509 questions total · 7pages · All types, answers revealed
What is the purpose of the 'postCommit' hook in a BuildConfig?
It provides a stage to run validation checks within the build container.
Why this answer
The postCommit hook allows you to run commands or tests inside the container after the image is built but before it is pushed.
Which component in OpenShift 4.14 serves as the API entry point for managing MachineAPI resources like Machines and MachineSets?
The Machine API Operator manages the controllers and CRDs for machines.
Why this answer
The Machine API Operator provides the custom resource definitions and controllers for managing Machine and MachineSet objects.
A cluster administrator has created a VolumeSnapshotClass and a VolumeSnapshot object targeting an active PVC. However, the VolumeSnapshot status never shows ready to use, and the underlying storage provider logs indicate snapshot creation failed due to missing cluster permissions. Which core OpenShift operator is primarily responsible for managing volume snapshot controllers and CRDs in OpenShift 4.14?
Correct. The Cluster Storage Operator manages the storage components, including deploying the Volume Snapshot Controller and related CustomResourceDefinitions across the cluster.
Why this answer
The OpenShift Storage Operator or specialized CSI operator handles deployment of the snapshot controller, but the cluster-storage-operator or ODF operator manages the storage stack components. Specifically, snapshot validation and controller logic are typically driven by the external snapshot controller deployed via the Cluster Storage Operator or CSI addon operator.
Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?
SecurityContextConstraints (or 'scc' for short) is a cluster-scoped resource listable via 'oc get scc'.
Why this answer
The 'oc get scc' command lists all SecurityContextConstraints available in the cluster.
An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?
Because RBAC is purely additive, you cannot deny an action if a user holds a role ('admin') that grants it; you must replace the role with a restricted custom role.
Why this answer
RBAC in Kubernetes/OpenShift is strictly additive. To deny a specific action like deletion while granting admin, a custom role and binding cannot deny by default unless using specialized admission webhooks or custom authorization webhooks. Wait, Kubernetes RBAC does not support explicit denies.
However, you can create a custom role without delete verbs and bind that, but if they have 'admin', they keep admin unless you remove it. To truly restrict specific verbs when using built-in roles, you cannot override unless you modify the role or use a custom authorization webhook/admission control. Let's check alternative mechanisms: Exclusion is handled by custom RBAC roles instead of 'admin', or using admission webhooks.
Since standard RBAC is additive, a user cannot have 'admin' and simultaneously be denied a subset via RBAC alone without replacing the role. Let's frame the question around replacing 'admin' with a custom role that omits delete verbs.
Which TWO tasks are typically performed by an OpenShift cluster administrator when managing worker node lifecycles? (Choose TWO)
Preparing nodes for maintenance requires cordoning and draining.
Why this answer
Administrators manage worker node lifecycles by cordoning and draining nodes for maintenance and labeling them for custom pools.
Which service account is used by default for pods that do not specify a service account in their manifest?
Every namespace has a 'default' service account for this purpose.
Why this answer
The 'default' service account is used when none is provided.
Which THREE components are typically deployed as part of a CSI driver architecture on OpenShift worker nodes and control planes?
Node plugins handle mounting and staging on individual nodes.
Why this answer
CSI architecture consists of external controllers (provisioner, attester, snapshotter, resizer) on control planes and CSI node plugins (node registrar, plugin daemonset) on worker nodes.
An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?
If selectors do not match pods, no endpoints are generated, causing the router to return a 503 error.
Why this answer
A 503 error with zero endpoints typically indicates that the selector in the Service definition does not match the labels on any running pods.
The 'dns' ClusterOperator is reporting Degraded=True because CoreDNS pods are failing health checks. The administrator suspects DNS request loops or upstream forwarding failures. Which log source is most effective for diagnosing CoreDNS resolution errors?
CoreDNS pods deployed by the DNS operator log all query resolutions and errors in the openshift-dns namespace.
Why this answer
CoreDNS runs as a deployment in the openshift-dns namespace. Its pod logs show incoming query failures and forwarding timeouts.
Which TWO of the following mechanisms can prevent developers from exhausting cluster memory resources through unbounded pod creation in a namespace? (Choose TWO)
LimitRanges ensure containers receive sensible default memory limits if omitted.
