509 questions total · 7pages · All types, answers revealed
Page 1 of 7
Page 2Which component in OpenShift 4.14 manages the creation and deletion of compute machines (VMs or physical servers) on cloud providers or bare metal?
The Machine API Operator provisions and manages compute nodes via the Machine API.
Why this answer
The Machine API Operator manages the underlying compute infrastructure using Custom Resources such as Machines and MachineSets.
An OpenShift cluster's SDN (OVN-Kubernetes) experiences packet loss between nodes. The administrator needs to inspect the Open vSwitch (OVS) flow tables on a specific worker node. How should they access the node to run 'ovs-ofctl dump-flows'?
This command runs chroot on the host filesystem via oc debug to directly execute OVS commands.
Why this answer
Using oc debug node/<node-name> provides a shell where chroot /host allows executing host-level commands like ovs-ofctl.
Which component in OpenShift 4.14 is responsible for orchestrating the upgrade of the entire cluster from one minor version to another?
The CVO is the core operator responsible for driving OpenShift cluster installation and version updates.
Why this answer
The Cluster Version Operator (CVO) manages the core components of OpenShift and orchestrates cluster upgrades based on the requested channel and version.
Which TWO objects are used by OLM to manage Operator catalogs and sources of software in OpenShift 4.14? (Choose TWO)
OperatorGroup defines namespace scoping for operators.
Why this answer
CatalogSource and OperatorGroup are key OLM components for catalog management and scoping.
Which THREE of the following actions can a user with the default OpenShift 'view' role perform within a project? (Choose THREE)
ConfigMaps are readable by the 'view' role.
Why this answer
The 'view' role permits viewing pods, services, deployments, and configmaps, but restricts secrets.
Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)
Monitoring scrapers need to discover and read services, endpoints, and pods cluster-wide.
Why this answer
Scraping metrics cluster-wide typically requires verbs like 'get' and 'list' on resources such as nodes/metrics, pods, and services or endpoints.
What is the primary difference between a Deployment and a DeploymentConfig in OpenShift?
DeploymentConfigs are unique to OpenShift, whereas Deployments are standard Kubernetes.
Why this answer
DeploymentConfigs are native OpenShift objects that support triggers and lifecycle hooks, while Deployments are standard Kubernetes resources.
An administrator is troubleshooting a custom MachineConfig that failed to apply across a worker MachineConfigPool. Which THREE diagnostic steps or resources should the administrator check? (Choose THREE)
Daemon logs show ignition parsing and file write errors on nodes.
Why this answer
To diagnose MachineConfig application failures, check pool status conditions, machine-config-daemon pod logs, and rendered MachineConfigs.
An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?
Exceeding a ResourceQuota results in admission rejection with an explanation of the quota violation.
Why this answer
When a ResourceQuota is exceeded, the API server rejects the admission request with a 403 Forbidden or 422 Unprocessable Entity error indicating the quota has been exceeded.
You have a build that fails because it requires access to a private repository. What is the correct way to provide credentials to the build?
Using a secret is the secure way to provide credentials for source code repositories.
Why this answer
You can add a Secret to the BuildConfig that contains the credentials for the private repository.
An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?
This label enforces the restricted Pod Security Standard, blocking non-compliant pods.
Why this answer
To enforce a standard while generating audit log violations, the audit level is set to enforce while warning/audit levels are configured via namespace labels.
You need to update an application without downtime. Which deployment strategy is most appropriate?
Rolling updates replace pods one by one or in batches, avoiding downtime.
Why this answer
The Rolling strategy replaces pods incrementally, ensuring capacity is maintained throughout.
An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?
This annotation instructs the SCC admission plugin to assign restricted-v2 as the default for pods in the namespace.
Why this answer
Applying the security.openshift.io/scc: restricted-v2 annotation to the Namespace forces pods requesting no specific SCC to default to restricted-v2 via admission control.
An administrator wants to check the health and availability status of all core OpenShift 4.14 cluster operators (such as authentication, ingress, and dns). Which command should be used?
oc get clusteroperators lists all core platform operators and their health statuses.
