RedHat EX380 Red Hat Certified Specialist in OpenShift Automation and Integration Exam Practice Test

Create namespace and service account

oc new-project ci

oc -n ci create sa ci-bot

The SA will represent automation access.

Grant permissions (example: edit in namespace)

oc -n ci policy add-role-to-user edit system:serviceaccount:ci:ci-bot

Without permissions, token auth succeeds but API actions are denied.

Generate token (TokenRequest)

TOKEN=$(oc -n ci create token ci-bot)

OCP issues a short-lived token by default (good practice).

Create kubeconfig using the token

oc config set-cluster lab --server="$(oc whoami --show-server)" \

--insecure-skip-tls-verify=true --kubeconfig=ci-bot.kubeconfig

oc config set-credentials ci-bot --token="$TOKEN" --kubeconfig=ci-bot.kubeconfig

oc config set-context ci --cluster=lab --user=ci-bot --namespace=ci \

--kubeconfig=ci-bot.kubeconfig

oc config use-context ci --kubeconfig=ci-bot.kubeconfig

This produces a self-contained kubeconfig for CI automation.

Test access

oc --kubeconfig=ci-bot.kubeconfig get pods

==========

Step 1: Confirm the service account exists in auth-audit.

It must exist before a role can be assigned to it.

Step 2: Run the command:

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:auth-audit:audit

Step 3: Verify the binding is added.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/cluster-reader added: "system:serviceaccount:auth-audit:audit"

Detailed explanation:

This binds the cluster-reader cluster role to the audit service account. The full subject format system:serviceaccount:namespace:name is required because OpenShift RBAC needs the exact service account identity. The cluster-reader role is broader than a project-scoped view role because it allows read-level access across cluster resources. This is appropriate for auditing or inspection use cases where the account must observe but not modify. The distinction between cluster roles and namespaced roles is important: cluster roles apply to non-namespaced resources and broad cluster visibility, while local roles are limited to individual projects. This Task is a classic RBAC operation that combines identity creation with controlled privilege assignment.

============

Create the schedule

velero schedule create orders-daily \

--schedule "0 1 * * *" \

--include-namespaces orders \

--snapshot-volumes

Cron format: minute hour day month weekday.

Verify schedule exists

velero schedule get

Confirm backups are created by the schedule

velero backup get | grep orders-daily

Scheduled backups usually have names derived from the schedule.

==========

Create a namespace for the sync job

oc new-project id-sync

Keeps the automation components organized.

Create a service account for the sync job

oc -n id-sync create sa group-sync

CronJob runs under this SA identity.

Grant cluster permissions to manage groups

oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:id-sync:group-sync

In real environments you should scope down, but lab Task SIMULATIONs often accept cluster-admin for speed.

Create a ConfigMap for groupsync.yaml and Secret(s) for bind password/CA

Mount them into the job container.

Create CronJob to run group sync

Command inside job:

oc adm groups sync --sync-config=/config/groupsync.yaml --confirm

The CronJob ensures periodic reconciliation with LDAP.

Verify job runs

oc -n id-sync get cronjob

oc -n id-sync get jobs

oc -n id-sync logs job/ < job-name >

==========

Log in to OpenShift internal registry

oc registry login

Allows podman to push to the internal registry.

Pull external image

podman pull docker.io/library/nginx:1.25

Gets the image locally.

Tag for internal registry destination

podman tag nginx:1.25 image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Uses the cluster service DNS name (works inside cluster network).

Push to internal registry

podman push image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Update deployment to use internal image

oc -n orders set image deploy/web web=image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Verify rollout

oc -n orders rollout status deploy/web

oc -n orders get pods -o wide

==========

Step 1: Ensure the certificate file rhds_ca.crt is available in your current working directory or use the correct path.

The Task requires creating a configmap from this CA certificate file.

Step 2: Run the command:

oc create configmap rhds-ca-config-map --from-file ca.crt=rhds_ca.crt -n openshift-config

Step 3: Confirm the configmap is created.

