bootstrap-kube-controller-manager: kubelet fails to create a mirror with OCP 4.12 due to security policy error

Assisted Installer team received a report from engineer trying to install OCP 4.12 where bootstrap-kube-controller-manager pod cannot start due to issues with security policies.

This is a regression from 4.11 where the same configuration does not explode. The issue is probably related to the recent changes in 4.12 security policies.

4.12

Always

1. Start OCP 4.12 installation using Assisted Installer via Zero Touch Provisioning flow

kubelet.go:1713] "Failed creating a mirror pod for" err="pods \"bootstrap-kube-controller-manager-cnfde10.ptp.lab.eng.bos.redhat.com\" is forbidden: violates PodSecurity \"restricted:latest\": host namespaces (hostNetwork=true), hostPort (containers \"kube-controller-manager\", \"cluster-policy-controller\" use hostPorts 10257, 10357), allowPrivilegeEscalation != false (containers \"kube-controller-manager\", \"cluster-policy-controller\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers \"kube-controller-manager\", \"cluster-policy-controller\" must set securityContext.capabilities.drop=[\"ALL\"]), restricted volume types (volumes \"secrets\", \"etc-kubernetes-cloud\", \"config\", \"ssl-certs-host\", \"logs\" use restricted volume type \"hostPath\"), runAsNonRoot != true (pod or containers \"kube-controller-manager\", \"cluster-policy-controller\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers \"kube-controller-manager\", \"cluster-policy-controller\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")" pod="kube-system/bootstrap-kube-controller-manager-cnfde10.ptp.lab.eng.bos.redhat.com"

Installation expected to be successful

1. Full journald log from the machine is attached
2. Engineer reporting the issue is ~jacding@redhat.com
3. Slack thread in apiserver (with no replies) - https://coreos.slack.com/archives/CB48XQ4KZ/p1665585376913689
4. Slack thread in assisted installer (note also irrelevant discussion there) - https://coreos.slack.com/archives/CUPJTHQ5P/p1665524436202809?thread_ts=1663261169.779619&cid=CUPJTHQ5P