EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Questions and Answers

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.

Bind it to a Placement targeting dev clusters.

Verify operator subscription exists on managed clusters and CSV reaches Succeeded.

Why this matters:

Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

Create overlay structure:

mkdir -p overlays/production

Confirm:

ls -R overlays

Why this matters:

Kustomize overlays let you maintain base manifests and environment-specific patches (production vs dev, etc.).

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.

Create Placement in that namespace selecting the desired clusters.

Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.

Log in to the OpenShift Web Console as a cluster-admin user.

Go to Operators → OperatorHub .

OperatorHub is the catalog of available operators.

In the search box, type: Advanced Cluster Management .

Click Advanced Cluster Management for Kubernetes (Red Hat ACM).

Click Install .

In the install wizard:

Update channel : choose the recommended/stable channel for your lab.

Installation mode : typically “All namespaces on the cluster” (default).

Installed Namespace : select or create open-cluster-management .

Click Install and wait for the operator to show Succeeded in:

Operators → Installed Operators .

Why these steps matter:

Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.

Create placement with matchExpressions (include one label, exclude another):

matchExpressions:

- key: openshiftVersion

operator: In

values: ["4.18"]

- key: region

operator: NotIn

values: ["us-west"]

Validate PlacementDecision.

Confirm the cluster is present on the hub:

oc get managedcluster

Bind cluster-dev to development:

clusteradm clusterset bind --clusterset development --cluster cluster-dev

Verify membership (common checks):

oc get managedclustersetbindings -A

oc get managedclusterset development -o yaml

oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n

Why this matters:

ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Ensure namespace has the correct ManagedClusterSetBinding.

Create placement in that namespace; only clusters visible via bound ClusterSet can be selected.

Verify placementdecision includes only clusters from that set.

This ties together ClusterSets (grouping) and Placement (selection).

Grant the ClusterSet role (admin on production).

Log in as user-a and attempt:

list clusters in production vs development

create policies in a namespace bound to production

Confirm authorization errors when accessing development resources.

(ClusterSet RBAC is explicitly part of cluster set management and access scope.)