CKA Practice Question 10: API Server Static Pod Debugging

Certified Kubernetes Administrator (CKA) · Test 1 · question 10 of 10

Troubleshootinghard

On a kubeadm-built cluster, every kubectl command fails with The connection to the server 10.0.0.10:6443 was refused - did you specify the right host or port?.

You SSH to the control plane node. The kubelet service is active and running, and the node has not been rebooted. You suspect the API server container is failing to start after a recent edit to its configuration.

How should you investigate?

Show answer and explanation

Answer:

C. Inspect the static Pod manifest in /etc/kubernetes/manifests/ and read the container's logs with crictl ps -a and crictl logs

On a kubeadm cluster the control plane components run as static pods: the kubelet watches /etc/kubernetes/manifests/ and starts a container for each manifest it finds, with no involvement from the API server or any controller. That is what makes recovery possible here: with the API server down, you must work below it, talking to the container runtime directly. crictl ps -a shows exited containers as well as running ones, and crictl logs <container-id> reveals why the API server crashed, which is typically a syntax error or a bad flag in kube-apiserver.yaml from the recent edit.

Option A cannot work. kubectl logs is served by the API server, and the API server is exactly what is down; the same connection-refused error will come back.

Option B looks for a systemd unit that does not exist. Under kubeadm, only the kubelet is a systemd service; the API server is a container the kubelet manages, so there is nothing for systemctl or journalctl -u to report. (The kubelet's own journal, journalctl -u kubelet, is worth reading, as it logs failures to start the static pod.)

Option D misidentifies the workload type. There is no Deployment for kube-apiserver; static pods are managed entirely by the local kubelet, not by any controller. There is also no way to delete the pod through the API while the API server is unreachable; to restart a static pod you move its manifest out of the directory and back.

Reference: Troubleshooting Clusters

Practice Test 1 ›

Study guides for CKA

Docker interview questions: commands, scenarios, experiencedDocker interview questions with answers: Dockerfiles and builds, run and debug commands, networking, volumes, Compose, security, and Docker vs Kubernetes.

Kubernetes interview questions: scenarios for experiencedScenario-based Kubernetes interview questions for experienced engineers: CrashLoopBackOff, DNS, RBAC, drains and etcd, with the commands and fixes.

Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.

CKA exam guide: price, voucher, booking and what it testsThe CKA exam explained: the $445 price, what the voucher includes, how to book it with PSI, the five domains and how to prepare for the hands-on tasks.

Best Kubernetes certification: CKA vs CKAD vs CKSWhich Kubernetes certification to take first - CKA, CKAD or CKS compared on format, cost, prerequisites and role, plus KCNA and KCSA for beginners.

Kubernetes NetworkPolicy, explained for CKA, CKAD and CKSHow NetworkPolicy isolation works, why policies only add allows, the namespaceSelector AND/OR trap, DNS egress, and what your CNI has to support.

Kubernetes Service types, Ingress and Gateway APIClusterIP, NodePort, LoadBalancer, ExternalName and headless Services, how selectors build endpoints, and how to debug a Service for CKA and CKAD.