Edit the subscription/app definition to include a time window (active or blocked window).

Attempt a change outside the window and observe behavior (no rollout until window).

Confirm rollout during window.

On hub: inspect managed cluster conditions for certificate issues.

Check pending CSRs (if applicable in your lab):

oc get csr

Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate-driven trust is core to “secure clusters” operations in ACM.

Apply the subscription/application manifest:

oc apply -f application-subscription.yaml

Confirm resources were created:

oc get applications.app.k8s.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc describe application.app.k8s.io my-app -n < namespace >

Watch placement/propagation (varies by model used in the lab):

oc get placement -A

oc get placementrule -A

Why this matters:

ACM “application” deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.

Create the ManagedClusterSet:

oc create managedclusterset development

Confirm it exists:

oc get managedclusterset

oc describe managedclusterset development

Why these steps matter:

ClusterSets are an ACM grouping primitive used for RBAC scoping , governance targeting, and multi-cluster app placement.

Patch remediation to inform:

oc patch policy policy-ensure-audit-namespace -n team-dev --type=merge -p '{"spec":{"remediationAction":"inform"}}'

Verify:

oc get policy policy-ensure-audit-namespace -n team-dev -o yaml | grep remediationAction -n

Observe compliance changes (policy will report but not auto-fix).

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

Open the ACM console on the hub.

Navigate to Governance → Policies .

Click Create policy .

Set Name : policy-etcd.

Choose the policy template/type ETCD Encryption .

Set Remediation action to enforce .

inform = report only

enforce = attempt to automatically remediate to desired state

Select clusters/ClusterSets to apply (depends on the wizard).

Click Submit .

Verify compliance once applied:

In console, check policy status: Compliant/NonCompliant

Or via CLI:

oc get policy -A

oc describe policy policy-etcd -n < policy-namespace >

Why this matters:

Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.