Which command grants the system:image-puller role to the service account myapp so it can pull from an internal registry?

Which command grants the system:image-puller role to the service account myapp so it can pull from an internal registry?

• A. oc policy add-role-to-group system:image-puller system:serviceaccounts:default
• B. oc policy add-role-to-group system:image-puller system:serviceaccounts:myapp
• C. oc policy add-role-to-group system:image-puller system:serviceaccounts:newproject
• D. oc policy add-role-to-group system:image-puller system:serviceaccounts:admin

Answer: (B)

Granting the system:image-puller role to a service account is how you let that account pull images from the internal registry. The command binds the image-puller role to the service account named myapp, using the subject that represents that specific service account (the system:serviceaccounts:<namespace>:<serviceaccount> form). This directly gives only myapp the ability to pull images, scoped to its project. Other options would target different subjects: one would apply to all service accounts in a namespace (not just myapp), another to a different namespace or group, and another to a different user. Those would either broaden access or apply to the wrong entity, not achieving the precise permission for myapp to pull from the internal registry.

Granting the system:image-puller role to a service account is how you let that account pull images from the internal registry. The command binds the image-puller role to the service account named myapp, using the subject that represents that specific service account (the system:serviceaccounts:: form). This directly gives only myapp the ability to pull images, scoped to its project.

Other options would target different subjects: one would apply to all service accounts in a namespace (not just myapp), another to a different namespace or group, and another to a different user. Those would either broaden access or apply to the wrong entity, not achieving the precise permission for myapp to pull from the internal registry.