From dcc8da9d16e0e0af1213e982cecf52f8ee5600de Mon Sep 17 00:00:00 2001
From: Divyam pateriya <dpateriy@redhat.com>
Date: Tue, 31 Mar 2026 00:41:10 +0530
Subject: [PATCH 1/2] fix: pin restricted-v2 SCC on HCP control plane pod
 templates

HCP control plane pods run in namespaces with PSA enforce: restricted,
but lack the openshift.io/required-scc annotation. If a permissive SCC
(e.g. anyuid) is granted to system:authenticated on the management
cluster, the SCC admission controller selects it for unpinned pods,
causing PSA violations and permanent FailedCreate.

Add a default openshift.io/required-scc: restricted-v2 annotation in
the shared setAnnotations() method so every v2 Deployment/StatefulSet
gets pinned automatically. The annotation is only set when not already
present, preserving any explicit overrides (e.g. privileged).

Remove the now-redundant explicit annotation from the
cluster-storage-operator asset YAML since the framework default covers
it.

Bug: https://issues.redhat.com/browse/OCPBUGS-78145
Made-with: Cursor
---
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_node_termination_handler_deployment.yaml |  1 +
 ...s_node_termination_handler_deployment.yaml |  1 +
 ...s_node_termination_handler_deployment.yaml |  1 +
 ...s_node_termination_handler_deployment.yaml |  1 +
 ...s_node_termination_handler_deployment.yaml |  1 +
 ...e_cloud_controller_manager_deployment.yaml |  1 +
 ...e_cloud_controller_manager_deployment.yaml |  1 +
 ...e_cloud_controller_manager_deployment.yaml |  1 +
 ...e_cloud_controller_manager_deployment.yaml |  1 +
 ...e_cloud_controller_manager_deployment.yaml |  1 +
 ...omponents_catalog_operator_deployment.yaml |  1 +
 ...omponents_catalog_operator_deployment.yaml |  1 +
 ...omponents_catalog_operator_deployment.yaml |  1 +
 ...omponents_catalog_operator_deployment.yaml |  1 +
 ...omponents_catalog_operator_deployment.yaml |  1 +
 ...ertified_operators_catalog_deployment.yaml |  1 +
 ...ertified_operators_catalog_deployment.yaml |  1 +
 ...ertified_operators_catalog_deployment.yaml |  1 +
 ...ertified_operators_catalog_deployment.yaml |  1 +
 ...ertified_operators_catalog_deployment.yaml |  1 +
 ..._cloud_credential_operator_deployment.yaml |  1 +
 ..._cloud_credential_operator_deployment.yaml |  1 +
 ..._cloud_credential_operator_deployment.yaml |  1 +
 ..._cloud_credential_operator_deployment.yaml |  1 +
 ..._cloud_credential_operator_deployment.yaml |  1 +
 ...ponents_cluster_autoscaler_deployment.yaml |  1 +
 ...ponents_cluster_autoscaler_deployment.yaml |  1 +
 ...ponents_cluster_autoscaler_deployment.yaml |  1 +
 ...ponents_cluster_autoscaler_deployment.yaml |  1 +
 ...ponents_cluster_autoscaler_deployment.yaml |  1 +
 ...er_image_registry_operator_deployment.yaml |  1 +
 ...er_image_registry_operator_deployment.yaml |  1 +
 ...er_image_registry_operator_deployment.yaml |  1 +
 ...er_image_registry_operator_deployment.yaml |  1 +
 ...er_image_registry_operator_deployment.yaml |  1 +
 ...s_cluster_network_operator_deployment.yaml |  1 +
 ...s_cluster_network_operator_deployment.yaml |  1 +
 ...s_cluster_network_operator_deployment.yaml |  1 +
 ...s_cluster_network_operator_deployment.yaml |  1 +
 ...s_cluster_network_operator_deployment.yaml |  1 +
