When deploying Instana host agents on Red Hat OpenShift 4.x, the DaemonSet pods fail to start with 'unable to validate against any security context constraint' errors. The agent image and configuration.yaml are verified correct. What is the OpenShift-specific step required to resolve this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OpenShift's SCC system enforces stricter pod security than standard Kubernetes. The Instana host agent requires privileged access including host PID namespace, host network, and host path volume mounts to collect infrastructure metrics. Administrators must run 'oc adm policy add-scc-to-user privileged -z <serviceaccount> -n <namespace>' to allow the agent pods to start successfully.
Full explanation below image
Full Explanation
OpenShift's SCC system enforces stricter pod security than standard Kubernetes. The Instana host agent requires privileged access including host PID namespace, host network, and host path volume mounts to collect infrastructure metrics. Administrators must run 'oc adm policy add-scc-to-user privileged -z <serviceaccount> -n <namespace>' to allow the agent pods to start successfully. The correct answer is 'Grant the Instana agent's ServiceAccount the privileged Security Context Constraint in the monitoring namespace'. The incorrect options — "Disable OpenShift's built-in Prometheus monitoring stack to prevent SCC conflicts with the Instana agent", 'Install the Instana operator from OperatorHub which automatically configures all required SCC permissions', 'Patch the DaemonSet to remove hostPID and hostNetwork settings so pods run under the default restricted SCC' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 4: Integration domain of the IBM Instana Observability certification.