I85PREP
⌘ K
CKA study materials
CKA study resources

CKA (CNCF) practice questions

One question at a time. Build your CKA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cluster Architecture, Installation & Configuration

Which control-plane component exposes the Kubernetes REST API and is the only control-plane component that writes directly to etcd?

  1. cloud-controller-manager
  2. kube-scheduler
  3. kube-controller-manager
  4. kube-apiserver Correct answer.

Explanation

The kube-apiserver validates and processes REST requests and is the only control-plane component with a direct client connection to etcd. Other components read and write cluster state through the API server, which centralizes authentication, authorization, and admission control.

Question 2Cluster Architecture, Installation & Configuration

What is the primary function of kube-scheduler?

  1. It selects nodes for pending Pods. Correct answer.
  2. It persists cluster objects into etcd.
  3. It runs containers on worker nodes.
  4. It signs API server certificates.

Explanation

The scheduler watches for Pods without a node assignment and filters and scores nodes using resource requests, affinity, taints, and other policies. It then records the chosen node by creating a binding through the API server.

Question 3Cluster Architecture, Installation & Configuration

Which node component is responsible for starting and monitoring containers in Pods on that node?

  1. etcd
  2. kube-apiserver
  3. kube-proxy
  4. kubelet Correct answer.

Explanation

The kubelet is the primary node agent; it receives PodSpecs from the API server, drives the container runtime through CRI, and reports Pod status. kube-proxy and the container runtime support networking and execution but do not manage the Pod lifecycle.

Question 4Cluster Architecture, Installation & Configuration

By default, in which directory does kubelet look for static Pod manifest files?

  1. /etc/kubernetes/pki
  2. /etc/cni/net.d
  3. /var/lib/kubelet/pods/manifests
  4. /etc/kubernetes/manifests Correct answer.

Explanation

kubelet reads static Pod manifests from the path set by staticPodPath in its configuration; kubeadm sets this to /etc/kubernetes/manifests. Files placed there are watched and the Pods are created directly by kubelet.

Question 5Cluster Architecture, Installation & Configuration

Which command switches kubectl to a different context in the current kubeconfig?

  1. kubectl config view
  2. kubectl config use-context Correct answer.
  3. kubectl config set-cluster
  4. kubectl config delete-user

Explanation

A context associates a cluster, a user, and optionally a default namespace. The `kubectl config use-context` command changes the current-context entry so subsequent commands use that association.

Question 6Cluster Architecture, Installation & Configuration

Which command marks a node as unschedulable without evicting existing Pods?

  1. kubectl drain
  2. kubectl cordon Correct answer.
  3. kubectl taint
  4. kubectl delete node

Explanation

`kubectl cordon` sets the node's spec.unschedulable field to true, so new Pods are not assigned while existing Pods keep running. `kubectl drain` performs cordon plus eviction, which is a different operation.

Question 7Cluster Architecture, Installation & Configuration

What is the role of kube-proxy on a node?

  1. It runs the container runtime for Pods.
  2. It resolves Service DNS names for Pods.
  3. It programs Service forwarding rules. Correct answer.
  4. It approves node certificate requests.

Explanation

kube-proxy watches Services and Endpoints and programs rules on each node so traffic to a Service virtual IP is forwarded to a backing Pod. It does not provide DNS or run containers.

Question 8Cluster Architecture, Installation & Configuration

Which interface does kubelet use to communicate with a container runtime such as containerd or CRI-O?

  1. CRI Correct answer.
  2. CSI
  3. OCI
  4. CNI

Explanation

The Container Runtime Interface (CRI) is the gRPC API kubelet uses to create, start, stop, and inspect containers and Pod sandboxes. CNI handles network setup and CSI handles storage.

Question 9Cluster Architecture, Installation & Configuration

Which command creates a consistent snapshot of etcd at /backup/etcd.db using client certificates?

  1. kubectl create snapshot etcd --file /backup/etcd.db --endpoints=https://127.0.0.1:2379 --cacert=ca.crt --cert=server.crt --key=server.key
  2. etcdctl snapshot save /backup/etcd.db --endpoints=https://127.0.0.1:2379 --cacert=ca.crt --cert=server.crt --key=server.key Correct answer.
  3. etcdctl snapshot status /backup/etcd.db --write-out=table --endpoints=https://127.0.0.1:2379 --cacert=ca.crt --cert=server.crt --key=server.key
  4. kubeadm etcd backup --output /backup/etcd.db --endpoints=https://127.0.0.1:2379 --cacert=ca.crt --cert=server.crt --key=server.key

Explanation

`etcdctl snapshot save` writes a consistent backup, and secure clusters require the etcd endpoints plus CA, client certificate, and key flags. The snapshot status subcommand only inspects an existing snapshot file.

