Cluster Architecture, Installation and Configuration

Control Plane and Node Components

A Kubernetes cluster splits into a control plane and one or more worker nodes. The control plane makes the global decisions, such as which node a Pod should run on, and detects and responds to cluster events. Each node runs the agents that actually keep containers running there. Knowing which component does which job is the single most useful mental model for the whole exam, because almost every troubleshooting question reduces to figuring out which component failed.

Exam tip. When a question describes a symptom rather than naming a component, work backward. A Pod never scheduling points at the scheduler or node capacity, a Service not routing traffic points at kube-proxy or the endpoints, and an entire node looking dead points at that node's kubelet.

1. An administrator is initializing the first control plane node of a new cluster using kubeadm. Which command starts this process and generates the initial cluster certificates and control plane static pod manifests?

• A. kubectl create cluster --init
• B. kubeadm init --pod-network-cidr=<cidr>correct
• C. kubeadm join --control-plane
• D. kubelet --bootstrap-kubeconfig

kubeadm init bootstraps the first control plane node, generating PKI certificates, the kubeconfig files, and the static pod manifests for etcd, kube-apiserver, kube-controller-manager, and kube-scheduler in /etc/kubernetes/manifests. kubectl create cluster is not a real command, kubeadm join --control-plane adds an additional control plane node to an already initialized cluster, and kubelet --bootstrap-kubeconfig is used during node bootstrapping, not cluster initialization.

2. A cluster administrator wants to take a consistent backup of the cluster's etcd data store before performing a risky change. Which command correctly creates that backup?

• A. kubectl backup etcd --output=/backup/etcd.db
• B. kubeadm backup etcd /backup/etcd.db
• C. ETCDCTL_API=3 etcdctl snapshot save /backup/etcd.db --endpoints=https://127.0.0.1:2379 --cert=<cert> --key=<key> --cacert=<ca>correct
• D. cp -r /var/lib/etcd /backup/

etcdctl snapshot save, run with API version 3 and the correct TLS certificate, key, and CA flags to authenticate against the etcd endpoint, produces a consistent point in time snapshot of etcd's data. kubectl backup etcd and kubeadm backup etcd are not real commands. Copying the /var/lib/etcd directory while etcd is running can capture data mid write and produce a corrupt or inconsistent backup.

3. A Helm release named 'api' was upgraded and is now failing. Which command reverts it to the immediately preceding revision?

• A. kubectl rollout undo deployment/api
• B. helm rollback api latest
• C. helm rollback apicorrect
• D. helm history api --undo

helm rollback RELEASE without a revision number reverts to the immediately preceding revision. kubectl rollout undo only touches a Deployment object directly and will not revert other resources the chart manages or update Helm's own release history. 'latest' and '--undo' are not valid Helm syntax.