Pass the RedHat Red Hat OpenShift EX432 Questions and answers with CertsForce

Grant view role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:view:development user-b

Validate:

oc get clusterrolebinding | grep -i development | grep -i user-b

Why this matters:

Provides read-only access to development ClusterSet resources, improving separation of duties.

In ACM console: Governance → Create policy → ETCD Encryption template and set to enforce .

Target clusters via Placement.

Confirm policy status: Compliant / NonCompliant per cluster.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Confirm the policy exists in the namespace:

oc get policy -n team-dev

Confirm Placement exists and selects clusters:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Confirm PlacementBinding points to correct placement + policy:

oc get placementbinding -n team-dev -o yaml

Fix common mistakes:

wrong namespace

placement name mismatch

missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.

Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.

Create placement with matchExpressions (include one label, exclude another):

matchExpressions:

- key: openshiftVersion

operator: In

values: ["4.18"]

- key: region

operator: NotIn

values: ["us-west"]

Validate PlacementDecision.

Create Placement in team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: dev-clusters

namespace: team-dev

spec:

predicates:

- requiredClusterSelector:

labelSelector:

matchExpressions:

- key: environment

operator: In

values: ["dev"]

EOF

Verify placement decisions:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Why this matters:

Placement is used broadly for policy targeting and multi-cluster app rollout .

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Check cluster conditions:

oc describe managedcluster cluster-dev

Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you’re looking for ACM/klusterlet agents).

On hub, check managedclusteraddons and addon health:

oc get managedclusteraddon -n cluster-dev

oc describe managedclusteraddon -n cluster-dev < addon-name >

Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).

In ACM console go to Applications .

Select the application you deployed.

Open the Editor view (YAML editor) for the Subscription object.

Under spec, add a timeWindow section similar to what the lab requests:

windowtype: active

day: Friday

hours: 09:00-17:00

Save/apply the changes.

Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.

Why this matters:

Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).

On hub: inspect managed cluster conditions for certificate issues.

Check pending CSRs (if applicable in your lab):

oc get csr

Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate-driven trust is core to “secure clusters” operations in ACM.