Red Hat Certified System Administrator in OpenShift EX280 Roadmap

Start by making scope and evidence habitual. A performance-based exam rewards correct outcomes, but production-grade practice also requires knowing what changed and how to recover.

• Use explicit contexts and projects; inspect API resources, status, events, and logs
• Create projects with ownership, labels, ResourceQuota, LimitRange, and service accounts
• Author, validate, apply, patch, export, compare, and clean reusable YAML manifests
• Separate ConfigMaps from Secrets and eliminate server-generated fields from desired state
• Diagnose Pending, image-pull, restart, and quota failures from evidence
• Practice idempotent changes and verify both expected success and expected denial

Deploy applications as connected control loops rather than isolated objects.

• Create Deployments, Services, configuration, and image references with consistent labels
• Trace selector matching, ready endpoints, DNS, and application request paths
• Design startup, readiness, and liveness probes with distinct purposes
• Set requests and limits, scale inside quota, and investigate OOM and scheduling behavior
• Promote immutable image content, observe rollout history, inject a bad revision, and roll back
• Preserve prior logs and revision evidence before remediation

Distinguish identity establishment from permission evaluation, then delegate narrowly.

• Configure or reason about OAuth identity providers, identity mapping, groups, and recovery access
• Create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings at the correct scope
• Test effective access using the intended user or service account
• Avoid wildcards, shared credentials, and unnecessary service-account token mounts
• Build self-service with Templates, clear parameters, secure Secret generation, quota, and admission
• Run complete self-service tests as a developer rather than only as administrator

Convert observed traffic requirements into tested policy and choose exposure by protocol.

• Build source, destination, port, protocol, DNS, ingress, probe, and monitoring matrices
• Apply default-deny ingress and egress, then narrowly allow required paths
• Understand directional isolation and additive NetworkPolicy behavior
• Configure edge, re-encrypt, and passthrough Routes at appropriate TLS boundaries
• Use SNI correctly and avoid claiming HTTP path routing through passthrough encryption
• Evaluate LoadBalancer and NodePort Services for approved non-HTTP traffic
• Test public versus private reachability, certificates, source controls, health, and rollback

Finish with controller lifecycle and constrained workloads, then practice complete operations under time pressure.

• Review Operator sources, channels, scopes, permissions, dependencies, approval, and support
• Trace Subscription, InstallPlan, CSV, CRD, custom resource, controller, and operand state
• Plan compatible updates, custom-resource migration, finalizers, and safe uninstall
• Run images with arbitrary non-root UIDs and avoid unnecessary SCC privilege
• Constrain capabilities, volumes, writable paths, Secrets, and workload API identity
• Complete all three projects including failure injection, recovery, cost, security, and cleanup
• Use the 50 checks to explain decisions, then repeat equivalent original lab tasks from a clean environment
• Read the current Red Hat program guide and official exam page immediately before scheduling