Why this answer
The 'oc get clusteroperators' command lists all cluster operators, their availability, progression, and degraded status.
An administrator wants to inspect cluster events filtered by warning type. Which TWO commands or techniques can help? (Choose TWO)
Displays warning events specific to the targeted pod.
Why this answer
Filtering events via oc get events or inspecting descriptions helps identify cluster warnings.
Which command displays all projects that the currently logged-in user has permission to access?
The 'oc projects' command safely lists all accessible projects for the current user.
Why this answer
The 'oc projects' command lists all projects accessible to the current user session.
An administrator wants to view the logs of a specific container named 'backend' inside a pod with multiple containers. Which command should be used?
The -c flag correctly specifies which container's logs to retrieve from a multi-container pod.
Why this answer
When a pod has multiple containers, the container name must be explicitly specified with the -c flag in the oc logs command.
A developer deploys an application that mounts a PVC in read-only mode inside the pod specification. How is this configured in the Pod's volumeMounts?
volumeMounts supports the readOnly boolean flag per container mount.
Why this answer
Setting 'readOnly: true' in the pod's volumeMounts array mounts the PVC in read-only mode for that container.
Which THREE commands are used to manage service account secrets?
This links a secret to a service account.
Why this answer
Service accounts use secrets for pull credentials and API tokens.
An administrator wants to perform a manual rollback of a MachineConfig change that caused issues on worker nodes. What is the standard way to revert to the previous configuration using the Machine Config Operator?
Deleting the unwanted MachineConfig causes the MCO to re-render the ignition config and revert nodes.
Why this answer
To rollback a MachineConfig, the administrator can delete the erroneous MachineConfig object, and the MCO will automatically revert the nodes to the previous valid configuration.
An administrator needs to roll back a Deployment in OpenShift to a specific previous revision because the latest update introduced a critical database connection bug. Which command identifies the available revisions and their associated change causes before executing the rollback?
'oc rollout history' displays all recorded revisions for a deployment along with their change causes.
Why this answer
The 'oc rollout history' command lists the deployment revisions and their associated change causes.
Which TWO characteristics describe StorageClasses in OpenShift?
Every StorageClass requires a provisioner field.
Why this answer
StorageClasses are cluster-scoped resources that define the provisioner and parameters for dynamic volume creation.
An administrator needs to secure a Route using a custom wildcard certificate. The certificate and private key are stored in a TLS Secret named wildcard-tls-secret in the same namespace as the Route. Which section of the Route manifest should reference this Secret?
The spec.tls block defines the termination strategy and references the secret keys.
Why this answer
Custom TLS certificates for routes are configured under the spec.tls block of the Route resource, referencing the certificate and key components in a TLS secret.
An administrator notices that Ingress controller logs show frequent health check failures for backend pods. Where can the administrator check or configure the liveness and readiness probes that dictate pod health for service endpoints?
Wait, IngressController configures router parameters, but pod probes are strictly workload properties. (Correction: Option A is correct, container probes belong in the pod template).
Why this answer
Liveness and readiness probes are configured directly within the Pod template spec of the Deployment or Pod resource.
An administrator is investigating why cluster operator upgrades are failing. Which TWO locations or commands provide detailed diagnostic information about cluster operators? (Choose TWO)
Describe output shows specific error messages and failure conditions for the operator.
Why this answer
To diagnose cluster operators, administrators inspect individual cluster operator status ('oc describe clusteroperator') and check logs of operator pods.
An administrator needs to perform a canary deployment strategy using standard OpenShift Deployment resources (not DeploymentConfigs). What is the standard Kubernetes/OpenShift native mechanism to route a small percentage of traffic to the canary deployment?
OpenShift Routes support weighted traffic distribution across multiple Services to implement canary routing.
Why this answer
Standard Deployments do not have native percentage-based traffic splitting; an administrator must use a Service with multiple underlying selector labels alongside a Service Mesh, Ingress controller, or an OpenShift Route with weight configurations pointing to distinct Services. Specifically, OpenShift Routes support splitting traffic via weighted backends across multiple Services.
