CKA (CNCF) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Static pod manifest directory

On kubeadm control-plane nodes the kubelet reads /etc/kubernetes/manifests and runs every YAML file there as a static pod, named after the manifest file plus the node hostname.

kubeadm join token and hash

Workers join with kubeadm join host:6443 --token id.secret --discovery-token-ca-cert-hash sha256:hash; the hash pins the cluster CA so a stolen token cannot be used against an impostor API server.

Cluster certificate location

kubeadm stores the cluster CA, apiserver, front-proxy and etcd certificates under /etc/kubernetes/pki; kubeadm certs check-expiration reports remaining validity and kubeadm certs renew all reissues them.

RBAC Role versus ClusterRole

A Role grants verbs on resources inside one namespace; a ClusterRole is cluster-scoped and can also be granted within a namespace by binding it with a RoleBinding.

kubectl auth can-i impersonation

kubectl auth can-i get pods --as system:serviceaccount:dev:builder --namespace dev asks the API server whether that identity is allowed, without needing the service account token.

kubeadm upgrade order

Run kubeadm upgrade apply on the first control plane, kubeadm upgrade node elsewhere, and only then drain each node, upgrade kubelet and kubectl packages, and uncordon it.

Pause container

Every pod has a sandbox or pause container that holds the pod's network namespace; the other containers join it, which is why they share one IP address and port space.

Guaranteed QoS class

A pod is Guaranteed only when every container sets CPU and memory requests exactly equal to its limits; such pods are evicted last when a node runs out of resources.

Taint effect NoExecute

NoExecute evicts already-running pods that do not tolerate the taint, while NoSchedule only blocks new scheduling and PreferNoSchedule is a soft hint the scheduler may ignore.

nodeAffinity required versus preferred

requiredDuringSchedulingIgnoredDuringExecution is a hard filter, so no matching node leaves the pod Pending; preferredDuringSchedulingIgnoredDuringExecution adds a weighted score that never blocks scheduling.

Topology spread maxSkew

maxSkew is the largest permitted difference in pod count between topology domains; whenUnsatisfiable DoNotSchedule makes it a hard constraint, while ScheduleAnyway only biases the scheduler's scoring.

DaemonSet automatic tolerations

The DaemonSet controller adds tolerations for node.kubernetes.io/not-ready, unreachable, disk-pressure, memory-pressure, pid-pressure and unschedulable, so its pods still run on cordoned or pressured nodes.

PriorityClass preemption

Pods reference a PriorityClass by name; when a higher-value pod cannot be scheduled, the scheduler may evict lower-priority pods on a node to free capacity for it.

RollingUpdate maxSurge and maxUnavailable

maxSurge caps how many pods above the desired replica count may exist during an update and maxUnavailable caps how many may be unavailable; both are integers or percentages and default to 25%.

NodePort default range

Services of type NodePort allocate a port from 30000-32767 on every node by default; the API server flag --service-node-port-range changes that range and requires an API server restart.

Headless Service

Setting clusterIP: None makes a Service headless: no virtual IP is allocated and DNS returns one A or AAAA record per ready backing pod, which StatefulSets rely on for stable per-pod names.

Service DNS name format

A Service resolves as service.namespace.svc.cluster.local, or as the bare service name from inside the same namespace; the search domains in /etc/resolv.conf supply the remaining suffixes.

NetworkPolicy default deny

A NetworkPolicy with an empty podSelector and no rules selects every pod in the namespace and denies the traffic types listed in policyTypes; policies only add allows, never denies.

CNI plugin directory

The kubelet reads /etc/cni/net.d for the CNI configuration and calls the binary in /opt/cni/bin; the plugin must be given the cluster pod CIDR, which must not overlap node networks.

kube-proxy IPVS mode

In ipvs mode kube-proxy programs virtual servers with ipvsadm instead of iptables chains, giving constant-time lookup, but it requires the ip_vs kernel modules loaded on every node.

PV access modes

ReadWriteOnce allows a read-write mount on a single node, ReadOnlyMany on many nodes read-only, ReadWriteMany on many nodes read-write, and ReadWriteOncePod on exactly one pod cluster-wide.

WaitForFirstConsumer binding mode

A StorageClass with volumeBindingMode WaitForFirstConsumer delays provisioning and PV binding until a pod using the PVC is scheduled, so the volume is created in the pod's zone or node.

PV reclaim policy Retain

With persistentVolumeReclaimPolicy Retain, deleting the PVC leaves the PV and its data in Released state; an administrator must clear claimRef and delete the volume manually to reuse it.

StatefulSet volumeClaimTemplates

Each replica gets its own PVC named template-statefulset-ordinal, generated from volumeClaimTemplates, and that PVC survives pod deletion so data persists across rescheduling and recreation.

Default StorageClass annotation

A StorageClass annotated storageclass.kubernetes.io/is-default-class with value true is selected for PVCs that omit storageClassName; only one default class per cluster is honoured at a time.

PVC expansion requirement

Growing a PVC's requested storage only works when the bound StorageClass sets allowVolumeExpansion to true and the CSI driver supports resize; shrinking a PVC is never permitted.

kubectl logs --previous

kubectl logs pod --previous prints the output of the container instance that just crashed, which is essential when a container is in CrashLoopBackOff and the current instance has barely started.

CreateContainerConfigError cause

This state means the kubelet could not build the container configuration, most often because a referenced ConfigMap or Secret, or a specific key inside it, is missing from the namespace.

Node NotReady first checks

On the affected node run systemctl status kubelet and journalctl -u kubelet; a stopped kubelet, a wrong container runtime socket, or an expired client certificate all surface as NotReady in kubectl get nodes.

Stuck Terminating pod

A pod stuck in Terminating usually has a finalizer whose controller no longer exists, or sits on an unreachable node; inspect metadata.finalizers and force-delete only as a last resort.

Check Service endpoints

kubectl get endpointslices -l kubernetes.io/service-name=svc lists the backing pod IPs; an empty list means the Service selector matches no ready pods or the targetPort is wrong.

etcdctl endpoint health

Run etcdctl with --endpoints=https://127.0.0.1:2379 and the --cacert, --cert and --key files from /etc/kubernetes/pki/etcd to check endpoint health and the member list on a control-plane node.