Exam for engine

See the solution below in Explanation.
Explanation:
* Create an empty kustomization file:
* touch overlays/production/kustomization.yaml
* Validate it exists:
* ls -l overlays/production
Why this matters:
* kustomization.yaml is the entrypoint file Kustomize uses to build overlays.

See the solution below in Explanation.
Explanation:
* Grant view role:
* oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:view:development user-b
* Validate:
* oc get clusterrolebinding | grep -i development | grep -i user-b
Why this matters:
* Provides read-only access to development ClusterSet resources, improving separation of duties.

See the solution below in Explanation.
Explanation:
* Create overlays/production/kustomization.yaml referencing base resources.
* Build overlay:
kustomize build overlays/production | oc apply -f –
(If kustomize isn’t present, use oc kustomize if available.)
* Verify resources created and placed only on production clusters via placement rules.

See the solution below in Explanation.
Explanation:
* Ensure you are logged into the hub cluster:
* oc whoami
* oc project open-cluster-management
* Create/apply the MultiClusterHub CR:
* oc apply -f multiclusterhub.yaml
* Verify it was created:
* oc get multiclusterhub -A
* oc describe multiclusterhub -n open-cluster-management
* Watch pods come up (typical namespaces include open-cluster-management, open-cluster- management-hub, etc. depending on ACM version/config):
* oc get pods -n open-cluster-management -w
Why these steps matter:
* The MultiClusterHub CR is the “hub installation” object. The operator reconciles it and installs
/maintains hub services.

See the solution below in Explanation.
Explanation:
* List clusters:
oc get managedcluster
* Label the target cluster(s):
oc label managedcluster cluster-dev environment=dev region=us-east –overwrite
* Verify labels:
oc get managedcluster cluster-dev –show-labels
Why this matters:
Labels drive Placement decisions used by policies and applications.

See the solution below in Explanation.
Explanation:
* Ensure namespace has the correct ManagedClusterSetBinding.
* Create placement in that namespace; only clusters visible via bound ClusterSet can be selected.
* Verify placementdecision includes only clusters from that set.
This ties together ClusterSets (grouping) and Placement (selection).

See the solution below in Explanation.
Explanation:
* Log in to the OpenShift Web Console as a cluster-admin user.
* Go to Operators # OperatorHub .
* OperatorHub is the catalog of available operators.
* In the search box, type: Advanced Cluster Management .
* Click Advanced Cluster Management for Kubernetes (Red Hat ACM).
* Click Install .
* In the install wizard:
* Update channel : choose the recommended/stable channel for your lab.
* Installation mode : typically “All namespaces on the cluster” (default).
* Installed Namespace : select or create open-cluster-management .
* Click Install and wait for the operator to show Succeeded in:
* Operators # Installed Operators .
Why these steps matter:
* Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

See the solution below in Explanation.
Explanation:
* Open the RHACS (Central) console (typically via a route created by Central).
* Navigate to: Platform Configuration # System Policies .
* Click Create Policy .
* Set the policy criteria:
* Add a rule/condition such as Image OS = debian:10 (as required by the lab)
* Set enforcement to apply at Build & Deploy stages.
* Build prevents images from being admitted into pipeline/registries depending on integration.
* Deploy prevents or flags deployments that violate policy.
* Save the policy.
* (Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts
/enforcement behavior.
Why this matters:
* Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

See the solution below in Explanation.
Explanation:
* Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.
* Create placement with matchExpressions (include one label, exclude another):
matchExpressions:
– key: openshiftVersion
operator: In
values: [“4.18”]
– key: region
operator: NotIn
values: [“us-west”]
* Validate PlacementDecision.

See the solution below in Explanation.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < ‘EOF’ | oc apply -f –
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

See the solution below in Explanation.
Explanation:
Policies in ACM require:
* a Policy resource
* a Placement (which clusters to target)
* a PlacementBinding (bind policy # placement)
* Create the Policy (in team-dev) enforcing a namespace audit-logs:
cat < < ‘EOF’ | oc apply -f –
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-ensure-audit-namespace
namespace: team-dev
spec:
remediationAction: enforce
disabled: false
policy-templates:
– objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: ensure-audit-namespace
spec:
remediationAction: enforce
severity: low
object-templates:
– complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: audit-logs
EOF
* Create PlacementBinding to bind it to dev-clusters placement:
cat < < ‘EOF’ | oc apply -f –
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: bind-policy-ensure-audit-namespace
namespace: team-dev
placementRef:
apiGroup: cluster.open-cluster-management.io
kind: Placement
name: dev-clusters
subjects:
– apiGroup: policy.open-cluster-management.io
kind: Policy
name: policy-ensure-audit-namespace
EOF
* Verify compliance:
oc get policy -n team-dev
oc describe policy policy-ensure-audit-namespace -n team-dev
Why this matters:
This is the core “ACM governance” exam pattern: define desired state and enforce across clusters.

See the solution below in Explanation.
* Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).
* Bind to placement.
* Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.

See the solution below in Explanation.
Explanation:
* Check cluster conditions:
oc describe managedcluster cluster-dev
* Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you’re looking for ACM/klusterlet agents).
* On hub, check managedclusteraddons and addon health:
oc get managedclusteraddon -n cluster-dev
oc describe managedclusteraddon -n cluster-dev < addon-name >
* Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).

See the solution below in Explanation.
Explanation:
* Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.
* Bind it to a Placement targeting dev clusters.
* Verify operator subscription exists on managed clusters and CSV reaches Succeeded.
Why this matters:
Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

See the solution below in Explanation.
Explanation:
* Create a Channel (Git) and Subscription referencing it (example pattern).
* In exams, you’re usually given a repo URL and target namespace.
* Ensure there is a placement rule/placement selecting clusters.
* Apply manifests:
oc apply -f channel.yaml
oc apply -f subscription.yaml
* Verify resources:
oc get channels.apps.open-cluster-management.io -A
oc get subscriptions.apps.open-cluster-management.io -A
oc get application.app.k8s.io -A
Why this matters:
Multi-cluster application lifecycle is part of ACM operations, and EX480 explicitly covers managing multi- cluster environments with ACM.

See the solution below in Explanation.
Explanation:
* Web Console # Operators # OperatorHub
* Search for multicluster engine (or Multicluster Engine Operator ).
* Install the operator into its recommended namespace (commonly multicluster-engine).
* Create the MultiClusterEngine custom resource (CLI method shown below):
cat < < ‘EOF’ | oc apply -f –
apiVersion: multicluster.openshift.io/v1
kind: MultiClusterEngine
metadata:
name: multiclusterengine
spec: {}
EOF
* Verify the engine reconciles:
oc get multiclusterengine
oc get pods -n multicluster-engine
Why this matters:
ACM can use the multicluster engine operator for cluster lifecycle functions; Red Hat documents cluster lifecycle with multicluster engine as a core capability.

See the solution below in Explanation.
Explanation:
* Create the ManagedClusterSet:
* oc create managedclusterset production
* Validate:
* oc get managedclusterset
* oc describe managedclusterset production
Why this matters:
* Separating development and production clusters is common for governance/RBAC isolation.