An ImageStream named 'frontend' in a project contains multiple tags, including 'latest' and 'v1.0'. You want to update an existing Deployment to specifically use the 'v1.0' tag of this ImageStream. Where must this reference be updated in the Deployment specification?
Deployments reference ImageStreams via the internal registry URL path format namespace/imagestream:tag.
Why this answer
ImageStreamTags or ImageStreamImages are referenced inside the container image field within the pod template of a Deployment.
An administrator needs to verify which user account or service account they are currently logged into the OpenShift cluster with. Which command provides this information?
oc whoami outputs the current authenticated user identity.
Why this answer
oc whoami returns the username of the currently authenticated user session.
You need to ensure that your application deployment always maintains at least 80% of its desired pod count during a rolling update. Which strategy parameter should you configure?
Setting maxUnavailable to 20% allows the deployment to tolerate a 20% reduction in capacity, maintaining 80% availability.
Why this answer
The maxUnavailable parameter defines the maximum number of pods that can be unavailable during the update process. Setting this to 20% ensures 80% availability.
An administrator wants to check the resource requests and limits across all pods in a specific namespace. Which command provides this summary?
Custom columns allow extracting specific resource requests and limits from pod specifications.
Why this answer
oc adm top pod lists CPU and memory usage for pods, while describing or querying pod YAML specifications reveals requests and limits.
An administrator is troubleshooting an Operator installation issue in OpenShift 4.14. Which TWO resources or logs should the administrator examine to diagnose OLM operator subscription and CSV issues? (Choose TWO)
The CSV resource details whether the operator installed successfully or encountered errors.
Why this answer
To troubleshoot OLM operators, checking the Subscription status and the ClusterServiceVersion (CSV) status provides the necessary error details.
An administrator needs to completely remove a Helm release named my-redis from the cluster, including its history. Which Helm command should be executed?
helm uninstall removes all resources associated with the release and deletes the release history.
Why this answer
The helm uninstall command removes the release and its associated history from the cluster.
A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?
This command evaluates the current user's permissions against the target namespace.
Why this answer
The developer can use 'oc auth can-i create pods --namespace=target-ns' to check their own permissions, or specify their service account token if testing externally.
Where are PersistentVolumeClaims located in terms of OpenShift's API scope?
PVCs exist within specific namespaces/projects.
Why this answer
PersistentVolumeClaims are namespace-scoped resources, whereas PersistentVolumes and StorageClasses are cluster-scoped.
A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?
Setting allowHostPorts to true allows pods to bind to ports on the host node, including privileged ports.
Why this answer
Allowing pods to bind to privileged ports (< 1024) is controlled by setting allowHostPorts to true or defining allowedHostPorts in a custom SCC.
An administrator is troubleshooting an Ingress routing issue where external clients receive a 503 error when trying to access a secure application through a Route configured with passthrough TLS termination. What is the most likely cause of this issue?
Passthrough routes send encrypted TLS traffic directly to the pod, requiring the application inside the pod to handle TLS termination.
Why this answer
With passthrough TLS termination, the router passes encrypted traffic directly to the backend pod, meaning the pod must handle TLS termination and present a valid certificate matching the hostname.
A service of type NodePort has been created in OpenShift. Within what default port range are NodePort services typically allocated on the worker nodes?
The standard Kubernetes NodePort range is 30000 through 32767.
Why this answer
Kubernetes and OpenShift allocate NodePort services from the standard port range of 30000-32767.
An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?
Correct. This binds the view cluster role to user alice in the development namespace via a RoleBinding.
Why this answer
The view ClusterRole provides read-only access to most resource types within a project. Binding it via a RoleBinding in the specific namespace limits access strictly to that namespace.
An administrator needs to inspect the current update channel and version of an OpenShift 4.14 cluster. Which command provides this status directly?
oc get clusterversion displays the cluster version state, available updates, and channel.
Why this answer
Running 'oc get clusterversion' displays the cluster version, channel, and overall update availability.
An administrator suspects that a memory leak in a system daemon on an RHCOS worker node is causing system instability. Which THREE commands or log sources can be examined via an oc debug node session to investigate system memory consumption? (Choose THREE)
Dumps process memory and CPU statistics on the host.