Question 10Cluster Architecture, Installation & Configuration

A worker node must be joined to an existing kubeadm cluster. Which two values are required by `kubeadm join`?

  1. A kubelet certificate and the pod network CIDR
  2. A bootstrap token and the control-plane CA key hash Correct answer.
  3. An admin kubeconfig and the etcd client certificate
  4. A bootstrap token and the API server's service CIDR

Explanation

The bootstrap token authenticates the joining node, and the CA certificate hash lets it verify the control-plane identity during discovery. Without the hash, the node could be tricked into trusting an impostor API server.

Question 11Cluster Architecture, Installation & Configuration

A RoleBinding in namespace dev references the ClusterRole view. What access does this grant?

  1. Write access to all namespaced resources in namespace dev.
  2. Cluster-wide read access to all resources in the view ClusterRole.
  3. Read access to view rules, limited to namespace dev. Correct answer.
  4. Read access only to cluster-scoped resources in the view ClusterRole.

Explanation

A RoleBinding grants the referenced role's permissions only within its own namespace, even when the role is a ClusterRole. A ClusterRoleBinding is required to grant those permissions across the whole cluster.

Question 12Cluster Architecture, Installation & Configuration

How can you check whether ServiceAccount deployer can create Deployments in namespace prod?

  1. kubectl describe serviceaccount deployer --namespace=prod --show-permissions
  2. kubectl auth can-i create deployments --namespace=prod --as=system:serviceaccount:prod:deployer Correct answer.
  3. kubectl config view --namespace=prod --serviceaccount=deployer --permissions
  4. kubectl get rolebindings --namespace=prod --output=yaml --as=system:serviceaccount:prod:deployer

Explanation

`kubectl auth can-i` submits a SubjectAccessReview and reports whether the specified identity is allowed to perform the verb on the resource. ServiceAccount identities are expressed as system:serviceaccount:<namespace>:<name>.

Question 13Cluster Architecture, Installation & Configuration

During a kubeadm cluster upgrade, what is the correct high-level order?

  1. Upgrade worker nodes and control-plane nodes simultaneously.
  2. Upgrade the control plane, then upgrade each node's kubelet. Correct answer.
  3. Upgrade all kubelets first, then upgrade the control plane.
  4. Upgrade etcd members only, then patch the API server image.

Explanation

kubeadm upgrades the control plane before worker nodes so the API server is never older than the kubelets. Each node is then drained, its kubelet and kubeadm packages are upgraded, and it is uncordoned.

Question 14Cluster Architecture, Installation & Configuration

After renewing control-plane certificates with `kubeadm certs renew all`, what must be done for the API server to use the new certificates?

  1. Restart the static control-plane Pods. Correct answer.
  2. Reboot the entire node immediately.
  3. Delete the kube-system namespace.
  4. Run `kubeadm reset` and rejoin the node.

Explanation

Control-plane components run as static Pods and read their certificates when the containers start. After `kubeadm certs renew all`, the static Pods must be recreated so the new certificates are loaded.

Question 15Cluster Architecture, Installation & Configuration

A static Pod named metrics-server is created on node worker-1. What name does the API server show for its mirror Pod?

  1. metrics-server-worker-1 Correct answer.
  2. metrics-server
  3. metrics-server-static
  4. mirror-metrics-server-worker-1

Explanation

A mirror Pod is the API server representation of a static Pod, named <static-pod-name>-<node-name>. It is managed by kubelet and cannot be edited or deleted independently of the manifest.

Question 16Cluster Architecture, Installation & Configuration

Which command safely evicts Pods from node worker-2 while ignoring DaemonSet Pods and allowing emptyDir data loss?

  1. kubectl drain worker-2 --ignore-daemonsets --delete-emptydir-data Correct answer.
  2. kubectl drain worker-2 --force --grace-period=0
  3. kubectl delete node worker-2 --ignore-daemonsets --force
  4. kubectl cordon worker-2 --ignore-daemonsets --delete-emptydir-data

Explanation

`kubectl drain` cordons the node and evicts Pods gracefully, respecting PodDisruptionBudgets where possible. DaemonSet Pods and Pods with emptyDir data require explicit flags because eviction would otherwise fail or lose data.

