Red Hat OpenShift Container Platform

Manually delete the custom security context constraints

You can delete the spire-spiffe-csi-driver custom SCC when the SPIFFE CSI driver is ready and its pods are using the privileged security context constraint (SCC).

Prerequisites

You have upgraded Zero Trust Workload Identity Manager to 1.1.0 from the OperatorHub catalog.

Procedure

Confirm the SPIFFE CSI driver is ready by running the following command:
```
$ oc get spiffecsidriver cluster -o jsonpath='{range .status.conditions[*]}{.type}={.status}{"\n"}{end}'
```
The expected output includes DaemonSetAvailable=True and Ready=True.

Confirm that the CSI DaemonSet is available by running the following command:

$ oc get ds spire-spiffe-csi-driver -n zero-trust-workload-identity-manager

Confirm the CSI pods are running and are using the privileged SCC by running the following commands:

$ oc get pods -n zero-trust-workload-identity-manager -l app.kubernetes.io/name=spiffe-csi-driver

$ oc get pod -n zero-trust-workload-identity-manager -l app.kubernetes.io/name=spiffe-csi-driver \
    -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.openshift\.io/scc}{"\n"}{end}'

Every pod should show privileged.

After all checks have passed, delete the legacy custom SCC by running the following commands:
```
$ oc get scc spire-spiffe-csi-driver
```
```
$ oc delete scc spire-spiffe-csi-driver
```
If the SCC is already absent, no action is needed.