Increase the verbosity of logging for the CVO when applying the manifests in"/etc/cvo/" directory.
We have a case when the error is "Permission Denied" but this is very vague.

The error in the CVO logs is:
~~~
failure=Unable to download and prepare the update: stat /etc/cvo/updatepayloads/7WNaprXJNWTsPAepCHJ00Q/release-manifests/release-metadata: permission denied.
~~~

At this moment we are unable to figure out the reason why it fails.
The CVO mounts the "/etc/cvo" directory as hostPath in Read-Only mode, and the files are in 444 with container_file_t selinux, but the CVO runs with spc_t so selinux should not cause the issue.

With that, it would be good to add additional context for the problem, why the CVO can't read the manifests.
    

OpenShift Container Platform 4.15
    

n/a
    

    1.
    2.
    3.