509 questions total · 7pages · All types, answers revealed
How do you view the history of deployments for a DeploymentConfig?
This displays the history of rollout revisions.
Why this answer
The 'oc rollout history' command lists the revisions of a deployment.
You want to ensure that all pods in a namespace are denied access to the host network. Which policy mechanism is most effective for this?
Setting 'hostNetwork: false' in an SCC prevents pods from using the host's network namespace.
Why this answer
SCCs control host networking capabilities. Editing the SCC bound to the service account or creating a restricted custom SCC is the way to enforce this.
A cluster administrator wants to restrict a specific storage class so that only members of a designated OpenShift project can create PVCs referencing it. How is this typically enforced in OpenShift?
StorageClasses are cluster-scoped and accessible to all namespaces by default; restriction requires admission webhooks or policy engines.
Why this answer
StorageClasses themselves do not have native namespace RBAC, but admission webhooks or project-level naming conventions combined with ValidatingWebhookConfigurations or ResourceQuotas can restrict usage. Wait, standard OpenShift does not restrict StorageClasses per project natively without admission control or OPA/Gatekeeper, but let's look at the standard approach: OpenShift allows restricting via cluster resource RBAC or custom admission webhooks. Let's verify standard answer: cluster administrators control access via StorageClass availability and default settings, or admission policies.
What happens if a pod does not match any SCC?
Admission control fails if no SCC can be assigned.
Why this answer
If no SCC matches the pod's security context, the pod creation request is rejected by the admission controller.
An administrator has successfully installed an Operator via OperatorHub, but the Operator's CSV (ClusterServiceVersion) status is stuck at 'Pending'. Upon investigating, the administrator discovers that the required CustomResourceDefinitions (CRDs) have conflicting versions with a previously deleted Operator. How can the administrator forcefully clean up orphaned CRDs if OLM fails to remove them?
Finalizers often block deletion of CRDs if controllers are missing; removing finalizers lets Kubernetes complete deletion.
Why this answer
Orphaned or stuck CRDs can be edited to remove finalizers (metadata.finalizers) so Kubernetes can successfully delete them.
Which resource in OpenShift acts as an abstraction over a set of images to provide a stable reference?
ImageStreams provide a stable reference to images.
Why this answer
An ImageStream creates a single virtual view of an image, even if the underlying image tag changes.
You want to prevent a specific pod from being scheduled on nodes that are already running other pods of the same application. What should you configure?
Anti-affinity rules prevent pods from landing on nodes with specific labels or existing pods.
Why this answer
Pod anti-affinity allows you to specify rules to keep pods of the same application apart.
A pod fails to start with a 'CreateContainerConfigError' error message. What is the most common cause of this error that an administrator should investigate?
Missing configuration dependencies like ConfigMaps or Secrets prevent container configuration creation.
Why this answer
CreateContainerConfigError typically occurs when a referenced ConfigMap or Secret does not exist or is misspelled in the pod specification.
An administrator needs to list all Services across all namespaces in the OpenShift cluster. Which command should be used?
The -A flag is shorthand for --all-namespaces, displaying services cluster-wide.
Why this answer
The --all-namespaces or -A flag with oc get services lists services across every namespace.
An administrator needs to troubleshoot an image pull failure caused by missing credentials. Which TWO locations or methods can be used to associate an image pull secret with a workload in OpenShift? (Choose TWO)
Linking a secret to a ServiceAccount automatically populates imagePullSecrets for any pods using that ServiceAccount.
Why this answer
Image pull secrets can be referenced directly in the pod template spec under imagePullSecrets, or linked directly to the ServiceAccount used by the pods.
An administrator needs to test internal cluster DNS resolution from a temporary troubleshooting pod. Which command creates a temporary pod with the 'dig' utility installed for DNS debugging?
This command spins up a temporary interactive container using a support image equipped with DNS diagnostic tools.
Why this answer
The 'oc debug' command or running a temporary debug pod using 'oc run' with an image containing DNS tools (like utils or busybox) is standard. Specifically, 'oc run' with an interactive shell or debug container provides access.
Which TWO statements are true regarding OpenShift Services of type LoadBalancer? (Choose TWO)
External load balancers require cloud controllers or MetalLB to assign the external IP.