The lab output shows:

configmap/rhds-ca-config-map created

Detailed explanation:

This creates a configmap named rhds-ca-config-map in the openshift-config namespace and maps the local file rhds_ca.crt to the key name ca.crt inside the configmap. This is important in external identity integration because OpenShift may need to trust a custom certificate authority when communicating with LDAP or another secured external service. By placing the certificate in a configmap, the authentication operator or related cluster configuration can reference it cleanly. The key name matters because many OpenShift resources expect a CA bundle key with a specific filename-like convention. If the file path is wrong, the command fails immediately. If the configmap name or key mapping is wrong, the authentication provider referencing it may not trust the external endpoint.

============

Create a local htpasswd file with a test user

htpasswd -c -B -b /tmp/htpass.txt testuser RedHat123!

-c creates a new file (use only once).

-B uses bcrypt hashing (recommended).

-b supplies password non-interactively (good for labs).

Create the HTPasswd secret in openshift-config

oc -n openshift-config create secret generic htpass-secret --from-file=htpasswd=/tmp/htpass.txt

OAuth reads the htpasswd key from this secret.

Edit OAuth and add the HTPasswd provider (keep LDAP intact)

oc edit oauth cluster

Add another entry under spec.identityProviders:

- name: local-htpasswd

mappingMethod: claim

type: HTPasswd

htpasswd:

fileData:

name: htpass-secret

This adds a second login option while preserving LDAP.

Restart OAuth pods

oc -n openshift-authentication delete pod -l app=oauth-openshift

Ensures the updated list of identity providers is loaded.

Verify login works for htpasswd user

Log in via console using testuser.

Confirm the user is created:

oc get user testuser

==========

Create (or switch to) the project

oc new-project payments

Namespace must exist before applying rolebindings.

Grant edit to the group

oc -n payments policy add-role-to-group edit dev-team

Members of dev-team can modify most resources in payments.

Grant view to a user

oc -n payments policy add-role-to-user view auditor1

auditor1 can read resources but not change them.

Verify rolebindings

oc -n payments get rolebinding

==========

Create target namespace

oc new-project gitops-demo

Destination must exist (unless Argo is configured to auto-create).

Create Application manifest

apiVersion: argoproj.io/v1alpha1

kind: Application

metadata:

name: demo-app

namespace: openshift-gitops

spec:

project: default

source:

repoURL: https://git.example.com/org/repo.git

targetRevision: main

path: manifests/demo

destination:

server: https://kubernetes.default.svc

namespace: gitops-demo

syncPolicy:

automated:

prune: true

selfHeal: true

automated: enables auto sync.

prune: removes deleted objects from Git.

selfHeal: corrects drift.

Apply Application

oc apply -f demo-app.yaml

Verify sync health

oc -n openshift-gitops get application demo-app -o yaml | grep -i -E "sync|health" -n

oc -n gitops-demo get all

==========

Create the MachineConfig YAML (example content encoded in base64)

apiVersion: machineconfiguration.openshift.io/v1

kind: MachineConfig

metadata:

name: 99-worker-motd

labels:

machineconfiguration.openshift.io/role: worker

spec:

config:

ignition:

version: 3.2.0

storage:

files:

- path: /etc/motd

mode: 0644

contents:

source: data:text/plain;charset=utf-8;base64,VGhpcyBpcyBhIHdvcmtlciBub2RlLg==

MachineConfig uses Ignition format; file content is typically base64.

Apply it

oc apply -f 99-worker-motd.yaml

Watch worker MachineConfigPool roll out

oc get mcp worker

MCP will show Updating then Updated.

Validate on a worker node (if you have node access)

Confirm /etc/motd contains the expected text.

==========

Taint nodes

oc adm taint nodes worker-1 dedicated=payments:NoSchedule

oc adm taint nodes worker-2 dedicated=payments:NoSchedule

NoSchedule blocks new pods that do not tolerate the taint.

Confirm taints

oc describe node worker-1 | grep -i taints -A2

Ensures taints are present.

Validate effect

A normal deployment without tolerations will remain Pending if it can only land on those tainted nodes.

==========

Find the alert name and labels

Web console: Observe → Alerts → click the alert to view label set.

Open Alertmanager silences

Observe → Alerting → Alertmanager → Silences → Create silence

Explanation: Silences mute alerts matching label filters.

Create the silence

Add matcher: alertname = < ALERT_NAME >

Duration: 2 hours

Save.

Verify the alert shows as silenced

The alert should indicate it is silenced in the UI.

==========