Step 1: Ensure the target project exists.

The lab specifies the namespace/project auth-audit.

Step 2: Run the command:

oc create sa audit -n auth-audit

Step 3: Verify creation.

The lab output shows:

serviceaccount/audit created

Detailed explanation:

This creates a service account named audit in the auth-audit namespace. Service accounts provide non-human identities for workloads and automation processes running inside the cluster. They are also commonly used when controlled API access is needed for scripts, jobs, or external kubeconfig generation. Creating a dedicated service account instead of using the default one is good practice because it supports least privilege and clearer access tracking. In exam and administration scenarios, service accounts are often paired with explicit RBAC bindings to grant only the permissions needed for the intended Task SIMULATION . This step lays the identity foundation before assigning a role in the following Task SIMULATION .

============

Create target namespace

oc new-project gitops-demo

Destination must exist (unless Argo is configured to auto-create).

Create Application manifest

apiVersion: argoproj.io/v1alpha1

kind: Application

metadata:

name: demo-app

namespace: openshift-gitops

spec:

project: default

source:

repoURL: https://git.example.com/org/repo.git

targetRevision: main

path: manifests/demo

destination:

server: https://kubernetes.default.svc

namespace: gitops-demo

syncPolicy:

automated:

prune: true

selfHeal: true

automated: enables auto sync.

prune: removes deleted objects from Git.

selfHeal: corrects drift.

Apply Application

oc apply -f demo-app.yaml

Verify sync health

oc -n openshift-gitops get application demo-app -o yaml | grep -i -E "sync|health" -n

oc -n gitops-demo get all

==========

Identify failing node and status

oc get nodes

Confirms which node is NotReady.

Inspect node conditions and events

oc describe node < worker >

Shows kubelet condition issues (network, disk pressure, runtime, etc.).

Check MachineConfigPool state

oc get mcp

oc describe mcp worker

If MCP is degraded, node may be stuck applying a config.

Check node logs (kubelet)

oc adm node-logs < worker > --path=kubelet.log

Often reveals why node isn’t reporting Ready.

Remediate based on symptom

Examples:

If out of disk: free space, then verify kubelet recovers.

If stuck MCO: investigate current/desired config and fix broken MachineConfig.

If node cordoned/drained incorrectly: uncordon after remediation.

oc adm uncordon < worker >

Confirm node returns Ready

oc get node < worker >

==========

Step 1: Log in to the OpenShift web console.

This Task is explicitly defined as a GUI workflow.

Step 2: Navigate to Operators .

Installed logging components are managed through the operator framework.

Step 3: Open Installed Operators .

This lists operators already deployed in the cluster.

Step 4: Select Red Hat OpenShift Logging .

This operator manages the cluster logging stack and its custom resources.

Step 5: Open the ClusterLogging instance.

The Task SIMULATION refers to editing the existing ClusterLogging custom resource.

Step 6: Switch to YAML View .

This allows direct editing of the logging custom resource specification.

Step 7: Edit the collection type and set it to vector.

This changes the log collector implementation.

Step 8: Click Save .

The operator will reconcile the resource and apply the updated collector configuration.

Detailed explanation:

The ClusterLogging custom resource controls the logging stack behavior in OpenShift. Changing the collection type to vector updates which collector technology is used for gathering node and container logs. In operator-managed platforms, direct YAML edits to the custom resource are the preferred method for changing managed behavior because the operator then applies and maintains the desired state. This Task tests both navigation skills in the web console and knowledge of where logging behavior is configured. Saving the resource triggers reconciliation, which is a core OpenShift operator pattern: the declared configuration is read and enforced by the operator rather than by manual per-pod changes.

============

Find the alert name and labels

Web console: Observe → Alerts → click the alert to view label set.

Open Alertmanager silences

Observe → Alerting → Alertmanager → Silences → Create silence

Explanation: Silences mute alerts matching label filters.

Create the silence

Add matcher: alertname = < ALERT_NAME >

Duration: 2 hours

Save.

Verify the alert shows as silenced

The alert should indicate it is silenced in the UI.

==========

Start the restore

velero restore create orders-restore --from-backup orders-full

Monitor restore status

velero restore get

velero restore describe orders-restore --details

Validate restored resources

oc -n orders get all

oc -n orders get pvc

Ensure deployments/pods/services and PVCs exist and pods become Running.

==========

Verify prerequisites exist (Secret + ConfigMap)

oc -n openshift-config get secret rhds-ldap-secret

oc -n openshift-config get configmap rhds-ca-config-map

OAuth LDAP configuration references these objects. If they don’t exist, OAuth won’t be able to bind to LDAP securely.

Edit the cluster OAuth resource

oc edit oauth cluster

The oauth/cluster resource is where identity providers are defined.

