests/approval subresource, which triggers the signer to issue the certificate.

Question 5

A ServiceAccount named 'app-sa' in namespace 'prod' is referenced in a pod spec. Which Secret naming convention did older Kubernetes versions use for its auto-generated token?

Accepted Answer

app-sa-token-<random>

Answer

Kubernetes historically auto-created a Secret named -token- and mounted it into pods automatically.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Credential Overview 3