Description of problem: Right now, the controller only looks at the PSA labels on the source / target namespaces to make the decision of whether a privileged pod can run in the ns or not. However, in some cases, the global admission controller config can already allow running a privileged Pod even when the labels are not present on the ns. The logic should be updated to consider this case. Version-Release number of selected component (if applicable): 1.7.8 How reproducible: Always Steps to Reproduce: 1. Set privileged policy as enforced at cluster level 2. Enable privileged pod setting in MigrationController 3. Do not put PSA labels on the namespace and run a migration, Actual results: the migration fails at the time of running Rsync because absence of labels causes the controller to run the Pod as underprivileged. Expected results: the migration should succeed as the cluster already allows running privileged pods at cluster level. Additional info: