Red Hat OpenShift Container Platform

Allowing pods to reference images across projects

To allow pods in one Red Hat OpenShift Container Platform project to reference images from another project, you can bind a service account to the system:image-puller role in the target project. Use the oc policy add-role-to-user or oc policy add-role-to-group command to grant cross-project image access.

When you create a pod service account or a namespace, wait until the service account is provisioned with a Docker pull secret. If you create a pod before its service account is fully provisioned, the pod fails to access the OpenShift image registry.

Procedure

Allow pods in project-a to reference images in project-b by entering the following command. In this example, the service account default in project-a is bound to the system:image-puller role in project-b:
```
$ oc policy add-role-to-user \
    system:image-puller system:serviceaccount:project-a:default \
    --namespace=project-b
```

Optional: Allow access for any service account in project-a by using the add-role-to-group flag. For example:

$ oc policy add-role-to-group \
    system:image-puller system:serviceaccounts:project-a \
    --namespace=project-b