List clusters:

oc get managedcluster

Label the target cluster(s):

oc label managedcluster cluster-dev environment=dev region=us-east --overwrite

Verify labels:

oc get managedcluster cluster-dev --show-labels

Why this matters:

Labels drive Placement decisions used by policies and applications.

Create PolicySet to group related policies.

Use Governance UI to filter by PolicySet and view compliance per cluster.

Export/report (or capture output via CLI oc get policy -o wide) depending on lab capability.

Grant view role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:view:development user-b

Validate:

oc get clusterrolebinding | grep -i development | grep -i user-b

Why this matters:

Provides read-only access to development ClusterSet resources, improving separation of duties.

Create the object storage secret (you’ll be given endpoint/access keys in an exam):

oc -n open-cluster-management-observability create secret generic thanos-object-storage \

--from-file=thanos.yaml=/path/to/thanos.yaml

Create or edit MultiClusterObservability CR to enable observability (storage class, retention, etc.).

Verify observability pods in the observability namespace and check dashboards/metrics. Why this matters: Monitoring health/performance with ACM observability is a common learning objective in ACM training.

Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).

Bind to placement.

Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.

Create overlay structure:

mkdir -p overlays/production

Confirm:

ls -R overlays

Why this matters:

Kustomize overlays let you maintain base manifests and environment-specific patches (production vs dev, etc.).

Create an empty kustomization file:

touch overlays/production/kustomization.yaml

Validate it exists:

ls -l overlays/production

Why this matters:

kustomization.yaml is the entrypoint file Kustomize uses to build overlays.

On hub, generate join command/token (varies by environment):

clusteradm get token

On managed cluster, run the join/import command.

Validate managed cluster appears and is Ready. Why this matters: CLI-based import is a practical alternative to console import and fits real exam workflows.

Log in to the OpenShift Web Console as a cluster-admin user.

Go to Operators → OperatorHub .

OperatorHub is the catalog of available operators.

In the search box, type: Advanced Cluster Management .

Click Advanced Cluster Management for Kubernetes (Red Hat ACM).

Click Install .

In the install wizard:

Update channel : choose the recommended/stable channel for your lab.

Installation mode : typically “All namespaces on the cluster” (default).

Installed Namespace : select or create open-cluster-management .

Click Install and wait for the operator to show Succeeded in:

Operators → Installed Operators .

Why these steps matter:

Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Identify the managed cluster:

oc get managedcluster

If required in your environment, remove dependent placements/policies/apps targeting it (exam often expects you to check “why deletion stuck”).

Delete managed cluster:

oc delete managedcluster cluster-dev

Watch finalizers and cleanup:

oc get managedcluster cluster-dev -o yaml | grep finalizers -n

Why this matters:

Proper lifecycle operations (import/manage/detach) is core EX432/EX480 scope.

Write a Policy → ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).

Bind to placement.

Verify on a managed cluster:

oc get configmap -n < ns >

oc describe configmap -n < ns > < name >

Create the ManagedClusterSet:

oc create managedclusterset development

Confirm it exists:

oc get managedclusterset

oc describe managedclusterset development

Why these steps matter:

ClusterSets are an ACM grouping primitive used for RBAC scoping , governance targeting, and multi-cluster app placement.