EX432 Sample Questions Answers

Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.

Bind it to a Placement targeting dev clusters.

Verify operator subscription exists on managed clusters and CSV reaches Succeeded.

Why this matters:

Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

In ACM console go to Applications .

Select the application you deployed.

Open the Editor view (YAML editor) for the Subscription object.

Under spec, add a timeWindow section similar to what the lab requests:

windowtype: active

day: Friday

hours: 09:00-17:00

Save/apply the changes.

Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.

Why this matters:

Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).

Policies in ACM require:

a Policy resource

a Placement (which clusters to target)

a PlacementBinding (bind policy ↔ placement)

Create the Policy (in team-dev) enforcing a namespace audit-logs:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: Policy

metadata:

name: policy-ensure-audit-namespace

namespace: team-dev

spec:

remediationAction: enforce

disabled: false

policy-templates:

- objectDefinition:

apiVersion: policy.open-cluster-management.io/v1

kind: ConfigurationPolicy

metadata:

name: ensure-audit-namespace

spec:

remediationAction: enforce

severity: low

object-templates:

- complianceType: musthave

objectDefinition:

apiVersion: v1

kind: Namespace

metadata:

name: audit-logs

EOF

Create PlacementBinding to bind it to dev-clusters placement:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: PlacementBinding

metadata:

name: bind-policy-ensure-audit-namespace

namespace: team-dev

placementRef:

apiGroup: cluster.open-cluster-management.io

kind: Placement

name: dev-clusters

subjects:

- apiGroup: policy.open-cluster-management.io

kind: Policy

name: policy-ensure-audit-namespace

EOF

Verify compliance:

oc get policy -n team-dev

oc describe policy policy-ensure-audit-namespace -n team-dev

Why this matters:

This is the core “ACM governance” exam pattern: define desired state and enforce across clusters.

Grant view role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:view:development user-b

Validate:

oc get clusterrolebinding | grep -i development | grep -i user-b

Why this matters:

Provides read-only access to development ClusterSet resources, improving separation of duties.

Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).

Bind to placement.

Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.

Confirm the cluster is present on the hub:

oc get managedcluster

Bind cluster-dev to development:

clusteradm clusterset bind --clusterset development --cluster cluster-dev

Verify membership (common checks):

oc get managedclustersetbindings -A

oc get managedclusterset development -o yaml

oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n

Why this matters:

ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Ensure you are logged into the hub cluster:

oc whoami

oc project open-cluster-management

Create/apply the MultiClusterHub CR:

oc apply -f multiclusterhub.yaml

Verify it was created:

oc get multiclusterhub -A

oc describe multiclusterhub -n open-cluster-management

Watch pods come up (typical namespaces include open-cluster-management, open-cluster- management-hub, etc. depending on ACM version/config):

oc get pods -n open-cluster-management -w

Why these steps matter:

The MultiClusterHub CR is the “hub installation” object. The operator reconciles it and installs/maintains hub services.

Confirm the policy exists in the namespace:

oc get policy -n team-dev

Confirm Placement exists and selects clusters:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Confirm PlacementBinding points to correct placement + policy:

oc get placementbinding -n team-dev -o yaml

Fix common mistakes:

wrong namespace

placement name mismatch

missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.

Create PolicySet referencing existing policies:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1beta1

kind: PolicySet

metadata:

name: baseline-dev

namespace: team-dev

spec:

policies:

- policy-ensure-audit-namespace

# Add more policies here as you create them

EOF

Verify:

oc get policyset -n team-dev

Why this matters:

PolicySets group policies to apply/track as a unit—common governance practice.