RedHat EX380 問題集

質問 1：
Identity Management - Create CA ConfigMap
正解：
See the solution below in Explanation:
Explanation:
Step 1: Ensure the certificate file rhds_ca.crt is available in your current working directory or use the correct path.
The Task requires creating a configmap from this CA certificate file.
Step 2: Run the command:
oc create configmap rhds-ca-config-map --from-file ca.crt=rhds_ca.crt -n openshift-config Step 3: Confirm the configmap is created.
The lab output shows:
configmap/rhds-ca-config-map created
Detailed explanation:
This creates a configmap named rhds-ca-config-map in the openshift-config namespace and maps the local file rhds_ca.crt to the key name ca.crt inside the configmap. This is important in external identity integration because OpenShift may need to trust a custom certificate authority when communicating with LDAP or another secured external service. By placing the certificate in a configmap, the authentication operator or related cluster configuration can reference it cleanly. The key name matters because many OpenShift resources expect a CA bundle key with a specific filename-like convention. If the file path is wrong, the command fails immediately. If the configmap name or key mapping is wrong, the authentication provider referencing it may not trust the external endpoint.

質問 2：
Configure BackupStorageLocation and VolumeSnapshotLocation
Task Information : Configure OADP/Velero storage locations and confirm they show as Available.
正解：
See the solution below in Explanation:
Explanation:
* Create a secret for cloud credentials (S3-compatible example)
* oc -n openshift-adp create secret generic cloud-credentials \
* --from-file=cloud=/path/to/credentials
* Velero uses this secret to authenticate to object storage.
* Create/Update the DataProtectionApplication (DPA)
* Apply a DPA CR that defines:
* backupLocations (bucket, endpoint URL, region, etc.)
* snapshotLocations (if using snapshots)
* Verify BackupStorageLocation and SnapshotLocation
* velero backup-location get
* velero snapshot-location get
* Status should be Available, meaning storage config is valid.
==========

質問 3：
Kubeconfig Management - Set Credentials in Kubeconfig
正解：
See the solution below in Explanation:
Explanation:
Step 1: Ensure the client certificate and private key files are available.
The lab uses audit.crt and tls.key.
Step 2: Run the command:
oc config set-credentials audit --client-certificate audit.crt --client-key tls.key --embed-certs --kubeconfig audit.config Step 3: Confirm the user entry is written.
The lab output shows:
User "audit" set.
Detailed explanation:
This command creates or updates the audit user entry inside the kubeconfig file audit.config. It points the user to a client certificate and private key, and the --embed-certs option stores certificate material directly inside the kubeconfig rather than only referencing external files. That makes the kubeconfig more portable because it can be moved and used without separately copying the certificate files, provided the embedded content is valid. In certificate-based authentication, the private key proves client possession while the certificate presents the approved identity. If the certificate and key do not match, authentication will fail. This step does not yet define what cluster or namespace the user works against; it only defines the credential identity.

質問 4：
Kubeconfig Management - Approve CSR
正解：
See the solution below in Explanation:
Explanation:
Step 1: Identify the pending certificate signing request.
The lab names it audit-csr.
Step 2: Run the approval command:
oc adm certificate approve audit-csr
Step 3: Confirm approval.
The lab output shows:
certificatesigningrequest.certificates.k8s.io/audit-csr approved
Detailed explanation:
In Kubernetes and OpenShift, a CSR must be approved before the requester can use the signed certificate for authentication. This Task approves the CSR named audit-csr, which is likely associated with the audit user or service account access flow in the lab. Certificate-based authentication is commonly used for kubeconfig access because it enables secure client identity without relying solely on tokens. Until the CSR is approved, the certificate cannot be trusted by the cluster API for authenticated operations. Administrative approval is therefore a gatekeeping step that ensures only intended certificate requests become valid credentials. This Task is part of a broader kubeconfig workflow that continues with setting credentials and defining context.

質問 5：
Resolve group synchronization conflicts (prune stale data)
Task Information : Run group sync with pruning to remove stale OpenShift group memberships that no longer exist in LDAP.
正解：
See the solution below in Explanation:
Explanation:
* Run group sync with prune controls
* oc adm groups sync --sync-config=groupsync.yaml --confirm --prune-whitelist=/tmp/whitelist.txt
* Prune removes stale memberships/groups, but whitelist protects selected groups from pruning.
* Verify group membership reflects LDAP
* oc describe group < groupname >
* Confirms removed users are no longer listed.