EX280 User And RBAC Management — 20 Questions

Question 1

A new user named 'sarah' requires read-only access to all resources within the 'web-frontend' project. Which CLI command creates the appropriate RoleBinding?

Accepted Answer

oc create rolebinding sarah-view --clusterrole=view --user=sarah -n web-frontend. The 'oc adm policy add-role-to-user' command is the standard helper tool to quickly bind roles to users within a project.

Answer

oc set role view sarah -n web-frontend

Answer

oc add-user sarah --role=view -n web-frontend

Question 2

Which OpenShift default role allows a user to see the resources in a project but explicitly prevents them from viewing build configurations, build logs, and secrets?

Accepted Answer

basic-user. The 'view' role allows viewing most resources, but OpenShift also includes restricted views or specialized roles. Wait, let's check standard roles: 'view' allows viewing almost everything except some sensitive resources like secrets. However, the 'basic-user' role is often used for self-provisioners. Let's look at the 'view' role vs 'basic-user'.

Answer

cluster-admin

Answer

view

Answer

edit

Question 3

An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?

Accepted Answer

oc describe user alex@example.com. The 'oc describe user alex@example.com' command displays the user object details, including identities and groups associated with the user.

Answer

oc auth can-i --list --user=alex@example.com

Answer

oc get groups --user=alex@example.com

Answer

oc get identity alex@example.com

Question 4

A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?

Accepted Answer

Update the container resource requests in the deployment YAML to meet or exceed the LimitRange minimums, or adjust the LimitRange object.. LimitRanges enforce minimum and maximum resource constraints on containers within a namespace. If a container's request violates these constraints, either the container specs or the LimitRange object itself must be modified.

Answer

Modify the ClusterQuota object to increase the CPU limit.

Answer

Create a ClusterRoleBinding giving the developer cluster-admin rights to bypass admission webhooks.

Answer

Add the developer to the 'system:masters' group to override resource constraints.

Question 5

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

Accepted Answer

oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd. The 'oc auth can-i' command with the '--as' flag allows testing permissions as another user or service account.

Answer

oc adm policy who-can get deployments -n ci-cd

Answer

oc describe serviceaccount cicd-bot -n ci-cd

Answer

oc get rolebindings --serviceaccount=cicd-bot

Question 6

A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?

Accepted Answer

Create a RoleBinding in the 'app-dev' namespace referencing the 'pod-debugger' ClusterRole and the 'development' group.. A RoleBinding created within the 'app-dev' project referencing the 'pod-debugger' ClusterRole and the 'development' group correctly scopes the cluster-wide permissions to that single namespace.

Answer

Modify the 'pod-debugger' ClusterRole directly to include a namespace selector for 'app-dev'.

Answer

Create a Role in the 'app-dev' namespace and assign it to the 'pod-debugger' subject.

Answer

Create a ClusterRoleBinding for the 'development' group pointing to 'pod-debugger'.

Question 7

An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?

Accepted Answer

A ClusterRole and a ClusterRoleBinding. A ClusterRole grants cluster-wide permissions, and a ClusterRoleBinding is required to bind this ClusterRole to a ServiceAccount located in a specific namespace.

Answer

A SecurityContextConstraints object assigned to the ServiceAccount

Answer

A ClusterRole and a RoleBinding in the monitoring namespace

Answer

A Role and a RoleBinding in the monitoring namespace

Question 8

Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?

Accepted Answer

admin. The 'admin' default ClusterRole grants comprehensive control over most resources in a project, including managing roles and role bindings.

Answer

edit

Answer

view

Answer

cluster-admin

Question 9

You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?

Accepted Answer

oc new-project secure-store --display-name='Secure Store' --description='Secure storage project'. The 'oc new-project' command creates a project and automatically assigns the creator as admin. To assign a specific user post-creation or manage project requests, specific commands are used, but 'oc adm new-project' does not exist; instead, 'oc adm create-project-request' or standard project requests are handled via 'oc new-project'. Alternatively, creating a Namespace and a RoleBinding is standard, but OpenShift provides the 'oc new-project' helper.

Answer

oc create projectsecure secure-store --user=jane

Answer

oc create namespace secure-store --admin=jane

Answer

oc adm project secure-store --set-admin=jane

Question 10

A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?

Accepted Answer

Configure a LimitRange object in the 'data-tier' namespace with max storage constraints for persistent volume claims.. ResourceQuotas can enforce storage request limits (e.g., 'requests.storage') across a namespace. To enforce a maximum size per individual PVC, a ResourceQuota with scope selectors or specific limits can be used, but OpenShift ResourceQuotas can also track max storage per PVC using standard quota objects.