 ...uster_node_tuning_operator_deployment.yaml |  1 +
 ...uster_node_tuning_operator_deployment.yaml |  1 +
 ...uster_node_tuning_operator_deployment.yaml |  1 +
 ...uster_node_tuning_operator_deployment.yaml |  1 +
 ...uster_node_tuning_operator_deployment.yaml |  1 +
 ..._cluster_policy_controller_deployment.yaml |  1 +
 ..._cluster_policy_controller_deployment.yaml |  1 +
 ..._cluster_policy_controller_deployment.yaml |  1 +
 ..._cluster_policy_controller_deployment.yaml |  1 +
 ..._cluster_policy_controller_deployment.yaml |  1 +
 ...s_cluster_version_operator_deployment.yaml |  1 +
 ...s_cluster_version_operator_deployment.yaml |  1 +
 ...s_cluster_version_operator_deployment.yaml |  1 +
 ...s_cluster_version_operator_deployment.yaml |  1 +
 ...s_cluster_version_operator_deployment.yaml |  1 +
 ...ommunity_operators_catalog_deployment.yaml |  1 +
 ...ommunity_operators_catalog_deployment.yaml |  1 +
 ...ommunity_operators_catalog_deployment.yaml |  1 +
 ...ommunity_operators_catalog_deployment.yaml |  1 +
 ...ommunity_operators_catalog_deployment.yaml |  1 +
 ...control_plane_pki_operator_deployment.yaml |  1 +
 ...control_plane_pki_operator_deployment.yaml |  1 +
 ...control_plane_pki_operator_deployment.yaml |  1 +
 ...control_plane_pki_operator_deployment.yaml |  1 +
 ...control_plane_pki_operator_deployment.yaml |  1 +
 ...apshot_controller_operator_deployment.yaml |  1 +
 ...apshot_controller_operator_deployment.yaml |  1 +
 ...apshot_controller_operator_deployment.yaml |  1 +
 ...apshot_controller_operator_deployment.yaml |  1 +
 ...apshot_controller_operator_deployment.yaml |  1 +
 ...aneComponents_dns_operator_deployment.yaml |  1 +
 ...aneComponents_dns_operator_deployment.yaml |  1 +
 ...aneComponents_dns_operator_deployment.yaml |  1 +
 ...aneComponents_dns_operator_deployment.yaml |  1 +
 ...aneComponents_dns_operator_deployment.yaml |  1 +
 ...mponents_endpoint_resolver_deployment.yaml |  1 +
 ...mponents_endpoint_resolver_deployment.yaml |  1 +
 ...mponents_endpoint_resolver_deployment.yaml |  1 +
 ...mponents_endpoint_resolver_deployment.yaml |  1 +
 ...mponents_endpoint_resolver_deployment.yaml |  1 +
 ...ntrolPlaneComponents_etcd_statefulset.yaml |  1 +
 ...ntrolPlaneComponents_etcd_statefulset.yaml |  1 +
 ...ntrolPlaneComponents_etcd_statefulset.yaml |  1 +
 ...ntrolPlaneComponents_etcd_statefulset.yaml |  1 +
 ...ntrolPlaneComponents_etcd_statefulset.yaml |  1 +
 ...eComponents_featuregate_generator_job.yaml |  1 +
 ...eComponents_featuregate_generator_job.yaml |  1 +
 ...eComponents_featuregate_generator_job.yaml |  1 +
 ...eComponents_featuregate_generator_job.yaml |  1 +
 ...eComponents_featuregate_generator_job.yaml |  1 +
 ...p_cloud_controller_manager_deployment.yaml |  1 +
 ...p_cloud_controller_manager_deployment.yaml |  1 +
 ...p_cloud_controller_manager_deployment.yaml |  1 +
 ...p_cloud_controller_manager_deployment.yaml |  1 +
 ...p_cloud_controller_manager_deployment.yaml |  1 +
 ...ed_cluster_config_operator_deployment.yaml |  1 +
 ...ed_cluster_config_operator_deployment.yaml |  1 +
 ...ed_cluster_config_operator_deployment.yaml |  1 +
 ...ed_cluster_config_operator_deployment.yaml |  1 +
 ...ed_cluster_config_operator_deployment.yaml |  1 +
 ...ents_ignition_server_proxy_deployment.yaml |  1 +
