RedHat EX280 Practice Exam Questions & Answers

Solution:

Generate the default template:

oc adm create-bootstrap-project-template -o yaml > template.yaml

Review and edit template.yaml if required.

Create the template in openshift-config:

oc create -f template.yaml -n openshift-config

Edit the cluster project configuration:

oc edit project.config.openshift.io/cluster

Add or update:

spec:

projectRequestTemplate:

name: project-request

Save and exit.

Create a test project:

oc new-project test123

Verify the template behavior:

oc get project test123 -o yaml

Notes:

The uploaded lab text shows projects.config.openshift.io cluster-admin; the standard resource is project.config.openshift.io/cluster.

This task checks cluster-wide customization of new-project creation behavior.

Solution:

Create the projects:

oc new-project apollo

oc new-project test

oc new-project demo

Grant cluster-admin to bob:

oc adm policy add-cluster-role-to-user cluster-admin bob

Disable normal self-provisioning for authenticated users:

oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth

Allow john to self-provision:

oc adm policy add-cluster-role-to-user self-provisioner john

Give natasha view access in test and apollo:

oc policy add-role-to-user view natasha -n test

oc policy add-role-to-user view natasha -n apollo

Give armstrong admin in apollo:

oc policy add-role-to-user admin armstrong -n apollo

Remove kubeadmin secret:

oc delete secret kubeadmin -n kube-system

Verify permissions:

oc adm policy who-can create projectrequests

oc describe rolebinding.rbac -n apollo

oc describe rolebinding.rbac -n test

This task tests core OpenShift administration around project lifecycle control, cluster-level RBAC, and decommissioning default bootstrap credentials.

Solution:

Switch to the correct project if needed:

oc project monday

Inject environment variables from the secret:

oc set env deployment/monday --from=secret/magic

Verify:

oc set env deployment/monday --list

oc describe deployment monday

Notes:

The uploaded lab references secret/file-secret, but Task 8 clearly intends the secret to be named magic.

In a real exam, match the actual secret name present in the cluster.

This task tests secret consumption by workloads through environment variable injection.

Solution:

$ oc get all | grep deploy

$ oc set env --from=secret/magic deployment.apps/qed

Solution:

Create a file named mysql-db-conn.yaml:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: mysql-db-conn

spec:

podSelector:

matchLabels:

networking.k8s.io/v1/network: database

policyTypes:

- Ingress

ingress:

- from:

- namespaceSelector:

matchLabels:

team: devsecops

podSelector:

matchLabels:

deployment: my-web-mysql

ports:

- protocol: TCP

port: 3306

Apply it:

oc apply -f mysql-db-conn.yaml

Verify:

oc get networkpolicy

oc describe networkpolicy mysql-db-conn

This task tests namespace/pod label selection and application isolation using OpenShift networking policy controls.

Solution:

$ sudo yum install httpd-tools -y

$ htpasswd -c -B -b htpasswd-file-upload armstrong indionce

$ htpasswd -B -b htpasswd-file collins veraster

$ htpasswd -B -b htpasswd-file aldrin roonkere

$ htpasswd -B -b htpasswd-file jobs sestiver

$ htpasswd -B -b htpasswd-file wozniak glegunge

$ oc create secret generic ex280-idp-secret --from-file

htpasswd=htpasswd-file -n openshift-config

$ oc get oauth/cluster -o yaml> oauth.yaml

$ vim oauth.yaml

$

esc--> type :set paste --> enter --> insert --> then paste the content for correct indent pasting

spec:

identityProviders:

- name: ex280-htpasswd mappingMethod: claim type: HTPasswd htpasswd:

fileData:

name: ex280-idp-secret

$ oc replace -f oauth.yaml

$ oc login -u armstrong -p indionce

$ oc login -u collins -p veraster

$ oc login -u aldrin roonkere

$ oc login -u jobs sestiver

$ oc login -u wozniak -p glegunge

#This below part of operation is completely optional and done just for handy login purpose

$ alias _kube='oc login -u kubeadmin -p ${kube_pass} ${api_url}'

$ alias _armstrong='oc login -u armstrong -p ${armstrong}

${api_url}'

$ alias _collins='oc login -u collins -p ${collins} ${api_url}'

$ alias _aldrin='oc login -u aldrin -p ${aldrin} ${api_url}'

$ alias _jobs='oc login -u jobs -p ${jobs} ${api_url}'

$ alias _wozniak='oc login -u wozniak -p ${wozniak} ${api_url}'

$ _armstrong;_armstrong;_collins;_aldrin;_jobs;_wozniak;

Solution:

$ vim limit.yaml

# Edit the yaml file like below mentioned

apiVersion: 'v1' kind: 'LimitRange' metadata:

name: 'resource-limits' spec:

limits:

- type: 'Pod'

max:

cpu: '500m' memory: '300Mi'

min:

cpu: '10m' memory: '5Mi'

- type: 'Container' max:

cpu: '500m' memory: '300Mi'

min:

cpu: '10m' memory: '5Mi'

defaultRequest: cpu: '100m' memory: '100Mi'

$ oc create -f limit.yaml --save-config -n bluebook

$ oc describe limitranges -n bluebook