1. Home
2. All questions
3. Cluster architecture

CKA study material: Cluster architecture

85 questions of the 1000 in the CKA — Certified Kubernetes Administrator quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 1. Which control plane component holds the authoritative record of all cluster state that the API server persists?
2. 2. A cluster needs more API server throughput. What is the supported way to add capacity?
3. 3. Which component watches for Pods that have been created but have no node assigned, and picks a node for each?
4. 4. Which factors does kube-scheduler weigh when choosing a node for a Pod? Choose two.
5. 5. Why are the Kubernetes controllers compiled into a single kube-controller-manager binary?
6. 6. Which controller inside kube-controller-manager reacts when a node stops responding?
7. 7. Which controller populates the objects that link a Service to the Pods behind it?
8. 8. A new namespace is created and immediately contains a default ServiceAccount. What put it there?
9. 9. A cluster runs on bare metal in an on-premises data centre. Which control plane component will it not have?
10. 10. Which controllers typically have cloud provider dependencies? Choose two.
11. 11. Which statement describes the kubelet's responsibility on a node?
12. 12. Under what circumstance can nodes run without kube-proxy?
13. 13. How does kube-proxy handle Service traffic when the operating system offers a packet filtering layer?
14. 14. Which container runtimes are named as implementations Kubernetes supports through the CRI? Choose two.
15. 15. In which namespace do the namespaced objects belonging to cluster addons live?
16. 16. Which addon does the documentation treat as effectively mandatory in every cluster?
17. 17. How does an administrator change authorization policy in a cluster running RBAC?
18. 18. Which two objects are namespaced in the RBAC API? Choose two.
19. 19. A team wants to revoke a permission that a broad Role already grants, by adding a second, narrower Role. Why will that not work?
20. 20. Which permission requires a ClusterRole rather than a Role?
21. 21. A RoleBinding in the development namespace references a ClusterRole named secret-reader. Which two statements are correct? Choose two.
22. 22. An administrator edits the roleRef of an existing RoleBinding and the request fails validation. Why?
23. 23. What is the security benefit of making a binding's roleRef immutable?
24. 24. A Role must let a subject read Pods and their logs. Which two entries belong in the rule's resources list? Choose two.
25. 25. Why can resourceNames not restrict a top-level create request?
26. 26. A Role restricts list on configmaps by resourceNames. What must a client include for the request to be authorized?
27. 27. An administrator writes rules into the rules field of an aggregated ClusterRole and they keep disappearing. What explains this?
28. 28. What is the supported way to let the built-in edit role manage a new custom resource?
29. 29. What does installing a CustomResourceDefinition give a cluster?
30. 30. A CustomResourceDefinition is installed but nothing happens when its objects are created. What is missing?
31. 31. Which two statements about the operator pattern are correct? Choose two.
32. 32. Which tasks are given as things an operator can automate? Choose two.
33. 33. Which CNI specification version does the Kubernetes project recommend a plugin be compatible with?
34. 34. What changed about CNI plugin management in Kubernetes 1.24? Choose two.
35. 35. Besides the CNI plugin, what must the container runtime provide for every Pod sandbox?
36. 36. A Pod using hostPort gets no traffic on the node's port. Which CNI configuration setting is likely missing?
37. 37. In what order does the API server process an incoming request?
38. 38. Several authorization modules are configured and none of them has an opinion about a request. What happens?
39. 39. Which HTTP status does the API server return for a request that authorization denies?
40. 40. An RBAC rule sets apiGroups to an empty string. Which API group does that name?
41. 41. A Role grants get on secrets but deliberately omits list. Why does this offer little protection?
42. 42. Which special RBAC verbs guard the RBAC API itself? Choose two.
43. 501. You are asked to design a disaster-recovery procedure that can rebuild the entire cluster state after every control plane node is lost. Backing up which component captures all of that state?
44. 502. A team is building a bare-metal cluster with no cloud provider integration at all. Which control plane component can simply be left out?
45. 503. A Pod has just been assigned to a node by kube-scheduler. Which statement correctly describes what the scheduler did?
46. 504. A cluster runs a CNI plugin that implements Service routing in its own dataplane. What does that make possible for the node components?
47. 505. You are auditing a cluster and want to distinguish core Kubernetes components from addons. Which two of the following are addons rather than core components? Choose two.
48. 506. An administrator wants to create Node objects by hand rather than letting machines add themselves. Which kubelet setting achieves that?
