EX280 Practice Questions

Solution:

Switch to the math project:

oc project math

Create the secret:

oc create secret generic magic --from-literal=MYSQL_ROOT_PASSWORD=redhat

Verify:

oc get secret magic

oc describe secret magic

Note:

The uploaded lab text contains a typo --from-listeral; the valid option is --from-literal.

The output in the lab also appears inconsistent. The intended secret name is magic .

This task checks secret creation and secure configuration data handling.

Solution:

$ vim limit.yaml

# Edit the yaml file like below mentioned

apiVersion: "v1" kind: "LimitRange" metadata:

name: "resource-limits" spec:

limits:

- type: "Pod"

max:

cpu: "500m" memory: "300Mi"

min:

cpu: "10m" memory: "5Mi"

- type: "Container" max:

cpu: "500m" memory: "300Mi"

min:

cpu: "10m" memory: "5Mi"

defaultRequest: cpu: "100m" memory: "100Mi"

$ oc create -f limit.yaml --save-config -n bluebook

$ oc describe limitranges -n bluebook

Solution:

Switch to the project:

oc project qed

Create the service account:

oc create serviceaccount project1-sa -n qed

Grant the SCC:

oc adm policy add-scc-to-user anyuid -z project1-sa -n qed

Verify:

oc get sa project1-sa -n qed

oc adm policy who-can use scc anyuid

Why this matters:

anyuid allows containers to run with arbitrary user IDs when an application requires it.

This is a common administrative task in OpenShift for third-party container images.

This task validates service account creation and SCC assignment.

Solution:

$ oc project lerna

$ oc get pods

$ oc get all | grep deployment

$ oc autoscale deployment.apps/hydra --max=9 --min=6 --cpu-percent=60

$ oc get hpa

$ oc set resources deployment.apps/hydra --limits=cpu=100m -- requests=cpu=25m

$ oc describe deployment.apps/hydra | grep Limits -A3

Solution:

Add the repository:

helm repo add do280-repo http://helm.ocp4.example.com/charts

Refresh repositories:

helm repo update

Install the chart:

helm install example-app do280-repo/etherpad

Verify:

helm list

oc get all

Notes:

The uploaded lab text appears to spell the chart name incorrectly as ehterpad.

In practice, use the actual chart name published in the repo. If the lab repo truly contains the typo, follow the repo index result.

This task tests Helm repository management and application deployment.

Solution:

Create a file named mysql-db-conn.yaml:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: mysql-db-conn

spec:

podSelector:

matchLabels:

networking.k8s.io/v1/network: database

policyTypes:

- Ingress

ingress:

- from:

- namespaceSelector:

matchLabels:

team: devsecops

podSelector:

matchLabels:

deployment: my-web-mysql

ports:

- protocol: TCP

port: 3306

Apply it:

oc apply -f mysql-db-conn.yaml

Verify:

oc get networkpolicy

oc describe networkpolicy mysql-db-conn

This task tests namespace/pod label selection and application isolation using OpenShift networking policy controls.

Solution:

Generate the default template:

oc adm create-bootstrap-project-template -o yaml > template.yaml

Review and edit template.yaml if required.

Create the template in openshift-config:

oc create -f template.yaml -n openshift-config

Edit the cluster project configuration:

oc edit project.config.openshift.io/cluster

Add or update:

spec:

projectRequestTemplate:

name: project-request

Save and exit.

Create a test project:

oc new-project test123

Verify the template behavior:

oc get project test123 -o yaml

Notes:

The uploaded lab text shows projects.config.openshift.io cluster-admin; the standard resource is project.config.openshift.io/cluster.

This task checks cluster-wide customization of new-project creation behavior.

Solution:

$ oc project area51

$ oc get pods

$ oc get all | grep deployment

$ oc get route

$ oc delete route oxcart

$ openssl genrsa -out ex280.key 2048

$ openssl req -new -key ex280.key -out ex280.csr -subj "/C=US/ST=NV/L=Hiko/O=CIA/OU=USAF/CN=classified.apps.domainxx.example.com"

$ openssl x509 -req -in ex280.csr -signkey ex280.key -out ex280.crt

$ oc create route edge oxcart --service oxcart --key ex280.key --cert ex280.crt --hostname classified.apps.domainxx.example.com

$ oc get route

$ oc get svc

Solution:

Run must-gather:

oc adm must-gather

Confirm the directory created, usually something like:

ls

Archive the directory:

tar -cvzf system10-4ktjl-l4kj5l-lk45j.tar.gz must-gather.local.*

Verify:

ls -lh *.tar.gz

Notes:

The lab text shows a tar command without source paths. A valid tar command must include the source directory or files.

Use the actual must-gather output directory generated in your environment.

This task validates support-data collection and cluster diagnostics handling.