RedHat EX380 Exam Dumps

Step 1: Identify the application namespace after restore.

The lab shows the namespace as my-app-namespace.

Step 2: Run the SCC assignment command:

oc adm policy add-scc-to-user anyuid -z default -n my-app-namespace

Step 3: Confirm the role binding is applied.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/system:openshift:scc:anyuid added: 'default'

Detailed explanation:

After a restore, the application may fail if its pods require a security context not permitted by the default SCC allocation. This command grants the anyuid SCC to the default service account in the my-app-namespace project. The -z default syntax targets the default service account, which many restored workloads use if no custom service account is defined. The anyuid SCC allows containers to run with arbitrary user IDs, which some legacy or prebuilt images require. In OpenShift, SCC mismatches commonly cause pods to remain in pending or crash-related states. Assigning the proper SCC resolves those admission issues so workloads can start successfully. This step is therefore a post-restore operational fix to align security policy with application requirements.

============

Log in to OpenShift internal registry

oc registry login

Allows podman to push to the internal registry.

Pull external image

podman pull docker.io/library/nginx:1.25

Gets the image locally.

Tag for internal registry destination

podman tag nginx:1.25 image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Uses the cluster service DNS name (works inside cluster network).

Push to internal registry

podman push image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Update deployment to use internal image

oc -n orders set image deploy/web web=image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Verify rollout

oc -n orders rollout status deploy/web

oc -n orders get pods -o wide

==========

Create a secret for cloud credentials (S3-compatible example)

oc -n openshift-adp create secret generic cloud-credentials \

--from-file=cloud=/path/to/credentials

Velero uses this secret to authenticate to object storage.

Create/Update the DataProtectionApplication (DPA)

Apply a DPA CR that defines:

backupLocations (bucket, endpoint URL, region, etc.)

snapshotLocations (if using snapshots)

Verify BackupStorageLocation and SnapshotLocation

velero backup-location get

velero snapshot-location get

Status should be Available, meaning storage config is valid.

==========

Find the alert name and labels

Web console: Observe Alerts click the alert to view label set.

Open Alertmanager silences

Observe Alerting Alertmanager Silences Create silence

Create the silence

Add matcher: alertname = <ALERT_NAME>

Duration: 2 hours

Save.

Verify the alert shows as silenced

The alert should indicate it is silenced in the UI.

==========

Annotate the namespace with default tolerations

oc annotate ns payments \

scheduler.alpha.kubernetes.io/defaultTolerations='[{'key':'dedicated','operator':'Equal','value':'payments','effect':'NoSchedule'}]' \

--overwrite

Some clusters honor this pattern; if not, the fallback is mutating admission or editing workloads.

Create a new pod/deployment in the namespace

Then verify its spec includes tolerations:

oc -n payments get pod -o yaml | grep -n tolerations -A5

==========