--- title: "Kubernetes Administrator Flashcards (CKA)" description: "Full exam coverage for the Certified Kubernetes Administrator (CKA) exam using spaced repetition. Covers cluster architecture, workloads, scheduling, networking, storage, security, and troubleshooting." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/flashcards/post/kubernetes-administrator-cka-flashcards --- # Kubernetes Administrator Flashcards (CKA) ## Flashcards ### 1. What are the core components of the Kubernetes control plane? kube-apiserver (front door for all API calls), etcd (cluster state store), kube-scheduler (assigns pods to nodes), kube-controller-manager (runs controllers), and cloud-controller-manager (cloud integration). ### 2. What runs on every worker node? kubelet (manages pods and containers on the node), kube-proxy (maintains network rules for Services), and a container runtime such as containerd or CRI-O. ### 3. What is etcd and why is it critical? etcd is the distributed key-value store that holds the entire cluster state. Losing it without a backup means losing the cluster, so regular snapshots are essential. ### 4. How do you take an etcd snapshot? Use etcdctl with snapshot save, pointing at the endpoint and supplying the CA cert, client cert, and key for authentication. ``` ETCDCTL_API=3 etcdctl snapshot save /backup/etcd.db \ --endpoints=https://127.0.0.1:2379 \ --cacert=/etc/kubernetes/pki/etcd/ca.crt \ --cert=/etc/kubernetes/pki/etcd/server.crt \ --key=/etc/kubernetes/pki/etcd/server.key ``` ### 5. How do you restore etcd from a snapshot? Run etcdctl snapshot restore to a new data directory, then point the etcd static pod manifest at that directory and restart etcd. ``` ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd.db \ --data-dir=/var/lib/etcd-restore ``` ### 6. What does kubeadm init do? It bootstraps a control plane node, generating certificates, static pod manifests for the control plane components, the kubeconfig files, and a bootstrap token for joining workers. ### 7. How does a worker node join a cluster created with kubeadm? Run kubeadm join with the control plane endpoint, a bootstrap token, and the CA cert hash. kubeadm token create can print a ready-made join command. ``` kubeadm token create --print-join-command ``` ### 8. How do you upgrade a cluster with kubeadm? Upgrade the control plane first with kubeadm upgrade apply, then upgrade kubelet and kubectl on each node. Drain each node before upgrading its kubelet and uncordon it afterward. ### 9. What is RBAC in Kubernetes? Role-Based Access Control authorizes API actions. Roles and ClusterRoles define permissions, while RoleBindings and ClusterRoleBindings grant them to users, groups, or ServiceAccounts. ### 10. What is the difference between a Role and a ClusterRole? A Role grants permissions within a single namespace. A ClusterRole is cluster-scoped and can grant access to cluster-wide resources like nodes or be reused across namespaces via RoleBindings. ### 11. How do you quickly test whether a user can perform an action? Use kubectl auth can-i, optionally with --as to impersonate another user or ServiceAccount. ``` kubectl auth can-i create deployments --as=jane -n dev ``` ### 12. Where does kubectl read its cluster connection settings from? From a kubeconfig file, by default ~/.kube/config. It defines clusters, users (credentials), and contexts that bind a user to a cluster and namespace. ### 13. How do you switch between clusters or namespaces with kubectl? Use kubectl config use-context to switch context, and kubectl config set-context --current --namespace to change the default namespace. ``` kubectl config use-context prod kubectl config set-context --current --namespace=team-a ``` ### 14. What is a static pod and how is it managed? A static pod is managed directly by the kubelet from a manifest in /etc/kubernetes/manifests, not by the API server. The control plane components are static pods in kubeadm clusters. ### 15. How do you make a control plane cluster highly available? Run an odd number of control plane nodes (3 or 5) with a stacked or external etcd cluster, fronted by a load balancer for the API server endpoint so quorum survives a node loss. ### 16. What is the difference between a Deployment and a StatefulSet? A Deployment manages stateless, interchangeable pods. A StatefulSet gives pods stable network identities and ordered, persistent storage, suited to databases and clustered apps. ### 17. What does a DaemonSet guarantee? It runs one copy of a pod on every (or every selected) node, automatically adding a pod when a new node joins. It