KCNA Kubernetes Architecture & Components 5 — Questions and Answers
Question 1: What is the Container Runtime Interface (CRI) in Kubernetes?
- A tool for building container images
- A plugin API that allows kubelet to use different container runtimes without recompilation (Correct answer)
- A network interface for containers
- A standard for writing Kubernetes controllers
Correct answer: A plugin API that allows kubelet to use different container runtimes without recompilation
CRI is a plugin interface that enables kubelet to work with different container runtimes (like containerd or CRI-O) through a standard gRPC API.
Question 2: Which Kubernetes object is used to expose a group of Pods as a network service with load balancing?
- Ingress
- Service (Correct answer)
- NetworkPolicy
- EndpointSlice
Correct answer: Service
A Service provides a stable virtual IP and DNS name for a set of Pods, load-balancing traffic across healthy Pod endpoints.
Question 3: What does the term 'reconciliation loop' mean in the context of Kubernetes controllers?
- The process of restarting crashed pods
- Continuously comparing actual cluster state to desired state and making corrections (Correct answer)
- Synchronizing etcd data across nodes
- Rotating TLS certificates automatically
Correct answer: Continuously comparing actual cluster state to desired state and making corrections
A reconciliation loop watches for changes and continuously drives the actual state of the cluster toward the declared desired state.
Question 4: Which field in a Pod spec lets you specify that a Pod requires a node with a particular label?
- tolerations
- nodeSelector (Correct answer)
- affinity.podAffinity
- topologySpreadConstraints
Correct answer: nodeSelector
nodeSelector is the simplest node selection constraint; it restricts scheduling to nodes that have all the specified key-value label pairs.
Question 5: What is a Kubernetes Taint used for?
- Marking a Pod as high priority
- Repelling Pods from a node unless the Pod has a matching Toleration (Correct answer)
- Defining resource limits on a node
- Encrypting data stored on a node
Correct answer: Repelling Pods from a node unless the Pod has a matching Toleration
Taints allow nodes to repel a set of Pods; only Pods with matching Tolerations can be scheduled onto a tainted node.
Question 6: Which Kubernetes component is responsible for serving the Kubernetes API, including authentication and authorization of requests?
- etcd
- kube-controller-manager
- kube-apiserver (Correct answer)
- kube-scheduler
Correct answer: kube-apiserver
The kube-apiserver is the front-end of the control plane, validating and processing all REST requests, enforcing authentication, authorization, and admission control.
Question 7: What is the purpose of a Kubernetes ServiceAccount?
- To store user credentials for kubectl access
- To provide an identity for processes running in Pods to authenticate with the Kubernetes API (Correct answer)
- To manage service mesh certificates
- To define network access rules for services
Correct answer: To provide an identity for processes running in Pods to authenticate with the Kubernetes API
ServiceAccounts provide an identity for Pod processes, allowing them to authenticate to the API server and be granted permissions via RBAC.
KCNA Kubernetes Architecture & Components 5
What is the Container Runtime Interface (CRI) in Kubernetes?