@Hassan9 very important query indeed!
First let me tell you the difference between Authorization and Authentication which are the building blocks of RBAC :
Authentication : Who are you ?
Authorization : Are you allowed to do this task ?
RBAC gives a SUBJECT ( Developer / Administrator / process ) a ROLE to do operations ( List, create, delete, get , patch , watch ) on the RESOURCES ( Pods, services, configmaps, secrets, PVC, ingress, nodes, deployment etc ) in a NAMESPACE.
whereas SCC defines the run time permissions the container will have once it runs in the node.
When you're working with Pods, you often need to manage their behavior and permissions very carefully. This means you control if they can run as root or non-root, if they are allowed to mount volumes directly from the host, or if they can have elevated (privileged) access. You can also customize their specific capabilities or SELinux labels. The key to enforcing these rules is by binding SCCs to service accounts or groups via RBAC , which ensures only specific Pods get to use certain SCCs.
You will generally use RBAC whenever you need to give or take away access to specific cluster resources, or even to command-line tools like oc. That is how you assign different roles to people or groups, like making someone an admin, a viewer, or an scc-user. Also, if you have got custom security policies, RBAC is crucial for limiting who can actually apply those special SCCs.
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/authentication_and_a...
https://www.redhat.com/en/blog/pod-admission-and-sccs-version-2-in-openshift
https://access.redhat.com/solutions/7058224
