EX432 Exam Dumps - RedHat Red Hat OpenShift Questions and Answers

In ACM console: Governance → Create policy → ETCD Encryption template and set to enforce .

Target clusters via Placement.

Confirm policy status: Compliant / NonCompliant per cluster.

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Create PolicySet referencing existing policies:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1beta1

kind: PolicySet

metadata:

name: baseline-dev

namespace: team-dev

spec:

policies:

- policy-ensure-audit-namespace

# Add more policies here as you create them

EOF

Verify:

oc get policyset -n team-dev

Why this matters:

PolicySets group policies to apply/track as a unit—common governance practice.

In ACM console go to Applications .

Select the application you deployed.

Open the Editor view (YAML editor) for the Subscription object.

Under spec, add a timeWindow section similar to what the lab requests:

windowtype: active

day: Friday

hours: 09:00-17:00

Save/apply the changes.

Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.

Why this matters:

Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).

Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.

Create Placement in that namespace selecting the desired clusters.

Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.

List clusters:

oc get managedcluster

Label the target cluster(s):

oc label managedcluster cluster-dev environment=dev region=us-east --overwrite

Verify labels:

oc get managedcluster cluster-dev --show-labels

Why this matters:

Labels drive Placement decisions used by policies and applications.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Ensure you are logged into the hub cluster:

oc whoami

oc project open-cluster-management

Create/apply the MultiClusterHub CR:

oc apply -f multiclusterhub.yaml

Verify it was created:

oc get multiclusterhub -A

oc describe multiclusterhub -n open-cluster-management

Watch pods come up (typical namespaces include open-cluster-management, open-cluster- management-hub, etc. depending on ACM version/config):

oc get pods -n open-cluster-management -w

Why these steps matter:

The MultiClusterHub CR is the “hub installation” object. The operator reconciles it and installs/maintains hub services.

In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).

Click Import cluster .

Provide a name (the UI may request details like distribution/credentials depending on flow).

The wizard will provide a command to run on the managed cluster you want to import.

Copy that import command.

Log into the managed cluster (spoke) using oc and run the copied command.

Back on the hub, wait until the cluster status becomes Ready / Managed .

Why these steps matter:

Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Grant the ClusterSet role (admin on production).

Log in as user-a and attempt:

list clusters in production vs development

create policies in a namespace bound to production

Confirm authorization errors when accessing development resources.

(ClusterSet RBAC is explicitly part of cluster set management and access scope.)