Why this answer
LoadBalancer services provision external load balancers via cloud provider integrations and automatically program NodePort mappings underneath.
Which THREE of the following mechanisms can be used to automatically trigger a new build in an OpenShift BuildConfig? (Choose three.)
An ImageChange trigger initiates a build whenever the referenced ImageStreamTag changes.
Why this answer
BuildConfigs support webhook triggers (GitHub, Generic), image change triggers (when a base image updates), and configuration change triggers (when the BuildConfig itself changes).
An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?
ResourceQuotas constrain aggregate resource consumption across all pods and objects within a namespace.
Why this answer
A ResourceQuota object sets hard resource consumption limits (such as limits.cpu and limits.memory) enforced per namespace.
An administrator receives an alert that the Cluster Monitoring Operator is degraded because Prometheus cannot scrape metrics from a custom application namespace. Where should the administrator check to verify the ServiceMonitor configuration targeting the application?
Checking the ServiceMonitor resource confirms correct label selectors and endpoint configurations for Prometheus scraping.
Why this answer
ServiceMonitor custom resources define how Prometheus scrapes application endpoints, and checking their status or YAML spec is essential.
Which TWO of the following tasks can a user with the default OpenShift 'admin' role perform within their project? (Choose TWO)
Admins have full CRUD access to application workloads in their namespace.
Why this answer
The 'admin' role permits managing project resources as well as creating and modifying Roles and RoleBindings within the project.
Which THREE of the following objects can be used to enforce resource governance and consumption limits within an OpenShift project? (Choose THREE)
LimitRanges enforce minimum, maximum, and default container resource constraints within a namespace.
Why this answer
Resource quotas, limit ranges, and cluster resource quotas are core mechanisms for managing resource constraints in OpenShift.
An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?
ovs-ofctl allows administrators to view OpenFlow flow tables and rule matches/actions on OVS bridges.
Why this answer
ovs-ofctl is used to inspect and manipulate OpenFlow rules in Open vSwitch bridges, which underpin OVN-Kubernetes data paths.
A node in an OpenShift cluster goes into 'NotReady' status. The administrator uses 'oc debug node/<node-name>' to inspect the node's root filesystem. Where are the host's system logs mounted inside the debug chroot environment?
The host root filesystem is mounted at /host, so host system logs are located at /host/var/log.
Why this answer
When using oc debug to access a node, the host's root filesystem is mounted under /host, making host logs available under /host/var/log.
An administrator needs to delete a Service named 'old-service' in the 'test' namespace. Which command accomplishes this?
This command correctly deletes the service in the specified namespace.
Why this answer
The oc delete service command removes the specified service resource.
You have a S2I build that fails because the builder image is not accessible by the restricted ServiceAccount. What is the most secure way to resolve this?
This grants the necessary permissions to pull images from other namespaces.
Why this answer
Granting the 'system:image-puller' role to the ServiceAccount in the namespace where the image exists allows the builder to pull the image.
An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?
The OIDC provider spec supports mapping claims (such as group memberships) to OpenShift groups via the claims.groups field.
Why this answer
In OpenShift OAuth OIDC configuration, group claims are specified under the 'claims.groups' field of the identity provider specification.
You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?
Reading endpoints across the cluster requires apiGroups [''] and resource 'endpoints' with get, list, watch verbs.
Why this answer
To scrape metrics or read endpoints across namespaces, the apiGroups must include '' (core) and metrics (if custom metrics API), but for standard core endpoints, apiGroups: [''], resources: ['endpoints'].
Which TWO options are valid methods to check service endpoints in OpenShift? (Choose TWO)
oc get endpoints lists all backend IP addresses and ports mapped to services.
Why this answer
Endpoints can be inspected using 'oc get endpoints' or 'oc describe service'.
Which built-in OpenShift role provides permissions to view all resources within a project but cannot see secrets or bindings? Wait, let's test: Which default role allows modifying resources in a project while excluding permission to modify RBAC roles and role bindings?
The 'edit' role permits modifying application workloads without granting permission to escalate privileges via RBAC manipulation.
