Control Plane Components Quiz
Quiz
# etcd cluster configuration
# Goal: Tolerate 2 failures
# Formula: Quorum = (N/2) + 1
# Quorum must be > 50% of total nodes
# If 2 nodes can fail, how many total nodes needed?Reconciliation Loop is the continuous process where controllers compare the desired state (from resource specs in etcd) with the actual state (current reality) and take corrective action when they differ.
Key characteristics:
- Runs approximately every 30 seconds
- Event-driven but also periodic
- Ensures self-healing and state enforcement
- Foundation of Kubernetes’ declarative model
Did you get it right?
kubectl taint nodes node1 maintenance=true:_____NoSchedule effect prevents new pods from being scheduled on the node unless they have a matching toleration. Other effects include NoExecute (evicts existing pods) and PreferNoSchedule (soft version). Syntax: kubectl taint nodes <node-name> <key>=<value>:<effect>NoSchedule effect prevents new pods from being scheduled on the node unless they have a matching toleration. Other effects include NoExecute (evicts existing pods) and PreferNoSchedule (soft version). Syntax: kubectl taint nodes <node-name> <key>=<value>:<effect>Node Controller, Endpoints Controller, Deployment Controller, and StatefulSet Controller (among others). Ingress Controller and Service Mesh Controller are typically separate components deployed in the cluster, not part of the core controller manager.Node Controller, Endpoints Controller, Deployment Controller, and StatefulSet Controller (among others). Ingress Controller and Service Mesh Controller are typically separate components deployed in the cluster, not part of the core controller manager.replicas: 5 but only 3 pods are currently running. What action will the Deployment Controller take?apiVersion: apps/v1
kind: Deployment
metadata:
name: web-app
spec:
replicas: 5
# Current state: 3 pods runningRaft Consensus Algorithm ensures consistency across the distributed etcd cluster.
How it works:
- Elects a leader among etcd nodes
- Leader handles all write operations
- Writes must be acknowledged by quorum (majority)
- Guarantees strong consistency
- Automatically handles leader failures
Why it matters: Prevents split-brain scenarios and ensures all nodes agree on the cluster state even during network partitions or node failures.
Did you get it right?
ETCDCTL_API=3 etcdctl _____ save snapshot.dbetcdctl snapshot save. The snapshot subcommand creates a point-in-time backup of the etcd database. This is critical for disaster recovery since etcd stores all cluster state.etcdctl snapshot save. The snapshot subcommand creates a point-in-time backup of the etcd database. This is critical for disaster recovery since etcd stores all cluster state.# Control plane status:
# kube-api-server: DOWN โ
# kube-scheduler: UP โ
# kube-controller-manager: UP โ
# etcd: UP โ
$ kubectl get podsNode Affinity โ places pods on nodes matching labels; not topology-aware
required...: hard constraint; pod stays Pending if no node matchespreferred...: soft preference; scheduler tries but won’t block scheduling
Pod Affinity / Anti-Affinity โ topology-aware placement relative to other pods
topologyKeydefines scope (e.g.,hostnamefor node-level,zonefor zone-level)- Affinity: co-locate pods near matching pods (e.g., same zone for low latency)
- Anti-Affinity: spread pods away from matching pods (e.g., across nodes for HA)
Did you get it right?
apiVersion: v1
kind: Pod
metadata:
name: web-pod
spec:
nodeSelector:
disktype: ssd
zone: us-east-1a
containers:
- name: nginx
image: nginxdisktype=ssd AND zone=us-east-1a labels for this pod to be scheduled on it. If any label is missing or has a different value, the node is filtered out during the scheduling filtering phase.disktype=ssd AND zone=us-east-1a labels for this pod to be scheduled on it. If any label is missing or has a different value, the node is filtered out during the scheduling filtering phase.Mutating Admission Controllers โ modify requests before persistence; run FIRST
- Inject sidecars, set defaults, add labels
- Can change the resource definition
Validating Admission Controllers โ validate without modifying; run AFTER mutating
- Enforce policies, check quotas, apply custom rules
- Can only accept or reject
Pipeline: Request โ Mutating โ Validating โ Validation โ etcd
Example: Mutating injects Istio sidecar; Validating blocks pod if namespace quota exceeded.
Did you get it right?
spec:
tolerations:
- key: "key"
operator: "Equal"
value: "value"
_____: "NoSchedule"effect field in tolerations specifies which taint effect this toleration applies to (NoSchedule, NoExecute, or PreferNoSchedule). The toleration must match the taint’s key, value, and effect for the pod to be scheduled on the tainted node.effect field in tolerations specifies which taint effect this toleration applies to (NoSchedule, NoExecute, or PreferNoSchedule). The toleration must match the taint’s key, value, and effect for the pod to be scheduled on the tainted node.ETCDCTL_API=3 etcdctl snapshot _____ snapshot.dbetcdctl snapshot restore command restores an etcd database from a backup file. While snapshot save creates the backup, snapshot restore is the recovery operation โ after restoring, etcd must be restarted pointing to the new data directory. Together, save and restore form the critical backup/recovery workflow that protects against total cluster data loss.etcdctl snapshot restore command restores an etcd database from a backup file. While snapshot save creates the backup, snapshot restore is the recovery operation โ after restoring, etcd must be restarted pointing to the new data directory. Together, save and restore form the critical backup/recovery workflow that protects against total cluster data loss.dev-team. Without any additional configuration, which component ensures a default service account is automatically available in that namespace?default service account in each one. This is reconciliation loop behavior โ the controller continuously ensures every namespace has a default SA. The API server handles validation and storage but does not create child resources; the Namespace Controller manages namespace lifecycle (cleanup on deletion), not resource provisioning within namespaces.default service account in each one. This is reconciliation loop behavior โ the controller continuously ensures every namespace has a default SA. The API server handles validation and storage but does not create child resources; the Namespace Controller manages namespace lifecycle (cleanup on deletion), not resource provisioning within namespaces.requiredDuringSchedulingIgnoredDuringExecution node affinity rule. If the node’s matching label is later removed, the pod will be evicted.IgnoredDuringExecution suffix means the affinity rule is enforced only at scheduling time โ once a pod is running, label changes on the node do NOT trigger eviction. The required part gates whether the pod can be initially scheduled, but confers no ongoing enforcement. If you need eviction when conditions change, you would use taints/tolerations with NoExecute effect instead, which do apply to running pods.IgnoredDuringExecution suffix means the affinity rule is enforced only at scheduling time โ once a pod is running, label changes on the node do NOT trigger eviction. The required part gates whether the pod can be initially scheduled, but confers no ongoing enforcement. If you need eviction when conditions change, you would use taints/tolerations with NoExecute effect instead, which do apply to running pods.# 5-node etcd cluster status:
# Node1: UP โ
# Node2: DOWN โ
# Node3: DOWN โ
# Node4: DOWN โ
# Node5: UP โ
# Quorum formula: (N/2) + 1
# For 5 nodes: quorum = 3
# Nodes currently available: 2nodeName field directly to etcd.