When deploying the Instana agent DaemonSet on Red Hat OpenShift 4.x, all agent pods immediately fail with a forbidden error citing a security context violation. The DaemonSet requires host-level access to collect infrastructure metrics. What is the correct remediation?

The Instana agent requires privileged host access to collect system-level metrics, which on OpenShift requires associating the agent service account with the privileged Security Context Constraint. The command oc adm policy add-scc-to-user privileged -z instana-agent -n instana-agent grants this permission. Without the SCC binding, OpenShift denies the pod its requested host-level access regardless of what is configured in the DaemonSet spec, as SCCs are enforced at the admission controller level. The correct answer is 'Grant the instana-agent service account the privileged Security Context Constraint using oc adm policy add-scc-to-user'. The incorrect options — 'Set the agent container securityContext.runAsNonRoot field to false in the DaemonSet specification', 'Add an OpenShift NetworkPolicy that permits the agent pods to communicate with the host network interface', 'Create a PodDisruptionBudget that exempts the agent DaemonSet from security policy enforcement' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 3: Installation domain of the IBM Instana Observability certification.