If you’re the one on your team booked for EX280, you’ll find that no established publisher prints a study guide for the current exam. Red Hat now bases it on OpenShift 4.22 and calls it the Red Hat Certified System Administrator in OpenShift exam, while the companion code for the newest admin book on the shelf points at 4.16. That gap is smaller than it sounds, because the tasks the exam grades (HTPasswd users, quotas, routes, network policies, SCCs) have barely moved across those releases.
Below are the OpenShift books worth buying in 2026 for administrators and EX280 candidates, with the release each one targets and who should skip it. We ran the exam-style tasks and the published chapter 7 snippets from the top pick on OpenShift Local with OpenShift 4.21.14 in November 2026, one minor behind the exam, so every output here comes from a real cluster.
Quick picks for EX280 and day-2 work
Buy for the job you’ll actually do on the cluster. One OpenShift admin book plus one Kubernetes foundations book covers the exam; the rest serve the work that comes after it:
- Best for EX280: Learn OpenShift, Second Edition, about $29. The only 2026 admin book from a major publisher, and its quota, limit range and project template snippets ran unchanged on 4.21.
- Best Kubernetes foundation: Kubernetes in Action, Second Edition, about $54. Published March 2026 and the clearest explanation of the objects every EX280 task is built from.
- Best for day-2 operations: Operating OpenShift, about $38. An SRE view of running clusters once the certificate is on the wall.
- Best for platform architects: OpenShift Multi-Cluster Management Handbook, about $47. Tenancy, GitOps and fleets of clusters, well past exam scope.
- Best for workload design: Kubernetes Patterns, Second Edition, about $35, for engineers who review what developers deploy.
If you’re coming to OpenShift from plain Kubernetes and still need the core shelf, our Kubernetes book guide covers it, so this list stays on OpenShift and the exam.
The shelf at a glance
Read the publication dates against OpenShift 4.22 before reading the reviews, because the date tells you how much of the console and operator content you’ll need to translate. Version columns say “not stated” where the publisher text names no release:
| Book | Focus | Written against | Published | Pages | EX280 fit |
|---|---|---|---|---|---|
| Learn OpenShift, 2nd Ed. | OpenShift admin | About 4.16 (repo channel) | January 2026 | 708 | High |
| Kubernetes in Action, 2nd Ed. | Kubernetes core | Not stated | March 2026 | 688 | Foundations |
| Operating OpenShift | SRE, day 2 | OpenShift 4, minor not stated | December 2022 | 264 | Medium |
| OpenShift Multi-Cluster Management Handbook | Architecture, GitOps | Not stated, labs on CRC | November 2022 | 458 | Low to medium |
| Kubernetes Patterns, 2nd Ed. | Workload design | Kubernetes up to 1.26 | April 2023 | 390 | Low |
| Hybrid Cloud Apps with OpenShift and Kubernetes | Production architecture | Not stated | July 2021 | 271 | Low |
| OpenShift for Developers, 2nd Ed. | Developer workflow | Not stated | October 2021 | 145 | Low |
Our lab cluster reported Kubernetes v1.34.6 under OpenShift 4.21.14, so even the 2026 books describe a platform a few releases old. That matters less for the exam than for the console: the CLI verbs in every book still work, while menus, operator names and default SCC names have shifted. Treat any screenshot older than 2024 as a hint about where to look, not as a map.
