OpenShift EX280 Practice Tasks: 25 Original Labs With Solutions

Quick answer: EX280 is Red Hat's hands-on OpenShift administration exam, which earns the Red Hat Certified System Administrator in OpenShift credential. It is graded on the final state of a live cluster, so the best practice is to perform real tasks: projects and RBAC, deployments, routes, storage, secrets, quotas, network policies and troubleshooting. The labs below are original tasks mapped to the public objective areas. Red Hat notes that more than one exam version can be in use, so confirm yours in its Learning Management System.

Key takeaways

• EX280 is performance-based; marks come from the end state of the cluster.
• Practise each task until it works without notes and survives a pod restart.
• Avoid exam dumps; sharing real items breaks Red Hat's exam agreement.
• Check your exam version and objectives in Red Hat's learning portal.
• Learn oc explain and --dry-run=client -o yaml to work fast.

Table of Contents

• How Do You Set Up a Practice Cluster?
• Projects, Users and RBAC
• Deploying and Exposing Applications
• Configuration, Secrets and Storage
• Quotas, Limits and Scaling
• Security Contexts and Network Policies
• Troubleshooting Tasks
• A Four-Week Practice Plan
• References

How Do You Set Up a Practice Cluster?

Use OpenShift Local (formerly CodeReady Containers) on a workstation with enough memory, or the Red Hat Developer Sandbox for short sessions. Cluster-admin tasks such as identity providers need OpenShift Local or a lab cluster.

crc setup
crc start
eval $(crc oc-env)
oc login -u kubeadmin https://api.crc.testing:6443
oc whoami; oc get nodes

Projects, Users and RBAC

htpasswd -c -B -b users.htpasswd alice Redhat123
htpasswd -B -b users.htpasswd bob Redhat123
oc create secret generic htpass-secret --from-file=htpasswd=users.htpasswd -n openshift-config
oc edit oauth cluster          # add an HTPasswd identityProvider referencing htpass-secret
oc new-project finance --display-name="Finance Apps"
oc policy add-role-to-user edit alice -n finance
oc adm groups new auditors bob
oc policy add-role-to-group view auditors -n finance
oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth

Deploying and Exposing Applications

oc create deployment web --image=registry.access.redhat.com/ubi9/httpd-24 -n finance
oc expose deployment web --port=8080
oc expose service web --hostname=web.apps-crc.testing
oc create route edge web-tls --service=web --hostname=secure.apps-crc.testing
oc set probe deploy/web --readiness --get-url=http://:8080/ --initial-delay-seconds=5
oc rollout undo deploy/web

Configuration, Secrets and Storage

oc create configmap web-cfg --from-literal=MODE=prod
oc set env deploy/web --from=configmap/web-cfg
oc create secret generic db-cred --from-literal=password=S3cret
oc set env deploy/web --from=secret/db-cred
oc set volume deploy/web --add --name=data --type=pvc --claim-name=web-data \
  --claim-size=1Gi --mount-path=/data

Quotas, Limits and Scaling

oc create quota finance-q --hard=pods=4,requests.cpu=2 -n finance
oc set resources deploy/web --requests=cpu=100m,memory=128Mi --limits=cpu=500m,memory=256Mi
oc scale deploy/web --replicas=3
oc autoscale deploy/web --min=2 --max=5 --cpu-percent=70
oc adm create-bootstrap-project-template -o yaml > template.yaml

Security Contexts and Network Policies

oc create sa legacy-sa
oc adm policy add-scc-to-user anyuid -z legacy-sa
oc set serviceaccount deploy/legacy legacy-sa
cat <<'EOF' | oc apply -n db -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-finance
spec:
  podSelector: {}
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: finance
EOF

Troubleshooting Tasks

oc get events -n finance --sort-by=.lastTimestamp | tail
oc logs deploy/web --previous
oc debug deploy/web
oc adm must-gather    # cluster-wide diagnostics

A Four-Week Practice Plan

1. Week 1: tasks 1 to 10 daily until each takes under five minutes.
2. Week 2: tasks 11 to 19, rebuilding from an empty project each time.
3. Week 3: tasks 20 to 25 and mixed sets of ten under a timer.
4. Week 4: full mock runs, then re-check every result from a fresh login.

Our DO280 and EX280 practice guide and OpenShift architect path continue from here, or talk to a WebAsha training advisor about DO280 batches.

References

• Red Hat, EX280 exam page
• OpenShift documentation