CKA Sample Questions & Answers

The DaemonSet controller adds only a fixed set of tolerations to its Pods: node.kubernetes.io/not-ready and node.kubernetes.io/unreachable (NoExecute), and disk-pressure, memory-pressure, pid-pressure, unschedulable and, for hostNetwork Pods, network-unavailable (NoSchedule). The control-plane taint is not among them, so the existing node-role.kubernetes.io/control-plane:NoSchedule taint already keeps DaemonSet Pods off the control plane nodes; the documentation's example adds an explicit control-plane toleration only to make a DaemonSet run there. To make the exclusion explicit (for example, in case a broad toleration is added later), add required node affinity with key: node-role.kubernetes.io/control-plane and operator: DoesNotExist; the DaemonSet controller creates Pods only on nodes that match the Pod template's node affinity. Adding the toleration would do the opposite, DaemonSets have no replicas field, and taints are not ignored for DaemonSet Pods, so no anti-affinity rule against kube-apiserver Pods is needed.

The DaemonSet controller adds only a fixed set of tolerations to its Pods: node.kubernetes.io/not-ready and node.kubernetes.io/unreachable (NoExecute), and disk-pressure, memory-pressure, pid-pressure, unschedulable and, for hostNetwork Pods, network-unavailable (NoSchedule). The control-plane taint is not among them, so the existing node-role.kubernetes.io/control-plane:NoSchedule taint already keeps DaemonSet Pods off the control plane nodes; the documentation's example adds an explicit control-plane toleration only to make a DaemonSet run there. To make the exclusion explicit (for example, in case a broad toleration is added later), add required node affinity with key: node-role.kubernetes.io/control-plane and operator: DoesNotExist; the DaemonSet controller creates Pods only on nodes that match the Pod template's node affinity. Adding the toleration would do the opposite, DaemonSets have no replicas field, and taints are not ignored for DaemonSet Pods, so no anti-affinity rule against kube-apiserver Pods is needed.

The kubectl auth can-i subcommand is specifically designed for this purpose. It allows you to impersonate a user, group, or service account (using the --as flag) and check if they have permission to perform a specific action on a resource. It returns a simple 'yes' or 'no', making it the most direct and efficient way to answer the question.

kube-proxy runs on every node and watches Services and EndpointSlices. For a NodePort Service it programs packet-forwarding rules on every node, so every node accepts traffic on the node port. On Linux these are iptables rules by default, or nftables; IPVS mode is deprecated in v1.35. The kernel then DNATs the packet to one of the ready backend Pod IPs, which may be on another node, and the Pod network set up by the CNI plugin delivers it there. kube-proxy does not relay the packets itself. CoreDNS only resolves names. The CNI plugin provides Pod-to-Pod connectivity but not the Service-to-Pod mapping. An Ingress controller handles HTTP routing for Ingress resources, not NodePort traffic.

The kubectl top pods command displays CPU and memory usage for pods. The -A flag (or --all-namespaces) ensures you see pods from all namespaces, and --sort-by=cpu orders the output to show the highest CPU consumers first, making it easy to identify the culprit. This command requires the Metrics Server to be installed in the cluster.

True. The v1.35 install guide says that 'the default behavior of a kubelet is to fail to start if swap memory is detected on a node', so swap must be either disabled or explicitly tolerated. With the default configuration (failSwapOn: true), disable it on every node with sudo swapoff -a. Then remove the swap entries from /etc/fstab (or disable the systemd swap units) so it stays off after a reboot. Tolerating swap is an explicit opt-in: set failSwapOn: false and, if workloads should use swap, a swapBehavior other than the default NoSwap (swap support is GA since v1.34). kubeadm's own preflight check only warns about swap; it is the kubelet that refuses to start.

This is the correct and modern way to define a node-specific local volume. It uses the local volume type and a nodeAffinity section to ensure that any pod claiming this volume will be scheduled onto node-03. Using hostPath for a PV is discouraged as it doesn't have this scheduling awareness, which can lead to pods being scheduled on the wrong node and failing to mount the volume.

etcdutl works directly on etcd data files, and it is the restore tool in the v1.35 docs. etcdutl --data-dir snapshot restore unpacks the snapshot into a new data directory, which the command creates. etcdctl snapshot restore was deprecated in etcd v3.5 and removed in v3.6, and kubeadm v1.35 deploys etcd 3.6.6. Stop all API server instances before restoring. Then point the etcd static Pod at the new directory by changing the etcd-data hostPath in /etc/kubernetes/manifests/etcd.yaml. Let the kubelet recreate the Pod (or restart the kubelet), and restart the API servers and the other control plane components. Running the restore inside the live etcd Pod does not work, because the backup file is on the host and the member is in use. A snapshot file cannot simply be moved into member/snap/db, and kubeadm has no --restore-from option.

The Gateway API separates concerns into different resources. The Gateway resource is typically managed by the cluster administrator and defines the listener (e.g., port 443, hostname). The HTTPRoute resource is managed by application developers and attaches to a Gateway, defining specific routing rules like matching a path (/) and forwarding traffic to a backend service (frontend-svc).

ImagePullBackOff means that a container could not start because its image could not be pulled; Kubernetes keeps retrying with an increasing back-off delay capped at 300 seconds. The Kubernetes docs name an invalid image name and pulling from a private registry without an imagePullSecret as typical reasons. A misspelled image name or tag (the registry has no such image), a node that cannot reach the registry over the network (for example a firewall, proxy or DNS problem), and a missing or wrong imagePullSecret for a private registry (authentication fails) therefore all lead to it. A failing liveness probe restarts a container that is already running, which shows up as restarts or CrashLoopBackOff, not as a pull error. A CPU request that no node can satisfy keeps the Pod Pending with a FailedScheduling event, before any image is pulled.

ImagePullBackOff means that a container could not start because its image could not be pulled; Kubernetes keeps retrying with an increasing back-off delay capped at 300 seconds. The Kubernetes docs name an invalid image name and pulling from a private registry without an imagePullSecret as typical reasons. A misspelled image name or tag (the registry has no such image), a node that cannot reach the registry over the network (for example a firewall, proxy or DNS problem), and a missing or wrong imagePullSecret for a private registry (authentication fails) therefore all lead to it. A failing liveness probe restarts a container that is already running, which shows up as restarts or CrashLoopBackOff, not as a pull error. A CPU request that no node can satisfy keeps the Pod Pending with a FailedScheduling event, before any image is pulled.

ImagePullBackOff means that a container could not start because its image could not be pulled; Kubernetes keeps retrying with an increasing back-off delay capped at 300 seconds. The Kubernetes docs name an invalid image name and pulling from a private registry without an imagePullSecret as typical reasons. A misspelled image name or tag (the registry has no such image), a node that cannot reach the registry over the network (for example a firewall, proxy or DNS problem), and a missing or wrong imagePullSecret for a private registry (authentication fails) therefore all lead to it. A failing liveness probe restarts a container that is already running, which shows up as restarts or CrashLoopBackOff, not as a pull error. A CPU request that no node can satisfy keeps the Pod Pending with a FailedScheduling event, before any image is pulled.

A ClusterRole is needed because the permissions (watch on Deployments, update on Pods) must apply cluster-wide (across all namespaces). A ClusterRoleBinding is then used to grant that ClusterRole to the controller's ServiceAccount, making the permissions effective across the entire cluster. Using namespaced Roles and RoleBindings would be inefficient and difficult to manage.