RedHat Red Hat Certified Specialist in OpenShift Automation and Integration EX380 Exam Dumps: Updated Questions & Answers (June 2026)

Create namespace and service account

oc new-project ci

oc -n ci create sa ci-bot

The SA will represent automation access.

Grant permissions (example: edit in namespace)

oc -n ci policy add-role-to-user edit system:serviceaccount:ci:ci-bot

Without permissions, token auth succeeds but API actions are denied.

Generate token (TokenRequest)

TOKEN=$(oc -n ci create token ci-bot)

OCP issues a short-lived token by default (good practice).

Create kubeconfig using the token

oc config set-cluster lab --server="$(oc whoami --show-server)" \

--insecure-skip-tls-verify=true --kubeconfig=ci-bot.kubeconfig

oc config set-credentials ci-bot --token="$TOKEN" --kubeconfig=ci-bot.kubeconfig

oc config set-context ci --cluster=lab --user=ci-bot --namespace=ci \

--kubeconfig=ci-bot.kubeconfig

oc config use-context ci --kubeconfig=ci-bot.kubeconfig

This produces a self-contained kubeconfig for CI automation.

Test access

oc --kubeconfig=ci-bot.kubeconfig get pods

==========

Deploy event router resources

Apply a deployment/serviceaccount/rolebinding manifest for eventrouter:

oc apply -f eventrouter.yaml -n openshift-logging

Eventrouter watches event API and writes them to stdout (collected by logging).

Verify eventrouter pod is running

oc -n openshift-logging get pods | grep -i event

Trigger some events

oc -n default run evtest --image=busybox --restart=Never -- sleep 1

oc -n default delete pod evtest

Creation/deletion generates events.

Query logs for events

In the logging UI/backend, search for the namespace/pod name evtest or eventrouter messages.

Explanation: Validates that events are being converted to searchable logs.

Find the alert name and labels

Web console: Observe → Alerts → click the alert to view label set.

Open Alertmanager silences

Observe → Alerting → Alertmanager → Silences → Create silence

Explanation: Silences mute alerts matching label filters.

Create the silence

Add matcher: alertname = < ALERT_NAME >

Duration: 2 hours

Save.

Verify the alert shows as silenced

The alert should indicate it is silenced in the UI.

==========

Install OADP via Web Console

Operators → OperatorHub → search OADP / OpenShift API for Data Protection → Install

Explanation: This operator manages Velero and backup integrations.

Verify the operator CSV is installed

oc get csv -A | grep -i -E "oadp|data protection|velero"

Confirms installation succeeded.

Verify pods in the OADP namespace (commonly openshift-adp)

oc get pods -n openshift-adp

You should see Velero/OADP-related pods in Running state.

==========

Verify logging namespace and resources

oc get ns openshift-logging

oc -n openshift-logging get clusterlogforwarder

ClusterLogForwarder configures pipelines and outputs.

Create/Edit ClusterLogForwarder (example structure)

Define an output (external system) and pipeline selecting application logs.

Apply via YAML:

oc -n openshift-logging apply -f clusterlogforwarder.yaml

Validate collector pods are healthy

oc -n openshift-logging get pods

Forwarding relies on collectors (vector/fluentd depending config).

Generate a test log line

oc -n openshift-logging run logger --image=busybox --restart=Never -- /bin/sh -c 'echo hello-forwarding; sleep 5'

This creates a known message to search in the external endpoint.

Confirm logs arrive at destination

Use your external system’s query/search to confirm hello-forwarding.

==========

Step 1: Identify the pending certificate signing request.

The lab names it audit-csr.

Step 2: Run the approval command:

oc adm certificate approve audit-csr

Step 3: Confirm approval.

The lab output shows:

certificatesigningrequest.certificates.k8s.io/audit-csr approved

Detailed explanation:

In Kubernetes and OpenShift, a CSR must be approved before the requester can use the signed certificate for authentication. This Task approves the CSR named audit-csr, which is likely associated with the audit user or service account access flow in the lab. Certificate-based authentication is commonly used for kubeconfig access because it enables secure client identity without relying solely on tokens. Until the CSR is approved, the certificate cannot be trusted by the cluster API for authenticated operations. Administrative approval is therefore a gatekeeping step that ensures only intended certificate requests become valid credentials. This Task is part of a broader kubeconfig workflow that continues with setting credentials and defining context.

============

Step 1: Ensure the target project exists.

The lab specifies the namespace/project auth-audit.

Step 2: Run the command:

oc create sa audit -n auth-audit

Step 3: Verify creation.

The lab output shows:

serviceaccount/audit created

Detailed explanation:

This creates a service account named audit in the auth-audit namespace. Service accounts provide non-human identities for workloads and automation processes running inside the cluster. They are also commonly used when controlled API access is needed for scripts, jobs, or external kubeconfig generation. Creating a dedicated service account instead of using the default one is good practice because it supports least privilege and clearer access tracking. In exam and administration scenarios, service accounts are often paired with explicit RBAC bindings to grant only the permissions needed for the intended Task SIMULATION . This step lays the identity foundation before assigning a role in the following Task SIMULATION .

============

Start the restore

velero restore create orders-restore --from-backup orders-full

Monitor restore status

velero restore get

velero restore describe orders-restore --details

Validate restored resources

oc -n orders get all

oc -n orders get pvc

Ensure deployments/pods/services and PVCs exist and pods become Running.

==========

Label the chosen worker nodes

oc label node worker-1 workload=payments

oc label node worker-2 workload=payments

Node labels are key/value metadata used by the scheduler.

Add a nodeSelector to the deployment

oc -n payments patch deploy api --type=merge -p '{

"spec":{"template":{"spec":{"nodeSelector":{"workload":"payments"}}}}

}'

Forces pods to schedule only to nodes that match the label.

Verify placement

oc -n payments get pods -o wide

Confirms pods are running on the intended nodes.

==========

Step 1: Make sure Velero is installed and configured in the environment.

The Task SIMULATION assumes an existing backup named backup-app-daily is already present.

Step 2: Run the restore command:

velero restore create --from-backup backup-app-daily

Step 3: Confirm the restore request is submitted.

The lab output shows:

Restore request "backup-app-daily-2024" submitted successfully.

Detailed explanation:

This command instructs Velero to create a restore operation using the existing backup called backup-app-daily. Velero is commonly used to protect Kubernetes and OpenShift resources by backing up object definitions and, when configured, persistent data integrations. The command does not manually recreate resources one by one; instead, it leverages the metadata captured during backup. A successful restore submission means the request has been accepted, not necessarily that every object has already been fully restored. In practical administration, you would often follow this by checking restore status and validating the application namespace, pods, services, routes, and storage bindings. This lab Task SIMULATION focuses specifically on initiating the restore from the named backup source.

============