Kubernetes and OpenShift utilize user accounts and service accounts. The difference is simple: User accounts are for humans, and service accounts are for processes. In my previous article, I demonstrated how to use a service account and security context constraints (SCCs) to ensure that a pod has sufficient permissions to run system-level processes. This article discusses using and managing service accounts and SCCs.

Service accounts exist within a project, and each service account username is derived from its project. Every service account is a member of two groups:

Use the oc command to view all service accounts within your current project:

If you are not querying the active project, use the -n option to specify the project or namespace.

Use oc create sa along with an arbitrary name to create a service account:

View details about the service account using the describe subcommand:

After creating a service account, use a role binding to connect the account to a specific role or bind it with a specific SCC. To grant a role to a service account for your active project, type:

[ Learn Kubernetes basics in this cheat sheet. ]

An SCC is an OpenShift resource that restricts a pod to a group of resources and is similar to the Kubernetes security context resource. The primary purpose of both is to limit a pod's access to the host environment. You can use an SCC to control pod permissions, similar to how you use role-based access control (RBAC) to manage user privilege.

You can use an SCC to define a set of conditions a pod must use when running. This capability allows you to control things like whether a pod can run privileged containers, the capabilities a container can request, the SELinux context of a container, the usage of volume types, and so on.

[ Improve your skills managing and using SELinux with this helpful guide. ]

You can create an SCC like any other resource: With a YAML file. Here is an example:

Process the YAML file with oc create:

To view details about the security context constraint you've just created, use oc get:

You can see even more detail with oc describe:

Service accounts and SCCs are important ways of managing permissions within a cluster. OpenShift has plenty of methods to query your projects and cluster to learn about resources, so get familiar with the available commands and constructs.

You can further explore the various SCC options by reading the OpenShift SCC documentation. Particularly useful topics include controlling a container's SELinux context, requesting additional capabilities to a container, changing the user ID, and using host directories as volumes.