Answer

Set a StorageClass default size restriction.

Answer

Apply a ClusterRole restricting PVC creation sizes.

Answer

Configure an egress firewall rule blocking large volume attachments.

Question 11

You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?

Accepted Answer

In the 'openshift-config' namespace as a Secret. HTPasswd identity providers require the password file to be stored as a Secret in the 'openshift-config' namespace.

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Answer

In the target user's project namespace as a Secret

Answer

On the master node filesystem at '/etc/origin/master/htpasswd'

Question 12

An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?

Accepted Answer

ResourceQuota. A ResourceQuota object sets hard resource consumption limits (such as limits.cpu and limits.memory) enforced per namespace.

Answer

ClusterResourceQuota

Answer

PodDisruptionBudget

Answer

LimitRange

Question 13

A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?

Accepted Answer

oc adm policy remove-role-from-user admin bob -n finance. The 'oc adm policy remove-role-from-user' command removes a specific role from a user within a given namespace.

Answer

oc revoke role admin bob --namespace=finance

Answer

oc delete user bob -n finance

Answer

oc remove-user bob --project=finance

Question 14

An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?

Accepted Answer

Define a template in the 'openshift-config' namespace and reference it in the Cluster operator configuration for project requests.. Template-based project requests via the Project CR allow specifying an administrative template that is instantiated whenever a user creates a new project.

Answer

Configure the cluster-admin settings in the 'cluster' resource config map.

Answer

Write an admission controller webhook daemonset to inject them.

Answer

Use a ClusterRoleBinding with auto-provisioning flags.

Question 15

You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?

Accepted Answer

apiGroups: [''], resources: ['endpoints'], verbs: ['get', 'list', 'watch']. To scrape metrics or read endpoints across namespaces, the apiGroups must include '' (core) and metrics (if custom metrics API), but for standard core endpoints, apiGroups: [''], resources: ['endpoints'].

Answer

apiGroups: [''], resources: ['pods', 'services'], verbs: ['get', 'list']

Answer

apiGroups: ['apps'], resources: ['deployments'], verbs: ['get']

Answer

apiGroups: ['metrics.k8s.io'], resources: ['nodes'], verbs: ['get']

Question 16

What is the primary function of the 'self-provisioner' cluster role in OpenShift?

Accepted Answer

It allows authenticated users to create new projects.. The 'self-provisioner' role allows authenticated users to create new projects via the project request API.

Answer

It allows users to scale deployments automatically.

Answer

It allows users to provision persistent storage volumes.

Answer

It allows users to generate their own OAuth tokens.

Question 17

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

Accepted Answer

Delete the 'self-provisioner' ClusterRoleBinding attached to the 'system:authenticated' group.. Removing the 'self-provisioner' cluster role binding from the 'system:authenticated' group prevents regular users from self-provisioning new projects.

Answer

Set the project request limit quota to zero globally.

Answer

Delete the 'cluster-admin' role from all users.

Answer

Modify the OAuth configuration to reject all login requests.

Question 18

A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?

Accepted Answer

Add 'system:serviceaccount:app-ns:app-sa' to the 'users' list inside the 'restricted-custom' SCC object.. SCCs are cluster-scoped resources that grant permissions by referencing either users, groups, or service accounts directly within the SCC's 'users' or 'groups' lists, or by binding a ClusterRole/Role that allows the 'use' verb on the specific SCC resource.

Answer

Create a RoleBinding in 'app-ns' linking 'app-sa' to a ClusterRole that permits 'use' on the 'restricted-custom' SCC.

Answer

Add an annotation to the 'app-sa' ServiceAccount object referencing the SCC name.

Answer

Create a ProjectRequest template that injects the SCC into the namespace.

Question 19

Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?

Accepted Answer

oc get securitycontextconstraints. The 'oc get scc' command lists all SecurityContextConstraints available in the cluster.

Answer

oc describe scc-cluster

Answer

oc get scc --namespaced

Answer

oc get policies -n openshift-config

Question 20

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

Accepted Answer

In the 'openshift-config' namespace as a Secret referenced by the OAuth configuration. LDAP identity provider bind passwords must be stored as a Secret in the 'openshift-config' namespace.

Answer

On each worker node at '/etc/origin/master/ldap.pass'

Answer

As an environment variable on the oauth-openshift deployment

Answer

In the 'openshift-authentication' namespace as a ConfigMap