Why this answer
The 'edit' role allows a user to create, modify, and delete most project resources, but prevents them from modifying Roles or RoleBindings.
Which TWO of the following are valid ways to secure a route?
This is a standard secure configuration.
Why this answer
Route security can be handled by choosing the right termination mode and using proper certificates.
Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?
Deleting the user resource via 'oc delete user' removes the user from OpenShift.
Why this answer
The 'oc delete user old-user' command removes the user resource from the cluster database.
A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?
LimitRanges support defining maximum and minimum constraints for persistent volume claims within a namespace.
Why this answer
ResourceQuotas can enforce storage request limits (e.g., 'requests.storage') across a namespace. To enforce a maximum size per individual PVC, a ResourceQuota with scope selectors or specific limits can be used, but OpenShift ResourceQuotas can also track max storage per PVC using standard quota objects.
A cluster administrator has created a new ProjectRequest template to ensure that every newly created project automatically includes a predefined LimitRange. Where must this template be configured so that it applies cluster-wide to all new projects?
Correct. OpenShift uses the project.config.openshift.io/cluster resource to reference the template used for project requests.
Why this answer
The project request template must be referenced in the cluster-wide Project configuration object located at the cluster resource named 'project.config.openshift.io/cluster'.
An administrator wants to check cluster networking and SDN communication. Which TWO commands can be used to gather network-related diagnostic information? (Choose TWO)
Displays the status and availability of the cluster network operator.
Why this answer
oc get clusteroperator network and inspecting OVN/SDN daemonset pod logs are key network troubleshooting steps.
An application pod is experiencing intermittent network drops. The administrator wants to capture network packets passing through the pod's interface for analysis. Which tool can be used inside a debugging session attached to the pod namespace?
oc debug allows capturing traffic by attaching to the pod's network namespace.
Why this answer
Using oc debug to attach to the target pod allows running tcpdump if diagnostic utilities are included in the debug container image.
An administrator notices that the 'storage' ClusterOperator is degraded. Which TWO resources or logs should be inspected to diagnose the underlying CSI driver or provisioner failure? (Choose TWO)
Shows detailed status conditions and error messages reported by the storage operator.
Why this answer
Inspecting the cluster operator status YAML and the logs of the cluster storage operator or CSI provisioner pods provides targeted diagnostic data.
An administrator needs to configure custom container runtime parameters (such as the maximum pod log size or maximum number of processes per container) across all worker nodes in an OpenShift 4.14 cluster. Which custom resource should the administrator create?
The ContainerRuntimeConfig custom resource allows administrators to customize CRI-O settings across a MachineConfigPool.
Why this answer
Container runtime settings such as max log size and storage options are managed using the ContainerRuntimeConfig custom resource in OpenShift.
An administrator is configuring ephemeral storage limits for containers in a namespace. Where must these limits be defined to enforce maximum local scratch space usage per container?
LimitRange objects enforce compute and ephemeral storage constraints per container or pod in a namespace.
Why this answer
Local ephemeral storage requests and limits can be enforced across a namespace using a LimitRange object.
An administrator is reviewing PersistentVolumes and notices several PVs stuck in a Terminating state. What is the most common reason a PV cannot be deleted immediately?
Volume attachments and finalizers prevent premature PV deletion while in use.
Why this answer
A PV in Terminating state usually has a finalizer attached or is still actively mounted/attached by a node/CSI driver attachment object that hasn't cleaned up.
An administrator needs to deploy a StorageClass that automatically provisions volumes only when a PersistentVolumeClaim is created and consumed by a Pod. Which StorageClass parameter determines this behavior?
Correct. This ensures that the PV is provisioned only when the pod requiring it is scheduled, enabling topology-aware provisioning.
Why this answer
The volumeBindingMode parameter in a StorageClass controls when volume binding and dynamic provisioning should occur. Setting it to WaitForFirstConsumer delays volume binding and provisioning until a Pod using the PVC is scheduled.
An administrator configures an EgressFirewall in a namespace to deny all external traffic except for a specific CIDR block. In what order are the rules in an EgressFirewall evaluated?
EgressFirewall rules are processed strictly in order, similar to traditional firewall ACLs.
Why this answer
EgressFirewall rules are evaluated in sequential order from top to bottom, and the first matching rule dictates whether traffic is allowed or denied.