Question 17Cluster Architecture, Installation & Configuration

How do you prevent a ServiceAccount's token from being automatically mounted into Pods that use it?

  1. Set automountServiceAccountToken: false on the Pod or ServiceAccount. Correct answer.
  2. Set serviceAccountToken: disabled in the kubelet configuration file.
  3. Delete the automatically generated token Secret from the namespace.
  4. Remove the service-account-issuer flag from the API server manifest.

Explanation

The automountServiceAccountToken field can be set on a ServiceAccount or on an individual Pod. Setting it to false prevents the projected service account token from being mounted automatically.

Question 18Cluster Architecture, Installation & Configuration

Which command prints a join command with a new bootstrap token for worker nodes?

  1. kubeadm token create --print-join-command Correct answer.
  2. kubeadm join --print-token
  3. kubeadm token list --print-join-command
  4. kubeadm init --join-command

Explanation

`kubeadm token create --print-join-command` creates a new bootstrap token and prints a complete join command including the CA certificate hash. `kubeadm token list` only displays existing tokens.

Question 19Cluster Architecture, Installation & Configuration

What does CoreDNS provide in a default kubeadm cluster?

  1. Persistent storage for application data.
  2. Load balancing for external traffic to Services.
  3. Certificate rotation for kubelet clients.
  4. Cluster DNS resolution for Services and Pods. Correct answer.

Explanation

CoreDNS runs as the cluster DNS server and resolves Service names and Pod records for workloads. It watches Services and Endpoints and is exposed through the kube-dns Service.

Question 20Cluster Architecture, Installation & Configuration

How do you initialize a control-plane node using a kubeadm configuration file named kubeadm-config.yaml?

  1. kubeadm config upload kubeadm-config.yaml
  2. kubeadm init --config kubeadm-config.yaml Correct answer.
  3. kubeadm init --file kubeadm-config.yaml
  4. kubeadm init --config-file kubeadm-config.yaml

Explanation

The `kubeadm init --config` flag accepts a YAML configuration file for settings such as networking, kubelet, and API server options. There is no `--file` or `--config-file` flag for this purpose.

Question 21Cluster Architecture, Installation & Configuration

A user has KUBECONFIG set to two files. How do kubectl and kubeadm resolve configuration when no --kubeconfig flag is given?

  1. They use only the last file listed in KUBECONFIG.
  2. They merge the files, with earlier files winning conflicts. Correct answer.
  3. They ignore KUBECONFIG and use admin.conf.
  4. They use only the first file listed in the KUBECONFIG environment variable.

Explanation

The KUBECONFIG environment variable can list multiple files separated by a colon. kubectl merges them, and for conflicting values the first file in the list takes precedence.

Question 22Cluster Architecture, Installation & Configuration

Which command removes the control-plane taint so a single-node cluster can schedule ordinary Pods on the control-plane node?

  1. kubectl uncordon node-role.kubernetes.io/control-plane
  2. kubectl taint nodes --all node-role.kubernetes.io/master:NoSchedule-
  3. kubectl taint nodes --all node-role.kubernetes.io/control-plane- Correct answer.
  4. kubectl label node node-role.kubernetes.io/control-plane-

Explanation

A taint key with a trailing hyphen removes that taint from the selected nodes. kubeadm applies node-role.kubernetes.io/control-plane:NoSchedule to control-plane nodes in current versions.

Question 23Cluster Architecture, Installation & Configuration

In a kubeadm HA cluster, what distinguishes a stacked etcd topology from an external etcd topology?

  1. Stacked etcd shares control-plane hosts; external etcd uses separate hosts. Correct answer.
  2. Stacked etcd stores data in memory, while external etcd stores data on disk.
  3. Stacked etcd uses a single member, while external etcd always uses five members.
  4. Stacked etcd runs only on worker nodes, while external etcd runs on control-plane nodes.

Explanation

Stacked etcd is co-located with control-plane nodes, which simplifies deployment but couples etcd and control-plane failure domains. External etcd runs on dedicated hosts and is common when etcd load or isolation requirements are higher.

Question 24Cluster Architecture, Installation & Configuration

Which etcdctl commands are appropriate for checking member health and reclaiming fragmented space on an etcd cluster?

  1. etcdctl endpoint health and etcdctl defrag Correct answer.
  2. etcdctl user add and etcdctl role add
  3. etcdctl put and etcdctl get
  4. etcdctl snapshot save and etcdctl snapshot restore

Explanation

`etcdctl endpoint health` checks whether members can serve requests, and `etcdctl defrag` reclaims free space fragmented by etcd's append-only store. Snapshot commands are for backup and restore, not routine health or defragmentation.

