PSA is decided to be disabled in 4.19 

    4.19.0-rc

Always    

1. Create a namespace in an **hypershift hosted cluster** and check pod-security.kubernetes.io/enforce
$ oc new-project xxia-test
$ oc get ns xxia-test -o yaml
...
  labels:
    kubernetes.io/metadata.name: xxia-test
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest

2. Check global setting in the hypershift mgmt cluster
$ oc get --kubeconfig=$MGMT_KUBECONFIG cm/kas-config -n clusters-$HC_NAME -ojsonpath='{.data.config\.json}' | jq '.admission.pluginConfig.PodSecurity'
{
  "location": "",
  "configuration": {
    "kind": "PodSecurityConfiguration",
    "apiVersion": "pod-security.admission.config.k8s.io/v1beta1",
    "defaults": {
      "enforce": "restricted",
      "enforce-version": "latest",
      "audit": "restricted",
      "audit-version": "latest",
      "warn": "restricted",
      "warn-version": "latest"
    },
    "exemptions": {
      "usernames": [
        "system:serviceaccount:openshift-infra:build-controller"
      ]
    }
  }
}

    1. pod-security.kubernetes.io/enforce is being set "restricted"
    2. Global setting enforces "restricted"

    1. pod-security.kubernetes.io/enforce should not be set
    2. Global setting should not enforce "restricted"

    We need to disable the feature flag.