What EX280 grades on OpenShift 4.22
EX280 is a three-hour, hands-on exam built on OpenShift Container Platform 4.22, according to the Red Hat exam page as of 4 November 2026. Red Hat recommends DO180 and DO280 or equivalent experience, and calls RHCSA strongly recommended rather than required. If that prerequisite needs dusting off, our hands-on RHCSA practice tasks cover the EX200 objectives with worked solutions on RHEL 10. The objectives group into nine areas, and the table maps each one to the book chapter that covers it best and to the drill we ran:
| EX280 objective area | Best book coverage | Run in our lab |
|---|---|---|
| Manage OpenShift (CLI, projects, logs, cluster health) | Learn OpenShift ch. 18; Operating OpenShift | Yes |
| Declarative resource management (YAML, Kustomize, secrets) | Learn OpenShift ch. 11; Kubernetes in Action ch. 8 | Partly |
| Deploy applications (templates, Helm, services) | Learn OpenShift ch. 11 | Partly |
| Authentication and authorization (HTPasswd, groups) | Learn OpenShift ch. 5 | Yes |
| Network security (routes, TLS, network policies) | Learn OpenShift ch. 7; Multi-Cluster Handbook ch. 7 | Yes |
| Non-HTTP/SNI applications (load balancer services) | Kubernetes in Action ch. 11 | No |
| Developer self-service (quotas, limit ranges, templates) | Learn OpenShift ch. 7 | Yes |
| Manage operators (install, uninstall, delete) | Learn OpenShift ch. 16 | Catalog only |
| Application security (SCCs, service accounts, cron jobs) | Learn OpenShift ch. 7 | Yes |
Two rows need a decision from you. Load balancer services need a cloud or MetalLB, which OpenShift Local does not give you, so practise that objective on a real cluster or at least read chapter 11 of Kubernetes in Action, which covers Services. Operators showed up in our catalog (four catalog sources, 667 package manifests), but we did not run a full install and uninstall, so lean on the DO280 lab or chapter 16 for that one. Cluster updates appear in the DO280 outline but not in the exam objectives, which is why we rank the upgrade chapters lower than the identity and quota ones.
How the books were chosen and tested
We started from Amazon catalog data, searching for OpenShift across O’Reilly, Packt, Manning and Apress, and kept only print books that were in stock in November 2026. A wave of 2025 and 2026 self-published titles with “OpenShift 4.21” in the name came back too, priced like quick e-book conversions and with no publisher record behind them, and we dropped all of them. For the books that remained we checked page counts, dates and editions against the publisher record, read each table of contents against the EX280 objectives, and opened the companion repository wherever one exists.
Then we built a lab, because a book that teaches a quota or SCC syntax the cluster now rejects would cost you points on exam day. We cloned a Fedora 44 VM with 8 vCPUs and 16 GB of RAM on Proxmox and ran OpenShift Local inside it with 6 vCPUs and the default 10.5 GB of memory. The CRC documentation says nested virtualization is not supported, and that is fair warning, yet the cluster came up on the first start and oc get co still showed all 24 cluster operators available and none degraded at the end of our run. The version check:
The single node holds the control-plane, master and worker roles, which is what you’ll practise on at home. The exam cluster is bigger, but none of the graded tasks depends on node count.
Next we cloned the Learn OpenShift companion repository and applied its chapter 7 snippets without editing a line. The quota allows two pods, the limit range caps a container at 1 GiB, and the project template injects that limit range into every new project:
git clone https://github.com/PacktPublishing/Learn-OpenShift-Second-Edition.git
cd Learn-OpenShift-Second-Edition/chapters
oc new-project chapter-7-quota-1 >/dev/null && oc apply -f 7/snippets/resourcequota.yml
for i in 1 2 3; do oc run busybox-$i -n chapter-7-quota-1 --image=registry.access.redhat.com/ubi9/ubi-minimal --restart=Never --command -- sleep 600; done
oc new-project chapter-7-limits
oc apply -f 7/snippets/limitrange.yml
oc run toobig -n chapter-7-limits --image=registry.access.redhat.com/ubi9/ubi-minimal --restart=Never --overrides='{"spec":{"containers":[{"name":"toobig","image":"registry.access.redhat.com/ubi9/ubi-minimal","command":["sleep","600"],"resources":{"limits":{"memory":"2Gi"}}}]}}'
oc apply -f 7/snippets/project-template.yml
oc patch project.config.openshift.io/cluster --type=merge -p '{"spec":{"projectRequestTemplate":{"name":"project-request"}}}'
oc new-project template-check >/dev/null && oc get limitrange -n template-checkEvery object was accepted, and each one did what the book says it does. The pods print a PodSecurity warning about the restricted profile, which is only a warning here. The third pod hit the quota, a 2 GiB limit was refused by the limit range, and a project created after the template change came up already carrying chapter-7-limitrange:
The chapter 7 SCC also applied, and a server-side dry run accepted its ClusterResourceQuota. One thing the book does not prepare you for: right after the template patch, oc new-project failed with Error from server (ServiceUnavailable): the server is currently unable to handle the request (get projectrequests.project.openshift.io). The project config feeds the OpenShift API server, which picks up the change with a short rollout, and the same command worked on a later attempt. Wait a minute or two and retry before you decide a template is broken under exam time pressure.