is used for log collectors, node monitoring, and CNI agents. ### 18. What is the difference between a Job and a CronJob? A Job runs pods to completion for a batch task. A CronJob creates Jobs on a repeating schedule using cron syntax. ### 19. How do resource requests and limits differ? A request is the amount reserved for scheduling and guaranteed to the container. A limit is the maximum it may use, CPU is throttled at the limit while exceeding a memory limit triggers an OOM kill. ### 20. How do taints and tolerations work together? A taint on a node repels pods that do not tolerate it. A matching toleration on a pod allows, but does not require, scheduling onto that node. ``` kubectl taint nodes node1 key=value:NoSchedule ``` ### 21. What is the difference between node affinity and nodeSelector? nodeSelector is a simple exact-match label requirement. Node affinity is more expressive, supporting required and preferred rules with operators like In, NotIn, and Exists. ### 22. How do you safely remove a node for maintenance? Run kubectl drain to cordon it and evict its pods, respecting PodDisruptionBudgets, then kubectl uncordon to allow scheduling again after maintenance. ``` kubectl drain node1 --ignore-daemonsets --delete-emptydir-data ``` ### 23. What does a PodDisruptionBudget protect against? It limits how many pods of an application can be voluntarily disrupted at once (via minAvailable or maxUnavailable), keeping enough replicas running during drains and upgrades. ### 24. What are the main Service types in Kubernetes? ClusterIP (internal virtual IP, the default), NodePort (exposes a port on every node), LoadBalancer (provisions an external load balancer), and ExternalName (maps to a DNS name). ### 25. How does a Service find its backing pods? Through a label selector. The endpoints controller keeps an EndpointSlice of matching, ready pod IPs, and kube-proxy programs the routing to them. ### 26. What is the difference between a NodePort and a LoadBalancer Service? A NodePort opens a static high port on every node. A LoadBalancer builds on NodePort by asking the cloud provider to provision an external load balancer that routes to those ports. ### 27. What does an Ingress provide that a Service does not? Ingress offers HTTP and HTTPS routing by host and path, TLS termination, and a single entry point for many Services. It requires an Ingress controller such as NGINX or Traefik to function. ### 28. What is a NetworkPolicy and what is the default without one? A NetworkPolicy restricts pod-to-pod traffic by pod and namespace selectors. Without any policy selecting a pod, all ingress and egress traffic is allowed. ### 29. How do you create a default-deny ingress policy for a namespace? Apply a NetworkPolicy that selects all pods with an empty podSelector and lists Ingress in policyTypes with no ingress rules. ``` spec: podSelector: {} policyTypes: - Ingress ``` ### 30. What component provides in-cluster DNS and what does it resolve? CoreDNS provides cluster DNS. Services resolve as service.namespace.svc.cluster.local, and pods can reach a Service by its short name within the same namespace. ### 31. What is a CNI and why does a cluster need one? The Container Network Interface is the plugin standard for pod networking. A CNI plugin (Calico, Cilium, Flannel) assigns pod IPs and wires up the flat network so every pod can reach every other pod. ### 32. How does kube-proxy implement Services? It watches Services and EndpointSlices and programs the node's dataplane (iptables or IPVS) to load-balance the Service virtual IP across healthy backend pods. ### 33. What is a headless Service and when is it used? A Service with clusterIP set to None. It returns the pod IPs directly via DNS instead of a single virtual IP, used with StatefulSets so each pod is individually addressable. ### 34. What is the difference between a PersistentVolume and a PersistentVolumeClaim? A PersistentVolume is a piece of provisioned storage in the cluster. A PersistentVolumeClaim is a user's request for storage that binds to a matching PV, decoupling pods from the storage backend. ### 35. What does a StorageClass enable? Dynamic provisioning. When a PVC references a StorageClass, an external provisioner automatically creates a matching PV, so admins need not pre-create volumes. ### 36. What are the PersistentVolume access modes? ReadWriteOnce (one node read-write), ReadOnlyMany (many nodes read-only), ReadWriteMany (many nodes read-write), and ReadWriteOncePod (a single pod read-write). ### 37. What do the reclaim policies Retain and Delete do? Retain keeps the PV and