Study. uk . com
  1. Home
  2. All questions
  3. Question 568

CKA study material · question 568 of 1000

An organisation wants kubeadm to sign cluster certificates with its own existing CA. What is the procedure?

  1. Pass --ca-cert-file and --ca-key-file to kubeadm init
  2. Place the CA at /etc/kubernetes/pki/ca.crt and ca.key before running kubeadm init
  3. Set externalCA: true in ClusterConfiguration
  4. Run kubeadm init first, then replace the generated CA and restart
Show the answer

Answer: B. Place the CA at /etc/kubernetes/pki/ca.crt and ca.key before running kubeadm init

kubeadm will not overwrite a certificate and key pair that already exists in its PKI directory, so copying an existing CA in beforehand makes kubeadm sign everything else with it.

Source: Certificate Management with kubeadm (Kubernetes) — Using custom certificates

Challenge yourself on this topic → Study as cards