Why this answer
ResourceQuotas and LimitRanges prevent unbounded consumption by setting hard aggregate limits and container request/limit defaults.
An administrator is preparing to perform maintenance on worker nodes in an OpenShift 4.14 cluster. Which TWO commands or actions are part of the standard workflow to safely prepare a node for maintenance? (Choose TWO)
Cordoning prevents new pods from being scheduled onto the node during maintenance.
Why this answer
To prepare a node for maintenance, the administrator must cordon it to prevent scheduling and drain it to evict workloads gracefully.
You are troubleshooting a TLS certificate issue on a route. Which command shows the current certificate status and details?
This provides detailed information about the route, including TLS status.
Why this answer
The 'oc get route' command with output formatting or 'oc describe route' is the standard way to inspect route TLS.
An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?
The 'lookup' method expects an existing identity-to-user mapping and will not auto-create user accounts.
Why this answer
The 'lookup' mapping method requires that both an Identity and a User object already exist and be linked; if not, authentication fails. (In contrast to 'add', which creates them).
An administrator wants to check the status of all cluster operators, specifically verifying that the Network and DNS operators are healthy. Which command should be run?
This command outputs the health status of all cluster operators.
Why this answer
The oc get clusteroperators command lists all cluster operators and their availability/health status.
What is the primary difference between PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs)?
PVs are the storage pieces; PVCs are the claims/requests consumed by pods.
Why this answer
PVs are actual storage resources in the cluster provisioned by admins, whereas PVCs are requests for storage made by users.
An administrator needs to configure a Route that handles encrypted communication both from the client to the router AND from the router to the backend pod. Which termination type is required?
Re-encrypt termination secures both legs of the journey: client-to-router and router-to-pod.
Why this answer
Re-encrypt termination decrypts TLS at the router and then re-encrypts a new TLS connection to the backend pod.
An administrator configures an Ingress resource in the 'web-apps' namespace to route traffic using the default OpenShift Ingress controller. The Ingress creation succeeds, but traffic to the hostname returns a 404 error. What is a common reason for this behavior in OpenShift?
Without an explicit ingressClassName or if it doesn't match the active IngressController, the controller ignores the resource.
Why this answer
OpenShift natively uses Route objects. While Ingress is supported, the Ingress controller watches Ingress objects, but custom annotations or missing paths/backend configurations or default controller sharding often require ensuring the Ingress class or annotations match the default router configuration. Alternatively, Ingress controllers in OpenShift require the ingress class name to be specified correctly (e.g., 'openshift-default').
A cluster administrator wants to create a VolumeSnapshot of a database PVC. Which API group must the VolumeSnapshotClass belong to?
VolumeSnapshot, VolumeSnapshotContent, and VolumeSnapshotClass all belong to snapshot.storage.k8s.io.
Why this answer
Volume snapshots are managed by the snapshot.storage.k8s.io API group.
A developer wants to ensure that a pod's temporary storage does not exceed 2Gi and that the pod is terminated or throttled if it exceeds this limit. Where should this ephemeral storage limit be declared?
ephemeral-storage is a standard resource type alongside CPU and memory in container resource specs.
Why this answer
Ephemeral storage limits and requests are declared in the container's 'resources.limits' and 'resources.requests' definitions within the Pod specification.
An administrator is configuring a new StorageClass in OpenShift Container Platform 4.14. Which TWO parameters or fields are valid and commonly used specifications within a StorageClass manifest? (Choose TWO)
Correct. reclaimPolicy determines whether dynamically created PVs are Deleted or Retained when their PVC is removed.
Why this answer
StorageClasses support fields such as provisioner, parameters, reclaimPolicy, volumeBindingMode, and allowVolumeExpansion. Among the choices, reclaimPolicy and volumeBindingMode are valid standard fields.
An administrator is investigating pod crash loops in a namespace. Which TWO commands are most useful for gathering initial diagnostic data about the crashing pods? (Choose TWO)
Displays pod events, exit codes, restart counts, and error reasons.