Revert the template before you go further, because it adds chapter-7-limitrange to every new project, and that changes the outcome of the quota drill later in this article. These two commands put the cluster back, and a new project afterwards came up with no limit range:
oc patch project.config.openshift.io/cluster --type=json -p '[{"op":"remove","path":"/spec/projectRequestTemplate"}]'
oc delete template project-request -n openshift-configGive oc get co openshift-apiserver a minute to settle before creating the next project, because the API server rolls out again after the patch.
1. Learn OpenShift, Second Edition
Buy this one if you only buy one book, because it is the only admin-focused OpenShift 4 title from a major publisher that we found with a 2026 date. Packt published it in January 2026, and at 708 pages it covers far more than the exam needs.
Aleksey Usov, Aleksandr Varlamov and Denis Zuev organise it around the cluster rather than the exam, but the chapters line up with EX280 well. Chapter 5 handles authentication and authorization, chapter 7 covers projects, quotas, network policies and SCCs, chapter 11 does Helm and Kustomize, and chapters 16 to 18 deal with operators, upgrades and troubleshooting. The companion repository subscribes OpenShift Data Foundation on the stable-4.16 channel, which dates the lab work to about OpenShift 4.16.
- What we verified: the chapter 7 quota, limit range, project template and SCC snippets applied unchanged on OpenShift 4.21.14 and behaved as described.
- What to watch: the only OAuth snippet in the repository is an LDAP example, so drill the HTPasswd provider from the Red Hat docs as well.
- Skip it if: you want an exam-shaped book with timed practice tasks. This one teaches the platform and leaves the drilling to you, and it spends chapters on service mesh and storage you will not be graded on.
We also found a trap in the chapter 5 cheat sheet in the same repository. Its last line, for removing the kubeadmin user, has an en dash where the -n flag should be, so a straight copy and paste turns the namespace flag into a secret name:
Here it only produced three NotFound errors, because the command ran in a project with no secret named kubeadmin. Retype flags from any cheat sheet rather than pasting them, which is also the habit the exam rewards. It sells for about $29, well under its list price, so check the current price on Amazon.
2. Kubernetes in Action, Second Edition
Every EX280 task is a Kubernetes object with OpenShift wrapped around it, and this is the book that explains the objects best. Manning shipped the second edition in March 2026, at 688 pages.
Marko Luksa and Kevin Conner work through 18 chapters on the API, pods, configuration, storage, Services, Ingress, the Gateway API, ReplicaSets, Deployments, StatefulSets, DaemonSets and batch jobs. The table of contents has no chapter on RBAC or resource quotas, so take those from Learn OpenShift. When a quota rejects your pods or a network policy drops traffic, the reason sits in how those Kubernetes objects behave, and this book is where you’ll understand it rather than memorise the fix. It pairs with Learn OpenShift because neither repeats the other.
- Who it’s for: admins who learned OpenShift through the console and can’t yet explain what a ReplicaSet or a Service does on its own.
- Exam relevance: ConfigMaps and Secrets (chapter 8), Services (chapter 11), ReplicaSets (chapter 14) and Jobs and CronJobs (chapter 18), which line up with four EX280 objective areas.
- Skip it if: you already hold the CKA. It has no OpenShift content (no routes, SCCs or
oc adm), so a certified Kubernetes admin gains little from it before EX280.
