EX380 Practice Exam Questions | Red Hat OpenShift

Step 1: Verify the cluster name, namespace, and user name that should be referenced.

The lab uses cluster api-ocp4-example-com:6443, namespace audit-ns, and user audit-sa.

Step 2: Run the command:

oc config set-context audit --cluster api-ocp4-example-com:6443 --namespace audit-ns --user audit-sa --kubeconfig audit.config

Step 3: Confirm context creation.

The lab output shows:

Context "audit" created.

Detailed explanation:

A kubeconfig context ties together three things: a cluster endpoint, a user identity, and optionally a default namespace. This Task creates a context named audit in the file audit.config. Contexts are useful because they simplify repeated administration by letting the user switch between prepared working environments instead of re-entering cluster and namespace details each time. The namespace portion is especially helpful for project-scoped operations, because commands run under that context default to the chosen namespace. Accuracy matters here: if the user name in the context does not match the credentials entry or the cluster name does not exist in the kubeconfig, the context will not function as intended.

============

Verify logging namespace and resources

oc get ns openshift-logging

oc -n openshift-logging get clusterlogforwarder

ClusterLogForwarder configures pipelines and outputs.

Create/Edit ClusterLogForwarder (example structure)

Define an output (external system) and pipeline selecting application logs.

Apply via YAML:

oc -n openshift-logging apply -f clusterlogforwarder.yaml

Validate collector pods are healthy

oc -n openshift-logging get pods

Forwarding relies on collectors (vector/fluentd depending config).

Generate a test log line

oc -n openshift-logging run logger --image=busybox --restart=Never -- /bin/sh -c 'echo hello-forwarding; sleep 5'

This creates a known message to search in the external endpoint.

Confirm logs arrive at destination

Use your external system’s query/search to confirm hello-forwarding.

==========

Verify prerequisites exist (Secret + ConfigMap)

oc -n openshift-config get secret rhds-ldap-secret

oc -n openshift-config get configmap rhds-ca-config-map

OAuth LDAP configuration references these objects. If they don’t exist, OAuth won’t be able to bind to LDAP securely.

Edit the cluster OAuth resource

oc edit oauth cluster

The oauth/cluster resource is where identity providers are defined.

Add an LDAP identity provider entry (example structure) Add under spec.identityProviders:

- name: corp-ldap

mappingMethod: claim

type: LDAP

ldap:

url: "ldaps://ldap.example.com:636/ou=People,dc=example,dc=com?uid"

bindDN: "uid=openshift,ou=svc,dc=example,dc=com"

bindPassword:

name: rhds-ldap-secret

ca:

name: rhds-ca-config-map

insecure: false

attributes:

id: ["dn"]

name: ["cn"]

preferredUsername: ["uid"]

email: ["mail"]

url: where to search for users and which attribute is used for login (here uid).

bindDN + bindPassword: service account used for LDAP queries.

ca: trusts the LDAP server CA for TLS.

attributes: maps LDAP data into OpenShift user identity fields.

Restart OAuth pods to load changes quickly

oc -n openshift-authentication delete pod -l app=oauth-openshift

This forces pods to restart and re-read the updated configuration.

Verify the identity provider appears and users can log in

In the web console login page, you should see the new provider (name may show as corp-ldap).

After a successful login, confirm user objects appear:

oc get users

oc get identities

OpenShift creates User and Identity objects upon first successful authentication.

==========