Tested in 4.7.0-0.nightly-2021-05-07-024046:
After creating above collector SCC and deleting OAS pod, new pod can be Running:
$ oc get po -n openshift-apiserver
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES REVISION
apiserver-8bbc4c89d-srmrv 2/2 Running 0 2m35s 10.129.0.11 ip-10-0-54-145.us-gov-west-1.compute.internal <none> <none> 2
...<snipped>...
New pod is assigned same SCC as the deleted pod, which matches container readOnlyRootFilesystem field set as false, as same as the pod before deleted, which is also as same as per the PR sets:
$ oc get po -n openshift-apiserver apiserver-8bbc4c89d-srmrv -o yaml | grep " openshift.io/scc"
openshift.io/scc: node-exporter
$ oc get po -n openshift-apiserver apiserver-8bbc4c89d-srmrv -o yaml | grep " readOnlyRootFilesystem"
readOnlyRootFilesystem: false
Operator is not Degraded:
$ oc get co openshift-apiserver
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE
openshift-apiserver 4.7.0-0.nightly-2021-05-07-024046 True False False 108m
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (OpenShift Container Platform 4.7.11 bug fix update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:1550
Tested in 4.7.0-0.nightly-2021-05-07-024046: After creating above collector SCC and deleting OAS pod, new pod can be Running: $ oc get po -n openshift-apiserver NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES REVISION apiserver-8bbc4c89d-srmrv 2/2 Running 0 2m35s 10.129.0.11 ip-10-0-54-145.us-gov-west-1.compute.internal <none> <none> 2 ...<snipped>... New pod is assigned same SCC as the deleted pod, which matches container readOnlyRootFilesystem field set as false, as same as the pod before deleted, which is also as same as per the PR sets: $ oc get po -n openshift-apiserver apiserver-8bbc4c89d-srmrv -o yaml | grep " openshift.io/scc" openshift.io/scc: node-exporter $ oc get po -n openshift-apiserver apiserver-8bbc4c89d-srmrv -o yaml | grep " readOnlyRootFilesystem" readOnlyRootFilesystem: false Operator is not Degraded: $ oc get co openshift-apiserver NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE openshift-apiserver 4.7.0-0.nightly-2021-05-07-024046 True False False 108m