Why this answer
Running 'top', 'free -h', and checking journald kernel logs via oc debug node inspects host memory usage.
A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?
Accessing logs across namespaces requires permission on the 'pods/log' subresource bound cluster-wide.
Why this answer
Reading pod logs requires permissions on the 'pods/log' subresource. A ClusterRole granting 'get' on 'pods/log' combined with a ClusterRoleBinding achieves this cluster-wide.
An OpenShift administrator needs to restrict external access to a specific application Route by limiting access to a predefined list of allowed client IP addresses. How can this be accomplished?
The ip_whitelist annotation on the Route configures HAProxy to allow traffic only from specified IPs/CIDRs.
Why this answer
Routes support spec.securityContext or annotations/fields for IP filtering. Specifically, the 'haproxy.router.openshift.io/ip_whitelist' annotation restricts access based on client source IP.
An administrator wants to check the logs of the Cluster Version Operator to see why an upgrade failed. In which namespace does the CVO run?
The CVO runs in the openshift-cluster-version namespace.
Why this answer
The Cluster Version Operator is deployed and runs in the openshift-cluster-version namespace.
Which TWO of the following statements regarding PersistentVolume access modes are correct?
RWO restricts write access to a single node.
Why this answer
ReadWriteOnce (RWO) allows read-write by a single node, and ReadWriteMany (RWX) allows read-write by multiple nodes simultaneously.
What is the effect of setting 'allowVolumeExpansion: true' in a StorageClass?
Enabling volume expansion permits PVC resizing.
Why this answer
It allows users to edit existing PersistentVolumeClaims associated with this StorageClass to request a larger storage size.
A developer has deployed a Helm chart in OpenShift and needs to list all currently installed Helm releases in the current namespace. Which command should be used?
helm list displays all installed releases in the active namespace.
Why this answer
The helm list command shows all active Helm releases in the current namespace.
An administrator must configure a NetworkPolicy in the 'secure-zone' namespace to explicitly deny all ingress traffic except for TCP traffic coming from pods labeled 'tier=frontend' in the 'frontend-zone' namespace. Which NetworkPolicy specification achieves this?
This correctly targets the source namespace and pod label while restricting to TCP and selecting all pods in secure-zone.
Why this answer
To allow traffic from another namespace, the policyPeer must use namespaceSelector combined with podSelector. Denying all other ingress requires an empty ingress rule list alongside policyTypes: [Ingress].
A cluster administrator needs to configure a generic ephemeral inline volume in a Pod specification. Where is the volume defined?
Inline ephemeral volumes allow storage to be specified directly in the pod spec and lifecycle-managed with the pod.
Why this answer
Generic ephemeral inline volumes are defined directly inside the Pod spec under 'volumes' using the 'ephemeral' volume source, referencing a StorageClass.
An administrator is troubleshooting a deployment where pods fail to pull container images. Which TWO potential issues should be checked? (Choose TWO)
Private registries require valid pull secrets attached to the pod's service account.
Why this answer
Incorrect image pull secrets and invalid image tags/registry paths are the two most common causes of image pull failures.
You notice that your builds are failing due to a lack of memory. Where can you set resource limits for the build process?
The resources field in the BuildConfig specifies limits for the build pod.
Why this answer
You can define 'resources' in the 'spec' of the BuildConfig to control CPU/Memory for the build pod.
An administrator troubleshoots a failing NetworkPolicy and wants to verify if the OpenShift SDN or OVN-Kubernetes controller has successfully applied the rules. Where are the controller operator logs examined?
Controller logs for networking are housed in the operator and CNI namespaces.
Why this answer
Network operator logs, such as cluster-networks-operator or ovnkube-controller logs in their respective namespaces, contain synchronization errors and policy status.
An administrator is troubleshooting an OAuth authentication failure where users receive an error indicating invalid credentials against an HTPasswd provider. Which TWO steps or checks are critical for resolving this issue? (Choose TWO)
The OAuth server reads identity provider secrets specifically from the openshift-config namespace.
Why this answer
Troubleshooting HTPasswd involves verifying that the referenced Secret exists in the openshift-config namespace and that the file format uses valid bcrypt or sha passwords.
