Pass the RedHat Red Hat OpenShift EX432 Questions and answers with ExamsMirror

Open the ACM console on the hub.

Navigate to Governance → Policies .

Click Create policy .

Set Name : policy-etcd.

Choose the policy template/type ETCD Encryption .

Set Remediation action to enforce .

inform = report only

enforce = attempt to automatically remediate to desired state

Select clusters/ClusterSets to apply (depends on the wizard).

Click Submit .

Verify compliance once applied:

In console, check policy status: Compliant/NonCompliant

Or via CLI:

oc get policy -A

oc describe policy policy-etcd -n < policy-namespace >

Why this matters:

Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.

On hub, generate join command/token (varies by environment):

clusteradm get token

On managed cluster, run the join/import command.

Validate managed cluster appears and is Ready. Why this matters: CLI-based import is a practical alternative to console import and fits real exam workflows.

Create PolicySet to group related policies.

Use Governance UI to filter by PolicySet and view compliance per cluster.

Export/report (or capture output via CLI oc get policy -o wide) depending on lab capability.

In ACM console: Governance → Create policy → ETCD Encryption template and set to enforce .

Target clusters via Placement.

Confirm policy status: Compliant / NonCompliant per cluster.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Log in to the OpenShift Web Console as a cluster-admin user.

Go to Operators → OperatorHub .

OperatorHub is the catalog of available operators.

In the search box, type: Advanced Cluster Management .

Click Advanced Cluster Management for Kubernetes (Red Hat ACM).

Click Install .

In the install wizard:

Update channel : choose the recommended/stable channel for your lab.

Installation mode : typically “All namespaces on the cluster” (default).

Installed Namespace : select or create open-cluster-management .

Click Install and wait for the operator to show Succeeded in:

Operators → Installed Operators .

Why these steps matter:

Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

Create a Channel (Git) and Subscription referencing it (example pattern).

In exams, you’re usually given a repo URL and target namespace.

Ensure there is a placement rule/placement selecting clusters.

Apply manifests:

oc apply -f channel.yaml

oc apply -f subscription.yaml

Verify resources:

oc get channels.apps.open-cluster-management.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc get application.app.k8s.io -A

Why this matters:

Multi-cluster application lifecycle is part of ACM operations, and EX480 explicitly covers managing multi-cluster environments with ACM.

Web Console → Operators → OperatorHub

Search for multicluster engine (or Multicluster Engine Operator ).

Install the operator into its recommended namespace (commonly multicluster-engine).

Create the MultiClusterEngine custom resource (CLI method shown below):

cat < < 'EOF' | oc apply -f -

apiVersion: multicluster.openshift.io/v1

kind: MultiClusterEngine

metadata:

name: multiclusterengine

spec: {}

EOF

Verify the engine reconciles:

oc get multiclusterengine

oc get pods -n multicluster-engine

Why this matters:

ACM can use the multicluster engine operator for cluster lifecycle functions; Red Hat documents cluster lifecycle with multicluster engine as a core capability.

Edit the subscription/app definition to include a time window (active or blocked window).

Attempt a change outside the window and observe behavior (no rollout until window).

Confirm rollout during window.

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.