It runs about $54, below its list price. Be careful with the listing: the Kindle edition sits on a separate page, so use the paperback page on Amazon if you want print.
3. Operating OpenShift
Rick Rackow and Manuel Dewald wrote this from the site reliability side, and it is the book for the year after you pass. O’Reilly published it in December 2022 at 264 pages, so it covers OpenShift 4 without naming the minor release it was written against.
It follows a sample arcade-platform workload through ten chapters of running OpenShift the way a site reliability team would. That is valuable once you own production, and it’s the closest thing on the shelf to how a platform team actually works. It does not drill the task list, so it will not move your exam score much.
- Who it’s for: engineers who already run OpenShift and need an SRE model for running the platform, not a feature tour.
- Stock note: Amazon listed the paperback as limited stock in November 2026, so expect the price to move.
- Skip it if: your exam date is in the next two months. Spend that time on Learn OpenShift and a running cluster instead.
Expect to pay about $38, well below list. See the current price on Amazon.
4. OpenShift Multi-Cluster Management Handbook
Giovanni Fontana and Rafael Pecora wrote this one for architects, and it shows from the first chapter. Packt published it in November 2022 at 458 pages, and its repository lists CodeReady Containers as the lab environment, the same OpenShift Local tool we tested on.
The early chapters cover multi-tenancy, deployment, troubleshooting, networking and security, which overlap with EX280. Then it moves into OpenShift Pipelines with Tekton, Argo CD for GitOps, and managing many clusters with Advanced Cluster Management and Advanced Cluster Security. If your platform has more than one cluster, that second half is the reason to buy it, and our Red Hat ACM install guide covers the hub setup it assumes.
- Who it’s for: architects designing tenancy and GitOps across several clusters.
- Exam relevance: the tenancy, network and security chapters, roughly a third of the book.
- Skip it if: you run one cluster or only need the certificate. Most of its pages describe products EX280 never touches.
It sells at about $47. Check the Amazon listing for the paperback.
5. Kubernetes Patterns, Second Edition
Bilgin Ibryam and Roland Huss catalogue the patterns cloud native workloads are built from: health probes, sidecars, configuration, elastic scale and controllers. O’Reilly published the second edition in April 2023 at 390 pages, updated through Kubernetes 1.26 and with a new part on security patterns.
An OpenShift admin spends a surprising amount of time reviewing what developers deploy, and this is the vocabulary for those reviews. We’d put it on a platform team shelf rather than an exam shelf.
- Who it’s for: platform engineers who approve deployments and want to say why a design is wrong.
- Version gap: written against Kubernetes 1.26, eight minor releases behind the v1.34 in our 4.21 cluster, though the patterns themselves age slowly.
- Skip it if: you want commands to practise. It has no
ocdrills and no OpenShift objects.
It costs about $35, roughly half its list price. Check stock on Amazon, since the paperback showed limited availability.
6. Hybrid Cloud Apps with OpenShift and Kubernetes
Michael Elder, Jake Kitchener and Brad Topol wrote a production architecture book with OpenShift as the running example. O’Reilly published it in July 2021 at 271 pages, and it’s now one of the cheapest O’Reilly titles in this list.
Its chapters cover tenancy, scheduling and capacity, cost, continuous delivery, high availability, multicluster provisioning and upgrades, and disaster recovery. The capacity and tenancy material explains why quotas and limit ranges exist, which helps the developer self-service objective make sense. The rest is design guidance that predates several OpenShift 4 releases.
- Who it’s for: architects planning where OpenShift clusters run and how workloads fail over between them.
- Age: published in 2021, so console screens and operator names are out of date.
- Skip it if: you need step-by-step admin tasks. It argues about design and rarely shows a command you’d type in the exam.
It sells for about $26, a steep discount on list, with limited stock. See the price on Amazon.
7. OpenShift for Developers, Second Edition
Joshua Wood and Brian Tannous wrote a short guide for developers deploying their first applications on OpenShift. O’Reilly published the second edition in October 2021 at 145 pages, which makes it the quickest read here.
