CKA Deep Guide: Cluster Architecture, Installation & etcd Backup

TL;DR (Quick Summary)

#

• Exam Format: 100% hands-on performance-based exam (17-20 performance tasks). Duration: 2 hours. Passing Score: 66%.
• Core CKA Domains:
  • Storage (10%)
  • Troubleshooting (30%)
  • Workloads & Scheduling (15%)
  • Cluster Architecture, Installation & Configuration (25%)
  • Services & Networking (20%)
• Critical Exam Commands: etcdctl snapshot save, kubeadm upgrade, openssl req, kubectl create clusterrolebinding.

1. Domain Breakdown: Cluster Architecture (25%)

#

graph TD
    subgraph ControlPlaneSetup ["Control Plane Setup"]
        KubeadmInit["kubeadm init"] -->|Bootstraps| APIServer["kube-apiserver"]
        APIServer <--> ETCD["(etcd Database)"]
        APIServer <--> PKI["/etc/kubernetes/pki/"]
    end
    
    subgraph ETCDBackupStrategy ["ETCD Backup Strategy"]
        ETCDctl["etcdctl snapshot save"] -->|Saves| BackupFile["/var/lib/etcd-snapshot.db"]
    end

2. Command Cheat Sheet: ETCD Backup & Restore (Must Know)

#

etcd backup and restore questions carry huge points on the CKA exam. You MUST memorize these commands.

3. Step-by-Step Lab 1: etcd Backup & Restore Protocol

#

Let’s execute a complete etcd backup and restore sequence in a hands-on scenario.

Step 1: Taking the Snapshot

#

Execute the snapshot save command specifying the TLS certificates:

sudo ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/backup/etcd-boot.db

Expected Terminal Output:

Snapshot saved at /opt/backup/etcd-boot.db

Step 2: Restoring from the Snapshot

#

When restoring, you must specify a new --data-dir:

sudo ETCDCTL_API=3 etcdctl \
  --data-dir=/var/lib/etcd-previous \
  snapshot restore /opt/backup/etcd-boot.db

Step 3: Updating the etcd Static Pod Manifest

#

Edit /etc/kubernetes/manifests/etcd.yaml to point the hostPath volume to /var/lib/etcd-previous:

  volumes:
  - name: etcd-data
    hostPath:
      path: /var/lib/etcd-previous
      type: DirectoryOrCreate

Save the file. kubelet will automatically detect the manifest change and restart the etcd static pod!

4. Step-by-Step Lab 2: Upgrading a Cluster with Kubeadm

#

Upgrading a cluster from version v1.27.0 to v1.28.0 is another classic CKA task.

Step 1: Upgrading the Control Plane Node

#

Drain the control plane node:

kubectl drain k8s-control-plane --ignore-daemonsets

Upgrade kubeadm:

sudo apt-get update && sudo apt-get install -y kubeadm=1.28.0-00

Verify and execute the upgrade plan:

sudo kubeadm upgrade plan
sudo kubeadm upgrade apply v1.28.0 -y

Upgrade kubelet and kubectl:

sudo apt-get install -y kubelet=1.28.0-00 kubectl=1.28.0-00
sudo systemctl daemon-reload
sudo systemctl restart kubelet

Uncordon the node:

kubectl uncordon k8s-control-plane

5. Step-by-Step Lab 3: Creating RBAC Users & RoleBindings

#

Create a user developer restricted to namespace dev.

Step 1: Create Certificate Signing Request (CSR)

#

Generate private key and CSR:

openssl genrsa -out developer.key 2048
openssl req -new -key developer.key -out developer.csr -subj "/CN=developer/O=devs"

Create Kubernetes CertificateSigningRequest manifest:

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: developer-csr
spec:
  request: <BASE64_ENCODED_CSR>
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth

Approve the CSR:

kubectl certificate approve developer-csr

Step 2: Bind Role to User

#

Create the Role and RoleBinding:

kubectl create role pod-reader --verb=get,list,watch --resource=pods -n dev
kubectl create rolebinding dev-user-binding --role=pod-reader --user=developer -n dev

Test permissions using kubectl auth can-i:

kubectl auth can-i get pods --as=developer -n dev
# Output: yes

kubectl auth can-i delete pods --as=developer -n dev
# Output: no

6. Troubleshooting & Common CKA Errors

#

Error 1: Control Plane Static Pod Crash

#

Symptom: kubectl returns The connection to the server localhost:8080 was refused. Diagnosis: Check static pod manifests in /etc/kubernetes/manifests/ and cgroup driver compatibility in /etc/containerd/config.toml (SystemdCgroup = true).

Error 2: Node Status NotReady

#

Symptom: Worker node shows NotReady in kubectl get nodes. Diagnosis: Inspect kubelet systemd logs:

sudo journalctl -u kubelet -f --no-pager

Check CNI plugin status in /etc/cni/net.d/.

Summary & Next Steps

#

In this guide:

• We executed exact etcd backup and restore operations using etcdctl.
• We performed a zero-downtime control plane upgrade using kubeadm.
• We created TLS client certificates and configured namespace RBAC rules.
• We debugged static pod crashes and kubelet systemd service failures.

Next, we move to the Certified Kubernetes Application Developer (CKAD) master guide!