In a workflow that shares a private image stream, which action is performed first to enable cross-project access to the image?

In a workflow that shares a private image stream, which action is performed first to enable cross-project access to the image?

• A. Create secret regtoken in the shared project
• B. Grant system:image-puller to the target service accounts in the target project
• C. Switch to the target project and then grant pull access
• D. Import the image into the target project’s image stream

Answer: (B)

Cross-project image sharing in OpenShift relies on RBAC to grant pull rights. To let workloads in the consuming project pull a private image from the image stream in the source project, you grant the system:image-puller role to the consuming project’s service accounts for the source image stream’s namespace. This permission is what enables the actual pull of the image across projects, and it must be in place before any pod can start using the image. Creating a secret for a regtoken isn’t needed for internal OpenShift image streams, switching projects isn’t required to grant the access, and importing the image into the target project would duplicate the image rather than enable ongoing cross-project access. So, granting pull access to the consuming project’s service accounts is the correct first step.

Cross-project image sharing in OpenShift relies on RBAC to grant pull rights. To let workloads in the consuming project pull a private image from the image stream in the source project, you grant the system:image-puller role to the consuming project’s service accounts for the source image stream’s namespace. This permission is what enables the actual pull of the image across projects, and it must be in place before any pod can start using the image. Creating a secret for a regtoken isn’t needed for internal OpenShift image streams, switching projects isn’t required to grant the access, and importing the image into the target project would duplicate the image rather than enable ongoing cross-project access. So, granting pull access to the consuming project’s service accounts is the correct first step.