Description of problem:
This is a tracking bug for MTC. The bug is actually in OADP.

The permissions for velero are too permissive.

In particular this rule grants use to every SCC:
```
            - apiGroups:
                - '*'
              resources:
                - '*'
              verbs:
                - '*'
```

It looks like once a clusterrole is created OLM won't overwrite it if it is edited so I believe we can work around this in the following manner until there is a release:

```
oc get clusterrolebinding | grep oadp
```
Look at each of these and determine which one has the subject with the velero SA:
```
subjects:
- kind: ServiceAccount
  name: velero
  namespace: openshift-migration
```

In my case it is oadp-operator.v1.0.2-f84b8b4b5, so I edit the clusterrole with the same name, oc edit clusterrole oadp-operator.v1.0.2-f84b8b4b5
You'll see a set of rules that look like this:
```
- apiGroups:
    - '*'
  resources:
    - '*'
  verbs:
    - '*'
- apiGroups:
  - security.openshift.io
  resourceNames:
  - privileged
  - velero-privileged
  resources:
  - securitycontextconstraints
  verbs:
  - use
```
Delete those and add these:
```
- apiGroups:
  - build.openshift.io
  - migration.openshift.io
  - rbac.authorization.k8s.io
  - velero.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  verbs:
  - '*'
- apiGroups:
  - packages.operators.coreos.com
  resources:
  - packagemanifests
  verbs:
  - '*'
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get
  - watch
  - list
  - update
  - patch
  - create
  - delete
  - assign
  - deletecollection
- nonResourceURLs:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - security.openshift.io
  resources:
  - securitycontextconstraints
  verbs:
  - use
  resourceNames:
  - privileged
```
Delete velero and restic pods so they are recreated afterwards.
```
$ oc get po velero-5fcfd885d4-8d858 restic-6hfht -o yaml | grep scc
      openshift.io/scc: restricted
      openshift.io/scc: privileged
```

When I was exploring more today I saw node-exporter and anyuid, which is wrong, but let things work for the most part. With more custom SCCs and the more permissive rule they could be almost anything though.