its data after the PVC is deleted, requiring manual cleanup. Delete removes the PV and the underlying storage asset automatically. ### 38. How do you mark a StorageClass as the cluster default? Annotate it with storageclass.kubernetes.io/is-default-class set to true, so PVCs without an explicit storageClassName use it. ``` metadata: annotations: storageclass.kubernetes.io/is-default-class: 'true' ``` ### 39. How does a pod consume a PersistentVolumeClaim? The pod defines a volume of type persistentVolumeClaim referencing the claim name, and a container mounts that volume at a path via volumeMounts. ### 40. What is your first step when a pod is not running? Run kubectl describe pod to see events and container states, then kubectl logs for the application output. describe usually reveals scheduling, image, or probe failures. ``` kubectl describe pod mypod kubectl logs mypod -c mycontainer ``` ### 41. What does a Pending pod status usually indicate? The scheduler cannot place it. Common causes are insufficient CPU or memory, unsatisfied node affinity or taints, or an unbound PersistentVolumeClaim. Check describe events for the reason. ### 42. What causes ImagePullBackOff? The kubelet cannot pull the container image, from a wrong image name or tag, a private registry without imagePullSecrets, or network and registry outages. ### 43. What does CrashLoopBackOff mean and how do you investigate? The container starts, exits, and restarts repeatedly. Inspect logs, including kubectl logs --previous for the crashed instance, and check the command, config, and readiness or liveness probes. ``` kubectl logs mypod --previous ``` ### 44. How do you check the logs of a control plane component in a kubeadm cluster? Control plane components run as static pods, so use kubectl logs against them in the kube-system namespace, or read the container logs directly on the node under /var/log/pods. ### 45. How do you check the health of the kubelet on a node? SSH to the node and inspect the service with systemctl status kubelet and journalctl -u kubelet. A stopped or misconfigured kubelet shows the node as NotReady. ``` systemctl status kubelet journalctl -u kubelet -f ``` ### 46. What are the common reasons a node shows NotReady? The kubelet is down, the container runtime failed, the CNI plugin is not installed or broken, or the node lost connectivity to the API server. describe node and kubelet logs pinpoint it. ### 47. How do you inspect resource usage of nodes and pods? Use kubectl top nodes and kubectl top pods. This requires the metrics-server to be installed in the cluster. ``` kubectl top nodes kubectl top pods -A ``` ### 48. How do you debug a Service that is not reaching its pods? Verify the Service selector matches pod labels, check that its EndpointSlice has ready pod IPs with kubectl get endpoints, confirm pods pass readiness probes, and test connectivity from another pod. ### 49. How can you run an ad-hoc pod to test networking from inside the cluster? Launch a temporary pod with kubectl run and an interactive shell, then use tools like curl, nslookup, or wget to test DNS and connectivity. ``` kubectl run tmp --rm -it --image=busybox -- sh ``` ### 50. What does kubectl get events tell you and how do you make it useful? It lists recent cluster events like scheduling failures, image pulls, and probe failures. Sort by timestamp to trace what just happened. ``` kubectl get events --sort-by=.metadata.creationTimestamp ``` ### 51. How do you verify API server certificate expiry in a kubeadm cluster? Run kubeadm certs check-expiration to list all managed certificates and their remaining validity, then kubeadm certs renew to renew them. ``` kubeadm certs check-expiration ``` ### 52. A pod cannot resolve Service names. What do you check? Confirm CoreDNS pods are running in kube-system, check their logs, verify the pod's /etc/resolv.conf points at the cluster DNS Service IP, and test with nslookup from a debug pod. ### 53. How do you find why a pod was OOMKilled? Run kubectl describe pod and look at the container's Last State showing Reason OOMKilled. It means the container exceeded its memory limit, so raise the limit or fix the leak. ### 54. How do you check whether etcd is healthy? Use etcdctl endpoint health and endpoint status with the CA and client certs. An unhealthy etcd makes the API server unresponsive and blocks all cluster changes. ``` ETCDCTL_API=3 etcdctl endpoint health \ --endpoints=https://127.0.0.1:2379 \ --cacert=/etc/kubernetes/pki/etcd/ca.crt \ --cert=/etc/kubernetes/pki/etcd/server.crt \ --key=/etc/kubernetes/pki/etcd/server.key ```