최신RedHat Red Hat Certified Specialist in OpenShift Automation and Integration - EX380무료샘플문제
문제1
Maintain group synchronization on a schedule (CronJob)
Task Information : Create a CronJob that runs LDAP group sync on a schedule using a service account that has the required permissions.
Maintain group synchronization on a schedule (CronJob)
Task Information : Create a CronJob that runs LDAP group sync on a schedule using a service account that has the required permissions.
정답:
See the solution below in Explanation:
Explanation:
* Create a namespace for the sync job
* oc new-project id-sync
* Keeps the automation components organized.
* Create a service account for the sync job
* oc -n id-sync create sa group-sync
* CronJob runs under this SA identity.
* Grant cluster permissions to manage groups
* oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:id-sync:group-sync
* In real environments you should scope down, but lab Task SIMULATIONs often accept cluster- admin for speed.
* Create a ConfigMap for groupsync.yaml and Secret(s) for bind password/CA
* Mount them into the job container.
* Create CronJob to run group sync
* Command inside job:
* oc adm groups sync --sync-config=/config/groupsync.yaml --confirm
* The CronJob ensures periodic reconciliation with LDAP.
* Verify job runs
* oc -n id-sync get cronjob
* oc -n id-sync get jobs
* oc -n id-sync logs job/ < job-name >
Explanation:
* Create a namespace for the sync job
* oc new-project id-sync
* Keeps the automation components organized.
* Create a service account for the sync job
* oc -n id-sync create sa group-sync
* CronJob runs under this SA identity.
* Grant cluster permissions to manage groups
* oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:id-sync:group-sync
* In real environments you should scope down, but lab Task SIMULATIONs often accept cluster- admin for speed.
* Create a ConfigMap for groupsync.yaml and Secret(s) for bind password/CA
* Mount them into the job container.
* Create CronJob to run group sync
* Command inside job:
* oc adm groups sync --sync-config=/config/groupsync.yaml --confirm
* The CronJob ensures periodic reconciliation with LDAP.
* Verify job runs
* oc -n id-sync get cronjob
* oc -n id-sync get jobs
* oc -n id-sync logs job/ < job-name >
문제2
Configure log forwarding to an external endpoint
Task Information : Configure Cluster Logging to forward application logs to an external output using ClusterLogForwarder.
Configure log forwarding to an external endpoint
Task Information : Configure Cluster Logging to forward application logs to an external output using ClusterLogForwarder.
정답:
See the solution below in Explanation:
Explanation:
* Verify logging namespace and resources
* oc get ns openshift-logging
* oc -n openshift-logging get clusterlogforwarder
* ClusterLogForwarder configures pipelines and outputs.
* Create/Edit ClusterLogForwarder (example structure)
* Define an output (external system) and pipeline selecting application logs.
* Apply via YAML:
* oc -n openshift-logging apply -f clusterlogforwarder.yaml
* Validate collector pods are healthy
* oc -n openshift-logging get pods
* Forwarding relies on collectors (vector/fluentd depending config).
* Generate a test log line
* oc -n openshift-logging run logger --image=busybox --restart=Never -- /bin/sh -c 'echo hello- forwarding; sleep 5'
* This creates a known message to search in the external endpoint.
* Confirm logs arrive at destination
* Use your external system's query/search to confirm hello-forwarding.
Explanation:
* Verify logging namespace and resources
* oc get ns openshift-logging
* oc -n openshift-logging get clusterlogforwarder
* ClusterLogForwarder configures pipelines and outputs.
* Create/Edit ClusterLogForwarder (example structure)
* Define an output (external system) and pipeline selecting application logs.
* Apply via YAML:
* oc -n openshift-logging apply -f clusterlogforwarder.yaml
* Validate collector pods are healthy
* oc -n openshift-logging get pods
* Forwarding relies on collectors (vector/fluentd depending config).
* Generate a test log line
* oc -n openshift-logging run logger --image=busybox --restart=Never -- /bin/sh -c 'echo hello- forwarding; sleep 5'
* This creates a known message to search in the external endpoint.
* Confirm logs arrive at destination
* Use your external system's query/search to confirm hello-forwarding.
문제3
Install OADP Operator and verify Velero components
Task Information : Install the OADP operator and confirm Velero pods/components are running.
