Which command grants the anyuid SCC to the myserviceaccount?

Which command grants the anyuid SCC to the myserviceaccount?

• A. oc adm policy add-scc-to-user anyuid -z myserviceaccount
• B. oc adm policy add-scc-to-user anyuid myserviceaccount -z
• C. oc adm policy grant-scc anyuid -z myserviceaccount
• D. oc policy add-scc-to-user anyuid -z myserviceaccount

Answer: (A)

OpenShift attaches an SCC to a service account with the policy command, specifying the SCC name and the service account after the -z flag. The -z indicates the subject is a service account, and you provide the service account’s name right after it. The anyuid SCC lets a container run with any UID, so granting it to your service account enables pods using that account to bypass UID restrictions. The correct command is: oc adm policy add-scc-to-user anyuid -z myserviceaccount. It targets the anyuid SCC and the service account in the current namespace (you can add -n if you need a different namespace). Other options fail for typical OpenShift CLI syntax reasons: the -z flag is not placed correctly after the service account name, or the subcommand is not the proper one for this task (grant-scc isn’t the right command here), or the command path uses oc policy instead of oc adm policy and combines -z with the name in an invalid way.

OpenShift attaches an SCC to a service account with the policy command, specifying the SCC name and the service account after the -z flag. The -z indicates the subject is a service account, and you provide the service account’s name right after it. The anyuid SCC lets a container run with any UID, so granting it to your service account enables pods using that account to bypass UID restrictions.

The correct command is: oc adm policy add-scc-to-user anyuid -z myserviceaccount. It targets the anyuid SCC and the service account in the current namespace (you can add -n if you need a different namespace).

Other options fail for typical OpenShift CLI syntax reasons: the -z flag is not placed correctly after the service account name, or the subcommand is not the proper one for this task (grant-scc isn’t the right command here), or the command path uses oc policy instead of oc adm policy and combines -z with the name in an invalid way.