What is the purpose of a Security Context Constraint (SCC) in OpenShift?

• A. To configure internal network policies.
• B. To control what a pod is allowed to do, such as user IDs, privileged mode, and volume types.
• C. To store secrets.
• D. To encrypt data at rest.

Answer: (B)

Security Context Constraints define the boundary of what a pod is allowed to do at runtime. They are applied by the OpenShift admission controller to enforce security settings for pods, ensuring workloads run with constrained permissions unless explicitly permitted. A SCC controls aspects like which user ID a container can run as, whether privileged mode is allowed, if privilege escalation is permitted, and which volume types or mount options can be used. This helps prevent actions that could compromise nodes or other tenants, such as running as root or mounting sensitive host volumes, by requiring pods to operate within approved security settings.

Network policies govern how pods can communicate with each other, not the security context of a pod. Secrets storage is about securely managing sensitive data, not enforcing runtime security constraints. Encryption at rest is a cluster-wide data protection feature, separate from pod-level security constraints.