Add an LDAP identity provider entry (example structure) Add under spec.identityProviders:

- name: corp-ldap

mappingMethod: claim

type: LDAP

ldap:

url: "ldaps://ldap.example.com:636/ou=People,dc=example,dc=com?uid"

bindDN: "uid=openshift,ou=svc,dc=example,dc=com"

bindPassword:

name: rhds-ldap-secret

ca:

name: rhds-ca-config-map

insecure: false

attributes:

id: ["dn"]

name: ["cn"]

preferredUsername: ["uid"]

email: ["mail"]

url: where to search for users and which attribute is used for login (here uid).

bindDN + bindPassword: service account used for LDAP queries.

ca: trusts the LDAP server CA for TLS.

attributes: maps LDAP data into OpenShift user identity fields.

Restart OAuth pods to load changes quickly

oc -n openshift-authentication delete pod -l app=oauth-openshift

This forces pods to restart and re-read the updated configuration.

Verify the identity provider appears and users can log in

In the web console login page, you should see the new provider (name may show as corp-ldap).

After a successful login, confirm user objects appear:

oc get users

oc get identities

OpenShift creates User and Identity objects upon first successful authentication.

==========

Create the schedule

velero schedule create orders-daily \

--schedule "0 1 * * *" \

--include-namespaces orders \

--snapshot-volumes

Cron format: minute hour day month weekday.

Verify schedule exists

velero schedule get

Confirm backups are created by the schedule

velero backup get | grep orders-daily

Scheduled backups usually have names derived from the schedule.

==========

Step 1: Log in to the OpenShift web console with an account that has sufficient cluster administrative privileges.

This Task is performed from the GUI, not the CLI. The lab hint explicitly places this under the worker node details page in the console.

Step 2: Navigate to Compute .

This area contains node-level resources, including control plane and worker nodes.

Step 3: Open Nodes .

Here you can view all nodes currently registered in the cluster.

Step 4: Select the required worker node .

Choose the exact worker node referenced by the lab Task SIMULATION .

Step 5: Open the Details tab.

The taint configuration is managed from the selected node’s details view.

Step 6: Locate the Taints section and click Edit .

A taint is used to control pod scheduling. If a worker has a taint, pods without matching tolerations may not schedule there.

Step 7: Remove the unwanted taint entry.

Removing the taint makes the worker eligible again for normal scheduling behavior, depending on the rest of the cluster policy.

Step 8: Click Save .

This commits the change so the node is updated and the scheduler can evaluate it without that taint.

============

Step 1: Identify the pending certificate signing request.

The lab names it audit-csr.

Step 2: Run the approval command:

oc adm certificate approve audit-csr

Step 3: Confirm approval.

The lab output shows:

certificatesigningrequest.certificates.k8s.io/audit-csr approved

Detailed explanation:

In Kubernetes and OpenShift, a CSR must be approved before the requester can use the signed certificate for authentication. This Task approves the CSR named audit-csr, which is likely associated with the audit user or service account access flow in the lab. Certificate-based authentication is commonly used for kubeconfig access because it enables secure client identity without relying solely on tokens. Until the CSR is approved, the certificate cannot be trusted by the cluster API for authenticated operations. Administrative approval is therefore a gatekeeping step that ensures only intended certificate requests become valid credentials. This Task is part of a broader kubeconfig workflow that continues with setting credentials and defining context.

============

Taint nodes

oc adm taint nodes worker-1 dedicated=payments:NoSchedule

oc adm taint nodes worker-2 dedicated=payments:NoSchedule

NoSchedule blocks new pods that do not tolerate the taint.

Confirm taints

oc describe node worker-1 | grep -i taints -A2

Ensures taints are present.

Validate effect

A normal deployment without tolerations will remain Pending if it can only land on those tainted nodes.

==========

Step 1: Ensure the certificate file rhds_ca.crt is available in your current working directory or use the correct path.

The Task requires creating a configmap from this CA certificate file.

Step 2: Run the command:

oc create configmap rhds-ca-config-map --from-file ca.crt=rhds_ca.crt -n openshift-config

Step 3: Confirm the configmap is created.

The lab output shows:

configmap/rhds-ca-config-map created

Detailed explanation:

This creates a configmap named rhds-ca-config-map in the openshift-config namespace and maps the local file rhds_ca.crt to the key name ca.crt inside the configmap. This is important in external identity integration because OpenShift may need to trust a custom certificate authority when communicating with LDAP or another secured external service. By placing the certificate in a configmap, the authentication operator or related cluster configuration can reference it cleanly. The key name matters because many OpenShift resources expect a CA bundle key with a specific filename-like convention. If the file path is wrong, the command fails immediately. If the configmap name or key mapping is wrong, the authentication provider referencing it may not trust the external endpoint.

============