Verified in 4.6.44:
After creating above collector SCC and deleting OAS pod, new pod can be Running:
$ oc get po -n openshift-apiserver
NAME READY STATUS RESTARTS AGE IP NODE ...
apiserver-5b79bbd5f-8vsdg 2/2 Running 0 2m4s 10.130.0.55 ip-10-0-208-157.us-east-2.compute.internal ...
$ oc get pod -n openshift-apiserver apiserver-5b79bbd5f-8vsdg -o yaml | grep " readOnlyRootFilesystem"
readOnlyRootFilesystem: false
Operator is not Degraded:
$ oc get co openshift-apiserver
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE
openshift-apiserver 4.6.44 True False False 37m
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (OpenShift Container Platform 4.6.44 bug fix update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:3395
Verified in 4.6.44: After creating above collector SCC and deleting OAS pod, new pod can be Running: $ oc get po -n openshift-apiserver NAME READY STATUS RESTARTS AGE IP NODE ... apiserver-5b79bbd5f-8vsdg 2/2 Running 0 2m4s 10.130.0.55 ip-10-0-208-157.us-east-2.compute.internal ... $ oc get pod -n openshift-apiserver apiserver-5b79bbd5f-8vsdg -o yaml | grep " readOnlyRootFilesystem" readOnlyRootFilesystem: false Operator is not Degraded: $ oc get co openshift-apiserver NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE openshift-apiserver 4.6.44 True False False 37m