Free RedHat Red Hat Certified OpenShift Administrator EX280 Exam Questions

Solution:

$ oc new-project apollo

$ oc new-project manhattan

$ oc new-project gemini

$ oc new-project bluebook

$ oc new-project titan

$ oc adm policy add-role-to-user admin armstrong -n apollo

$ oc adm policy add-role-to-user admin armstrong -n gemini

$ oc adm policy add-role-to-user view wozniak -n titan

Solution:

Create a file named mysql-db-conn.yaml:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: mysql-db-conn

spec:

podSelector:

matchLabels:

networking.k8s.io/v1/network: database

policyTypes:

- Ingress

ingress:

- from:

- namespaceSelector:

matchLabels:

team: devsecops

podSelector:

matchLabels:

deployment: my-web-mysql

ports:

- protocol: TCP

port: 3306

Apply it:

oc apply -f mysql-db-conn.yaml

Verify:

oc get networkpolicy

oc describe networkpolicy mysql-db-conn

This task tests namespace/pod label selection and application isolation using OpenShift networking policy controls.

Solution:

$ oc project bullwinkle

$ oc get pods

$ oc get all | grep deploy

$ oc get nodes

$ oc describe nodes | grep -i taint

$ oc adm taint nodes worker0 key1=value1:NoSchedule-

$ oc adm taint nodes worker1 key1=value1:NoSchedule-

$ oc describe nodes | grep -i taint

$ oc get route

$ oc delete route rocky

$ oc expose svc rocky --hostname rocky.apps.domainxx.example.com

$ oc get route

Solution:

$ sudo yum install httpd-tools -y

$ htpasswd -c -B -b htpasswd-file-upload armstrong indionce

$ htpasswd -B -b htpasswd-file collins veraster

$ htpasswd -B -b htpasswd-file aldrin roonkere

$ htpasswd -B -b htpasswd-file jobs sestiver

$ htpasswd -B -b htpasswd-file wozniak glegunge

$ oc create secret generic ex280-idp-secret --from-file

htpasswd=htpasswd-file -n openshift-config

$ oc get oauth/cluster -o yaml> oauth.yaml

$ vim oauth.yaml

$

esc--> type :set paste --> enter --> insert --> then paste the content for correct indent pasting

spec:

identityProviders:

- name: ex280-htpasswd mappingMethod: claim type: HTPasswd htpasswd:

fileData:

name: ex280-idp-secret

$ oc replace -f oauth.yaml

$ oc login -u armstrong -p indionce

$ oc login -u collins -p veraster

$ oc login -u aldrin roonkere

$ oc login -u jobs sestiver

$ oc login -u wozniak -p glegunge

#This below part of operation is completely optional and done just for handy login purpose

$ alias _kube='oc login -u kubeadmin -p ${kube_pass} ${api_url}'

$ alias _armstrong='oc login -u armstrong -p ${armstrong}

${api_url}'

$ alias _collins='oc login -u collins -p ${collins} ${api_url}'

$ alias _aldrin='oc login -u aldrin -p ${aldrin} ${api_url}'

$ alias _jobs='oc login -u jobs -p ${jobs} ${api_url}'

$ alias _wozniak='oc login -u wozniak -p ${wozniak} ${api_url}'

$ _armstrong;_armstrong;_collins;_aldrin;_jobs;_wozniak;

Solution:

Create the projects:

oc new-project apollo

oc new-project test

oc new-project demo

Grant cluster-admin to bob:

oc adm policy add-cluster-role-to-user cluster-admin bob

Disable normal self-provisioning for authenticated users:

oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth

Allow john to self-provision:

oc adm policy add-cluster-role-to-user self-provisioner john

Give natasha view access in test and apollo:

oc policy add-role-to-user view natasha -n test

oc policy add-role-to-user view natasha -n apollo

Give armstrong admin in apollo:

oc policy add-role-to-user admin armstrong -n apollo

Remove kubeadmin secret:

oc delete secret kubeadmin -n kube-system

Verify permissions:

oc adm policy who-can create projectrequests

oc describe rolebinding.rbac -n apollo

oc describe rolebinding.rbac -n test

This task tests core OpenShift administration around project lifecycle control, cluster-level RBAC, and decommissioning default bootstrap credentials.