Question 25Cluster Architecture, Installation & Configuration

A new worker node is configured for TLS bootstrapping. What happens after kubelet sends a certificate signing request to the API server?

  1. The CSR is stored in etcd and then used directly as the kubelet's serving certificate.
  2. The CSR is rejected unless the kubelet first presents a pre-shared administrator certificate.
  3. The CSR is automatically signed without review and kubelet receives an admin kubeconfig.
  4. The CSR must be approved before kubelet receives a client certificate. Correct answer.

Explanation

With TLS bootstrapping, kubelet uses a bootstrap token to request a client certificate through the CSR API. An administrator or an auto-approval controller must approve the request before kubelet receives a certificate signed by the cluster CA.

Question 26Cluster Architecture, Installation & Configuration

Where does kubelet look for static Pod manifests on a kubeadm-provisioned control-plane node by default?

  1. /var/lib/kubelet/pods
  2. /etc/kubernetes/manifests Correct answer.
  3. /etc/kubernetes/static-pods
  4. /var/lib/kubelet/manifests

Explanation

On kubeadm nodes the kubelet configuration sets staticPodPath to /etc/kubernetes/manifests. The kubelet watches that directory and creates mirror Pods for each manifest it finds.

Question 27Cluster Architecture, Installation & Configuration

A node was drained for maintenance and is now ready to accept Pods again. Which command makes it schedulable?

  1. kubectl label node <node> schedulable=true
  2. kubectl taint node <node> node.kubernetes.io/unschedulable-
  3. kubectl drain <node> --force
  4. kubectl uncordon <node> Correct answer.

Explanation

Cordoning a node sets spec.unschedulable, and uncordon clears that field so the scheduler can place new Pods there. Labels and taints do not remove the unschedulable flag.

Question 28Cluster Architecture, Installation & Configuration

Which control-plane component binds a Pod to a node by writing the nodeName field?

  1. kubelet
  2. kube-scheduler Correct answer.
  3. cloud-controller-manager
  4. kube-proxy

Explanation

The scheduler watches for Pods without a node assignment, filters and scores nodes, then records the chosen node in the Pod binding. The kubelet then runs the Pod on that node.

Question 29Cluster Architecture, Installation & Configuration

Which command removes the local Kubernetes configuration that kubeadm created on a node so it can be re-joined?

  1. kubectl delete node <node>
  2. kubeadm cleanup
  3. kubeadm init --force
  4. kubeadm reset Correct answer.

Explanation

kubeadm reset stops local components and removes files such as /etc/kubernetes and kubelet configuration so the node can be initialized or joined again. Deleting the Node object only removes the API representation.

Question 30Cluster Architecture, Installation & Configuration

A kubeconfig file defines contexts dev and prod. Which command switches the active context to prod?

  1. kubectl config use-context prod Correct answer.
  2. kubectl config set-context prod
  3. kubectl use prod
  4. kubectl config current-context prod

Explanation

kubectl config use-context sets the current-context field in the kubeconfig. set-context modifies fields of a context rather than selecting it.

Question 31Cluster Architecture, Installation & Configuration

Running `kubectl top nodes` returns 'error: Metrics API not available'. What must be installed for this command to work?

  1. kube-state-metrics
  2. Prometheus Operator
  3. node-exporter
  4. metrics-server Correct answer.

Explanation

kubectl top reads from the metrics.k8s.io API, which is served by metrics-server. Other monitoring tools may collect metrics but do not provide that API.

Question 32Cluster Architecture, Installation & Configuration

A new worker node registers but stays NotReady. kubelet logs show 'network plugin is not ready: cni config uninitialized'. What is the most likely cause?

  1. The node has not been cordoned yet.
  2. The kubelet is missing a valid kubeconfig.
  3. The cluster has no CNI plugin installed. Correct answer.
  4. The kubelet cannot reach the API server.

Explanation

kubelet reports NetworkReady as false until a CNI configuration is present on the node. Installing a CNI plugin provides that configuration and allows the node to become Ready.

Question 33Cluster Architecture, Installation & Configuration

Which command lists the container images required by the kubeadm version installed on the host?

  1. kubectl get images -n kube-system
  2. crictl images list
  3. kubeadm config images list Correct answer.
  4. kubeadm images show

Explanation

kubeadm config images list prints the control-plane and infrastructure images for the Kubernetes version kubeadm will install. crictl lists images already present in a container runtime.