Which TWO deployment triggers are supported by a DeploymentConfig?
Triggers on DC changes.
Why this answer
DeploymentConfigs natively support ImageChange and ConfigChange triggers.
Which TWO commands are used to check the health and status of the cluster networking operator? (Choose TWO)
Provides detailed status and error conditions for the network operator.
Why this answer
oc get clusteroperators and oc describe clusteroperator network are correct.
A cluster uses a CSI driver that does not support volume expansion. A user edits an existing PVC to request a larger size. What action does the OpenShift API server take?
CSI capability checks prevent unauthorized or unsupported volume expansions.
Why this answer
If expansion is not supported by the driver or allowed by the StorageClass, the API server rejects the update or the resize controller marks the expansion condition as unsupported/failed.
An OpenShift cluster is configured with a custom Cluster Network CIDR. An administrator needs to verify the cluster network subnet settings and host subnet assignments. Which operator status or configuration resource contains this cluster-wide network configuration?
This cluster-scoped configuration resource defines the cluster network CIDRs and network type.
Why this answer
The networks.config.openshift.io cluster singleton resource holds the cluster network, service network, and CNI provider configuration.
A pod in the 'production' namespace is crashing repeatedly due to a segmentation fault in the application binary. The administrator needs to inspect the file system of the crashing container without altering the deployment spec permanently. Which command is most appropriate?
oc debug creates a troubleshooting container attached to the pod namespace for inspection.
Why this answer
oc debug with a pod target creates a debugging pod that shares the namespace and mounts the containers of the target pod, allowing file system inspection.
An administrator wants to check the status of all api-server instances in the cluster. Which TWO commands are helpful? (Choose TWO)
Lists the running API server pods across control plane nodes.
Why this answer
Checking the kube-apiserver cluster operator and listing API server pods provides status information.
An OpenShift cluster's Ingress controller is failing to route external traffic because the router pods are crashing with 'Bind: address already in use'. What is the most likely cause that an administrator should investigate?
Binding collisions happen when ports 80/443 are already occupied on the host network namespace.
Why this answer
HostPort or hostNetwork conflicts occur when multiple router replicas or daemonsets attempt to bind to ports 80 and 443 on the same worker node interface.
Setting insecureEdgeTerminationPolicy to Redirect instructs the router to send a 301 redirect for HTTP requests.
Why this answer
Insecure edge termination policy can be set on the Route resource itself using the spec.tls.insecureEdgeTerminationPolicy field set to Redirect.
Which THREE parameters are commonly found in the SCC 'spec' section?
This controls SELinux labels.
Why this answer
SCCs control security via fields like 'seLinuxContext', 'runAsUser', and 'capabilities'.
An administrator needs to drain a worker node safely for hardware maintenance, but some pods have local emptyDir storage that would be permanently deleted. Which flag must be added to the drain command to allow eviction of these pods?
This flag allows draining nodes even when pods contain local emptyDir volumes.
Why this answer
Pods with emptyDir volumes are protected by default during drains. The --delete-emptydir-data flag overrides this protection.
An administrator wants to check whether any worker nodes in an OpenShift 4.14 cluster are currently unschedulable (cordoned). Which command provides this information quickly?
Cordoned nodes show 'SchedulingDisabled' in the STATUS column of 'oc get nodes'.
Why this answer
The 'oc get nodes' command displays node status, including whether scheduling is disabled (SchedulingDisabled).
An administrator needs to expose an existing deployment using a quick command without writing a YAML manifest. Which command exposes port 8080 of a deployment named 'my-app' as a Service?
This command correctly exposes the deployment on port 8080.
Why this answer
The oc expose deployment command creates a service matching the deployment's pods and exposes the specified port.
When configuring a custom build strategy, where do you define the Dockerfile to use?
The strategy section contains the build process details including the Dockerfile source.
Why this answer
In the BuildConfig, under the 'strategy' block, you can specify the Dockerfile context or explicitly define the Dockerfile source.
An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?
Correct. Namespaced Roles only apply to the namespace in which they are created.
