Free and Premium RedHat EX380 Dumps Questions Answers

Verify prerequisites exist (Secret + ConfigMap)

oc -n openshift-config get secret rhds-ldap-secret

oc -n openshift-config get configmap rhds-ca-config-map

OAuth LDAP configuration references these objects. If they don’t exist, OAuth won’t be able to bind to LDAP securely.

Edit the cluster OAuth resource

oc edit oauth cluster

The oauth/cluster resource is where identity providers are defined.

Add an LDAP identity provider entry (example structure) Add under spec.identityProviders:

- name: corp-ldap

mappingMethod: claim

type: LDAP

ldap:

url: "ldaps://ldap.example.com:636/ou=People,dc=example,dc=com?uid"

bindDN: "uid=openshift,ou=svc,dc=example,dc=com"

bindPassword:

name: rhds-ldap-secret

ca:

name: rhds-ca-config-map

insecure: false

attributes:

id: ["dn"]

name: ["cn"]

preferredUsername: ["uid"]

email: ["mail"]

url: where to search for users and which attribute is used for login (here uid).

bindDN + bindPassword: service account used for LDAP queries.

ca: trusts the LDAP server CA for TLS.

attributes: maps LDAP data into OpenShift user identity fields.

Restart OAuth pods to load changes quickly

oc -n openshift-authentication delete pod -l app=oauth-openshift

This forces pods to restart and re-read the updated configuration.

Verify the identity provider appears and users can log in

In the web console login page, you should see the new provider (name may show as corp-ldap).

After a successful login, confirm user objects appear:

oc get users

oc get identities

OpenShift creates User and Identity objects upon first successful authentication.

==========

Create (or switch to) the project

oc new-project payments

Namespace must exist before applying rolebindings.

Grant edit to the group

oc -n payments policy add-role-to-group edit dev-team

Members of dev-team can modify most resources in payments.

Grant view to a user

oc -n payments policy add-role-to-user view auditor1

auditor1 can read resources but not change them.

Verify rolebindings

oc -n payments get rolebinding

==========

Create the MachineConfig YAML (example content encoded in base64)

apiVersion: machineconfiguration.openshift.io/v1

kind: MachineConfig

metadata:

name: 99-worker-motd

labels:

machineconfiguration.openshift.io/role: worker

spec:

config:

ignition:

version: 3.2.0

storage:

files:

- path: /etc/motd

mode: 0644

contents:

source: data:text/plain;charset=utf-8;base64,VGhpcyBpcyBhIHdvcmtlciBub2RlLg==

MachineConfig uses Ignition format; file content is typically base64.

Apply it

oc apply -f 99-worker-motd.yaml

Watch worker MachineConfigPool roll out

oc get mcp worker

MCP will show Updating then Updated.

Validate on a worker node (if you have node access)

Confirm /etc/motd contains the expected text.

==========

Generate private key and CSR

openssl genrsa -out audit2.key 2048

openssl req -new -key audit2.key -out audit2.csr -subj "/CN=audit2/O=auditors"

CN becomes username; O can map to groups in some setups.

Base64 encode CSR for the API object

CSR=$(base64 -w0 audit2.csr)

Kubernetes CSR object expects base64-encoded request data.

Create the CSR object

cat < < EOF | oc apply -f -

apiVersion: certificates.k8s.io/v1

kind: CertificateSigningRequest

metadata:

name: audit2-csr

spec:

request: ${CSR}

signerName: kubernetes.io/kube-apiserver-client

usages:

- client auth

EOF

Approve the CSR

oc adm certificate approve audit2-csr

Approval triggers certificate issuance.

Extract the signed certificate

oc get csr audit2-csr -o jsonpath='{.status.certificate}' | base64 -d > audit2.crt

Produces the client certificate file.

Build kubeconfig using cert/key

oc config set-credentials audit2 \

--client-certificate=audit2.crt --client-key=audit2.key \

--embed-certs=true --kubeconfig=audit2.kubeconfig

oc config set-cluster lab \

--server="$(oc whoami --show-server)" \

--insecure-skip-tls-verify=true \

--kubeconfig=audit2.kubeconfig

oc config set-context audit2 \

--cluster=lab --user=audit2 --namespace=default \

--kubeconfig=audit2.kubeconfig

Creates a kubeconfig that authenticates using client certificates.

Test

oc --kubeconfig=audit2.kubeconfig get ns

==========

Label the chosen worker nodes

oc label node worker-1 workload=payments

oc label node worker-2 workload=payments

Node labels are key/value metadata used by the scheduler.

Add a nodeSelector to the deployment

oc -n payments patch deploy api --type=merge -p '{

"spec":{"template":{"spec":{"nodeSelector":{"workload":"payments"}}}}

}'

Forces pods to schedule only to nodes that match the label.

Verify placement

oc -n payments get pods -o wide

Confirms pods are running on the intended nodes.

==========

Step 1: Verify the cluster name, namespace, and user name that should be referenced.

The lab uses cluster api-ocp4-example-com:6443, namespace audit-ns, and user audit-sa.

Step 2: Run the command:

oc config set-context audit --cluster api-ocp4-example-com:6443 --namespace audit-ns --user audit-sa --kubeconfig audit.config

Step 3: Confirm context creation.

The lab output shows:

Context "audit" created.