Question 34Cluster Architecture, Installation & Configuration

A ClusterRole named node-reader grants get and list on nodes. Which binding lets a user read nodes across the entire cluster?

  1. A RoleBinding in kube-system to node-reader
  2. A RoleBinding in default to node-reader
  3. A Role in each namespace granting get on nodes
  4. A ClusterRoleBinding to node-reader Correct answer.

Explanation

Nodes are cluster-scoped resources, so cluster-wide access requires a ClusterRoleBinding. A RoleBinding only grants permissions within its namespace and cannot grant access to cluster-scoped resources.

Question 35Cluster Architecture, Installation & Configuration

A node is given the taint maintenance=true:NoExecute. What happens to running Pods on that node that do not tolerate it?

  1. They are evicted from the node. Correct answer.
  2. They keep running but new Pods are not scheduled.
  3. They are rescheduled only after a node reboot.
  4. They are paused until the taint is removed.

Explanation

The NoExecute effect evicts running Pods that lack a matching toleration. NoSchedule only prevents new Pods from being placed on the node.

Question 36Cluster Architecture, Installation & Configuration

A Pod has nodeSelector: disktype: ssd. Which nodes can it be scheduled on?

  1. Only nodes whose name contains ssd.
  2. Only nodes labeled disktype=ssd. Correct answer.
  3. Nodes that tolerate disktype=ssd.
  4. Any node, with a preference for ssd nodes.

Explanation

nodeSelector is a hard label match, so the scheduler filters out nodes that lack the specified label. It does not express a soft preference or use taints.

Question 37Cluster Architecture, Installation & Configuration

A kubelet's CSR appears as Pending in `kubectl get csr`. Which command approves it so the kubelet receives a certificate?

  1. kubectl certificate sign csr <name>
  2. kubectl certificate approve <name> Correct answer.
  3. kubectl csr approve <name> --force
  4. kubectl apply -f csr-<name>.yaml

Explanation

Approving a CSR sets its Approved condition, after which the controller-manager signs it. The kubelet can then download the issued certificate and complete TLS bootstrapping.

Question 38Cluster Architecture, Installation & Configuration

Which command creates a short-lived bearer token for ServiceAccount deployer in namespace prod?

  1. kubectl create serviceaccount deployer -n prod
  2. kubectl create token deployer -n prod Correct answer.
  3. kubectl get secret deployer-token -n prod
  4. kubectl auth token deployer -n prod

Explanation

kubectl create token requests a time-limited token through the TokenRequest API. Since Kubernetes 1.24, long-lived token Secrets are not created automatically for new ServiceAccounts.

Question 39Cluster Architecture, Installation & Configuration

Which command shows a node's taints, allocatable CPU and memory, and conditions in one output?

  1. kubectl top node <node>
  2. kubectl logs node/<node>
  3. kubectl describe node <node> Correct answer.
  4. kubectl get node <node> -o yaml

Explanation

kubectl describe node summarizes the node's taints, capacity and allocatable resources, and current conditions. The YAML output is more verbose and does not provide the same human-readable summary.

Question 40Cluster Architecture, Installation & Configuration

After editing /var/lib/kubelet/config.yaml to change eviction thresholds, what must be done for kubelet to apply the change?

  1. kubeadm upgrade node
  2. systemctl restart kubelet Correct answer.
  3. kubectl rollout restart kubelet
  4. kubectl delete pod kubelet

Explanation

kubelet reads its configuration file when the service starts, so the kubelet systemd unit must be restarted to apply changes. On kubeadm nodes kubelet runs as a system service rather than as an API-managed Pod.

Question 41Cluster Architecture, Installation & Configuration

Which command shows the Kubernetes versions that the current kubeadm cluster can be upgraded to?

  1. kubectl version --short
  2. kubeadm version
  3. kubeadm upgrade status
  4. kubeadm upgrade plan Correct answer.

Explanation

kubeadm upgrade plan queries available release information and reports target versions and component upgrade details. kubeadm version only prints the local binary version.

Question 42Cluster Architecture, Installation & Configuration

Two PriorityClasses exist with values 1000 and 100000. How does the scheduler use these values?

  1. Higher values are preferred when resources are scarce. Correct answer.
  2. The values must be between 1 and 100.
  3. The values affect only eviction decisions and never scheduling.
  4. Lower values are always scheduled first.

Explanation

A higher priority value means a more important Pod, and the scheduler orders its queues accordingly. Preemption may also remove lower-priority Pods when resources are insufficient.