Why this answer
A standard Role and RoleBinding are strictly namespace-scoped. A Role in namespace A cannot grant permissions to resources in namespace B. To grant cross-namespace access, a ClusterRole must be used with either a RoleBinding (in the target namespace) or a ClusterRoleBinding.
When draining a worker node in OpenShift 4.14, which type of pod running on the node will typically be blocked from eviction unless explicitly ignored or handled?
Naked pods will prevent eviction unless '--force' is supplied because losing them results in immediate workload termination.
Why this answer
Pods that are not managed by a ReplicationController, ReplicaSet, Job, DaemonSet, or StatefulSet (often called naked pods) are not safely replicated and require '--force' or special handling during drainage.
An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)
Correct. A custom Role defines the exact API permissions permitted within the namespace.
Why this answer
To implement custom restrictions when predefined roles are too broad, an administrator must create a custom Role with explicit rules (allowing pods and services, denying or omitting secrets), and bind it to the contractors group via a RoleBinding in the staging namespace.
When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?
An HTPasswd identity provider references a Secret containing the htpasswd formatted file.
Why this answer
HTPasswd identity providers require a Secret containing the htpasswd file data referenced by the OAuth configuration.
An administrator needs to provision persistent storage dynamically using an NFS server. Which provisioner is required in the StorageClass definition since OpenShift removed the in-tree NFS provisioner?
This external provisioner correctly supports dynamic NFS provisioning via subdirectories.
Why this answer
OpenShift removed in-tree provisioners. The external NFS subdir external provisioner is the standard Red Hat-supported way to dynamically provision NFS volumes.
An administrator needs to tail the logs of all pods with the label 'tier=frontend' across the current namespace. Which command should be used?
The -l flag allows filtering logs by label selector across matching pods.
Why this answer
oc logs with the label selector flag (-l) streams logs from all matching pods simultaneously.
A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?
This command prints all subjects bound to the cluster-admin cluster role, allowing filtering for kind: User.
Why this answer
Inspecting the 'cluster-admin' ClusterRoleBinding object using jsonpath or yaml output displays all subjects (users, groups, service accounts).
Which command allows an administrator to view details of a specific project named 'web-app', including its annotations and status?
Describing a project resource outputs its full status, labels, annotations, and associated namespace details.
Why this answer
The 'oc describe project web-app' command displays detailed information about the project resource.
Which TWO service accounts have special roles in OpenShift projects regarding SCCs?
The default service account is used by pods.
Why this answer
The 'default' and 'builder' service accounts are commonly used and often have pre-configured roles.
An administrator notices that the Cluster Version Operator (CVO) is blocked during an upgrade because a cluster operator is missing version annotations. Which command allows checking the current status and payload version of the CVO?
oc get clusterversion displays the cluster's upgrade progress, version, and working status.
Why this answer
oc get clusterversion provides the high-level status of the cluster upgrade, available updates, and active version history.
An administrator is troubleshooting a multi-tenant environment where a project administrator of the 'team-a' namespace attempts to bind the cluster-admin ClusterRole to a user in their namespace using a RoleBinding. What is the expected outcome of this operation?
Using a RoleBinding to reference the cluster-admin ClusterRole grants full administrative permissions within that specific namespace only.
Why this answer
A RoleBinding can reference a ClusterRole, which grants the permissions of that ClusterRole scoped to that namespace. However, binding cluster-admin via a RoleBinding grants full admin privileges *within that namespace*, not cluster-wide.
An administrator wants to check the status of all Certificate Signing Requests (CSRs) in an OpenShift 4.14 cluster, specifically looking for pending node certificates. Which command should be used?
oc get csr lists certificate requests and their approval status.
Why this answer
The 'oc get csr' command lists all certificate signing requests, allowing administrators to approve pending node bootstrapping certificates if necessary.
When configuring a NetworkPolicy in OpenShift, which THREE options represent valid components or fields within a NetworkPolicy specification? (Choose THREE)
podSelector determines which pods the policy applies to.
Why this answer
NetworkPolicy specifications include podSelector, policyTypes, and ingress/egress rule blocks.
Which THREE items are contained within a Helm Chart structure?
The default configuration file.
Why this answer
A chart contains metadata (Chart.yaml), templates, and values.
