Level 2 — Operator · wrap-up
Cheat sheet & self-check
30 questions across 8 lessons. Each answer links back to the lesson it came from.
Pick an answer to see if you got it, and why.
Q1. After 'kubeadm init', every node shows NotReady. What is the most likely reason?
Show answer
B. The kubelet reports NotReady until a CNI plugin provides pod networking. Install one (Flannel, Calico, Cilium…) and the nodes turn Ready.
From lesson 09 · Build a cluster with kubeadmQ2. Why pass --control-plane-endpoint even when you start with one control-plane node?
Show answer
B. The endpoint (a DNS name or load-balancer address) is baked into certificates and kubeconfigs. Using a stable name from day one makes growing to HA painless.
From lesson 09 · Build a cluster with kubeadmQ3. Why must containerd and the kubelet use the same cgroup driver (systemd)?
Show answer
B. On systemd hosts, kubeadm configures the kubelet for the systemd driver. containerd must match (SystemdCgroup = true), or the node can become unstable.
From lesson 09 · Build a cluster with kubeadmQ4. How long are kubeadm's leaf certificates valid by default?
Show answer
B. Leaf certificates last one year. They are renewed automatically by 'kubeadm upgrade apply', or manually with 'kubeadm certs renew'. Clusters that are never upgraded can hit expiry.
From lesson 09 · Build a cluster with kubeadmQ5. Why build nodes from an image instead of running install steps on each machine?
Show answer
B. At tens or hundreds of nodes, hand-built machines drift and slow every change. Images make nodes disposable.
From lesson 10 · kubeadm at scale: immutable imagesQ6. You clone 20 worker VMs from one template, and nodes randomly replace each other in the cluster. Likely cause?
Show answer
B. Clean cloud-init state and machine-id in the template; set unique hostnames at first boot.
From lesson 10 · kubeadm at scale: immutable imagesQ7. A new control-plane node fails to join an hour-old cluster with a 'certificate key' error three hours after init. Why?
Show answer
B. Automated control-plane joins must either refresh the uploaded certs or get the PKI securely from a secret store.
From lesson 10 · kubeadm at scale: immutable imagesQ8. Why do LoadBalancer Services stay <pending> on a bare-metal cluster without MetalLB?
Show answer
B. Kubernetes has no built-in bare-metal load balancer. MetalLB fills that gap.
From lesson 11 · Bare-metal load balancing with MetalLBQ9. In MetalLB L2 mode, how does traffic reach the Service?
Show answer
B. L2 mode gives failover, not load spreading across nodes: one node is the entry point for each IP.
From lesson 11 · Bare-metal load balancing with MetalLBQ10. What does BGP mode add over L2 mode?
Show answer
B. BGP gives real load distribution and routed designs; it needs cooperation from the network team.
From lesson 11 · Bare-metal load balancing with MetalLBQ11. Your cluster runs 1.29. Can you upgrade straight to 1.31?
Show answer
B. kubeadm supports upgrading one minor version at a time. Skipping minors isn't supported and can break API migrations.
From lesson 12 · Upgrades & version skewQ12. Which is upgraded first?
Show answer
B. The API server must never be older than the kubelets. Upgrading the control plane first keeps every component within the supported skew.
From lesson 12 · Upgrades & version skewQ13. kubectl drain is stuck and keeps retrying an eviction. What's a common cause?
Show answer
B. Evictions respect PDBs. If evicting a pod would drop below the budget, drain waits. Fix the budget or scale up first; don't force it blindly.
From lesson 12 · Upgrades & version skewQ14. Why check for deprecated API usage before upgrading?
Show answer
B. When a version removes an API (for example an old beta), manifests, Helm charts or controllers still using it start failing. Find and migrate them first.
From lesson 12 · Upgrades & version skewQ15. Your etcd cluster has 3 members and 2 fail. What happens?
Show answer
B. etcd needs a majority (2 of 3) to agree on writes. With only 1 left, the cluster can't make progress until quorum is restored or it is rebuilt from a snapshot.
