EX380 Exam Questions & Answers

Step 1: Make sure the context already exists in the kubeconfig file.

This follows the context creation Task SIMULATION.

Step 2: Run the command:

oc config use-context audit --kubeconfig audit.config

Step 3: Confirm the active context switches successfully.

The lab output shows:

Switched to context 'audit'.

Detailed explanation:

This command activates the audit context inside the specified kubeconfig file. Once selected, subsequent oc commands using that kubeconfig will default to the cluster, user, and namespace associated with that context. This is operationally important because many administration mistakes come from running commands against the wrong cluster or project. Using explicit context switching reduces that risk and makes the kubeconfig usable for the intended audit workflow. In exams and real environments alike, the context is what turns separate kubeconfig elements into a working session configuration. Without switching to the correct context, even a well-formed kubeconfig may not be used as expected.

Step 1: Identify the application namespace after restore.

The lab shows the namespace as my-app-namespace.

Step 2: Run the SCC assignment command:

oc adm policy add-scc-to-user anyuid -z default -n my-app-namespace

Step 3: Confirm the role binding is applied.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/system:openshift:scc:anyuid added: 'default'

Detailed explanation:

After a restore, the application may fail if its pods require a security context not permitted by the default SCC allocation. This command grants the anyuid SCC to the default service account in the my-app-namespace project. The -z default syntax targets the default service account, which many restored workloads use if no custom service account is defined. The anyuid SCC allows containers to run with arbitrary user IDs, which some legacy or prebuilt images require. In OpenShift, SCC mismatches commonly cause pods to remain in pending or crash-related states. Assigning the proper SCC resolves those admission issues so workloads can start successfully. This step is therefore a post-restore operational fix to align security policy with application requirements.

Step 1: Confirm the service account exists in auth-audit.

It must exist before a role can be assigned to it.

Step 2: Run the command:

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:auth-audit:audit

Step 3: Verify the binding is added.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/cluster-reader added: 'system:serviceaccount:auth-audit:audit'

Detailed explanation:

This binds the cluster-reader cluster role to the audit service account. The full subject format system:serviceaccount:namespace:name is required because OpenShift RBAC needs the exact service account identity. The cluster-reader role is broader than a project-scoped view role because it allows read-level access across cluster resources. This is appropriate for auditing or inspection use cases where the account must observe but not modify. The distinction between cluster roles and namespaced roles is important: cluster roles apply to non-namespaced resources and broad cluster visibility, while local roles are limited to individual projects. This Task is a classic RBAC operation that combines identity creation with controlled privilege assignment.

Create namespace and service account

oc new-project ci

oc -n ci create sa ci-bot

The SA will represent automation access.

Grant permissions (example: edit in namespace)

oc -n ci policy add-role-to-user edit system:serviceaccount:ci:ci-bot

Without permissions, token auth succeeds but API actions are denied.

Generate token (TokenRequest)

TOKEN=$(oc -n ci create token ci-bot)

OCP issues a short-lived token by default (good practice).

Create kubeconfig using the token

oc config set-cluster lab --server='$(oc whoami --show-server)' \

--insecure-skip-tls-verify=true --kubeconfig=ci-bot.kubeconfig

oc config set-credentials ci-bot --token='$TOKEN' --kubeconfig=ci-bot.kubeconfig

oc config set-context ci --cluster=lab --user=ci-bot --namespace=ci \

--kubeconfig=ci-bot.kubeconfig

oc config use-context ci --kubeconfig=ci-bot.kubeconfig

This produces a self-contained kubeconfig for CI automation.

Test access

oc --kubeconfig=ci-bot.kubeconfig get pods

Generate private key and CSR

openssl genrsa -out audit2.key 2048

openssl req -new -key audit2.key -out audit2.csr -subj '/CN=audit2/O=auditors'

CN becomes username; O can map to groups in some setups.

Base64 encode CSR for the API object

CSR=$(base64 -w0 audit2.csr)

Kubernetes CSR object expects base64-encoded request data.

Create the CSR object

cat <<EOF | oc apply -f -

apiVersion: certificates.k8s.io/v1

kind: CertificateSigningRequest

metadata:

name: audit2-csr

spec:

request: ${CSR}

signerName: kubernetes.io/kube-apiserver-client

usages:

- client auth

EOF

Approve the CSR

oc adm certificate approve audit2-csr

Approval triggers certificate issuance.

Extract the signed certificate

oc get csr audit2-csr -o jsonpath='{.status.certificate}' | base64 -d > audit2.crt

Produces the client certificate file.

Build kubeconfig using cert/key

oc config set-credentials audit2 \

--client-certificate=audit2.crt --client-key=audit2.key \

--embed-certs=true --kubeconfig=audit2.kubeconfig

oc config set-cluster lab \

--server='$(oc whoami --show-server)' \

--insecure-skip-tls-verify=true \

--kubeconfig=audit2.kubeconfig

oc config set-context audit2 \

--cluster=lab --user=audit2 --namespace=default \

--kubeconfig=audit2.kubeconfig

Creates a kubeconfig that authenticates using client certificates.

Test

oc --kubeconfig=audit2.kubeconfig get ns