Red Hat Certified Specialist in OpenShift Automation and Integration EX380 Exam Questions with Experts Answers Updated Recently

Start the restore

velero restore create orders-restore --from-backup orders-full

Monitor restore status

velero restore get

velero restore describe orders-restore --details

Validate restored resources

oc -n orders get all

oc -n orders get pvc

Ensure deployments/pods/services and PVCs exist and pods become Running.

==========

Step 1: Log in to the OpenShift web console with an account that has sufficient cluster administrative privileges.

This Task is performed from the GUI, not the CLI. The lab hint explicitly places this under the worker node details page in the console.

Step 2: Navigate to Compute .

This area contains node-level resources, including control plane and worker nodes.

Step 3: Open Nodes .

Here you can view all nodes currently registered in the cluster.

Step 4: Select the required worker node .

Choose the exact worker node referenced by the lab Task SIMULATION .

Step 5: Open the Details tab.

The taint configuration is managed from the selected node’s details view.

Step 6: Locate the Taints section and click Edit .

A taint is used to control pod scheduling. If a worker has a taint, pods without matching tolerations may not schedule there.

Step 7: Remove the unwanted taint entry.

Removing the taint makes the worker eligible again for normal scheduling behavior, depending on the rest of the cluster policy.

Step 8: Click Save .

This commits the change so the node is updated and the scheduler can evaluate it without that taint.

============

Collect Keycloak details

Issuer URL (realm), client ID, and client secret.

Confirm Keycloak client has correct redirect URI for OpenShift OAuth callback.

Create a secret with the OIDC client secret

oc -n openshift-config create secret generic keycloak-oidc-secret \

--from-literal=clientSecret=' < SECRET > '

OAuth reads the OIDC client secret from this secret.

Edit OAuth and add OpenID provider

oc edit oauth cluster

Add under spec.identityProviders:

- name: keycloak

mappingMethod: claim

type: OpenID

openID:

issuer: "https://keycloak.example.com/realms/ocp"

clientID: "openshift"

clientSecret:

name: keycloak-oidc-secret

claims:

preferredUsername: ["preferred_username"]

name: ["name"]

email: ["email"]

issuer must match Keycloak realm issuer URL.

claims determines which token claims map to OpenShift username/name/email.

Restart OAuth pods

oc -n openshift-authentication delete pod -l app=oauth-openshift

Verify by logging in through the web console

You should be redirected to Keycloak, authenticate, then return to OpenShift.

Confirm users/identities:

oc get users

oc get identities

==========

Create a local htpasswd file with a test user

htpasswd -c -B -b /tmp/htpass.txt testuser RedHat123!

-c creates a new file (use only once).

-B uses bcrypt hashing (recommended).

-b supplies password non-interactively (good for labs).

Create the HTPasswd secret in openshift-config

oc -n openshift-config create secret generic htpass-secret --from-file=htpasswd=/tmp/htpass.txt

OAuth reads the htpasswd key from this secret.

Edit OAuth and add the HTPasswd provider (keep LDAP intact)

oc edit oauth cluster

Add another entry under spec.identityProviders:

- name: local-htpasswd

mappingMethod: claim

type: HTPasswd

htpasswd:

fileData:

name: htpass-secret

This adds a second login option while preserving LDAP.

Restart OAuth pods

oc -n openshift-authentication delete pod -l app=oauth-openshift

Ensures the updated list of identity providers is loaded.

Verify login works for htpasswd user

Log in via console using testuser.

Confirm the user is created:

oc get user testuser

==========