An administrator needs to verify that the cluster autoscaler is successfully scaling worker nodes in response to pending pods. Which custom resource should the administrator inspect to check the autoscaler configuration and status?
ClusterAutoscaler defines cluster-wide autoscaling limits, and MachineAutoscaler targets specific MachineSets.
Why this answer
Cluster scaling parameters and status are managed and viewed via the ClusterAutoscaler and MachineAutoscaler custom resources in OpenShift.
An administrator needs to ensure that if a worker node freezes or becomes unresponsive for more than 5 minutes, the cluster automatically remediates it by deleting and recreating the underlying virtual machine instance. Which OpenShift 4.14 feature should the administrator configure?
A MachineHealthCheck monitors node conditions and triggers remediation (machine deletion/recreation) if nodes fail.
Why this answer
MachineHealthCheck allows administrators to define criteria (such as node not ready conditions) and automatically remediate unhealthy nodes by deleting their corresponding Machine objects.
You need to assign the 'cluster-reader' ClusterRole to an LDAP group named 'ldap-auditors' across the entire cluster. Which command accomplishes this?
This command creates a ClusterRoleBinding associating the cluster-reader role with the specified LDAP group.
Why this answer
The 'oc adm policy add-cluster-role-to-group' command correctly binds a cluster role to a group cluster-wide.
Which tool should be used to troubleshoot why an SCC is being rejected for a pod?
This tool reviews pod specifications against available SCCs.
Why this answer
The 'oc adm policy scc-review' command helps determine why an SCC is or is not being assigned.
An administrator needs to check the cluster events across all namespaces sorted by timestamp to identify recent infrastructure warnings. Which command should they use?
This command sorts cluster events chronologically to trace recent issues.
Why this answer
oc get events --sort-by='.metadata.creationTimestamp' lists all events ordered by creation time.
You need to assign a custom ClusterRole named 'operator-viewer' to all authenticated users cluster-wide. Which command accomplishes this?
Binding the role to the 'system:authenticated' group via a ClusterRoleBinding applies it to all logged-in users cluster-wide.
Why this answer
The 'oc adm policy add-cluster-role-to-group' command binding to the 'system:authenticated' group achieves this.
An administrator observes that a specific node has high CPU utilization and wants to identify which processes or containers are consuming the most resources on that host directly. Which command-line tool executed inside an oc debug session on the node is best suited for interactive process monitoring?
Spawning a debug shell with chroot /host allows running standard Linux diagnostic utilities like top.
Why this answer
Running 'top' or 'htop' inside an oc debug chroot environment provides real-time CPU and memory consumption of processes on the host.
You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?
The core API group handles ConfigMaps and Secrets, and these verbs cover full read/write access.
Why this answer
ConfigMaps and Secrets belong to the core API group ('') and their resource names are 'configmaps' and 'secrets'.
A developer needs to configure a Pod where multiple containers need concurrent read-write access to the exact same PersistentVolumeClaim. Which access mode is mandatory on the PVC?
ReadWriteMany allows mounting by multiple nodes/pods for concurrent read-write access.
Why this answer
ReadWriteMany (RWX) or ReadWriteOncePod (RWOP) can be used, but for multiple containers across nodes (or even multiple containers on the same node wanting shared concurrent write access without conflict), RWX is required. Wait, multiple containers in the *same* pod can share a single RWO volume because they share the same node and mount namespace context. However, across pods or when explicitly sharing, RWX is the classic answer.
Let's frame it as multiple pods or general multi-reader/writer access.
You are examining a PersistentVolume in OpenShift and notice its status is Released. What does this indicate?
Released means the claim is gone, waiting for automated recycling/deletion or manual admin handling.
Why this answer
The Released status means the PVC that was bound to the PV has been deleted, but the volume has not yet been reclaimed according to its reclaim policy.
A developer deploys a pod with an emptyDir volume. The application running inside writes temporary files. What happens to these files when the container crashes and restarts within the same pod?
Container restarts do not clear emptyDir storage; only pod termination does.
Why this answer
An emptyDir volume survives container crashes and restarts; it is only deleted when the pod itself is removed from the node.
Practice EX280 by domain
Target a specific domain to shore up weak areas.