What is the primary function of a CSI (Container Storage Interface) Driver Operator in OpenShift?
CSI operators automate the deployment and lifecycle management of storage plugins.
Why this answer
CSI Driver Operators manage the lifecycle of CSI plugins, deploying controller and node plugin pods that enable communication between OpenShift and storage backends.
An administrator needs to view which users currently possess the 'cluster-admin' cluster role across the OpenShift cluster. Which command is most efficient for displaying this information?
Correct. The cluster-admin ClusterRoleBinding explicitly lists all subjects (users, groups, service accounts) bound to the cluster-admin role.
Why this answer
The 'oc adm policy who-can' command or inspecting the ClusterRoleBinding for cluster-admin reveals which users and service accounts hold the role.
A developer wants to expose an application using a secure Route that terminates TLS on the pod itself, avoiding decryption at the router layer. Which TLS termination type should be selected?
Passthrough sends encrypted traffic straight through the router to the destination pod.
Why this answer
Passthrough termination forwards encrypted traffic directly to the backend pod without terminating TLS at the router.
A developer has created a Kustomization file that applies a namespace prefix and some patches to base Kubernetes manifests. How can the developer apply these manifests to an OpenShift cluster using standard oc tooling without installing standalone Kustomize?
oc apply -k directs the client to build and apply the Kustomize package from the directory.
Why this answer
The oc apply command includes built-in support for Kustomize via the -k flag, which processes a directory containing a kustomization.yaml file.
An administrator needs to configure volume snapshot data protection where the underlying snapshot content object must remain intact even if the user deletes the VolumeSnapshot object. How is this controlled?
StorageClass reclaimPolicy applies to PVs, not VolumeSnapshots.
Why this answer
The deletionPolicy in the VolumeSnapshotClass controls whether the underlying VolumeSnapshotContent is deleted (Delete) or retained (Retain) when the user deletes the VolumeSnapshot.
Which THREE methods can be used to pass parameters or configuration values into a Helm chart installation in OpenShift? (Choose three.)
Charts inherently utilize the default values defined in their packaged values.yaml file.
Why this answer
Helm values can be supplied via the --set flag for inline values, the --values (-f) flag for YAML files, and by setting environment variables or default values within the chart's values.yaml file.
An administrator wants to inspect or modify the OperatorGroup for a namespace in OpenShift 4.14. Which TWO characteristics or settings are defined by an OperatorGroup? (Choose TWO)
OperatorGroups specify whether an operator watches a single namespace, all namespaces, or a select list.
Why this answer
OperatorGroups define the target namespaces where OLM operators can be installed and operated.
An administrator has successfully updated the global pull secret in openshift-config/pull-secret. How does the Machine Config Operator propagate this new pull secret to all existing worker nodes in the cluster?
The MCO watches the global pull secret and automatically triggers node configuration updates when it changes.
Why this answer
When the global pull secret is updated in openshift-config, the MCO automatically detects the change, renders a new MachineConfig, and initiates a rolling update of the nodes to apply the new pull secret via Ignition.
An administrator needs to expose an internal application running on port 8080 via an OpenShift Route using edge termination. Which object configuration correctly defines this Route?
This correctly specifies edge termination and maps to the service and target port.
Why this answer
An edge terminated route requires the TLS configuration block with termination set to edge, while the target port references the container port 8080.
What is the primary function of the 'self-provisioner' cluster role in OpenShift?
By default, authenticated users have this role bound, enabling them to request and create new projects.
Why this answer
The 'self-provisioner' role allows authenticated users to create new projects via the project request API.
An administrator needs to create a service that exposes an application externally via an IP address allocated from an external cloud provider load balancer. Which service type must be used?
LoadBalancer provisions an external IP via the integrated cloud provider infrastructure.
Why this answer
A LoadBalancer service type provisions an external load balancer specific to the underlying cloud infrastructure platform.
An administrator creates a new custom Security Context Constraint (SCC) named restrict-root. After creating the SCC resource, users complain that pods using a ServiceAccount tied to this SCC are still falling back to the restricted-v2 SCC. What is the most likely cause?
