Which OpenShift object governs security privileges for pods (e.g., runAsUser, capabilities)?

Which OpenShift object governs security privileges for pods (e.g., runAsUser, capabilities)?

• A. PodSecurityPolicy
• B. SecurityContextConstraints (SCC)
• C. NetworkPolicy
• D. ResourceQuota

Answer: (B)

OpenShift uses SecurityContextConstraints to govern what a pod is allowed to do at runtime, including the user it runs as and its capabilities. When a pod requests a security context (for example, a specific runAsUser, whether privileged mode is allowed, or which capabilities can be added), OpenShift checks those requests against the SCCs that the pod’s service account (and user) is permitted to use. If an SCC bound to that service account allows the requested settings, the pod can start with those privileges; if not, the pod is rejected. This mechanism centralizes and enforces pod security decisions across the cluster. NetworkPolicy controls network traffic between pods, not their security context. ResourceQuota governs resource limits like CPU, memory, and storage, not privileged access. PodSecurityPolicy is a Kubernetes construct for similar policy concepts, but in OpenShift the equivalent and actively used mechanism is SecurityContextConstraints.

OpenShift uses SecurityContextConstraints to govern what a pod is allowed to do at runtime, including the user it runs as and its capabilities. When a pod requests a security context (for example, a specific runAsUser, whether privileged mode is allowed, or which capabilities can be added), OpenShift checks those requests against the SCCs that the pod’s service account (and user) is permitted to use. If an SCC bound to that service account allows the requested settings, the pod can start with those privileges; if not, the pod is rejected. This mechanism centralizes and enforces pod security decisions across the cluster.

NetworkPolicy controls network traffic between pods, not their security context. ResourceQuota governs resource limits like CPU, memory, and storage, not privileged access. PodSecurityPolicy is a Kubernetes construct for similar policy concepts, but in OpenShift the equivalent and actively used mechanism is SecurityContextConstraints.