CKA Troubleshooting 2 — Questions and Answers
Question 1: A pod's status shows 'ImagePullBackOff'. What is the most likely cause?
- The pod has insufficient CPU resources allocated
- The container image cannot be pulled due to a wrong name, tag, or missing credentials (Correct answer)
- The node running the pod has run out of disk space
- A required ConfigMap referenced by the pod does not exist
Correct answer: The container image cannot be pulled due to a wrong name, tag, or missing credentials
ImagePullBackOff occurs when Kubernetes cannot pull the container image, typically due to an incorrect image name or tag, or missing imagePullSecret for a private registry.
Question 2: Which command checks the health of etcd cluster members?
- kubectl get pods -n kube-system -l component=etcd
- etcdctl endpoint health --endpoints=<endpoint> --cacert=<ca> --cert=<crt> --key=<key> (Correct answer)
- kubectl describe etcd -n kube-system
- systemctl status etcd
Correct answer: etcdctl endpoint health --endpoints=<endpoint> --cacert=<ca> --cert=<crt> --key=<key>
etcdctl endpoint health with proper TLS certificate flags is the correct way to verify etcd cluster member health and connectivity.
Question 3: A service exists but pods are not receiving traffic. What should you check first?
- Whether the pod's namespace matches the service namespace
- Whether the service's selector labels match the pod's labels (Correct answer)
- Whether the pod has sufficient resource requests defined
- Whether the node has a valid external IP address assigned
Correct answer: Whether the service's selector labels match the pod's labels
Services route traffic using label selectors; if the selector doesn't match the pod labels, no endpoints are created and traffic cannot flow to the pods.
Question 4: How do you check the expiration date of the API server certificate on a kubeadm cluster?
- kubectl get secret kube-apiserver-cert -n kube-system
- openssl x509 -noout -dates -in /etc/kubernetes/pki/apiserver.crt
- kubeadm certs check-expiration
- Both B and C are valid methods (Correct answer)
Correct answer: Both B and C are valid methods
Both openssl x509 -noout -dates and kubeadm certs check-expiration are valid methods to inspect certificate expiration on a kubeadm-managed cluster.
Question 5: A node is showing 'DiskPressure' condition as True. What does this mean?
- The node's CPU usage is above the eviction threshold
- The node has less available disk space than the kubelet eviction threshold requires (Correct answer)
- The node's memory usage is critically high
- The node cannot communicate with the API server
Correct answer: The node has less available disk space than the kubelet eviction threshold requires
DiskPressure indicates the node's available disk space has fallen below the kubelet eviction threshold, which can trigger pod evictions to free space.
Question 6: Which kubectl flag allows you to watch a resource for changes in real-time?
- kubectl get pods --refresh
- kubectl watch pods
- kubectl get pods -w (Correct answer)
- kubectl monitor pods
Correct answer: kubectl get pods -w
The -w (--watch) flag makes kubectl continuously stream and display changes to the specified resource in real-time.
Question 7: What is the correct command to create an etcd snapshot backup?
- cp -r /var/lib/etcd /backup/etcd
- kubectl backup etcd -n kube-system
- etcdctl snapshot save /backup/etcd-snapshot.db --endpoints=<ep> --cacert=<ca> --cert=<crt> --key=<key> (Correct answer)
- kubeadm backup etcd --snapshot /backup/etcd.db
Correct answer: etcdctl snapshot save /backup/etcd-snapshot.db --endpoints=<ep> --cacert=<ca> --cert=<crt> --key=<key>
etcdctl snapshot save is the proper command to create a consistent etcd snapshot with TLS authentication parameters.
CKA Troubleshooting 2
A pod's status shows 'ImagePullBackOff'.
What is the most likely cause?