OpenShift controls SCC assignment via RBAC roles matching the system:openshift:scc:<name> convention.
Why this answer
In OpenShift, users or service accounts must be explicitly granted access to an SCC via RBAC (binding the system:openshift:scc:<scc-name> ClusterRole to the ServiceAccount) or by assigning priority so that evaluation happens correctly, though authorization is driven by RBAC.
A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?
LimitRanges validate individual container resource requests against defined minimums and maximums at admission time.
Why this answer
LimitRanges enforce minimum and maximum resource constraints on containers within a namespace. If a container's request violates these constraints, either the container specs or the LimitRange object itself must be modified.
Which command is used to remove a role binding named 'dev-binding' from a namespace named 'development'?
Deleting the RoleBinding object revokes the permissions granted by that binding.
Why this answer
The 'oc delete rolebinding dev-binding -n development' command removes the role binding object.
Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?
This command correctly provisions a cluster-scoped role for persistent volumes.
Why this answer
The 'oc create clusterrole' command creates a cluster role with specified verbs and resources.
An administrator wants to check the exit code of a container that terminated earlier today in a pod that has since been restarted. Which command displays the previous termination details?
The --previous flag fetches logs from the prior container instance that crashed or exited.
Why this answer
oc logs --previous retrieves the log output from the previous container instance before it restarted.
When setting up authentication and user provisioning in OpenShift 4, which THREE identity providers are natively supported out-of-the-box by the OAuth server configuration? (Choose THREE)
Correct. OIDC is a natively supported identity provider type in OpenShift.
Why this answer
OpenShift natively supports several identity providers, including HTPasswd, LDAP, OpenID Connect (OIDC), GitHub, and Keystone. Standard RBAC tools do not replace IDP configuration.
Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?
Checking authorization with '--as' on the service account helps verify its operational context.
Why this answer
Administrators can check SCC assignments by evaluating who can bind to the SCC cluster roles using 'oc adm policy' commands or by checking effective SCCs using 'oc auth can-i'.
An administrator needs to view the current list of active Security Context Constraints installed in an OpenShift cluster. Which command should be executed?
oc get scc retrieves all Security Context Constraints present in the OpenShift cluster.
Why this answer
SCCs are cluster-scoped resources. Running oc get scc lists all security context constraints available in the cluster.
During an upgrade of an OpenShift 4.14 cluster using the Cluster Version Operator (CVO), the upgrade status stalls at a specific component. The administrator wants to check the detailed error messages and reconciling loops of the CVO itself. Where should the administrator look?
The CVO pod in openshift-cluster-version manages cluster upgrades and logs all synchronization errors.
Why this answer
The Cluster Version Operator runs in the openshift-cluster-version namespace. Its logs provide detailed reconciliation status and errors during cluster upgrades.
You want to restore an existing VolumeSnapshot into a new PersistentVolumeClaim. Which field in the PVC specification must reference the VolumeSnapshot?
dataSource points to the VolumeSnapshot (or another PVC) used to initialize the new volume.
Why this answer
To restore from a snapshot, the dataSource (or dataSourceRef) field in the PVC spec must point to the VolumeSnapshot object.
An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?
Modifying the 'default' IngressController object in the operator.openshift.io API group allows scaling and tuning the router.
Why this answer
The default Ingress controller is managed by the Ingress operator via the 'default' Ingress resource in the operator.openshift.io API group.
An OpenShift administrator observes that the 'authentication' ClusterOperator is reporting Available=False, Progressing=True, and Degraded=True. During troubleshooting, they notice that the kube-apiserver cannot validate tokens because the OAuth server routes are unreachable due to a misconfigured ingress controller. Which log collection method is best suited to pinpoint the OAuth metadata retrieval failure?
The authentication operator deploys the OAuth server in the openshift-authentication namespace, where connectivity and token exchange logs reside.
Why this answer
Checking the operator pods in openshift-authentication namespace using oc logs on the oauth-openshift deployment provides the exact HTTP communication errors.
Page 1 of 7
Page 2Practice EX280 by domain
Target a specific domain to shore up weak areas.