EX432 Questions and Answers

Create a Channel (Git) and Subscription referencing it (example pattern).

In exams, you’re usually given a repo URL and target namespace.

Ensure there is a placement rule/placement selecting clusters.

Apply manifests:

oc apply -f channel.yaml

oc apply -f subscription.yaml

Verify resources:

oc get channels.apps.open-cluster-management.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc get application.app.k8s.io -A

Why this matters:

Multi-cluster application lifecycle is part of ACM operations, and EX480 explicitly covers managing multi-cluster environments with ACM.

Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.

Create placement with matchExpressions (include one label, exclude another):

matchExpressions:

- key: openshiftVersion

operator: In

values: ["4.18"]

- key: region

operator: NotIn

values: ["us-west"]

Validate PlacementDecision.

Apply the subscription/application manifest:

oc apply -f application-subscription.yaml

Confirm resources were created:

oc get applications.app.k8s.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc describe application.app.k8s.io my-app -n < namespace >

Watch placement/propagation (varies by model used in the lab):

oc get placement -A

oc get placementrule -A

Why this matters:

ACM “application” deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.

Check cluster conditions:

oc describe managedcluster cluster-dev

Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you’re looking for ACM/klusterlet agents).

On hub, check managedclusteraddons and addon health:

oc get managedclusteraddon -n cluster-dev

oc describe managedclusteraddon -n cluster-dev < addon-name >

Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).

Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.

Bind it to a Placement targeting dev clusters.

Verify operator subscription exists on managed clusters and CSV reaches Succeeded.

Why this matters:

Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Policies in ACM require:

a Policy resource

a Placement (which clusters to target)

a PlacementBinding (bind policy ↔ placement)

Create the Policy (in team-dev) enforcing a namespace audit-logs:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: Policy

metadata:

name: policy-ensure-audit-namespace

namespace: team-dev

spec:

remediationAction: enforce

disabled: false

policy-templates:

- objectDefinition:

apiVersion: policy.open-cluster-management.io/v1

kind: ConfigurationPolicy

metadata:

name: ensure-audit-namespace

spec:

remediationAction: enforce

severity: low

object-templates:

- complianceType: musthave

objectDefinition:

apiVersion: v1

kind: Namespace

metadata:

name: audit-logs

EOF

Create PlacementBinding to bind it to dev-clusters placement:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: PlacementBinding

metadata:

name: bind-policy-ensure-audit-namespace

namespace: team-dev

placementRef:

apiGroup: cluster.open-cluster-management.io

kind: Placement

name: dev-clusters

subjects:

- apiGroup: policy.open-cluster-management.io

kind: Policy

name: policy-ensure-audit-namespace

EOF

Verify compliance:

oc get policy -n team-dev

oc describe policy policy-ensure-audit-namespace -n team-dev

Why this matters:

This is the core “ACM governance” exam pattern: define desired state and enforce across clusters.

Grant the ClusterSet role (admin on production).

Log in as user-a and attempt:

list clusters in production vs development

create policies in a namespace bound to production

Confirm authorization errors when accessing development resources.

(ClusterSet RBAC is explicitly part of cluster set management and access scope.)