The openshift-ptp namespace is labelled with openshift.io/run-level: "1" From bug #1805488: Run-level 1 bypasses SCC, but many components have no need for that (are less secure as a result). Every component that does not need to be up before SCC starts should be in either the anyuid or restricted SCC profile so they get a stable SELinux label. Because these components are running without the appropriate restrictions, the security profile of these core components is weaker than it should be. All platform components that can run without a run level MUST do so, and use anyuid or restricted unless they can make a case for host network or privileged. Those components should be granted access to the protected SCCs. Each component listed here must be reviewed to determine whether it must be in run-level 1 or not, and if not, the label should be removed and appropriate SCC bindings created. If the PTP operator has a genuine need to run at this level, it would at least be helpful to briefly document the reason for that as a comment above the label.
Opened https://github.com/openshift/ptp-operator/pull/55
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2409