Bug 1804886

Description of problem:
This is on a UPI baremetal install of OCP 4.3.3 console logged in as user kubeadmin.
After deploying Node Feature Discovery (NFD) operator from OperatorHub and creating an instance in an namespace other than default, the nfd-worker pods fail to deploy with this error:

7s          Warning   FailedCreate          daemonset/nfd-worker                           Error creating: pods "nfd-worker-" is forbidden: unable to validate against any security context constraint: [provider restricted: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.volumes[0] ...


$ oc get pods -n test-nfd
NAME                            READY   STATUS    RESTARTS   AGE
nfd-master-782h6                1/1     Running   0          72s
nfd-master-cnfhb                1/1     Running   0          72s
nfd-master-kpmgz                1/1     Running   0          72s
nfd-operator-75d7895d58-h96mp   1/1     Running   0          104s

$ oc get events -n test-nfd
LAST SEEN   TYPE      REASON                OBJECT                                         MESSAGE
<unknown>   Normal    Scheduled             pod/nfd-master-782h6                           Successfully assigned test-nfd/nfd-master-782h6 to anlistg433-5c7fr-control-plane-0
81s         Normal    Pulling               pod/nfd-master-782h6                           Pulling image "registry.stage.redhat.io/openshift4/ose-node-feature-discovery@sha256:700634b616e8a68f0ceb501d8461002fe1c863a4b88c29c18eab95ecab4dc6f8"
69s         Normal    Pulled                pod/nfd-master-782h6                           Successfully pulled image "registry.stage.redhat.io/openshift4/ose-node-feature-discovery@sha256:700634b616e8a68f0ceb501d8461002fe1c863a4b88c29c18eab95ecab4dc6f8"
68s         Normal    Created               pod/nfd-master-782h6                           Created container nfd-master
68s         Normal    Started               pod/nfd-master-782h6                           Started container nfd-master
<unknown>   Normal    Scheduled             pod/nfd-master-cnfhb                           Successfully assigned test-nfd/nfd-master-cnfhb to anlistg433-5c7fr-control-plane-2
82s         Normal    Pulling               pod/nfd-master-cnfhb                           Pulling image "registry.stage.redhat.io/openshift4/ose-node-feature-discovery@sha256:700634b616e8a68f0ceb501d8461002fe1c863a4b88c29c18eab95ecab4dc6f8"
71s         Normal    Pulled                pod/nfd-master-cnfhb                           Successfully pulled image "registry.stage.redhat.io/openshift4/ose-node-feature-discovery@sha256:700634b616e8a68f0ceb501d8461002fe1c863a4b88c29c18eab95ecab4dc6f8"
71s         Normal    Created               pod/nfd-master-cnfhb                           Created container nfd-master
71s         Normal    Started               pod/nfd-master-cnfhb                           Started container nfd-master
<unknown>   Normal    Scheduled             pod/nfd-master-kpmgz                           Successfully assigned test-nfd/nfd-master-kpmgz to anlistg433-5c7fr-control-plane-1
79s         Normal    Pulling               pod/nfd-master-kpmgz                           Pulling image "registry.stage.redhat.io/openshift4/ose-node-feature-discovery@sha256:700634b616e8a68f0ceb501d8461002fe1c863a4b88c29c18eab95ecab4dc6f8"
69s         Normal    Pulled                pod/nfd-master-kpmgz                           Successfully pulled image "registry.stage.redhat.io/openshift4/ose-node-feature-discovery@sha256:700634b616e8a68f0ceb501d8461002fe1c863a4b88c29c18eab95ecab4dc6f8"
69s         Normal    Created               pod/nfd-master-kpmgz                           Created container nfd-master
68s         Normal    Started               pod/nfd-master-kpmgz                           Started container nfd-master
89s         Normal    SuccessfulCreate      daemonset/nfd-master                           Created pod: nfd-master-782h6
89s         Normal    SuccessfulCreate      daemonset/nfd-master                           Created pod: nfd-master-kpmgz
89s         Normal    SuccessfulCreate      daemonset/nfd-master                           Created pod: nfd-master-cnfhb
<unknown>   Normal    Scheduled             pod/nfd-operator-75d7895d58-h96mp              Successfully assigned test-nfd/nfd-operator-75d7895d58-h96mp to anlistg433-5c7fr-control-plane-2
113s        Normal    Pulling               pod/nfd-operator-75d7895d58-h96mp              Pulling image "registry.stage.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:41cdfcb9771e0df28a72b0fa62f0d9f302f6f6420d7a7f30400d4c50dd0f4a73"
102s        Normal    Pulled                pod/nfd-operator-75d7895d58-h96mp              Successfully pulled image "registry.stage.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:41cdfcb9771e0df28a72b0fa62f0d9f302f6f6420d7a7f30400d4c50dd0f4a73"
101s        Normal    Created               pod/nfd-operator-75d7895d58-h96mp              Created container nfd-operator
101s        Normal    Started               pod/nfd-operator-75d7895d58-h96mp              Started container nfd-operator
2m1s        Normal    SuccessfulCreate      replicaset/nfd-operator-75d7895d58             Created pod: nfd-operator-75d7895d58-h96mp
2m1s        Normal    ScalingReplicaSet     deployment/nfd-operator                        Scaled up replica set nfd-operator-75d7895d58 to 1
7s          Warning   FailedCreate          daemonset/nfd-worker                           Error creating: pods "nfd-worker-" is forbidden: unable to validate against any security context constraint: [provider restricted: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used spec.volumes[2]: Invalid value: "hostPath": hostPath volumes are not allowed to be used spec.volumes[3]: Invalid value: "hostPath": hostPath volumes are not allowed to be used spec.volumes[4]: Invalid value: "hostPath": hostPath volumes are not allowed to be used spec.containers[0].securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used]
2m3s        Normal    RequirementsUnknown   clusterserviceversion/nfd.4.3.3-202002171705   requirements not yet checked
2m3s        Normal    RequirementsNotMet    clusterserviceversion/nfd.4.3.3-202002171705   one or more requirements couldn't be found
2m2s        Normal    AllRequirementsMet    clusterserviceversion/nfd.4.3.3-202002171705   all requirements found, attempting install
2m1s        Normal    InstallSucceeded      clusterserviceversion/nfd.4.3.3-202002171705   waiting for install components to report healthy
2m          Normal    InstallWaiting        clusterserviceversion/nfd.4.3.3-202002171705   installing: Waiting: waiting for deployment nfd-operator to become ready: Waiting for rollout to finish: 0 of 1 updated replicas are available...
89s         Normal    InstallSucceeded      clusterserviceversion/nfd.4.3.3-202002171705   install strategy completed with no errors


Version-Release number of selected component (if applicable):
Server Version: 4.3.0-0.nightly-2020-02-17-205936. <=== same as 4.3.3
Kubernetes Version: v1.16.2


How reproducible:
More than once

Steps to Reproduce:
1. UPI install on OpenStack of OCP 4.3.3 on openstack, 3 worker nodes and 3 masters
2. From OpenShift console logged in as kubeadmin, with kubeadmin password from install
3. Create namespace called test-nfd
4. Operators -> OperatorHub, search for NFD operator, click install
5. Keep Default Update channel at 4.3.  Select namespace test-nfd.
6. Create a CSV instance

Actual results:
nfd-operator and only the 3 nfd-master pods deploy successfully.  All 3 nfd-worker pods fail to deploy (see error in events above)


Expected results:
nfd-operator with 3 nfd-master pods and 3 nfd-worker pods deploy successfully


Additional info:
If you select to deploy NFD in the default namespace, NFD deploys successfully