RedHat EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Exam Practice Test

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).

Click Import cluster .

Provide a name (the UI may request details like distribution/credentials depending on flow).

The wizard will provide a command to run on the managed cluster you want to import.

Copy that import command.

Log into the managed cluster (spoke) using oc and run the copied command.

Back on the hub, wait until the cluster status becomes Ready / Managed .

Why these steps matter:

Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Create overlays/production/kustomization.yaml referencing base resources.

Build overlay:

kustomize build overlays/production | oc apply -f -

(If kustomize isn’t present, use oc kustomize if available.)

Verify resources created and placed only on production clusters via placement rules.

Create a Channel (Git) and Subscription referencing it (example pattern).

In exams, you’re usually given a repo URL and target namespace.

Ensure there is a placement rule/placement selecting clusters.

Apply manifests:

oc apply -f channel.yaml

oc apply -f subscription.yaml

Verify resources:

oc get channels.apps.open-cluster-management.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc get application.app.k8s.io -A

Why this matters:

Multi-cluster application lifecycle is part of ACM operations, and EX480 explicitly covers managing multi-cluster environments with ACM.

Open the ACM console on the hub.

Navigate to Governance → Policies .

Click Create policy .

Set Name : policy-etcd.

Choose the policy template/type ETCD Encryption .

Set Remediation action to enforce .

inform = report only

enforce = attempt to automatically remediate to desired state

Select clusters/ClusterSets to apply (depends on the wizard).

Click Submit .

Verify compliance once applied:

In console, check policy status: Compliant/NonCompliant

Or via CLI:

oc get policy -A

oc describe policy policy-etcd -n < policy-namespace >

Why this matters:

Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.

Grant the ClusterSet role (admin on production).

Log in as user-a and attempt:

list clusters in production vs development

create policies in a namespace bound to production

Confirm authorization errors when accessing development resources.

(ClusterSet RBAC is explicitly part of cluster set management and access scope.)

Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.

Create Placement in that namespace selecting the desired clusters.

Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.

Ensure namespace has the correct ManagedClusterSetBinding.

Create placement in that namespace; only clusters visible via bound ClusterSet can be selected.

Verify placementdecision includes only clusters from that set.

This ties together ClusterSets (grouping) and Placement (selection).

Apply the subscription/application manifest:

oc apply -f application-subscription.yaml

Confirm resources were created:

oc get applications.app.k8s.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc describe application.app.k8s.io my-app -n < namespace >

Watch placement/propagation (varies by model used in the lab):

oc get placement -A

oc get placementrule -A

Why this matters:

ACM “application” deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Check cluster conditions:

oc describe managedcluster cluster-dev

Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you’re looking for ACM/klusterlet agents).

On hub, check managedclusteraddons and addon health:

oc get managedclusteraddon -n cluster-dev

oc describe managedclusteraddon -n cluster-dev < addon-name >

Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).

Ensure ACM hub components are installed and healthy.

In ACM console, open Search and query for:

a namespace name

a specific deployment

Validate results show cluster origin and resource details.

Why this matters:

Search is a core ACM operational workflow for multi-cluster visibility.