EX380 Red Hat Certified Specialist in OpenShift Automation and Integration Question and Answers

Confirm resources and PVCs exist

oc -n orders get all

oc -n orders get pvc

Ensures there is something meaningful to back up.

Create backup including volume snapshots

velero backup create orders-full --include-namespaces orders --snapshot-volumes

Captures Kubernetes objects and requests PV snapshots where supported.

Check status/details

velero backup describe orders-full --details

velero backup logs orders-full

Review warnings/errors and confirm snapshot actions.

==========

Step 1: Log in to the OpenShift web console.

This Task is explicitly defined as a GUI workflow.

Step 2: Navigate to Operators .

Installed logging components are managed through the operator framework.

Step 3: Open Installed Operators .

This lists operators already deployed in the cluster.

Step 4: Select Red Hat OpenShift Logging .

This operator manages the cluster logging stack and its custom resources.

Step 5: Open the ClusterLogging instance.

The Task SIMULATION refers to editing the existing ClusterLogging custom resource.

Step 6: Switch to YAML View .

This allows direct editing of the logging custom resource specification.

Step 7: Edit the collection type and set it to vector.

This changes the log collector implementation.

Step 8: Click Save .

The operator will reconcile the resource and apply the updated collector configuration.

Detailed explanation:

The ClusterLogging custom resource controls the logging stack behavior in OpenShift. Changing the collection type to vector updates which collector technology is used for gathering node and container logs. In operator-managed platforms, direct YAML edits to the custom resource are the preferred method for changing managed behavior because the operator then applies and maintains the desired state. This Task tests both navigation skills in the web console and knowledge of where logging behavior is configured. Saving the resource triggers reconciliation, which is a core OpenShift operator pattern: the declared configuration is read and enforced by the operator rather than by manual per-pod changes.

============

Step 1: Confirm the service account exists in auth-audit.

It must exist before a role can be assigned to it.

Step 2: Run the command:

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:auth-audit:audit

Step 3: Verify the binding is added.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/cluster-reader added: "system:serviceaccount:auth-audit:audit"

Detailed explanation:

This binds the cluster-reader cluster role to the audit service account. The full subject format system:serviceaccount:namespace:name is required because OpenShift RBAC needs the exact service account identity. The cluster-reader role is broader than a project-scoped view role because it allows read-level access across cluster resources. This is appropriate for auditing or inspection use cases where the account must observe but not modify. The distinction between cluster roles and namespaced roles is important: cluster roles apply to non-namespaced resources and broad cluster visibility, while local roles are limited to individual projects. This Task is a classic RBAC operation that combines identity creation with controlled privilege assignment.

============

Start the restore

velero restore create orders-restore --from-backup orders-full

Monitor restore status

velero restore get

velero restore describe orders-restore --details

Validate restored resources

oc -n orders get all

oc -n orders get pvc

Ensure deployments/pods/services and PVCs exist and pods become Running.

==========

Install OADP via Web Console

Operators → OperatorHub → search OADP / OpenShift API for Data Protection → Install

Explanation: This operator manages Velero and backup integrations.

Verify the operator CSV is installed

oc get csv -A | grep -i -E "oadp|data protection|velero"

Confirms installation succeeded.

Verify pods in the OADP namespace (commonly openshift-adp)

oc get pods -n openshift-adp

You should see Velero/OADP-related pods in Running state.

==========

Create a group sync config file (example groupsync.yaml)

This file defines how OpenShift queries LDAP for groups and members.

Run a one-time group sync

oc adm groups sync --sync-config=groupsync.yaml --confirm

--confirm actually applies changes (without it, it’s a dry-run preview).

Verify groups created/updated

oc get groups

oc describe group < groupname >

Confirms group objects exist and membership is present.

==========

Create target namespace

oc new-project gitops-demo

Destination must exist (unless Argo is configured to auto-create).

Create Application manifest

apiVersion: argoproj.io/v1alpha1

kind: Application

metadata:

name: demo-app

namespace: openshift-gitops

spec:

project: default

source:

repoURL: https://git.example.com/org/repo.git

targetRevision: main

path: manifests/demo

destination:

server: https://kubernetes.default.svc

namespace: gitops-demo

syncPolicy:

automated:

prune: true

selfHeal: true

automated: enables auto sync.

prune: removes deleted objects from Git.

selfHeal: corrects drift.

Apply Application

oc apply -f demo-app.yaml

Verify sync health

oc -n openshift-gitops get application demo-app -o yaml | grep -i -E "sync|health" -n

oc -n gitops-demo get all

==========

Collect Keycloak details

Issuer URL (realm), client ID, and client secret.

Confirm Keycloak client has correct redirect URI for OpenShift OAuth callback.

Create a secret with the OIDC client secret

oc -n openshift-config create secret generic keycloak-oidc-secret \

--from-literal=clientSecret=' < SECRET > '

OAuth reads the OIDC client secret from this secret.

Edit OAuth and add OpenID provider

oc edit oauth cluster

Add under spec.identityProviders:

- name: keycloak

mappingMethod: claim

type: OpenID

openID:

issuer: "https://keycloak.example.com/realms/ocp"

clientID: "openshift"

clientSecret:

name: keycloak-oidc-secret

claims:

preferredUsername: ["preferred_username"]

name: ["name"]

email: ["email"]

issuer must match Keycloak realm issuer URL.

claims determines which token claims map to OpenShift username/name/email.

Restart OAuth pods

oc -n openshift-authentication delete pod -l app=oauth-openshift

Verify by logging in through the web console

You should be redirected to Keycloak, authenticate, then return to OpenShift.

Confirm users/identities:

oc get users

oc get identities

==========

Patch deployment with toleration

oc -n payments patch deploy api --type=merge -p '{

"spec":{"template":{"spec":{"tolerations":[

{"key":"dedicated","operator":"Equal","value":"payments","effect":"NoSchedule"}

]}}}

}'

Toleration allows pods to schedule onto tainted nodes.

Verify scheduling

oc -n payments get pods -o wide

==========