From lesson 13 · etcd backup & restoreQ16. Does an etcd snapshot contain everything needed to rebuild the control plane?
Show answer
B. The snapshot is the database. Certificates, kubeconfigs and encryption keys live on disk outside etcd. Back them up too, securely.
From lesson 13 · etcd backup & restoreQ17. Why restore into a new data directory instead of over /var/lib/etcd?
Show answer
B. Restoring to a new directory is safe and reversible, and restore creates new cluster and member IDs. Point the static pod at the new directory once it's ready.
From lesson 13 · etcd backup & restoreQ18. What does a successful backup job NOT prove?
Show answer
B. Only a restore drill proves a backup. Test restores regularly and time them: that's your real recovery time.
From lesson 13 · etcd backup & restoreQ19. A pod has nodeSelector disktype=ssd, but no node has that label. What happens?
Show answer
B. nodeSelector and required node affinity are hard rules. With no matching node the scheduler filters everything out and the pod waits.
From lesson 14 · Scheduling in depthQ20. What's the difference between a taint and node affinity?
Show answer
B. Taints/tolerations are the node saying 'keep out unless you tolerate me'. Affinity is the pod saying 'I want (or require) nodes like this'. Dedicated nodes usually need both.
From lesson 14 · Scheduling in depthQ21. Which setting keeps 3 replicas of a web app in 3 different zones where possible?
Show answer
B. Topology spread constraints limit the skew of matching pods across a topology domain such as zones or hostnames.
From lesson 14 · Scheduling in depthQ22. A high-priority pod can't fit anywhere. What can the scheduler do?
Show answer
B. With PriorityClasses, the scheduler may preempt lower-priority pods. Adding nodes is the cluster autoscaler's job, not the scheduler's.
From lesson 14 · Scheduling in depthQ23. What's the difference between a Role and a ClusterRole?
Show answer
B. A Role is namespaced. A ClusterRole isn't: bind it with a ClusterRoleBinding for cluster-wide access, or with a RoleBinding to grant it inside just one namespace.
From lesson 15 · RBAC & service accountsQ24. Kubernetes RBAC rules are…
Show answer
B. RBAC has no deny rules. Every request is denied unless some binding grants it, so permissions only ever add up.
From lesson 15 · RBAC & service accountsQ25. A pod needs to list ConfigMaps in its own namespace. What's the least-privilege setup?
Show answer
B. Give each workload its own ServiceAccount, grant only the verbs and resources it needs, and scope it to its namespace.
From lesson 15 · RBAC & service accountsQ26. Why is 'list' on secrets almost as powerful as 'get'?
Show answer
B. A list response contains complete objects. Anyone who can list Secrets can read all of them in that scope.
From lesson 15 · RBAC & service accountsQ27. A container's last state shows 'Terminated, Reason: OOMKilled, Exit Code: 137'. What does it mean?
Show answer
B. Exit codes above 128 mean 'killed by a signal' (128 + signal number). 137 is SIGKILL; with Reason OOMKilled it hit its memory limit.
From lesson 16 · Troubleshooting: nodes, pods, networkingQ28. Every pod on one node is failing, and pods on other nodes are fine. Where do you look first?
Show answer
B. Scope tells you the layer. One node failing points at that node's health, not at the app or the control plane.
From lesson 16 · Troubleshooting: nodes, pods, networkingQ29. kubectl itself times out, but existing apps still serve traffic. What's most likely affected?
Show answer
B. Running pods don't need the API server to keep serving. When only management fails, check the API server, its load balancer, certificates and etcd.
From lesson 16 · Troubleshooting: nodes, pods, networkingQ30. What does 'kubectl debug' with --target give you that 'kubectl exec' can't?
Show answer
B. Ephemeral containers let you bring tools (busybox, netshoot…) into a running pod whose image is minimal or distroless.
From lesson 16 · Troubleshooting: nodes, pods, networking