What is the Security Context Constraint (SCC) in OpenShift, and why might you adjust it?

• A. It defines the policy of allowed privileges for pods; you adjust it to permit non-root execution or specific capabilities required by the app.
• B. It governs how network traffic is filtered between pods.
• C. It controls image pull policies for a namespace.
• D. It determines storage persistence across restarts.

Answer: (C)

Security Context Constraints govern what a pod is allowed to do in terms of security settings. They define the policies around privileges and how the container’s security context can be configured—things like whether a container can run as root, which Linux capabilities can be added, whether privileged mode is allowed, and which SELinux contexts are acceptable. You adjust an SCC to match the needs of your application while maintaining security. For example, many apps require non-root execution or specific capabilities; by selecting or tweaking the appropriate SCC, you grant those permissions to pods using a given service account, without opening up the entire cluster.

In OpenShift, access to specific SCCs is controlled through service accounts, so only pods using an allowed service account can be created with that policy. This is why SCC adjustments are about enabling the right security context for your workload rather than about other areas like network traffic (that’s handled by network policies), image pull behavior (governed by image pull policies and related settings), or storage persistence (handled by persistent volumes and claims).