I85PREP
⌘ K
CKA study materials
CKA study resources

CKA (Other exams): Cluster Architecture, Installation & Configuration

CKA · Work through your exam, one topic at a time.

All guide sections

Cluster Architecture, Installation & Configuration

The Cluster Architecture, Installation & Configuration domain covers the control plane and node lifecycle: kubeadm-based cluster creation and upgrades, etcd backup and restore, RBAC, and extending the API with CRDs and operators. Expect tasks that require editing YAML and verifying the result from the command line, not multiple-choice recall.

Core rules

  • kubeadm upgrades are ordered: upgrade kubeadm, run kubeadm upgrade plan, apply the control-plane upgrade one node at a time, drain the node, upgrade kubelet and kubectl packages, then uncordon. Never upgrade a worker before its control plane is compatible.
  • etcd snapshots need the v3 API and the etcd certificates: etcdctl --endpoints=https://127.0.0.1:2379 --cacert=... --cert=... --key=... snapshot save /backup/etcd.db.
  • RBAC is additive. A Role or ClusterRole grants verbs on resources; a RoleBinding grants it in one namespace, a ClusterRoleBinding cluster-wide. kubectl auth can-i checks effective permissions.
  • CRDs add new resource types; an operator is a controller that reconciles those custom resources. Installing one does not automatically make its CRDs ready-check kubectl get crd and the operator pods.

Worked example

Back up etcd, then verify the snapshot. On a kubeadm control-plane node, read the etcd static Pod manifest at /etc/kubernetes/manifests/etcd.yaml to confirm the listen-client URL and certificate paths. Run ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /var/backups/etcd.db, then snapshot status /var/backups/etcd.db. The reasoning: the API server writes to etcd, so the snapshot must use the same endpoint and client credentials; snapshot status proves the file is readable rather than merely present.

Traps

  • Restoring etcd while the API server is still running, or restoring to the wrong --data-dir, can corrupt the cluster. Move static Pod manifests aside, restore, then restore the manifests.
  • kubectl drain needs --ignore-daemonsets and often --delete-emptydir-data; forgetting these leaves the node stuck.
  • A RoleBinding to a ClusterRole is namespace-scoped; do not assume it works in every namespace.
  • kubeadm upgrade order mistakes-upgrading kubelet before kubeadm upgrade apply-produce version skew.