Enforce privileged PSA by default

control-plane-operator/controllers/hostedcontrolplane/clusterpolicy/config.go

@@ -67,5 +67,24 @@ func reconcileConfig(cfg *openshiftcpv1.OpenShiftControllerManagerConfig, minTLS
 			CipherSuites:  cipherSuites,
 		},
 	}
+
+	// disables automatically setting the `pod-security.kubernetes.io/enforce` label on namespaces by the pod-security-admission-label-synchronization-controller
+	// see https://github.com/openshift/cluster-policy-controller/blob/50c2a8337f08856bbae4cd419bb8ffcbdf92567c/pkg/cmd/controller/psalabelsyncer.go#L19
+	index := -1
+	for i := range cfg.FeatureGates {
+		fg := cfg.FeatureGates[i]
+		if strings.HasPrefix(fg, "OpenShiftPodSecurityAdmission") {
+			index = i
+			break
+		}
+	}
+
+	if index != -1 {
+		// overwrite
+		cfg.FeatureGates[index] = "OpenShiftPodSecurityAdmission=false"
+	} else {
+		cfg.FeatureGates = append(cfg.FeatureGates, "OpenShiftPodSecurityAdmission=false")
+	}
+
 	return nil
 }

control-plane-operator/controllers/hostedcontrolplane/kas/config.go

@@ -99,7 +99,7 @@ func generateConfig(p KubeAPIServerConfigParams) *kcpv1.KubeAPIServerConfig {
 									Kind:       "PodSecurityConfiguration",
 								},
 								Defaults: podsecurityadmissionv1beta1.PodSecurityDefaults{
-									Enforce:        "restricted",
+									Enforce:        "privileged",
 									EnforceVersion: "latest",
 									Audit:          "restricted",
 									AuditVersion:   "latest",