EX280 User And RBAC Management — 10 Questions

Question 1

An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

oc describe user alex@example.com. The 'oc describe user <username>' command shows the user object's details, including the list of groups the user belongs to, as synced from the identity provider. This is the correct administrative command to inspect group membership for a specific user.

Answer

oc auth can-i --list --user=alex@example.com

Answer

oc get groups --user=alex@example.com

Answer

oc get identity alex@example.com

Question 2

You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?

Accepted Answer

oc new-project secure-store --display-name='Secure Store' --description='Secure storage project'. The `oc new-project` command creates a new project and allows specifying a display name and description via flags. It also automatically switches the current context to the new project. This is the standard CLI method for creating a project with metadata in OpenShift.

Answer

oc create projectsecure secure-store --user=jane

Answer

oc create namespace secure-store --admin=jane

Answer

oc adm project secure-store --set-admin=jane

Question 3

A new user named 'sarah' requires read-only access to all resources within the 'web-frontend' project. Which CLI command creates the appropriate RoleBinding?

Accepted Answer

oc create rolebinding sarah-view --clusterrole=view --user=sarah -n web-frontend. The 'oc adm policy add-role-to-user' command is the standard helper tool to quickly bind roles to users within a project.

Answer

oc set role view sarah -n web-frontend

Answer

oc add-user sarah --role=view -n web-frontend

Question 4

An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?

Accepted Answer

ResourceQuota. A ResourceQuota is a namespace-scoped object that enforces aggregate resource consumption limits across all pods in a namespace. By setting hard limits on requests.cpu and requests.memory (or limits.cpu and limits.memory), it prevents the total consumption from exceeding 10 CPU cores and 40Gi of memory collectively. This directly satisfies the requirement to cap collective usage in the 'production' namespace.

Answer

ClusterResourceQuota

Answer

PodDisruptionBudget

Answer

LimitRange

Question 5

Which OpenShift default role allows a user to see the resources in a project but explicitly prevents them from viewing build configurations, build logs, and secrets?

Accepted Answer

basic-user. The 'view' role allows viewing most resources, but OpenShift also includes restricted views or specialized roles. Wait, let's check standard roles: 'view' allows viewing almost everything except some sensitive resources like secrets. However, the 'basic-user' role is often used for self-provisioners. Let's look at the 'view' role vs 'basic-user'.

Answer

cluster-admin

Answer

view

Answer

edit

Question 6

An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?

Accepted Answer

Define a template in the 'openshift-config' namespace and reference it in the Cluster operator configuration for project requests.. OpenShift uses a project request template stored in the `openshift-config` namespace to define default resources applied to newly created projects. Administrators can edit this template to include ResourceQuota and LimitRange objects, and the Cluster operator configuration references it for project requests. This ensures every developer-created project automatically inherits the specified quotas and limits.

Answer

Configure the cluster-admin settings in the 'cluster' resource config map.

Answer

Write an admission controller webhook daemonset to inject them.

Answer

Use a ClusterRoleBinding with auto-provisioning flags.

Question 7

You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?

Accepted Answer

apiGroups: [''], resources: ['endpoints'], verbs: ['get', 'list', 'watch']. To read metrics endpoints across all namespaces, the ClusterRole must grant access to the 'endpoints' resource in the core API group (empty string), because metrics endpoints are exposed via Endpoints objects. The verbs 'get', 'list', and 'watch' are required to read and monitor those endpoints. This is the minimal rule set that permits reading metrics endpoints without granting broader access.

Answer

apiGroups: [''], resources: ['pods', 'services'], verbs: ['get', 'list']

Answer

apiGroups: ['apps'], resources: ['deployments'], verbs: ['get']

Answer

apiGroups: ['metrics.k8s.io'], resources: ['nodes'], verbs: ['get']

Question 8

A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?

Accepted Answer

Add 'system:serviceaccount:app-ns:app-sa' to the 'users' list inside the 'restricted-custom' SCC object.. SCCs are associated with subjects through the `users`, `groups`, and `serviceAccounts` fields inside the SCC object itself, or via RBAC by granting the `use` verb on the SCC resource. Adding the fully-qualified ServiceAccount name `system:serviceaccount:app-ns:app-sa` to the SCC's `users` list directly authorizes that SA to use the SCC. This is the explicit, object-level association the question asks for.

Answer

Create a RoleBinding in 'app-ns' linking 'app-sa' to a ClusterRole that permits 'use' on the 'restricted-custom' SCC.

Answer

Add an annotation to the 'app-sa' ServiceAccount object referencing the SCC name.

Answer

Create a ProjectRequest template that injects the SCC into the namespace.

Question 9

Which command is used to list all users who currently have the 'cluster-admin' role assigned via ClusterRoleBindings?

Accepted Answer

oc get clusterrolebindings cluster-admin -o jsonpath='{.subjects}'. The command 'oc get clusterrolebindings cluster-admin -o jsonpath='{.subjects}'' retrieves the subjects (users, groups, service accounts) associated with the cluster-admin ClusterRoleBinding, effectively listing all users who have the cluster-admin role via that binding.

Answer

oc get users --role=cluster-admin

Answer

oc adm who-is cluster-admin

Answer

oc describe clusterrole cluster-admin

Question 10

Which command displays all projects that the currently logged-in user has permission to access?

Accepted Answer

oc projects. The 'oc projects' command lists all projects that the currently logged-in user has permission to access. It queries the OpenShift API for projects visible to the user and displays them, allowing quick switching between projects. This is a standard command for developers and administrators to see their available namespaces.

Answer

oc list accessible-namespaces

Answer

oc auth list-projects

Answer

oc get projects