EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Questions and Answers

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.

Create Placement in that namespace selecting the desired clusters.

Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.

Apply the subscription/application manifest:

oc apply -f application-subscription.yaml

Confirm resources were created:

oc get applications.app.k8s.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc describe application.app.k8s.io my-app -n < namespace >

Watch placement/propagation (varies by model used in the lab):

oc get placement -A

oc get placementrule -A

Why this matters:

ACM “application” deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Create an empty kustomization file:

touch overlays/production/kustomization.yaml

Validate it exists:

ls -l overlays/production

Why this matters:

kustomization.yaml is the entrypoint file Kustomize uses to build overlays.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Confirm the policy exists in the namespace:

oc get policy -n team-dev

Confirm Placement exists and selects clusters:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Confirm PlacementBinding points to correct placement + policy:

oc get placementbinding -n team-dev -o yaml

Fix common mistakes:

wrong namespace

placement name mismatch

missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.

Create the ManagedClusterSet:

oc create managedclusterset production

Validate:

oc get managedclusterset

oc describe managedclusterset production

Why this matters:

Separating development and production clusters is common for governance/RBAC isolation.

Create the object storage secret (you’ll be given endpoint/access keys in an exam):

oc -n open-cluster-management-observability create secret generic thanos-object-storage \

--from-file=thanos.yaml=/path/to/thanos.yaml

Create or edit MultiClusterObservability CR to enable observability (storage class, retention, etc.).

Verify observability pods in the observability namespace and check dashboards/metrics. Why this matters: Monitoring health/performance with ACM observability is a common learning objective in ACM training.

Web Console → Operators → OperatorHub

Search for multicluster engine (or Multicluster Engine Operator ).

Install the operator into its recommended namespace (commonly multicluster-engine).

Create the MultiClusterEngine custom resource (CLI method shown below):

cat < < 'EOF' | oc apply -f -

apiVersion: multicluster.openshift.io/v1

kind: MultiClusterEngine

metadata:

name: multiclusterengine

spec: {}

EOF

Verify the engine reconciles:

oc get multiclusterengine

oc get pods -n multicluster-engine

Why this matters:

ACM can use the multicluster engine operator for cluster lifecycle functions; Red Hat documents cluster lifecycle with multicluster engine as a core capability.