RedHat EX432 - Red Hat Certified Specialist in OpenShift Advanced Cluster Management

Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.

Bind it to a Placement targeting dev clusters.

Verify operator subscription exists on managed clusters and CSV reaches Succeeded.

Why this matters:

Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

Policies in ACM require:

a Policy resource

a Placement (which clusters to target)

a PlacementBinding (bind policy ↔ placement)

Create the Policy (in team-dev) enforcing a namespace audit-logs:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: Policy

metadata:

name: policy-ensure-audit-namespace

namespace: team-dev

spec:

remediationAction: enforce

disabled: false

policy-templates:

- objectDefinition:

apiVersion: policy.open-cluster-management.io/v1

kind: ConfigurationPolicy

metadata:

name: ensure-audit-namespace

spec:

remediationAction: enforce

severity: low

object-templates:

- complianceType: musthave

objectDefinition:

apiVersion: v1

kind: Namespace

metadata:

name: audit-logs

EOF

Create PlacementBinding to bind it to dev-clusters placement:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: PlacementBinding

metadata:

name: bind-policy-ensure-audit-namespace

namespace: team-dev

placementRef:

apiGroup: cluster.open-cluster-management.io

kind: Placement

name: dev-clusters

subjects:

- apiGroup: policy.open-cluster-management.io

kind: Policy

name: policy-ensure-audit-namespace

EOF

Verify compliance:

oc get policy -n team-dev

oc describe policy policy-ensure-audit-namespace -n team-dev

Why this matters:

This is the core “ACM governance” exam pattern: define desired state and enforce across clusters.

Put the NetworkPolicy manifest under object-templates in a ConfigurationPolicy.

Bind to a Placement for dev clusters.

Verify NetworkPolicy exists on all targeted clusters.

Create the ManagedClusterSet:

oc create managedclusterset production

Validate:

oc get managedclusterset

oc describe managedclusterset production

Why this matters:

Separating development and production clusters is common for governance/RBAC isolation.

In OpenShift Web Console, go to Operators → OperatorHub .

Search for Advanced Cluster Security .

Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .

Click Install and follow the wizard (namespace/channel per lab).

After operator installation, create RHACS components (as the hint indicates):

Install/Deploy Central (the management plane)

Install/Deploy SecuredCluster (sensor/collector on clusters)

Confirm operator and pods are running:

Operators → Installed Operators

oc get pods -n < rhacs-namespace >

Why this matters:

RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

Create a group (example) and add users:

oc adm groups new dev-team

oc adm groups add-users dev-team user1 user2

Grant namespace access:

oc adm policy add-role-to-group edit dev-team -n team-dev

Validate with a user token/login (or check rolebindings):

oc get rolebinding -n team-dev | grep dev-team

Why this matters:

ACM access patterns commonly combine namespace RBAC + ClusterSetBinding to scope what teams can manage.

Apply the subscription/application manifest:

oc apply -f application-subscription.yaml

Confirm resources were created:

oc get applications.app.k8s.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc describe application.app.k8s.io my-app -n < namespace >

Watch placement/propagation (varies by model used in the lab):

oc get placement -A

oc get placementrule -A

Why this matters:

ACM “application” deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod