EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Question and Answers

Create PolicySet referencing existing policies:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1beta1

kind: PolicySet

metadata:

name: baseline-dev

namespace: team-dev

spec:

policies:

- policy-ensure-audit-namespace

# Add more policies here as you create them

EOF

Verify:

oc get policyset -n team-dev

Why this matters:

PolicySets group policies to apply/track as a unit—common governance practice.

Web Console → Operators → OperatorHub

Search for multicluster engine (or Multicluster Engine Operator ).

Install the operator into its recommended namespace (commonly multicluster-engine).

Create the MultiClusterEngine custom resource (CLI method shown below):

cat < < 'EOF' | oc apply -f -

apiVersion: multicluster.openshift.io/v1

kind: MultiClusterEngine

metadata:

name: multiclusterengine

spec: {}

EOF

Verify the engine reconciles:

oc get multiclusterengine

oc get pods -n multicluster-engine

Why this matters:

ACM can use the multicluster engine operator for cluster lifecycle functions; Red Hat documents cluster lifecycle with multicluster engine as a core capability.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Edit the subscription/app definition to include a time window (active or blocked window).

Attempt a change outside the window and observe behavior (no rollout until window).

Confirm rollout during window.

On hub: inspect managed cluster conditions for certificate issues.

Check pending CSRs (if applicable in your lab):

oc get csr

Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate-driven trust is core to “secure clusters” operations in ACM.

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

In OpenShift Web Console, go to Operators → OperatorHub .

Search for Advanced Cluster Security .

Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .

Click Install and follow the wizard (namespace/channel per lab).

After operator installation, create RHACS components (as the hint indicates):

Install/Deploy Central (the management plane)

Install/Deploy SecuredCluster (sensor/collector on clusters)

Confirm operator and pods are running:

Operators → Installed Operators

oc get pods -n < rhacs-namespace >

Why this matters:

RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

Create the ManagedClusterSet:

oc create managedclusterset production

Validate:

oc get managedclusterset

oc describe managedclusterset production

Why this matters:

Separating development and production clusters is common for governance/RBAC isolation.

Patch remediation to inform:

oc patch policy policy-ensure-audit-namespace -n team-dev --type=merge -p '{"spec":{"remediationAction":"inform"}}'

Verify:

oc get policy policy-ensure-audit-namespace -n team-dev -o yaml | grep remediationAction -n

Observe compliance changes (policy will report but not auto-fix).

Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.

Create placement with matchExpressions (include one label, exclude another):

matchExpressions:

- key: openshiftVersion

operator: In

values: ["4.18"]

- key: region

operator: NotIn

values: ["us-west"]

Validate PlacementDecision.