Why this answer
oc logs --previous and oc describe pod are the standard foundational commands for inspecting exit codes, termination reasons, and prior log output of crashing pods.
An administrator is managing an OpenShift 4.14 cluster and notices that a newly installed Operator fails to start because it requires a specific version of Kubernetes that is older than what OpenShift 4.14 provides. How does OLM handle Operator compatibility checks during subscription creation?
OLM inspects the CSV definitions and ensures compatibility with the cluster's Kubernetes API version before installation.
Why this answer
OLM checks the 'minVersion' and 'maxVersion' or 'capabilities' specified in the Operator's CSV against the cluster version and will not install an incompatible CSV, keeping the installation pending or failing.
An administrator is setting up a new custom MachineConfigPool for GPU-enabled worker nodes. After creating the MachineConfigPool resource, the administrator creates a MachineConfig that should apply exclusively to these nodes. What must the administrator include in the MachineConfig to ensure it only applies to the GPU pool?
MachineConfig objects require matching labels to be associated with custom MachineConfigPools.
Why this answer
MachineConfigs must include node role labels matching the MachineConfigPool (e.g., pools.operator.machineconfiguration.openshift.io/<pool-name>: '') so the MCO targets the correct nodes.
Which namespace contains the Machine Config Operator (MCO) and its associated daemon pods in OpenShift 4.14?
openshift-machine-config-operator is the namespace where the MCO controller and daemon run.
Why this answer
The MCO runs in the openshift-machine-config-operator namespace.
An administrator installed an Operator via OperatorHub and selected a specific update channel. Later, the administrator wants to switch the Subscription to a different update channel. How should this be performed?
Updating the channel in the Subscription resource tells OLM to look for updates in the new channel.
Why this answer
To change the channel, the administrator edits the Subscription custom resource and updates the 'spec.channel' field to the new channel name.
An administrator wants to verify node health and readiness across the cluster. Which TWO commands provide this information? (Choose TWO)
Provides detailed node capacity, allocations, and condition statuses.
Why this answer
oc get nodes and oc describe node provide node status and health conditions.
An administrator is examining the cluster architecture and core operators of OpenShift 4.14. Which THREE core operators run as part of the control plane and platform management? (Choose THREE)
Manages core platform upgrades.
Why this answer
Cluster Version Operator, Machine Config Operator, and Ingress Operator are core platform operators.
How do you view the currently active OAuth identity providers in an OpenShift cluster?
The cluster OAuth configuration object contains all providers.
Why this answer
The OAuth configuration is stored in the 'cluster' OAuth object.
Which THREE components are involved in TLS termination for routes?
The secret stores the TLS data.
Why this answer
Termination involves the ingress controller, the route object, and the secret containing the keys.
An administrator wants to stream logs from all pods belonging to a specific Deployment named 'web-frontend' in real-time. Which command achieves this?
Targeting the deployment with the -f flag streams logs from all pods managed by the deployment.
Why this answer
oc logs supports targeting a Deployment directly via the resource type, streaming logs from all associated pods.
An administrator is managing operator subscriptions and wants to ensure that an operator is automatically updated when new versions are released in the channel. Which THREE conditions or configuration settings must be satisfied? (Choose THREE)
OperatorGroups must allow the operator to operate in the desired namespace.
Why this answer
Automatic updates require installPlanApproval set to Automatic, a valid CatalogSource, and an active Subscription.
Which TWO of the following are valid ways to trigger a build in OpenShift?
Webhooks are standard triggers.
Why this answer
Builds can be triggered by manual user command or by a configured webhook.
An administrator is configuring a DeploymentConfig in OpenShift and wants to set up automated triggers for new rollouts. Which TWO trigger types are natively supported in a DeploymentConfig spec? (Choose two.)
ConfigChange is a native DeploymentConfig trigger type that rolls out a new revision when the DC template changes.
Why this answer
DeploymentConfigs support ConfigChange (triggering when the DeploymentConfig template changes) and ImageChange (triggering when a referenced ImageStream tag updates).
Which THREE actions can be performed using the oc rollout subcommand in OpenShift? (Choose three.)
oc rollout pause suspends automatic deployments.
