The SCC created by CDI has a priority of 10 which means it is used in priority.

Altough we might think by its specification that this SCC is restricted to cdi serviceaccount in openshift-cnv namespace it actually can be used by other service accounts through k8s RBAC mechanism.

For instance the cluster-storage-operator service account is granted the cluster-admin role through the cluster-storage-operator-role clusterrolebinding.

As a result, once CDI is deployed the cluster-storage-operator Pod is admitted using the containerized-data-importer SCC instead of restricted-v2 and fails to start:

Error: container has runAsNonRoot and image will run as root (pod: "cluster-storage-operator-5648cb555d-v7mkk_openshift-cluster-storage-operator(651e5e61-fa77-4f37-b2b1-78f0a15fc450)", container: cluster-storage-operator)