It sits on this list for one reason: admins support developers, and this is the book to hand the application teams who’ll use your cluster. As the title says, it is written for application developers rather than cluster operators. It is not an admin book, and it will not teach you identity providers, quotas or SCCs.
- Who it’s for: developers new to OpenShift, and admins who want to know what those developers will try first.
- Length: 145 pages, a weekend read.
- Skip it if: you’re preparing for EX280. It barely touches the graded tasks.
Expect about $30 for the paperback, which Amazon showed as limited stock. Check the current price on Amazon.
The EX280 drills we ran
No book replaces repetition on a cluster, so here are the drills we ran on OpenShift Local as the victor user with the cluster-admin kubeconfig. Each one maps to an objective in the table above, and each produced at least one result a book wouldn’t warn you about. Run them on your own practice cluster until you can type them without notes.
An HTPasswd user, and the missing newline
You’ll need the htpasswd tool, which comes from the httpd-tools package on Fedora and RHEL, so install it first with sudo dnf install -y httpd-tools. OpenShift Local already ships an HTPasswd identity provider named developer, backed by the htpass-secret secret in openshift-config. The exam pattern is to extract that file, add a user and write it back. Our first attempt failed with Login failed (401 Unauthorized), because the file in the CRC secret does not end with a newline, so htpasswd glued the new user onto the kubeadmin line:
The broken copy lists only two users, and od -c shows the last byte is the letter i, not \n. Worse, the corrupted line also breaks the kubeadmin password, so you can lock yourself out of the admin account. A file you create with htpasswd -c ends in a newline, so this bites mainly when you edit an existing secret, which is exactly what the exam asks. Add the newline first, then the user:
oc extract secret/htpass-secret -n openshift-config --to /tmp/htp --confirm
sed -i -e '$a\' /tmp/htp/htpasswd
htpasswd -B -b /tmp/htp/htpasswd ops-admin 'Ex280-Lab-Pass'
cut -d: -f1 /tmp/htp/htpasswd
oc set data secret/htpass-secret -n openshift-config --from-file htpasswd=/tmp/htp/htpasswdThe sed expression appends a newline only when the last line lacks one, so it is safe to run on any file. We then timed how long the new password took to work, because nothing in OpenShift 4.21 tells you when it’s live:
It took 1 minute 11 seconds, and in our run the oauth-openshift pod kept its age through the change, so there was no restart to wait for. The authentication operator logged that it updated its copy of the secret in openshift-authentication, and logins started working shortly after. Don’t rely on oc rollout status for this, and don’t read a login that fails 30 seconds after the change as a wrong password. Retry for a couple of minutes before you start debugging.
Groups and cluster roles
EX280 covers both user and group permissions, and groups are the habit worth building, because a group binding survives staff changes. Create the group with the user in it, bind the cluster role, then confirm from the user side:
oc adm groups new platform-team ops-admin
oc adm policy add-cluster-role-to-group cluster-admin platform-team
oc login -u ops-admin -p 'Ex280-Lab-Pass' https://api.crc.testing:6443 --insecure-skip-tls-verify=true --kubeconfig /tmp/ops.kubeconfig
oc whoami --kubeconfig /tmp/ops.kubeconfig
oc get nodes --kubeconfig /tmp/ops.kubeconfig
oc get identityUsing a separate kubeconfig keeps your admin session intact while you test the new user, and --insecure-skip-tls-verify is only there because OpenShift Local signs its API with its own CA. The identity list shows developer:ops-admin, meaning the provider name followed by the user, which is how you prove the login went through HTPasswd:
Since oc get nodes works as ops-admin, the group binding is live. On a real cluster the next task is usually removing kubeadmin, and you should only do that after a second cluster-admin login like this one has succeeded.