Why this answer
oc rollout supports history, undo, pause, resume, and status. It does not support build or scale directly as primary subcommands.
Which THREE actions can be performed when managing Route objects in OpenShift? (Choose THREE)
Routes support these three TLS termination modes.
Why this answer
Routes support custom hostnames, path-based routing, and multiple TLS termination modes.
You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?
The HTPasswd secret containing the password file must reside in the 'openshift-config' namespace for the cluster-authentication-operator to mount it.
Why this answer
HTPasswd identity providers require the password file to be stored as a Secret in the 'openshift-config' namespace.
Which TWO methods can an administrator use to troubleshoot why a pod cannot connect to a remote Service? (Choose TWO)
Missing endpoints prevent service routing.
Why this answer
Checking service endpoints and testing connectivity with nc/telnet/curl are standard troubleshooting steps.
Which TWO actions can an administrator perform using the 'oc adm' command set related to cluster management? (Choose TWO)
'oc adm upgrade' is used to manage cluster versions and upgrades.
Why this answer
The 'oc adm' command group provides administrative utilities such as cordoning nodes and managing cluster upgrades.
An administrator wants to check the status of Machine API provisioning and verify that all machines are in a running state. Which TWO commands or resource inspections should the administrator perform? (Choose TWO)
oc get machines lists all machine instances and their provisioning phase.
Why this answer
Administrators inspect machines and machinesets using 'oc get machines' and 'oc get machinesets'.
During a troubleshooting session on a degraded cluster operator, an administrator finds that the operator's operand configuration is controlled by a Custom Resource (CR). Where is the most reliable place to look for error status messages reported by the operator controller loop regarding this CR?
Operators report reconciliation errors and conditions directly in the status section of their managed CRs.
Why this answer
Cluster operators store detailed status conditions, error messages, and reasons inside the status block of their specific Custom Resource instance.
Which OpenShift resource defines the desired state of a containerized application, including replica count and image version?
Deployments manage the desired state of replica sets.
Why this answer
A Deployment (or DeploymentConfig) object defines the desired state of the pods.
Which THREE components are part of a Kustomize configuration?
The main entry point.
Why this answer
Kustomize uses resources, patches, and a kustomization file to manage deployment overrides.
An administrator notices that client source IP addresses are lost when traffic hits a Service of type NodePort, appearing instead as a node IP. Which field in the Service specification should be changed to 'Local' to preserve client source IPs?
Setting externalTrafficPolicy to Local avoids second-hop routing and preserves the client source IP.
Why this answer
Setting externalTrafficPolicy to Local preserves the client source IP for NodePort and LoadBalancer services.
A BuildConfig uses an S2I strategy and needs to pull private base images from a secured external container registry. Where must the administrator configure the pull credentials so the builder pod can authenticate?
Build configs support pullSecret configurations to authenticate against private registries during image pulls.
Why this answer
BuildConfig objects use pushSecret or pullSecret configurations, specifically output.pushSecret for pushing images and source.secrets or a service account for pulling source/base images, but standard registry access for builds is often tied to the builder service account or a specified pushSecret/pullSecret. More precisely, pullSecret in the source or strategy block allows authenticating to registries.
A pod fails to start, and the event log shows a Multi-Attach error for volume 'pvc-xyz'. What is the root cause of this error?
RWO block storage can only be attached to one node at a time.
Why this answer
A Multi-Attach error occurs when a volume with ReadWriteOnce access mode is already attached to one worker node and another node attempts to mount it simultaneously (often during pod rescheduling or rolling updates).
An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?
Setting termination to passthrough ensures TLS is not terminated at the router.
Why this answer
A passthrough route requires setting tls.termination to passthrough.
Which YAML key in a StorageClass definition specifies the CSI plugin responsible for provisioning the storage?
provisioner defines the driver plugin name (e.g., ebs.csi.aws.com).
Why this answer
The 'provisioner' key in a StorageClass specifies the CSI driver or provisioner plugin name.
An administrator creates a StorageClass with volumeBindingMode: WaitForFirstConsumer. A user creates a PVC using this StorageClass. What will be the initial phase of the PVC?
