PROBLEM:

In clusters under resource pressure, file-integrity daemon pods often fail to schedule because nodes don't have enough available resources. This leaves nodes without integrity checks. Currently there's no way to set pod priority for these pods. Without a PriorityClass, the scheduler cannot preempt lower-priority workloads to make room for the file integrity pods. REQUEST: Add an optional `priorityClassName` field to the FileIntegrity CR that sets the PriorityClass for daemon pods. REFERENCE: PriorityClass documentation:

https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/

The compliance-operator already has this feature (see

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/security_and_compliance/compliance-operator#compliance-priorityclass_compliance-advanced).

PROPOSED SOLUTION:

fileintegrity.openshift.io/v1alpha1

kind: FileIntegrity metadata: name: worker-fileintegrity namespace: openshift-file-integrity spec: priorityClassName: system-node-critical nodeSelector:

node-role.kubernetes.io/worker

: ""