Solution:

$ oc project gru

$ oc get pods

$ oc get all | grep deployment

$ oc scale --replicas=5 deployment.apps/minion

$ oc get pods

Solution:

Switch to the project hosting the cronjob, if needed:

oc project cron-test

Create the service account:

oc create sa jupiter

Grant anyuid:

oc adm policy add-scc-to-user anyuid -z jupiter -n cron-test

Grant cluster-admin:

oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:cron-test:jupiter

Update the cronjob:

oc patch cronjob cron-test -p '{"spec":{"jobTemplate":{"spec":{"template":{"spec":{"serviceAccountName":"jupiter"}}}}}}'

Verify:

oc get cronjob cron-test -o yaml | grep serviceAccountName

Notes:

The uploaded lab uses oc set sa cronjob.batch/cron-test jupiter, which is not the usual command form for CronJobs. Patching the pod template is the reliable method.

This task checks service account and privilege adjustments for scheduled workloads.

Solution:

Create a file named mysql-db-conn.yaml:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: mysql-db-conn

spec:

podSelector:

matchLabels:

networking.k8s.io/v1/network: database

policyTypes:

- Ingress

ingress:

- from:

- namespaceSelector:

matchLabels:

team: devsecops

podSelector:

matchLabels:

deployment: my-web-mysql

ports:

- protocol: TCP

port: 3306

Apply it:

oc apply -f mysql-db-conn.yaml

Verify:

oc get networkpolicy

oc describe networkpolicy mysql-db-conn

This task tests namespace/pod label selection and application isolation using OpenShift networking policy controls.

Solution:

Run must-gather:

oc adm must-gather

Confirm the directory created, usually something like:

ls

Archive the directory:

tar -cvzf system10-4ktjl-l4kj5l-lk45j.tar.gz must-gather.local.*

Verify:

ls -lh *.tar.gz

Notes:

The lab text shows a tar command without source paths. A valid tar command must include the source directory or files.

Use the actual must-gather output directory generated in your environment.

This task validates support-data collection and cluster diagnostics handling.

Solution:

$ oc project manhattan

$ oc create quota ex280-quota -- hard=memory=1Gi,cpu=2,pods=3,services=6,replicationcontrollers=3

$ oc get resourcequota

Solution:

Switch to the quart project:

oc project quart

Create the secure route:

oc create route edge htquart \

--service=httpd \

--hostname=quart.apps.ocp4.example.com \

--cert=./req.crt \

--key=./req.key

Verify:

oc get route htquart

oc describe route htquart

Test resolution and access if DNS is available:

curl -k https://quart.apps.ocp4.example.com

This task checks route exposure, TLS termination, and secure ingress administration.