The PVC remains Pending because binding and provisioning are deferred until pod scheduling.
Why this answer
When using WaitForFirstConsumer, a newly created PVC remains in the Pending state until a pod referencing it is created and scheduled.
How can you view the list of all SCCs available in the cluster?
This command lists all SCC resources.
Why this answer
The 'oc get scc' command lists all available security context constraints.
An administrator configures a Pod with a volume type of hostPath. What is a key security risk or operational limitation of using hostPath in a production multi-tenant OpenShift cluster?
hostPath bypasses container storage isolation, allowing direct access to the underlying node.
Why this answer
hostPath mounts node filesystem paths directly into containers, which can allow containerized workloads to read/write sensitive host files or compromise node security.
An administrator needs to check the IP address and network status assigned to a running pod. Which command displays this information quickly?
The -o wide output format includes the pod IP and assigned node name.
Why this answer
oc get pod <pod-name> -o wide displays additional details including the pod IP address and the node it is scheduled on.
An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?
This is the correct fully qualified domain name structure for internal cluster services.
Why this answer
The standard FQDN format for a Kubernetes service is <service-name>.<namespace>.svc.cluster.local.
An administrator needs to troubleshoot DNS resolution failures inside an application namespace. Which THREE resources or commands should they check? (Choose THREE)
Provides direct access to CoreDNS pod logs to check query resolution errors.
Why this answer
Checking CoreDNS operator status, testing DNS resolution inside a debug pod, and inspecting the DNS cluster operator configuration are essential steps.
An administrator needs to collect logs from all router pods in the 'openshift-ingress' namespace. Which TWO methods can achieve this? (Choose TWO)
Using the specific operator label selector retrieves logs from all matching router pods.
Why this answer
Targeting the deployment or using a label selector with oc logs retrieves logs from all router pods.
An OpenShift cluster administrator notices that API requests are taking an excessively long time to complete. They suspect etcd database bloat due to excessive ConfigMap creations. Which etcd maintenance command can be run inside an etcd pod to reclaim storage space after compaction?
etcdctl defrag reorganizes the etcd database file and frees up disk space on the underlying storage.
Why this answer
Etcd requires defragmentation (etcdctl defrag) after compaction to release free space back to the file system.
An administrator is inspecting an OpenShift 4.14 cluster and notices that the MachineConfigPool for workers is in a degraded state because a MachineConfig failed to apply. Where should the administrator look to find the exact error encountered by the Machine Config Daemon on the affected nodes?
The machine-config-daemon runs on every node and logs configuration application failures.
Why this answer
The Machine Config Daemon runs as a DaemonSet across all nodes in the openshift-machine-config-operator namespace. Its logs contain the exact ignition and file application errors.
Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)
The user object record is deleted from etcd.
Why this answer
Deleting a User object removes the user entity, but existing RBAC bindings referencing that username remain until cleaned up, and their active OAuth tokens are revoked.
Which command is used to start a new build from an existing BuildConfig named 'frontend'?
This is the correct command syntax to trigger a build.
Why this answer
The 'oc start-build' command triggers a new build for the specified BuildConfig.
Which THREE of the following are required when configuring an OIDC identity provider?
The secret is required for authentication.
Why this answer
OIDC requires specific parameters to identify the provider, client, and client secret.
A developer is using Kustomize to manage environment overlays (dev and prod) for an OpenShift application. Where should the common base resources be referenced in the prod/kustomization.yaml file?
Kustomize uses the resources field to include base directories or dependent manifest files.
Why this answer
Kustomize overlays reference shared base manifests using the resources field pointing to the relative path of the base directory.
An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?
Correct. The 'oc get user' command queries the API for the automatically generated User resource.
Why this answer
When an identity provider successfully authenticates a user, OpenShift automatically creates a corresponding User object. You can verify this with 'oc get user sarah'.
An administrator needs to identify worker nodes that require attention during an upgrade or maintenance. Which TWO conditions or states on a node object indicate potential issues or special maintenance states? (Choose TWO)
Indicates the node is cordoned and unschedulable.
Why this answer
SchedulingDisabled (cordoned) and NotReady indicate maintenance or health issues on nodes.