Question 43Cluster Architecture, Installation & Configuration

What does requiredDuringSchedulingIgnoredDuringExecution mean in node affinity?

  1. It applies only to Pods managed by a DaemonSet.
  2. It is a hard rule at scheduling time and is not rechecked later. Correct answer.
  3. It is a soft preference that is ignored if no node matches at all.
  4. It is checked only when the Pod is evicted from a node.

Explanation

This term is a hard scheduling requirement, so the Pod stays Pending if no node satisfies it. The IgnoredDuringExecution part means later label changes do not evict a running Pod.

Question 44Cluster Architecture, Installation & Configuration

Which three top-level sections make up a kubeconfig file?

  1. apiVersion, metadata, spec
  2. nodes, pods, services
  3. users, roles, bindings
  4. clusters, users, contexts Correct answer.

Explanation

A kubeconfig contains clusters with API endpoints and certificate data, users with credentials, and contexts that pair a cluster with a user. The current-context field selects which pairing is active.

Question 45Cluster Architecture, Installation & Configuration

Why is --pod-network-cidr supplied to kubeadm init?

  1. To set the Pod IP range used by the CNI plugin. Correct answer.
  2. To set the CIDR used by kube-proxy for Service IPs.
  3. To restrict which nodes can join the cluster.
  4. To configure the API server's advertise address.

Explanation

The pod-network-cidr value is passed to the controller-manager and must match the range configured in the CNI plugin. Service IPs are configured separately with --service-cidr.

Question 46Cluster Architecture, Installation & Configuration

Which additional flag is required when joining a new control-plane node with `kubeadm join ... --control-plane`?

  1. --etcd-external-endpoint <url>
  2. --bootstrap-token-only <token>
  3. --certificate-key <key> Correct answer.
  4. --skip-certificate-validation

Explanation

A control-plane join must download the cluster certificates, which are encrypted with a certificate key. This key is produced by kubeadm init --upload-certs or by kubeadm certs certificate-key.

Question 47Cluster Architecture, Installation & Configuration

Which API server flag enables both Node and RBAC authorization, with Node evaluated first?

  1. --authorization-mode=RBAC,Node
  2. --authorization-mode=AlwaysAllow
  3. --authorization-mode=Webhook,Node,RBAC
  4. --authorization-mode=Node,RBAC Correct answer.

Explanation

Authorization modes are evaluated in the order listed, so Node must appear before RBAC for kubelet requests to be handled by the Node authorizer first. AlwaysAllow is insecure and is not suitable for production clusters.

Question 48Cluster Architecture, Installation & Configuration

An etcd snapshot is at /backup/etcd.db. Which command restores it into a new data directory /var/lib/etcd-restore?

  1. etcdctl defrag --data-dir /var/lib/etcd-restore --cluster --command-timeout=30s
  2. kubectl apply -f /backup/etcd.db --namespace=etcd
  3. etcdctl snapshot status /backup/etcd.db --write-out=table
  4. etcdctl snapshot restore /backup/etcd.db --data-dir /var/lib/etcd-restore Correct answer.

Explanation

etcdctl snapshot restore writes a fresh etcd data directory from the snapshot, which you then point etcd at. snapshot status only inspects the snapshot, and defrag reclaims space in an existing data directory.

Question 49Cluster Architecture, Installation & Configuration

In a kubeadm HA cluster with three control-plane nodes, why is --control-plane-endpoint required?

  1. It gives clients one stable, load-balanced API address. Correct answer.
  2. It replaces the need for etcd certificates.
  3. It sets the cluster's internal DNS domain.
  4. It pins all kubelets to a single API server for security.

Explanation

The control-plane endpoint is a stable DNS name or virtual IP that a load balancer uses to distribute API requests across control-plane nodes. kubeconfigs and kubelets then remain functional when an individual API server fails.

Question 50Cluster Architecture, Installation & Configuration

An administrator runs `kubectl edit pod kube-apiserver-node1 -n kube-system` and the change does not persist. How should this static Pod be modified?

  1. Use kubectl patch with --force.
  2. Scale the static Pod's ReplicaSet.
  3. Delete the mirror Pod, then recreate it with kubectl apply -f.
  4. Edit the manifest on the node in /etc/kubernetes/manifests. Correct answer.

Explanation

Static Pods are owned by the kubelet, and the API only shows a read-only mirror Pod. Editing the manifest file on the node causes the kubelet to recreate the Pod with the new configuration.