Cluster Architecture, Installation & Configuration

CKA · 75 questions

• A county clerk portal needs a ServiceAccount that can list Pods only in the permits namespace, not cluster-wide. Which RBAC approach meets least privilege?
• City auditors need read-only access to Deployments across every namespace for inventory. Which RBAC design fits?
• A municipal CI bot must create Secrets only in billing, but someone bound a ClusterRole with a ClusterRoleBinding by mistake. What should ops change first to restore least privilege?
• Library consortium apps currently share one ServiceAccount; ops wants each app to carry its own identity for RBAC. What should they do?
• A new hire’s kubeconfig user can get Nodes but cannot create NetworkPolicies. What is the most likely RBAC gap?
• Transit ops needs a Role in schedules that can update ConfigMaps but must not touch Secrets. How should the Role rules be written?
• Emergency-management wants group oncall to use the built-in view ClusterRole, but only inside the incident namespace. Which binding achieves that?
• Someone deleted a RoleBinding used by human operators; apps keep running, but staff lose kubectl access. Why can workloads continue?
• A court-records platform must forbid anonymous API access and require authenticated subjects for any authorized action. Which statement matches Kubernetes authorization posture?
• Public-works IoT operators ask whether a Pod’s ServiceAccount automatically inherits the Role of the human who applied the manifest. What is correct?
• Before kubeadm, city DC techs left swap enabled and control-plane init fails mysteriously. What infrastructure fix aligns with typical kubeadm/kubelet prerequisites?
• County firewalls block TCP 6443 between worker nodes and the API server VIP. What breaks, and what should networking open?
• Municipal hosts still assume an old Docker Engine–only dockershim setup; the team needs a runtime for current Kubernetes. What should they prepare?
• School-district VMs were cloned with duplicate hostnames and overlapping machine-ids before join. What should admins fix first?
• Time skew across city racks breaks certificate validation during kubeadm join. What infrastructure practice prevents that class of failure?
• Public-health cluster nodes need bridged IPv4 traffic sysctl settings before CNI networking works reliably. Which preparation is appropriate?
• Building-permits VMs have tiny root disks; after join, kubelet is expected to hit DiskPressure quickly. What should platform ops correct before install?
• Sanitation cluster planners ask which packages to stage on nodes before kubeadm init. Which set is the standard baseline?
• Open-data portal ops wonders whether worker nodes need a public internet VIP for the API or only private reachability. What is required?
• City platform runs kubeadm init and must pass a pod-network CIDR that will not clash with the civic WAN. What should admins do?
• After kubeadm init, county control-plane components look healthy, but Pods stay Pending without network. What admin step is still missing?
• Transit authority workers fail kubeadm join because the bootstrap token expired. What should admins do?
• A library cluster finished control-plane init and must add workers using the printed join instructions. What is the correct action on each worker?
• A municipal admin needs kubectl access right after kubeadm init without weakening kubeconfig file permissions. What is the usual approach?
• A court cluster must prepare for later HA expansion. What should be set during initial kubeadm planning for a stable API endpoint?
• A water-utility platform runs kubeadm on a dual-homed control-plane host and must make the API advertise on the correct NIC while including that address in the API server certificate. Which ClusterConfiguration approach should the admin use?
• After a parks booking platform joins its first worker pool with kubeadm, operators need a second pool of GPU nodes for GIS jobs without re-running kubeadm init. What is the correct admin approach?
• A city SRE accidentally runs kubeadm init a second time on a node that still has leftover cluster state from a prior attempt. What should they do before a clean re-initialization?
• Emergency-management builds a single-node kubeadm lab and needs application Pods to schedule on the control-plane node. What must they understand about the default control-plane taint?
• A county must upgrade a kubeadm cluster from an N-2 minor release toward the current supported minor. Which upgrade ordering principle should platform ops follow?
• Before a weekend control-plane upgrade, a city platform team wants durable recovery for cluster state. What lifecycle action should they take?
• After a failed upgrade, municipal ops must recover API object state from a previously taken etcd snapshot. What does a successful etcd restore primarily recover?
• Certificate expiration is approaching for kubeadm-managed certificates on a civic control plane. Which action reduces the risk of API outages due to expired certs?
• A school district upgrades kubelet on a worker while keeping applications available. Which node lifecycle pattern matches standard practice?
• Transit platform ops must decommission a worker permanently. What clean removal sequence avoids stale node registrations?
• Public-works plans to restart kubelets after a config change and wants to avoid unsupported version skew with the API server. What constraint should they respect?
• An open-data cluster needs a sustained operational change to kube-proxy’s ConfigMap as part of lifecycle maintenance. What does this illustrate about cluster lifecycle work?
