SIMULATIONTask SIMULATION 6 Service Accounts and RBAC – Create Audit Service Account
Answer(s): A
Step 1: Ensure the target project exists. The lab specifies the namespace/project auth-audit.Step 2: Run the command: oc create sa audit -n auth-auditStep 3: Verify creation. The lab output shows: serviceaccount/audit createdDetailed explanation: This creates a service account named audit in the auth-audit namespace. Service accounts provide non-human identities for workloads and automation processes running inside the cluster. They are also commonly used when controlled API access is needed for scripts, jobs, or external kubeconfig generation. Creating a dedicated service account instead of using the default one is good practice because it supports least privilege and clearer access tracking. In exam and administration scenarios,service accounts are often paired with explicit RBAC bindings to grant only the permissions needed for the intended Task SIMULATION. This step lays the identity foundation before assigning a role in the following Task SIMULATION.
SIMULATIONTask SIMULATION 7 Service Accounts and RBAC – Grant Cluster Reader Role
Step 1: Confirm the service account exists in auth-audit. It must exist before a role can be assigned to it.Step 2: Run the command: oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:auth-audit:auditStep 3: Verify the binding is added. The lab output shows: clusterrole.rbac.authorization.k8s.io/cluster-reader added: "system:serviceaccount:auth-audit:audit"Detailed explanation: This binds the cluster-reader cluster role to the audit service account. The full subject format system:serviceaccount:namespace:name is required because OpenShift RBAC needs the exact service account identity. The cluster-reader role is broader than a project-scoped view role because it allows read-level access across cluster resources. This is appropriate for auditing or inspection use cases where the account must observe but not modify. The distinction between cluster roles and namespaced roles is important: cluster roles apply to non-namespaced resources and broad cluster visibility, while local roles are limited to individual projects. This Task is a classic RBAC operation that combines identity creation with controlled privilege assignment.
SIMULATIONTask SIMULATION 8 Kubeconfig Management – Approve CSR
Step 1: Identify the pending certificate signing request. The lab names it audit-csr.Step 2: Run the approval command: oc adm certificate approve audit-csrStep 3: Confirm approval. The lab output shows: certificatesigningrequest.certificates.k8s.io/audit-csr approvedDetailed explanation: In Kubernetes and OpenShift, a CSR must be approved before the requester can use the signed certificate for authentication. This Task approves the CSR named audit-csr, which is likely associated with the audit user or service account access flow in the lab. Certificate-based authentication is commonly used for kubeconfig access because it enables secure client identity without relying solely on tokens. Until the CSR is approved, the certificate cannot be trusted by the cluster API for authenticated operations. Administrative approval is therefore a gatekeeping step that ensures only intended certificate requests become valid credentials. This Task is part of a broader kubeconfig workflow that continues with setting credentials and defining context.
SIMULATIONTask SIMULATION 9 Kubeconfig Management – Set Credentials in Kubeconfig
Step 1: Ensure the client certificate and private key files are available. The lab uses audit.crt and tls.key.Step 2: Run the command: oc config set-credentials audit --client-certificate audit.crt --client-key tls.key --embed-certs --kubeconfig audit.configStep 3: Confirm the user entry is written. The lab output shows: User "audit" set.Detailed explanation: This command creates or updates the audit user entry inside the kubeconfig file audit.config. It points the user to a client certificate and private key, and the --embed-certs option stores certificate material directly inside the kubeconfig rather than only referencing external files. That makes the kubeconfig more portable because it can be moved and used without separately copying the certificate files, provided the embedded content is valid. In certificate-based authentication, the private key proves client possession while the certificate presents the approved identity. If the certificate and key do not match, authentication will fail. This step does not yet define what cluster or namespace the user works against; it only defines the credential identity.
SIMULATIONTask SIMULATION 10 Kubeconfig Management – Set Context in Kubeconfig
Step 1: Verify the cluster name, namespace, and user name that should be referenced. The lab uses cluster api-ocp4-example-com:6443, namespace audit-ns, and user audit-sa.Step 2: Run the command: oc config set-context audit --cluster api-ocp4-example-com:6443 --namespace audit-ns --user audit-sa --kubeconfig audit.configStep 3: Confirm context creation. The lab output shows: Context "audit" created.Detailed explanation: A kubeconfig context ties together three things: a cluster endpoint, a user identity, and optionally a default namespace. This Task creates a context named audit in the file audit.config. Contexts are useful because they simplify repeated administration by letting the user switch between prepared working environments instead of re-entering cluster and namespace details each time. The namespace portion is especially helpful for project-scoped operations, because commands run under that context default to the chosen namespace. Accuracy matters here: if the user name in the context does not match the credentials entry or the cluster name does not exist in the kubeconfig, the context will not function as intended.
Post your Comments and Discuss RedHat EX380 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the EX380 content, but please register or login to continue.