Create a MCO drop-in to explicitly set seccomp_use_default_when_empty = false in 4.10.z crio will change the default value of seccomp_use_default_when_empty from false to true in 4.11(crio1.24) and later versions. In order to not break current clusters, in 4.10.z we create a machine-config to have drop-in crio.conf file with seccomp_use_default_when_empty = false and make it a mandatory upgrade edge(OTA team). So seccomp_use_default_when_empty = true change be an opt-in for upgraded users, users will have the option to delete the MC associated with this file when they are ready to consume this change for their workload - How to verify it Fresh cluster installation, machine configs exit on the cluster: 99-worker-generated-crio-seccomp-use-default 99-master-generated-crio-seccomp-use-default Upgrade to version with this patch with ctrcfg CR on one pool with ctrcfg CR on all the pools with no ctrcfg CR After upgrade tried the following if no ctrcfg CR was created prior to upgrade, create one if ctrcfg CR was created prior to upgrade, delete it delete one or both of the capabilities MCs restart the MCC restart the MCO reboot nodes (make sure that the delete capabilities MCs are not created again) check that the configmap crio-seccomp-use-default-when-empty exists in the openshift-machine-config-operator namespace Upgrade to next version 4.11.0-0.ci-2022-04-01-023231 upgrade with generated-crio-seccomp-use-default MC existing upgrade with no generated-crio-seccomp-use-default MC