EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Questions and Answers

On hub: inspect managed cluster conditions for certificate issues.

Check pending CSRs (if applicable in your lab):

oc get csr

Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate-driven trust is core to “secure clusters” operations in ACM.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Log in to the OpenShift Web Console as a cluster-admin user.

Go to Operators → OperatorHub .

OperatorHub is the catalog of available operators.

In the search box, type: Advanced Cluster Management .

Click Advanced Cluster Management for Kubernetes (Red Hat ACM).

Click Install .

In the install wizard:

Update channel : choose the recommended/stable channel for your lab.

Installation mode : typically “All namespaces on the cluster” (default).

Installed Namespace : select or create open-cluster-management .

Click Install and wait for the operator to show Succeeded in:

Operators → Installed Operators .

Why these steps matter:

Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

Write a Policy → ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).

Bind to placement.

Verify on a managed cluster:

oc get configmap -n < ns >

oc describe configmap -n < ns > < name >

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Confirm the cluster is present on the hub:

oc get managedcluster

Bind cluster-dev to development:

clusteradm clusterset bind --clusterset development --cluster cluster-dev

Verify membership (common checks):

oc get managedclustersetbindings -A

oc get managedclusterset development -o yaml

oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n

Why this matters:

ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Put the NetworkPolicy manifest under object-templates in a ConfigurationPolicy.

Bind to a Placement for dev clusters.

Verify NetworkPolicy exists on all targeted clusters.

In OpenShift Web Console, go to Operators → OperatorHub .

Search for Advanced Cluster Security .

Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .

Click Install and follow the wizard (namespace/channel per lab).

After operator installation, create RHACS components (as the hint indicates):

Install/Deploy Central (the management plane)

Install/Deploy SecuredCluster (sensor/collector on clusters)

Confirm operator and pods are running:

Operators → Installed Operators

oc get pods -n < rhacs-namespace >

Why this matters:

RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).

Click Import cluster .

Provide a name (the UI may request details like distribution/credentials depending on flow).

The wizard will provide a command to run on the managed cluster you want to import.

Copy that import command.

Log into the managed cluster (spoke) using oc and run the copied command.

Back on the hub, wait until the cluster status becomes Ready / Managed .

Why these steps matter:

Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.

Create Placement in that namespace selecting the desired clusters.

Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.