RedHat Red Hat Certified Specialist in OpenShift Automation and Integration - EX380무료 덤프문제 풀어보기
Backup and Restore - Fix SCC for Restored Application
정답:
See the solution below in Explanation:
Explanation:
Step 1: Identify the application namespace after restore.
The lab shows the namespace as my-app-namespace.
Step 2: Run the SCC assignment command:
oc adm policy add-scc-to-user anyuid -z default -n my-app-namespace
Step 3: Confirm the role binding is applied.
The lab output shows:
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:anyuid added: "default" Detailed explanation:
After a restore, the application may fail if its pods require a security context not permitted by the default SCC allocation. This command grants the anyuid SCC to the default service account in the my-app-namespace project. The -z default syntax targets the default service account, which many restored workloads use if no custom service account is defined. The anyuid SCC allows containers to run with arbitrary user IDs, which some legacy or prebuilt images require. In OpenShift, SCC mismatches commonly cause pods to remain in pending or crash-related states. Assigning the proper SCC resolves those admission issues so workloads can start successfully. This step is therefore a post-restore operational fix to align security policy with application requirements.
Explanation:
Step 1: Identify the application namespace after restore.
The lab shows the namespace as my-app-namespace.
Step 2: Run the SCC assignment command:
oc adm policy add-scc-to-user anyuid -z default -n my-app-namespace
Step 3: Confirm the role binding is applied.
The lab output shows:
clusterrole.rbac.authorization.k8s.io/system:openshift:scc:anyuid added: "default" Detailed explanation:
After a restore, the application may fail if its pods require a security context not permitted by the default SCC allocation. This command grants the anyuid SCC to the default service account in the my-app-namespace project. The -z default syntax targets the default service account, which many restored workloads use if no custom service account is defined. The anyuid SCC allows containers to run with arbitrary user IDs, which some legacy or prebuilt images require. In OpenShift, SCC mismatches commonly cause pods to remain in pending or crash-related states. Assigning the proper SCC resolves those admission issues so workloads can start successfully. This step is therefore a post-restore operational fix to align security policy with application requirements.
Restore application into same namespace
Task Information : Restore from backup orders-full and validate the app resources return.
Task Information : Restore from backup orders-full and validate the app resources return.
정답:
See the solution below in Explanation:
Explanation:
* Start the restore
* velero restore create orders-restore --from-backup orders-full
* Monitor restore status
* velero restore get
* velero restore describe orders-restore --details
* Validate restored resources
* oc -n orders get all
* oc -n orders get pvc
* Ensure deployments/pods/services and PVCs exist and pods become Running.
Explanation:
* Start the restore
* velero restore create orders-restore --from-backup orders-full
* Monitor restore status
* velero restore get
* velero restore describe orders-restore --details
* Validate restored resources
* oc -n orders get all
* oc -n orders get pvc
* Ensure deployments/pods/services and PVCs exist and pods become Running.
Install OADP Operator and verify Velero components
Task Information : Install the OADP operator and confirm Velero pods/components are running.
Task Information : Install the OADP operator and confirm Velero pods/components are running.
정답:
See the solution below in Explanation:
Explanation:
* Install OADP via Web Console
* Operators # OperatorHub # search OADP / OpenShift API for Data Protection # Install
* Explanation: This operator manages Velero and backup integrations.
* Verify the operator CSV is installed
* oc get csv -A | grep -i -E "oadp|data protection|velero"
* Confirms installation succeeded.
* Verify pods in the OADP namespace (commonly openshift-adp)
* oc get pods -n openshift-adp
* You should see Velero/OADP-related pods in Running state.
Explanation:
* Install OADP via Web Console
* Operators # OperatorHub # search OADP / OpenShift API for Data Protection # Install
* Explanation: This operator manages Velero and backup integrations.
* Verify the operator CSV is installed
* oc get csv -A | grep -i -E "oadp|data protection|velero"
* Confirms installation succeeded.
* Verify pods in the OADP namespace (commonly openshift-adp)
* oc get pods -n openshift-adp
* You should see Velero/OADP-related pods in Running state.
Silence an alert in Alertmanager
Task Information : Create an Alertmanager silence for a noisy alert for 2 hours, then confirm it's silenced.
Task Information : Create an Alertmanager silence for a noisy alert for 2 hours, then confirm it's silenced.
정답:
See the solution below in Explanation:
Explanation:
* Find the alert name and labels
* Web console: Observe # Alerts # click the alert to view label set.
* Open Alertmanager silences
* Observe # Alerting # Alertmanager # Silences # Create silence
* Explanation: Silences mute alerts matching label filters.
* Create the silence
* Add matcher: alertname = < ALERT_NAME >
* Duration: 2 hours
* Save.
* Verify the alert shows as silenced
* The alert should indicate it is silenced in the UI.
Explanation:
* Find the alert name and labels
* Web console: Observe # Alerts # click the alert to view label set.
* Open Alertmanager silences
* Observe # Alerting # Alertmanager # Silences # Create silence
* Explanation: Silences mute alerts matching label filters.
* Create the silence
* Add matcher: alertname = < ALERT_NAME >
* Duration: 2 hours
* Save.
* Verify the alert shows as silenced
* The alert should indicate it is silenced in the UI.
Dedicate nodes to a workload using labels and nodeSelector
Task Information : Label two nodes with workload=payments and schedule a deployment only onto those nodes.
Task Information : Label two nodes with workload=payments and schedule a deployment only onto those nodes.
정답:
See the solution below in Explanation:
Explanation:
* Label the chosen worker nodes
* oc label node worker-1 workload=payments
* oc label node worker-2 workload=payments
* Node labels are key/value metadata used by the scheduler.
* Add a nodeSelector to the deployment
* oc -n payments patch deploy api --type=merge -p '{
* "spec":{"template":{"spec":{"nodeSelector":{"workload":"payments"}}}}
* }'
* Forces pods to schedule only to nodes that match the label.
* Verify placement
* oc -n payments get pods -o wide
* Confirms pods are running on the intended nodes.
Explanation:
* Label the chosen worker nodes
* oc label node worker-1 workload=payments
* oc label node worker-2 workload=payments
* Node labels are key/value metadata used by the scheduler.
* Add a nodeSelector to the deployment
* oc -n payments patch deploy api --type=merge -p '{
* "spec":{"template":{"spec":{"nodeSelector":{"workload":"payments"}}}}
* }'
* Forces pods to schedule only to nodes that match the label.
* Verify placement
* oc -n payments get pods -o wide
* Confirms pods are running on the intended nodes.