Solution:

Switch to the target project:

oc project darpa

Create a YAML file, for example limitrange.yaml:

apiVersion: v1

kind: LimitRange

metadata:

name: darpa-limits

namespace: darpa

spec:

limits:

- type: Pod

max:

cpu: 300m

memory: 300Mi

min:

cpu: 5m

memory: 5Mi

- type: Container

max:

cpu: 300m

memory: 300Mi

min:

cpu: 5m

memory: 5Mi

default:

cpu: 100m

memory: 100Mi

Apply it:

oc apply -f limitrange.yaml

Verify:

oc get limitrange -n darpa

oc describe limitrange darpa-limits -n darpa

This task validates namespace-level defaulting and constraint policies for pod scheduling and resource consumption.

Solution:

Open the Web Console.

Switch to project start .

Navigate to: Workloads → Deployments

Select the target deployment.

Click the action menu and choose: Add Health Checks

Select Liveness Probe .

Configure the appropriate probe type:

HTTP

TCP

or Command

Enter the required endpoint or command based on the application.

Save the configuration.

Verify the deployment updates successfully and the pod status remains healthy.

CLI alternative if needed:

oc set probe deployment/ < deployment-name > --liveness --get-url=http://:8080/ --initial-delay-seconds=10

This task measures health-check configuration for workload self-recovery.

Solution:

$ oc project gru

$ oc get pods

$ oc get all | grep deployment

$ oc scale --replicas=5 deployment.apps/minion

$ oc get pods

Solution:

$ vim limit.yaml

# Edit the yaml file like below mentioned

apiVersion: "v1" kind: "LimitRange" metadata:

name: "resource-limits" spec:

limits:

- type: "Pod"

max:

cpu: "500m" memory: "300Mi"

min:

cpu: "10m" memory: "5Mi"

- type: "Container" max:

cpu: "500m" memory: "300Mi"

min:

cpu: "10m" memory: "5Mi"

defaultRequest: cpu: "100m" memory: "100Mi"

$ oc create -f limit.yaml --save-config -n bluebook

$ oc describe limitranges -n bluebook

Solution:

Create the initial HTPasswd file with the first user:

htpasswd -c -B -b /tmp/htpass.txt bob indionce

Add the remaining users:

htpasswd -b /tmp/htpass.txt qwerty catalog

htpasswd -b /tmp/htpass.txt john john123

htpasswd -b /tmp/htpass.txt armstrong natasha123

htpasswd -b /tmp/htpass.txt natasha arthstrong

htpasswd -b /tmp/htpass.txt harry harry123

htpasswd -b /tmp/htpass.txt susan susuan123

Create the secret in openshift-config :

oc create secret generic ex280-secure --from-file=htpasswd=/tmp/htpass.txt -n openshift-config

Edit OAuth and add the HTPasswd identity provider:

oc edit oauth cluster

Use a valid structure like this:

spec:

identityProviders:

- name: ex280-idp-secure

mappingMethod: claim

type: HTPasswd

htpasswd:

fileData:

name: ex280-secure

Save and exit.

Restart OAuth pods:

oc delete pod -n openshift-authentication -l app=oauth-openshift

Verify:

oc get pods -n openshift-authentication

oc get oauth cluster -o yaml

This task validates OpenShift local authentication configuration through HTPasswd and cluster OAuth integration.

Solution:

Switch to the correct project if needed:

oc project monday

Inject environment variables from the secret:

oc set env deployment/monday --from=secret/magic

Verify:

oc set env deployment/monday --list

oc describe deployment monday

Notes:

The uploaded lab references secret/file-secret, but Task 8 clearly intends the secret to be named magic .

In a real exam, match the actual secret name present in the cluster.

This task tests secret consumption by workloads through environment variable injection.

Solution:

Switch to the project:

oc project qed

Create the service account:

oc create serviceaccount project1-sa -n qed

Grant the SCC:

oc adm policy add-scc-to-user anyuid -z project1-sa -n qed

Verify:

oc get sa project1-sa -n qed

oc adm policy who-can use scc anyuid

Why this matters:

anyuid allows containers to run with arbitrary user IDs when an application requires it.

This is a common administrative task in OpenShift for third-party container images.

This task validates service account creation and SCC assignment.

Solution:

Create the groups:

oc adm groups new site-users

oc adm groups new guest-users

Add users to groups:

oc adm groups add-users guest-users qwerty

oc adm groups add-users site-users harry susan

Grant edit role on test to site-users:

oc policy add-role-to-group edit site-users -n test

Grant view role on demo to guest-users:

oc policy add-role-to-group view guest-users -n demo

Verify:

oc get groups

oc describe group site-users

oc describe group guest-users

oc get rolebinding -n test

oc get rolebinding -n demo

This task measures practical administration of OpenShift groups and project-scoped RBAC assignments.

Solution:

Create a file named mysql-db-conn.yaml:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: mysql-db-conn

spec:

podSelector:

matchLabels:

networking.k8s.io/v1/network: database

policyTypes:

- Ingress

ingress:

- from:

- namespaceSelector:

matchLabels:

team: devsecops

podSelector:

matchLabels:

deployment: my-web-mysql

ports:

- protocol: TCP

port: 3306

Apply it:

oc apply -f mysql-db-conn.yaml

Verify:

oc get networkpolicy

oc describe networkpolicy mysql-db-conn

This task tests namespace/pod label selection and application isolation using OpenShift networking policy controls.