Study. uk . com
  1. Home
  2. All questions
  3. Question 990

CKA study material · question 990 of 1000

The API server logs "x509: certificate has expired" for one node. Which kubeadm mechanism has failed?

  1. Automatic rotation of that node's kubelet client certificate
  2. Renewal of the cluster CA
  3. The front-proxy certificate chain
  4. The etcd peer certificate rotation
Show the answer

Answer: A. Automatic rotation of that node's kubelet client certificate

kubeadm points the kubelet at /var/lib/kubelet/pki/kubelet-client-current.pem for automatic rotation; when that fails, the API server sees an expired client certificate from that node.

Source: Troubleshooting kubeadm (Kubernetes) — Kubelet client certificate rotation fails

Challenge yourself on this topic → Study as cards