When applying for restricted-v3 scc and failing, the associated error message mentions wrong field path for hostUsers. It's not places in .spec.securityContext, just in .spec:

E1104 08:33:35.763522       1 task.go:128] "Unhandled Error" err="error running apply for deployment \"openshift-controller-manager-operator/openshift-controller-manager-operator\" (491 of 958): deployment openshift-controller-manager-operator/openshift-controller-manager-operator has a replica failure FailedCreate: pods \"openshift-controller-manager-operator-b445854f4-\" is forbidden: unable to validate against any security context constraint: provider restricted-v3: .spec.securityContext.hostUsers: Invalid value: null: Host Users must be set to false" logger="UnhandledError"

    Always

    1. Create a deployment requiring restricted-v3 and not setting hostUsers: false
    2. See the deployment rollout error message
    

unable to validate against any security context constraint: provider restricted-v3: .spec.securityContext.hostUsers: Invalid value: null: Host Users must be set to false

unable to validate against any security context constraint: provider restricted-v3: .spec.hostUsers: Invalid value: null: Host Users must be set to false