49. 507. A kubelet is configured with both --register-node=false and --register-with-taints=workload=gpu:NoSchedule. What happens to the taint?
50. 508. An operator edits a node's systemd unit to add a new value to --node-labels and restarts the kubelet, but the label never appears on the Node object. What explains this?
51. 509. A security review requires that a compromised kubelet cannot relabel other machines in the cluster. Which combination enforces that?
52. 510. A machine is rebuilt with different hardware but keeps its old hostname and re-registers under the same Node name. What does Kubernetes assume?
53. 511. You label a node with node-role.kubernetes.io/worker=production. How does Kubernetes interpret the value "production"?
54. 512. A cluster's control plane needs to decide whether a node is still alive. Which two mechanisms does a node use to report that it is? Choose two.
55. 513. A worker node's network link fails and it stops answering the control plane. What does the node controller write to that Node's Ready condition?
56. 514. A node goes unreachable at 10:00 and its Ready condition is set to Unknown immediately. With default settings, when does the node controller first request eviction of its Pods?
57. 515. An operator wants the control plane to notice node failures faster. Which kube-controller-manager flag controls how often each node's state is examined?
58. 516. With the default --node-eviction-rate of 0.1 per second, how quickly can the node controller start draining Pods from failed nodes?
59. 517. A 20-node cluster in a single zone loses network connectivity to most of its nodes, pushing the unhealthy fraction past 0.55. With default settings, what does the node controller do?
60. 518. Every zone in a large multi-zone cluster reports unhealthy at the same moment. How does the node controller behave?
61. 519. You cordon a node that is currently running twelve Pods. What is the immediate effect on those Pods?
62. 520. An operator starts a container directly through the container runtime on a node, outside Kubernetes. How does the scheduler account for the resources it consumes?
63. 521. A Job's Pods appear on nodes shortly after the Job is created. What did the Job controller itself actually do?
64. 522. A namespace contains both a Deployment and a Job, and both controllers create Pods. What stops the Job controller from deleting the Deployment's Pods?
65. 523. How are Kubernetes' built-in controllers deployed in a standard cluster?
66. 524. A monitoring tool needs to detect a node going silent as early as possible. Which field does the control plane itself watch for that purpose?
67. 525. Three control plane nodes each run kube-scheduler, yet only one is making scheduling decisions. What arranges that?
68. 526. You want to find out how many kube-apiserver instances a cluster is running. Which objects reveal that?
69. 527. You delete a ReplicaSet with kubectl and no extra flags. What happens to its Pods and to the ReplicaSet object?
70. 528. During foreground cascading deletion, an object sits in a "deletion in progress" state. Which two things does the API server set on it? Choose two.
71. 529. An owner is being deleted in the foreground, but one of its dependents never delays the deletion at all. What would explain that?
72. 530. A ConfigMap in namespace app-a carries an ownerReference naming a Deployment in namespace app-b. What becomes of the ConfigMap?
73. 531. Objects are disappearing unexpectedly and you suspect malformed owner references. Which Event reason should you filter for?
74. 532. A node is running a cron job that prunes unused containers with the container runtime's own CLI. Why does the Kubernetes documentation warn against this?
75. 533. A node's image filesystem crosses its HighThresholdPercent. Which images does the kubelet delete, and until when?
76. 534. A node is configured with imageMaximumGCAge: 12h, but images that have been unused for a day are still present after a kubelet restart. Why?
77. 535. An administrator wants to stop the kubelet from deleting dead containers on age alone. Which setting and value does that?
78. 536. On a busy node, keeping MaxPerPodContainer dead containers for every Pod would exceed the cluster-wide MaxContainers ceiling. What does the kubelet do?
79. 537. You are hardening a cluster whose nodes sit on an untrusted network. Which statement about node-to-control-plane traffic is correct?
80. 538. By default the API server does not verify a kubelet's serving certificate. Which two operations therefore travel over an unverified connection? Choose two.
81. 539. Which kube-apiserver flag makes the API server validate the certificate a kubelet presents?
82. 540. An operator reaches a Service through the API server proxy and prefixes the name with https: to secure it. What guarantee does that give?
83. 541. A cluster still relies on SSH tunnels for control-plane-to-node traffic. What is the documented replacement?
84. 542. A misbehaving Pod is flooding the API server with requests, yet leader election and the built-in controllers keep working. Which feature accounts for that?
85. 896. Which two components do not run inside containers on a typical node? Choose two.