Detailed explanation:

A kubeconfig context ties together three things: a cluster endpoint, a user identity, and optionally a default namespace. This Task creates a context named audit in the file audit.config. Contexts are useful because they simplify repeated administration by letting the user switch between prepared working environments instead of re-entering cluster and namespace details each time. The namespace portion is especially helpful for project-scoped operations, because commands run under that context default to the chosen namespace. Accuracy matters here: if the user name in the context does not match the credentials entry or the cluster name does not exist in the kubeconfig, the context will not function as intended.

============

Step 1: Confirm the service account exists in auth-audit.

It must exist before a role can be assigned to it.

Step 2: Run the command:

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:auth-audit:audit

Step 3: Verify the binding is added.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/cluster-reader added: "system:serviceaccount:auth-audit:audit"

Detailed explanation:

This binds the cluster-reader cluster role to the audit service account. The full subject format system:serviceaccount:namespace:name is required because OpenShift RBAC needs the exact service account identity. The cluster-reader role is broader than a project-scoped view role because it allows read-level access across cluster resources. This is appropriate for auditing or inspection use cases where the account must observe but not modify. The distinction between cluster roles and namespaced roles is important: cluster roles apply to non-namespaced resources and broad cluster visibility, while local roles are limited to individual projects. This Task is a classic RBAC operation that combines identity creation with controlled privilege assignment.

============

Step 1: Ensure the client certificate and private key files are available.

The lab uses audit.crt and tls.key.

Step 2: Run the command:

oc config set-credentials audit --client-certificate audit.crt --client-key tls.key --embed-certs --kubeconfig audit.config

Step 3: Confirm the user entry is written.

The lab output shows:

User "audit" set.

Detailed explanation:

This command creates or updates the audit user entry inside the kubeconfig file audit.config. It points the user to a client certificate and private key, and the --embed-certs option stores certificate material directly inside the kubeconfig rather than only referencing external files. That makes the kubeconfig more portable because it can be moved and used without separately copying the certificate files, provided the embedded content is valid. In certificate-based authentication, the private key proves client possession while the certificate presents the approved identity. If the certificate and key do not match, authentication will fail. This step does not yet define what cluster or namespace the user works against; it only defines the credential identity.

============

Step 1: Identify the pending certificate signing request.

The lab names it audit-csr.

Step 2: Run the approval command:

oc adm certificate approve audit-csr

Step 3: Confirm approval.

The lab output shows:

certificatesigningrequest.certificates.k8s.io/audit-csr approved

Detailed explanation:

In Kubernetes and OpenShift, a CSR must be approved before the requester can use the signed certificate for authentication. This Task approves the CSR named audit-csr, which is likely associated with the audit user or service account access flow in the lab. Certificate-based authentication is commonly used for kubeconfig access because it enables secure client identity without relying solely on tokens. Until the CSR is approved, the certificate cannot be trusted by the cluster API for authenticated operations. Administrative approval is therefore a gatekeeping step that ensures only intended certificate requests become valid credentials. This Task is part of a broader kubeconfig workflow that continues with setting credentials and defining context.

============

Step 1: Log in to the OpenShift web console.

This Task is explicitly defined as a GUI workflow.

Step 2: Navigate to Operators .

Installed logging components are managed through the operator framework.

Step 3: Open Installed Operators .

This lists operators already deployed in the cluster.

Step 4: Select Red Hat OpenShift Logging .

This operator manages the cluster logging stack and its custom resources.

Step 5: Open the ClusterLogging instance.

The Task SIMULATION refers to editing the existing ClusterLogging custom resource.

Step 6: Switch to YAML View .

This allows direct editing of the logging custom resource specification.

Step 7: Edit the collection type and set it to vector.

This changes the log collector implementation.

Step 8: Click Save .

The operator will reconcile the resource and apply the updated collector configuration.

Detailed explanation:

The ClusterLogging custom resource controls the logging stack behavior in OpenShift. Changing the collection type to vector updates which collector technology is used for gathering node and container logs. In operator-managed platforms, direct YAML edits to the custom resource are the preferred method for changing managed behavior because the operator then applies and maintains the desired state. This Task tests both navigation skills in the web console and knowledge of where logging behavior is configured. Saving the resource triggers reconciliation, which is a core OpenShift operator pattern: the declared configuration is read and enforced by the operator rather than by manual per-pod changes.

============

Start the restore

velero restore create orders-restore --from-backup orders-full

Monitor restore status

velero restore get

velero restore describe orders-restore --details

Validate restored resources

oc -n orders get all

oc -n orders get pvc

Ensure deployments/pods/services and PVCs exist and pods become Running.

==========

Step 1: Make sure the context already exists in the kubeconfig file.

This follows the context creation Task SIMULATION .

Step 2: Run the command:

oc config use-context audit --kubeconfig audit.config

Step 3: Confirm the active context switches successfully.

The lab output shows:

Switched to context "audit".

Detailed explanation:

This command activates the audit context inside the specified kubeconfig file. Once selected, subsequent oc commands using that kubeconfig will default to the cluster, user, and namespace associated with that context. This is operationally important because many administration mistakes come from running commands against the wrong cluster or project. Using explicit context switching reduces that risk and makes the kubeconfig usable for the intended audit workflow. In exams and real environments alike, the context is what turns separate kubeconfig elements into a working session configuration. Without switching to the correct context, even a well-formed kubeconfig may not be used as expected.

============