• An HR self-service platform schedules a quarterly OS patch weekend on worker nodes. How should ops keep applications available during node maintenance?
• After finishing a kubeadm upgrade, budget analytics operators must confirm components moved forward. Which verification approach best matches admin practice?
• A city wants three control-plane nodes reachable through a stable VIP for API high availability. What kubeadm HA building block is required?
• County architects debate stacked etcd on control-plane nodes versus an external etcd cluster for HA. What is the accurate admin-level distinction?
• A library consortium runs three control-plane nodes with stacked etcd. One control-plane VM fails. Why can the API often remain available?
• After the first kubeadm init, a municipal team must expand to additional control-plane nodes. Which join pattern applies?
• A 911 dispatch platform sizes etcd for HA. Why do operators typically choose an odd etcd member count?
• Court records asks whether a single-node etcd member deployment is highly available. What is the correct assessment?
• A water utility places control-plane and etcd members for an HA cluster. Which placement practice improves failure tolerance?
• Sanitation ops configures kubelets and admin kubeconfigs after building an HA control plane. Where should they point API clients?
• Parks platform validates that API service continues while one control-plane node is drained for patching. Under what HA condition is this safe?
• A city installs ingress-nginx as a shared cluster component. Which packaging approach matches CKA-style cluster-component management with Helm?
• A county deploys metrics-server and must raise replicas and resource requests without forking upstream YAML by hand each time. Which Kustomize approach fits cluster-component customization?
• A city library upgrades its cert-manager Helm chart during a change window so the release tracks a newer chart and app version. Which Helm action best describes moving that installed release forward?
• A transit agency’s Helm-managed addon starts failing after a bad release; ops needs the previous working revision back. Which Helm capability restores that earlier release revision?
• A school district keeps shared Kubernetes manifests in git and needs lab versus production differences without duplicating every file. Which Kustomize pattern best separates common definitions from environment-specific changes?
• A public-health platform team debates one-off kubectl apply of raw YAML versus packaging cluster addons. Why do teams commonly prefer Helm or Kustomize for repeatable addon installs?
• Building-permits ops must raise replicaCount for a Helm-packaged cluster component without maintaining a full fork of the upstream chart. Which approach customizes that setting correctly?
• An open-data portal stores a cluster component as a Kustomize directory and wants to deploy the built output with kubectl. Which invocation applies that Kustomize tree?
• A municipal SRE needs an operational inventory of which Helm-managed cluster components are installed and their status. Which Helm commands provide that release inventory?
• City architects evaluating Calico- or Cilium-style plugins ask which Kubernetes extension interface provides Pod network connectivity?
• A county storage vendor integrates a driver that dynamically provisions volumes for PersistentVolumeClaims. Which extension interface is that driver implementing?
• Library cluster nodes run containerd as the low-level runtime that kubelet talks to when starting Pod containers. Which interface defines that kubelet-to-runtime contract?
• A transit engineer claims that installing a CNI plugin removes the need for Services and kube-proxy because CNI already load-balances ClusterIP traffic. What distinction should platform leads teach?
• A school district workload uses only emptyDir volumes and no PersistentVolumeClaims. Must the cluster install a CSI driver for those Pods to run?
• Public-works brings up a new kubeadm cluster but forgets to install a CNI plugin. What typically happens to workloads?
• A court platform wants to swap container runtimes on worker nodes while keeping kubelet’s integration model stable. Which design makes that runtime choice possible?
• A water utility asks which Kubernetes extension mechanism adds custom cluster APIs, as distinct from CNI, CSI, or CRI node plugins?
• A sanitation training poster must map responsibilities correctly: Pod networking, volume plugins, and container runtime integration. Which mapping is accurate?
• A city installs a backup operator that introduces a new BackupSchedule kind into the cluster. What does the CustomResourceDefinition provide in that install?
• A county applies an operator manifest; afterward a controller continuously reconciles custom resources toward desired state. What is the operator’s essential role?
• Library staff try kubectl get on a custom resource and fail until the matching CRD is installed. What rule explains that behavior?
• Transit installs a cert-manager-like operator as a cluster component, often packaging CRDs and controllers together. Which statement best describes that install pattern?
• A school district upgrades a cluster operator and must roll forward CRD schemas carefully. Why does upgrade order and compatibility matter?
• A public-health team labels every Deployment an “Operator” because it runs in the cluster. What distinction should architects enforce?
• Building-permits platform engineers consider deleting a CRD while custom resource instances still exist. What operational caution applies?
• An open-data portal chooses an operator to manage a clustered datastore addon rather than only a raw Deployment manifest. What advantage are they seeking?
• During an audit, a municipal SRE needs to see which API extensions are installed. Which approach inventories CustomResourceDefinitions in the cluster?