Which command links the secret quayio to the default service account for pulling images?

• A. oc secrets link default quayio --for pull
• B. oc secrets link default quayio
• C. oc secrets link builder quayio
• D. oc set secrets default quayio

Answer: (A)

When a pod pulls an image from a private registry, it needs credentials available to the pod’s service account. In OpenShift, you attach a secret that contains those registry credentials to the service account, so every pod using that SA can authenticate to the registry automatically.

The command to do this explicitly assigns the secret to a service account for the purpose of image pulling. By naming the default service account and the secret quayio, and adding the flag to indicate the use is for pulling images, you ensure the credentials are used exactly for authentication during image pull. This avoids misusing the secret for mounting or other purposes and ties the credentials to the SA that governs the pod’s access.

So this specific command links the quayio secret to the default service account with the pull purpose, which is what enables pulling images from quay.io for pods running under that SA.