Install OADP Operator and verify Velero components
Task Information : Install the OADP operator and confirm Velero pods/components are running.
정답:
See the solution below in Explanation:
Explanation:
* Install OADP via Web Console
* Operators # OperatorHub # search OADP / OpenShift API for Data Protection # Install
* Explanation: This operator manages Velero and backup integrations.
* Verify the operator CSV is installed
* oc get csv -A | grep -i -E "oadp|data protection|velero"
* Confirms installation succeeded.
* Verify pods in the OADP namespace (commonly openshift-adp)
* oc get pods -n openshift-adp
* You should see Velero/OADP-related pods in Running state.
Explanation:
* Install OADP via Web Console
* Operators # OperatorHub # search OADP / OpenShift API for Data Protection # Install
* Explanation: This operator manages Velero and backup integrations.
* Verify the operator CSV is installed
* oc get csv -A | grep -i -E "oadp|data protection|velero"
* Confirms installation succeeded.
* Verify pods in the OADP namespace (commonly openshift-adp)
* oc get pods -n openshift-adp
* You should see Velero/OADP-related pods in Running state.
문제4
Kubeconfig Management - Set Credentials in Kubeconfig
Kubeconfig Management - Set Credentials in Kubeconfig
정답:
See the solution below in Explanation:
Explanation:
Step 1: Ensure the client certificate and private key files are available.
The lab uses audit.crt and tls.key.
Step 2: Run the command:
oc config set-credentials audit --client-certificate audit.crt --client-key tls.key --embed-certs --kubeconfig audit.config Step 3: Confirm the user entry is written.
The lab output shows:
User "audit" set.
Detailed explanation:
This command creates or updates the audit user entry inside the kubeconfig file audit.config. It points the user to a client certificate and private key, and the --embed-certs option stores certificate material directly inside the kubeconfig rather than only referencing external files. That makes the kubeconfig more portable because it can be moved and used without separately copying the certificate files, provided the embedded content is valid. In certificate-based authentication, the private key proves client possession while the certificate presents the approved identity. If the certificate and key do not match, authentication will fail. This step does not yet define what cluster or namespace the user works against; it only defines the credential identity.
Explanation:
Step 1: Ensure the client certificate and private key files are available.
The lab uses audit.crt and tls.key.
Step 2: Run the command:
oc config set-credentials audit --client-certificate audit.crt --client-key tls.key --embed-certs --kubeconfig audit.config Step 3: Confirm the user entry is written.
The lab output shows:
User "audit" set.
Detailed explanation:
This command creates or updates the audit user entry inside the kubeconfig file audit.config. It points the user to a client certificate and private key, and the --embed-certs option stores certificate material directly inside the kubeconfig rather than only referencing external files. That makes the kubeconfig more portable because it can be moved and used without separately copying the certificate files, provided the embedded content is valid. In certificate-based authentication, the private key proves client possession while the certificate presents the approved identity. If the certificate and key do not match, authentication will fail. This step does not yet define what cluster or namespace the user works against; it only defines the credential identity.
문제5
Configure project-wide default tolerations
Task Information : Configure the payments namespace so new pods automatically include a default toleration.
Configure project-wide default tolerations
Task Information : Configure the payments namespace so new pods automatically include a default toleration.
정답:
See the solution below in Explanation:
Explanation:
* Annotate the namespace with default tolerations
* oc annotate ns payments \
* scheduler.alpha.kubernetes.io/defaultTolerations='[{"key":"dedicated","operator":"Equal","value":" payments","effect":"NoSchedule"}]' \
* --overwrite
* Some clusters honor this pattern; if not, the fallback is mutating admission or editing workloads.
* Create a new pod/deployment in the namespace
* Then verify its spec includes tolerations:
* oc -n payments get pod < pod > -o yaml | grep -n tolerations -A5
Explanation:
* Annotate the namespace with default tolerations
* oc annotate ns payments \
* scheduler.alpha.kubernetes.io/defaultTolerations='[{"key":"dedicated","operator":"Equal","value":" payments","effect":"NoSchedule"}]' \
* --overwrite
* Some clusters honor this pattern; if not, the fallback is mutating admission or editing workloads.
* Create a new pod/deployment in the namespace
* Then verify its spec includes tolerations:
* oc -n payments get pod < pod > -o yaml | grep -n tolerations -A5