EX380 Red Hat Certified Specialist in OpenShift Automation and Integration Questions and Answers

Start the restore

velero restore create orders-restore --from-backup orders-full

Monitor restore status

velero restore get

velero restore describe orders-restore --details

Validate restored resources

oc -n orders get all

oc -n orders get pvc

Ensure deployments/pods/services and PVCs exist and pods become Running.

==========

Patch deployment with toleration

oc -n payments patch deploy api --type=merge -p '{

"spec":{"template":{"spec":{"tolerations":[

{"key":"dedicated","operator":"Equal","value":"payments","effect":"NoSchedule"}

]}}}

}'

Toleration allows pods to schedule onto tainted nodes.

Verify scheduling

oc -n payments get pods -o wide

==========

Step 1: Open a terminal with oc access to the cluster.

This Task is CLI-driven and targets the openshift-config namespace.

Step 2: Run the command:

oc create secret generic rhds-ldap-secret --from-literal bindPassword=redhatocp -n openshift-config

Step 3: Verify that the secret is created successfully.

The lab output shows:

secret/rhds-ldap-secret created

Detailed explanation:

This step creates a generic secret named rhds-ldap-secret in the openshift-config namespace. The secret stores a key called bindPassword with the value redhatocp. In an identity-provider or LDAP integration workflow, the bind password is used by OpenShift when connecting to the external directory service. Storing this value in a secret is the correct operational pattern because authentication material should not be embedded directly into configuration objects. The openshift-config namespace is specifically important because cluster authentication configuration commonly references secrets and configmaps from that namespace. If the secret name or key is wrong, the authentication configuration that depends on it may fail to validate or connect properly.

============

Confirm resources and PVCs exist

oc -n orders get all

oc -n orders get pvc

Ensures there is something meaningful to back up.

Create backup including volume snapshots

velero backup create orders-full --include-namespaces orders --snapshot-volumes

Captures Kubernetes objects and requests PV snapshots where supported.

Check status/details

velero backup describe orders-full --details

velero backup logs orders-full

Review warnings/errors and confirm snapshot actions.

==========

Create the MachineConfig YAML (example content encoded in base64)

apiVersion: machineconfiguration.openshift.io/v1

kind: MachineConfig

metadata:

name: 99-worker-motd

labels:

machineconfiguration.openshift.io/role: worker

spec:

config:

ignition:

version: 3.2.0

storage:

files:

- path: /etc/motd

mode: 0644

contents:

source: data:text/plain;charset=utf-8;base64,VGhpcyBpcyBhIHdvcmtlciBub2RlLg==

MachineConfig uses Ignition format; file content is typically base64.

Apply it

oc apply -f 99-worker-motd.yaml

Watch worker MachineConfigPool roll out

oc get mcp worker

MCP will show Updating then Updated.

Validate on a worker node (if you have node access)

Confirm /etc/motd contains the expected text.

==========

Create (or switch to) the project

oc new-project payments

Namespace must exist before applying rolebindings.

Grant edit to the group

oc -n payments policy add-role-to-group edit dev-team

Members of dev-team can modify most resources in payments.

Grant view to a user

oc -n payments policy add-role-to-user view auditor1

auditor1 can read resources but not change them.

Verify rolebindings

oc -n payments get rolebinding

==========

Find the alert name and labels

Web console: Observe → Alerts → click the alert to view label set.

Open Alertmanager silences

Observe → Alerting → Alertmanager → Silences → Create silence

Explanation: Silences mute alerts matching label filters.

Create the silence

Add matcher: alertname = < ALERT_NAME >

Duration: 2 hours

Save.

Verify the alert shows as silenced

The alert should indicate it is silenced in the UI.

==========

Taint nodes

oc adm taint nodes worker-1 dedicated=payments:NoSchedule

oc adm taint nodes worker-2 dedicated=payments:NoSchedule

NoSchedule blocks new pods that do not tolerate the taint.

Confirm taints

oc describe node worker-1 | grep -i taints -A2

Ensures taints are present.

Validate effect

A normal deployment without tolerations will remain Pending if it can only land on those tainted nodes.

==========

Collect Keycloak details

Issuer URL (realm), client ID, and client secret.

Confirm Keycloak client has correct redirect URI for OpenShift OAuth callback.

Create a secret with the OIDC client secret

oc -n openshift-config create secret generic keycloak-oidc-secret \

--from-literal=clientSecret=' < SECRET > '

OAuth reads the OIDC client secret from this secret.

Edit OAuth and add OpenID provider

oc edit oauth cluster

Add under spec.identityProviders:

- name: keycloak

mappingMethod: claim

type: OpenID

openID:

issuer: "https://keycloak.example.com/realms/ocp"

clientID: "openshift"

clientSecret:

name: keycloak-oidc-secret

claims:

preferredUsername: ["preferred_username"]

name: ["name"]

email: ["email"]

issuer must match Keycloak realm issuer URL.

claims determines which token claims map to OpenShift username/name/email.

Restart OAuth pods

oc -n openshift-authentication delete pod -l app=oauth-openshift

Verify by logging in through the web console

You should be redirected to Keycloak, authenticate, then return to OpenShift.

Confirm users/identities:

oc get users

oc get identities

==========