The EX380 exam validates your ability to automate and integrate workflows within Red Hat OpenShift environments. This certification, part of the Red Hat Openshift Certifications path, is designed for platform engineers and DevOps professionals who need to demonstrate hands-on expertise in OpenShift automation and integration tasks. This page provides a clear roadmap of exam topics, question formats, and effective preparation strategies to help you build confidence and competence before test day.
Use this topic map to guide your study for RedHat EX380 (Red Hat Certified Specialist in OpenShift Automation and Integration) within the Red Hat Openshift Certifications path.
The EX380 exam combines multiple-choice questions with scenario-based items and practical simulations to assess both conceptual knowledge and real-world problem-solving ability.
Questions increase in complexity and reward candidates who understand not just what to do, but why certain approaches work better in production scenarios.
An efficient study plan maps each syllabus topic to weekly learning goals, balances theory with hands-on labs, and includes regular practice testing to build confidence. Start by reviewing core concepts, then move into configuration tasks and scenario analysis, and finish with full-length timed practice exams.
Explore other RedHat certifications: view all RedHat exams.
Strengthen your preparation with up‑to‑date resources from validexamdumps.com. These materials align to EX380 and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test or get Bundle Discount offer for both Formats: Red Hat Certified Specialist in OpenShift Automation and Integration.
Operator Framework, Ansible automation, and integration patterns typically account for a significant portion of the exam. These areas directly reflect real-world job responsibilities and require both conceptual understanding and hands-on configuration skills. Strong performance in these domains often translates to a passing score.
Ideally, you should have at least 6-12 months of practical experience deploying and managing OpenShift clusters. If you're newer to the platform, prioritize labs that cover cluster installation, Operator deployment, and Ansible integration. Hands-on work fills gaps that reading alone cannot and builds the confidence needed for scenario-based questions.
Candidates often underestimate the importance of understanding Operator lifecycle management and CRD design, leading to errors in scenario questions. Another frequent pitfall is confusing Ansible syntax or missing security best practices in configuration tasks. Reviewing explanations after practice questions and focusing on "why" rather than just "what" helps avoid these mistakes.
Operators automate application lifecycle management using Kubernetes-native CRDs; Ansible playbooks orchestrate cluster-level and infrastructure tasks; integration patterns tie these together to create end-to-end automation. Understanding this relationship, how each layer supports the others, is crucial for scenario-based questions and real production work.
In the final week, focus on weak areas identified in practice tests rather than re-reading everything. Run one full-length timed exam, review all incorrect answers with explanations, and do quick spot-checks on high-weight topics like Operators and Ansible. Avoid cramming new topics; instead, reinforce what you've already learned and build test-day confidence through realistic practice.
SIMULATION
Task SIMULATION 3
Integrate OpenShift with Keycloak (OIDC)
Task Information: Add a Keycloak (RH SSO) OpenID Connect identity provider to OpenShift OAuth and verify redirect/login works.
Collect Keycloak details
Issuer URL (realm), client ID, and client secret.
Confirm Keycloak client has correct redirect URI for OpenShift OAuth callback.
Create a secret with the OIDC client secret
oc -n openshift-config create secret generic keycloak-oidc-secret \
--from-literal=clientSecret='<SECRET>'
OAuth reads the OIDC client secret from this secret.
Edit OAuth and add OpenID provider
oc edit oauth cluster
Add under spec.identityProviders:
- name: keycloak
mappingMethod: claim
type: OpenID
openID:
issuer: 'https://keycloak.example.com/realms/ocp'
clientID: 'openshift'
clientSecret:
name: keycloak-oidc-secret
claims:
preferredUsername: ['preferred_username']
name: ['name']
email: ['email']
issuer must match Keycloak realm issuer URL.
claims determines which token claims map to OpenShift username/name/email.
Restart OAuth pods
oc -n openshift-authentication delete pod -l app=oauth-openshift
Verify by logging in through the web console
You should be redirected to Keycloak, authenticate, then return to OpenShift.
Confirm users/identities:
oc get users
oc get identities
==========
SIMULATION
Task SIMULATION 5
Backup and Restore -- Fix SCC for Restored Application
Step 1: Identify the application namespace after restore.
The lab shows the namespace as my-app-namespace.
Step 2: Run the SCC assignment command:
oc adm policy add-scc-to-user anyuid -z default -n my-app-namespace
Step 3: Confirm the role binding is applied.
The lab output shows:
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:anyuid added: 'default'
Detailed explanation:
After a restore, the application may fail if its pods require a security context not permitted by the default SCC allocation. This command grants the anyuid SCC to the default service account in the my-app-namespace project. The -z default syntax targets the default service account, which many restored workloads use if no custom service account is defined. The anyuid SCC allows containers to run with arbitrary user IDs, which some legacy or prebuilt images require. In OpenShift, SCC mismatches commonly cause pods to remain in pending or crash-related states. Assigning the proper SCC resolves those admission issues so workloads can start successfully. This step is therefore a post-restore operational fix to align security policy with application requirements.
============
SIMULATION
Task SIMULATION 2
Identity Management -- Create HTPasswd Secret
Step 1: Open a terminal with oc access to the cluster.
This Task is CLI-driven and targets the openshift-config namespace.
Step 2: Run the command:
oc create secret generic rhds-ldap-secret --from-literal bindPassword=redhatocp -n openshift-config
Step 3: Verify that the secret is created successfully.
The lab output shows:
secret/rhds-ldap-secret created
Detailed explanation:
This step creates a generic secret named rhds-ldap-secret in the openshift-config namespace. The secret stores a key called bindPassword with the value redhatocp. In an identity-provider or LDAP integration workflow, the bind password is used by OpenShift when connecting to the external directory service. Storing this value in a secret is the correct operational pattern because authentication material should not be embedded directly into configuration objects. The openshift-config namespace is specifically important because cluster authentication configuration commonly references secrets and configmaps from that namespace. If the secret name or key is wrong, the authentication configuration that depends on it may fail to validate or connect properly.
============
SIMULATION
Task SIMULATION 26
Silence an alert in Alertmanager
Task Information: Create an Alertmanager silence for a noisy alert for 2 hours, then confirm it's silenced.
Find the alert name and labels
Web console: Observe Alerts click the alert to view label set.
Open Alertmanager silences
Observe Alerting Alertmanager Silences Create silence
Create the silence
Add matcher: alertname = <ALERT_NAME>
Duration: 2 hours
Save.
Verify the alert shows as silenced
The alert should indicate it is silenced in the UI.
==========
SIMULATION
Task SIMULATION 2
Add a second Identity Provider (HTPasswd) alongside LDAP
Task Information: Configure multiple identity providers by adding an HTPasswd IDP without removing the existing LDAP IDP.
Create a local htpasswd file with a test user
htpasswd -c -B -b /tmp/htpass.txt testuser RedHat123!
-c creates a new file (use only once).
-B uses bcrypt hashing (recommended).
-b supplies password non-interactively (good for labs).
Create the HTPasswd secret in openshift-config
oc -n openshift-config create secret generic htpass-secret --from-file=htpasswd=/tmp/htpass.txt
OAuth reads the htpasswd key from this secret.
Edit OAuth and add the HTPasswd provider (keep LDAP intact)
oc edit oauth cluster
Add another entry under spec.identityProviders:
- name: local-htpasswd
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: htpass-secret
This adds a second login option while preserving LDAP.
Restart OAuth pods
oc -n openshift-authentication delete pod -l app=oauth-openshift
Ensures the updated list of identity providers is loaded.
Verify login works for htpasswd user
Log in via console using testuser.
Confirm the user is created:
oc get user testuser
==========