EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Questions and Answers

Edit the subscription/app definition to include a time window (active or blocked window).

Attempt a change outside the window and observe behavior (no rollout until window).

Confirm rollout during window.

Confirm the policy exists in the namespace:

oc get policy -n team-dev

Confirm Placement exists and selects clusters:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Confirm PlacementBinding points to correct placement + policy:

oc get placementbinding -n team-dev -o yaml

Fix common mistakes:

wrong namespace

placement name mismatch

missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.

Write a Policy → ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).

Bind to placement.

Verify on a managed cluster:

oc get configmap -n < ns >

oc describe configmap -n < ns > < name >

Create PolicySet referencing existing policies:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1beta1

kind: PolicySet

metadata:

name: baseline-dev

namespace: team-dev

spec:

policies:

- policy-ensure-audit-namespace

# Add more policies here as you create them

EOF

Verify:

oc get policyset -n team-dev

Why this matters:

PolicySets group policies to apply/track as a unit—common governance practice.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Confirm the cluster is present on the hub:

oc get managedcluster

Bind cluster-dev to development:

clusteradm clusterset bind --clusterset development --cluster cluster-dev

Verify membership (common checks):

oc get managedclustersetbindings -A

oc get managedclusterset development -o yaml

oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n

Why this matters:

ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Log in to the OpenShift Web Console as a cluster-admin user.

Go to Operators → OperatorHub .

OperatorHub is the catalog of available operators.

In the search box, type: Advanced Cluster Management .

Click Advanced Cluster Management for Kubernetes (Red Hat ACM).

Click Install .

In the install wizard:

Update channel : choose the recommended/stable channel for your lab.

Installation mode : typically “All namespaces on the cluster” (default).

Installed Namespace : select or create open-cluster-management .

Click Install and wait for the operator to show Succeeded in:

Operators → Installed Operators .

Why these steps matter:

Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.

Bind it to a Placement targeting dev clusters.

Verify operator subscription exists on managed clusters and CSV reaches Succeeded.

Why this matters:

Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

Policies in ACM require:

a Policy resource

a Placement (which clusters to target)

a PlacementBinding (bind policy ↔ placement)

Create the Policy (in team-dev) enforcing a namespace audit-logs:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: Policy

metadata:

name: policy-ensure-audit-namespace

namespace: team-dev

spec:

remediationAction: enforce

disabled: false

policy-templates:

- objectDefinition:

apiVersion: policy.open-cluster-management.io/v1

kind: ConfigurationPolicy

metadata:

name: ensure-audit-namespace

spec:

remediationAction: enforce

severity: low

object-templates:

- complianceType: musthave

objectDefinition:

apiVersion: v1

kind: Namespace

metadata:

name: audit-logs

EOF

Create PlacementBinding to bind it to dev-clusters placement:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: PlacementBinding

metadata:

name: bind-policy-ensure-audit-namespace

namespace: team-dev

placementRef:

apiGroup: cluster.open-cluster-management.io

kind: Placement

name: dev-clusters

subjects:

- apiGroup: policy.open-cluster-management.io

kind: Policy

name: policy-ensure-audit-namespace

EOF

Verify compliance:

oc get policy -n team-dev

oc describe policy policy-ensure-audit-namespace -n team-dev

Why this matters:

This is the core “ACM governance” exam pattern: define desired state and enforce across clusters.