+++ This bug was initially created as a clone of Bug #1805488 +++ Run-level 1 bypasses SCC, but many components have no need for that (are less secure as a result). Every component that does not need to be up before SCC starts should be in either the anyuid or restricted SCC profile so they get a stable SELinux label. Because these components are running without the appropriate restrictions, the security profile of these core components is weaker than it should be. All platform components that can run without a run level MUST do so, and use anyuid or restricted unless they can make a case for host network or privileged. Those components should be granted access to the protected SCCs. +++ In our scenario `assisted-installer` namespace in a cluster created using Assisted Installer is labeled as `openshift.io/run-level: "0"`. This has been done for performance reasons so that the controller starts as soon as possible during the installation.
One path worth investigating is use of pod priority classes [1] in order to mark assisted-installer-controller. There are already a default classes defined and reusing one of those could give us the same result (scheduling-wise) as the current approach with run-level. [1] https://docs.openshift.com/container-platform/4.7/nodes/pods/nodes-pods-priority.html#admin-guide-priority-preemption-priority-class_nodes-pods-priority