An administrator is troubleshooting a storage performance issue on an OpenShift cluster using Container Storage Interface (CSI) drivers. Which THREE actions or diagnostic commands are effective for investigating CSI driver health and provisioner issues? (Choose THREE)
Correct. CSIDriver and CSINode objects define cluster-wide integration parameters and node attachment states for the CSI driver.
Why this answer
To troubleshoot CSI drivers, administrators should examine logs of the CSI provisioner and attacher pods, inspect StorageClass definitions, and check PersistentVolumeClaim events. Examining systemctl on nodes or editing container runtimes directly does not target CSI control plane logic.
Where do you define the default image pull secrets for all service accounts in a namespace?
Linking the secret to the 'default' service account ensures it is used by pods that do not specify a service account.
Why this answer
You can link a secret to the 'builder' or 'default' service accounts, but creating a secret and linking it to the default service account is the standard method.
A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?
SCCs explicitly list authorized users, groups, and service accounts in their specification fields to grant access.
Why this answer
SCCs are cluster-scoped resources that grant permissions by referencing either users, groups, or service accounts directly within the SCC's 'users' or 'groups' lists, or by binding a ClusterRole/Role that allows the 'use' verb on the specific SCC resource.
Which command creates a new user identity mapping using the HTPasswd provider if configured, or views user details? Let's focus on user management: Which command lists all registered user objects in the OpenShift cluster?
'oc get users' retrieves the list of user resources recognized by the OpenShift master.
Why this answer
The 'oc get users' command lists all internal User objects created in the cluster.
An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?
Re-encrypt routes re-encrypt traffic from the router to the backend, requiring the router to trust the backend pod via a destination CA.
Why this answer
Re-encrypt routes require a destination CA certificate (spec.tls.destinationCACertificate) so the router can trust the backend pod's self-signed or internal certificate.
Which THREE of the following fields are required when defining a custom Role or ClusterRole resource YAML? (Choose THREE)
Every Kubernetes resource manifest requires apiVersion.
Why this answer
A Role or ClusterRole YAML requires 'apiVersion', 'kind', 'metadata' (with name), and 'rules' (with API groups, resources, and verbs).
An administrator needs to configure cluster-wide DNS forwarding for a specific custom domain (e.g., 'corp.local') to point to internal corporate DNS servers. Where is this configured in OpenShift 4.14?
The DNS operator provides the spec.servers configuration to forward queries for specific zones.
Why this answer
Cluster-wide DNS forwarding is configured by modifying the DNS custom resource named 'cluster' to include a forwardPlugin rule.
An OpenShift administrator needs to allow users to expand the storage capacity of existing PersistentVolumeClaims without restarting their applications. Which action must be taken first to enable this capability?
Correct. StorageClasses must explicitly permit volume expansion before any PVC referencing them can be resized.
Why this answer
To allow PVC expansion, the associated StorageClass must have the allowVolumeExpansion field set to true.
Which command checks if a specific service account can use a restricted SCC?
This is the correct command to verify if a service account has the 'use' verb for a specific SCC.
Why this answer
The 'oc adm policy can-i' command is used to verify permissions, including SCC usage.
A cluster administrator needs to inspect the current bindings and capacities of all PersistentVolumes across the entire OpenShift cluster. Which CLI command should be used?
oc get pv displays all PersistentVolumes cluster-wide.
Why this answer
'oc get pv' lists all PersistentVolumes cluster-wide.
During an S2I build, an administrator needs to pass sensitive build arguments, such as subscription keys, without hardcoding them into the BuildConfig or exposing them in the final image history. How should this be handled?
Build secrets can be securely mounted into the builder pod during the build process without being baked into the final image layers.
Why this answer
Secret mounting during builds allows referencing Kubernetes Secrets as build secrets that are available during the build process but not persisted in the output image layers.
A developer needs to expose a service via a route with re-encryption. What is required in the Route configuration?
This enables re-encryption termination mode.
Why this answer
Re-encryption requires a termination configuration that specifies the certificate for the route and potentially the certificate for the destination service.
Practice EX280 by domain
Target a specific domain to shore up weak areas.