Which command grants the system:image-puller role to system:serviceaccount:myphp in the otherphp namespace?

• A. oc create rolebinding image-puller --group system:image-puller
• B. oc policy add-role-to-group system:image-puller system:serviceaccount:myphp -n otherphp
• C. oc policy add-role-to-group system:image-puller system:serviceaccount:myphp -n shared
• D. oc policy remove-role-to-group system:image-puller

Answer: (B)

Granting a role to a service account lets that service account perform actions in a namespace, such as pulling images. In OpenShift, the service account is treated as a user identity, so you attach the image-puller capability to the service account's identity and scope it to the namespace where the service account runs. The correct approach uses a policy command to bind the system:image-puller role to the service account identity, identified as system:serviceaccount::, and you specify the target namespace with -n to create the binding in that namespace. This ensures pods using that service account in otherphp can pull images from the image registry.

Other options either try to create a binding inappropriately, reference the wrong namespace, or remove a binding, which would not grant the needed permissions.