Removing self-provisioner
By default any authenticated user can create projects. The exam often asks you to stop that, and the command that does it prints a warning worth reading:
oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauthThen log in as developer with a separate kubeconfig and try to create a project:
oc login -u developer -p developer https://api.crc.testing:6443 --insecure-skip-tls-verify=true --kubeconfig /tmp/dev.kubeconfig
oc new-project dev-sandbox --kubeconfig /tmp/dev.kubeconfigIt failed exactly as intended:
The warning says the change can be reverted when the control plane restarts unless you set rbac.authorization.kubernetes.io/autoupdate=false on the self-provisioners binding. If a task says the change must persist, run the annotate command the warning prints. To give the role back on a practice cluster, add it to the same group again:
oc adm policy add-cluster-role-to-group self-provisioner system:authenticated:oauthYou’ll see Group 'system:authenticated:oauth' not found, which is harmless because the group is virtual, and project creation works again.
Quotas and limit ranges
A project quota that counts CPU and memory makes every pod declare requests and limits, and pods that don’t are refused silently from your point of view: the deployment just sits at zero ready. We set a quota, deployed three httpd replicas with no resources and read the events:
oc new-project quota-demo
oc create quota team-quota -n quota-demo --hard=pods=4,requests.cpu=1,requests.memory=1Gi,limits.memory=2Gi
oc create deployment web -n quota-demo --image=registry.access.redhat.com/ubi9/httpd-24 --replicas=3
oc get events -n quota-demo --field-selector reason=FailedCreate -o custom-columns=MESSAGE:.messageThe event names every missing field. Give the deployment requests and limits, then ask for more replicas than the quota allows:
oc set resources deployment web -n quota-demo --requests=cpu=100m,memory=128Mi --limits=memory=256Mi
oc scale deployment web -n quota-demo --replicas=6
oc get deployment web -n quota-demo
oc describe quota team-quota -n quota-demoFour of the six replicas came up before the quota stopped the rest:
The quota shows pods at 4 of 4 while CPU and memory still have room, so the pod count is the binding limit. In practice you’d pair a quota with a limit range, so pods that forget their resources get defaults instead of failing. Save this as limitrange.yaml:
apiVersion: v1
kind: LimitRange
metadata:
name: defaults
spec:
limits:
- type: Container
defaultRequest:
cpu: 50m
memory: 64Mi
default:
memory: 128MiApply it to the project, and every container created afterwards picks up those defaults:
oc apply -n quota-demo -f limitrange.yamlPods that already exist keep what they had, because a limit range applies at admission. That is also why the Learn OpenShift project template is the stronger answer to “every new project must get these limits”.
An edge route and a network policy
Routes and network policies are graded together in practice, because the most common mistake is a policy that blocks the router. We exposed the httpd deployment through an edge route, with TLS terminated at the router:
oc expose deployment web -n quota-demo --port=8080
oc create route edge web -n quota-demo --service=web --hostname=web-quota-demo.apps-crc.testing
curl -ks -o /dev/null -w 'HTTP %{http_code} over TLS\n' https://web-quota-demo.apps-crc.testing/
curl -s -o /dev/null -w 'HTTP %{http_code} over plain HTTP\n' http://web-quota-demo.apps-crc.testing/Next, a policy that admits traffic from the same namespace and from the ingress routers only. The label in the second rule matches the openshift-ingress namespace, where the routers live. Save it as netpol.yaml:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-other-namespaces
spec:
podSelector: {}
ingress:
- from:
- podSelector: {}
- from:
- namespaceSelector:
matchLabels:
policy-group.network.openshift.io/ingress: ""To test it from outside the project, start a throwaway pod in a second project, check that it can reach the service, apply the policy and check again:
oc new-project client-demo
oc run probe -n client-demo --image=registry.access.redhat.com/ubi9/ubi-minimal --restart=Never --command -- sleep 3600
oc wait pod/probe -n client-demo --for=condition=Ready --timeout=180s
oc exec -n client-demo probe -- curl -s -o /dev/null -w 'before policy: HTTP %{http_code}\n' --max-time 5 http://web.quota-demo.svc:8080/
oc apply -n quota-demo -f netpol.yaml
oc exec -n client-demo probe -- curl -s -o /dev/null -w 'after policy: HTTP %{http_code}\n' --max-time 5 http://web.quota-demo.svc:8080/The route checks run from the VM itself with curl -k, and the results line up like this:
Read the codes carefully. The 403 comes from httpd itself, since its document root is empty, so it proves the request reached the pod. Plain HTTP returns 503 because an edge route has no insecure policy by default; add --insecure-policy=Redirect when creating the route if users will type http://. After the policy, the cross-namespace curl timed out with exit code 28 while the route still returned 403.
OpenShift Local can’t show you the classic mistake here. We applied a version with only the same-namespace rule and the route still returned 403, because the CRC router runs on the host network of the only node, and Red Hat documents that network policies cannot block traffic from a pod’s resident node. On a multi-node cluster the router usually sits on another node, and the policy-group.network.openshift.io/ingress rule is what Red Hat gives for letting router traffic in. Keep both in mind when a route breaks on a real cluster right after a policy change.
An SCC for an image that wants root
The upstream nginx image expects to run as root, and OpenShift does not let it by default. The pod crash-loops with mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied), and the EX280 fix is a service account with the anyuid SCC:
oc new-project scc-demo
oc create deployment nginx -n scc-demo --image=docker.io/library/nginx:latest
oc create serviceaccount nginx-sa -n scc-demo
oc adm policy add-scc-to-user anyuid -z nginx-sa -n scc-demo
oc set serviceaccount deployment/nginx nginx-sa -n scc-demoThe replacement pod was Running 45 seconds after the change, and its openshift.io/scc annotation confirms which SCC admitted it:
Check that annotation every time, because a pod that starts under the wrong SCC can look healthy until it writes to a path it does not own. Outside the exam, we’d rather run an image built for a random UID than hand out anyuid, but the exam grades the SCC grant.
Books we left off the list
Several titles turn up in every OpenShift book search and still don’t deserve your money in 2026. Here is why each was cut:
- OpenShift in Action and the 2018 first edition of Learn OpenShift: both teach OpenShift 3, whose installer, templates and networking OpenShift 4 replaced.
- Self-published “OpenShift 4.21” guides from 2025 and 2026: no publisher or author record we could verify, and pricing typical of rushed e-book conversions.
- “OpenShift Administration” exam-prep listings at around $225 and more: question-dump style material under an old exam name. Red Hat exams are hands-on, so memorised answers don’t transfer.
- Architecting and Operating OpenShift Clusters (Apress, 2019): solid in its day, but it predates most of OpenShift 4 and costs about $62.
- Kubernetes Operators (O’Reilly, 2020): written for people building operators. EX280 only asks you to install and remove them, and the SDK tooling it uses has moved on.
If a seller lists a book with EX280 in its title, check the publisher before the reviews. In our search the only listings matching that code were unrelated accessories, which tells you no mainstream EX280 print guide exists yet.
Practice clusters and what they cost
The books only pay off with a cluster you can break. Pick by the hardware you already have, since every option below is free of license cost for practice:
- OpenShift Local (CRC): the cheapest path, needing 4 physical cores, 10.5 GB of free memory and 35 GB of disk per the CRC documentation. Our 16 GB VM ran every drill above. Setup is in our OpenShift Local install guide, and the RHEL and Fedora walkthrough covers the OKD preset.
- A full cluster on KVM: the closest to the exam environment, with separate control plane and worker nodes, at the cost of a host with far more RAM. Our agent-based installer guide builds one on libvirt.
- OKD on Fedora CoreOS: the community distribution, useful when you want a multi-node cluster without a Red Hat pull secret. Follow the OKD cluster guide.
We’d start on OpenShift Local, because it covers the identity, quota, route, policy and SCC objectives on a single machine. Move to a multi-node cluster once you practise load balancer services, node scheduling or operator installs at size, since those are the tasks a single node can’t fully reproduce. Whichever you choose, rebuild it at least once before the exam, because a clean install is the only way to know you did not rely on a fix you’ve already forgotten.