 ...ents_ignition_server_proxy_deployment.yaml |  1 +
 ...ents_ignition_server_proxy_deployment.yaml |  1 +
 ...ents_ignition_server_proxy_deployment.yaml |  1 +
 ...ents_ignition_server_proxy_deployment.yaml |  1 +
 ...Components_ignition_server_deployment.yaml |  1 +
 ...Components_ignition_server_deployment.yaml |  1 +
 ...Components_ignition_server_deployment.yaml |  1 +
 ...Components_ignition_server_deployment.yaml |  1 +
 ...Components_ignition_server_deployment.yaml |  1 +
 ...omponents_ingress_operator_deployment.yaml |  1 +
 ...omponents_ingress_operator_deployment.yaml |  1 +
 ...omponents_ingress_operator_deployment.yaml |  1 +
 ...omponents_ingress_operator_deployment.yaml |  1 +
 ...omponents_ingress_operator_deployment.yaml |  1 +
 ...ponents_konnectivity_agent_deployment.yaml |  1 +
 ...ponents_konnectivity_agent_deployment.yaml |  1 +
 ...ponents_konnectivity_agent_deployment.yaml |  1 +
 ...ponents_konnectivity_agent_deployment.yaml |  1 +
 ...ponents_konnectivity_agent_deployment.yaml |  1 +
 ...eComponents_kube_apiserver_deployment.yaml |  1 +
 ...eComponents_kube_apiserver_deployment.yaml |  1 +
 ...eComponents_kube_apiserver_deployment.yaml |  1 +
 ...eComponents_kube_apiserver_deployment.yaml |  1 +
 ...eComponents_kube_apiserver_deployment.yaml |  1 +
 ...ts_kube_controller_manager_deployment.yaml |  1 +
 ...ts_kube_controller_manager_deployment.yaml |  1 +
 ...ts_kube_controller_manager_deployment.yaml |  1 +
 ...ts_kube_controller_manager_deployment.yaml |  1 +
 ...ts_kube_controller_manager_deployment.yaml |  1 +
 ...eComponents_kube_scheduler_deployment.yaml |  1 +
 ...eComponents_kube_scheduler_deployment.yaml |  1 +
 ...eComponents_kube_scheduler_deployment.yaml |  1 +
 ...eComponents_kube_scheduler_deployment.yaml |  1 +
 ...eComponents_kube_scheduler_deployment.yaml |  1 +
 ...t_cloud_controller_manager_deployment.yaml |  1 +
 ...t_cloud_controller_manager_deployment.yaml |  1 +
 ...t_cloud_controller_manager_deployment.yaml |  1 +
 ...t_cloud_controller_manager_deployment.yaml |  1 +
 ...t_cloud_controller_manager_deployment.yaml |  1 +
 ...ts_kubevirt_csi_controller_deployment.yaml |  1 +
 ...ts_kubevirt_csi_controller_deployment.yaml |  1 +
 ...ts_kubevirt_csi_controller_deployment.yaml |  1 +
 ...ts_kubevirt_csi_controller_deployment.yaml |  1 +
 ...ts_kubevirt_csi_controller_deployment.yaml |  1 +
 ...omponents_machine_approver_deployment.yaml |  1 +
 ...omponents_machine_approver_deployment.yaml |  1 +
 ...omponents_machine_approver_deployment.yaml |  1 +
 ...omponents_machine_approver_deployment.yaml |  1 +
 ...omponents_machine_approver_deployment.yaml |  1 +
 ...neComponents_metrics_proxy_deployment.yaml |  1 +
 ...neComponents_metrics_proxy_deployment.yaml |  1 +
 ...neComponents_metrics_proxy_deployment.yaml |  1 +
 ...neComponents_metrics_proxy_deployment.yaml |  1 +
 ...neComponents_metrics_proxy_deployment.yaml |  1 +
 ...Components_oauth_openshift_deployment.yaml |  1 +
 ...Components_oauth_openshift_deployment.yaml |  1 +
 ...Components_oauth_openshift_deployment.yaml |  1 +
 ...Components_oauth_openshift_deployment.yaml |  1 +
 ...Components_oauth_openshift_deployment.yaml |  1 +
 ...mponents_olm_collect_profiles_cronjob.yaml |  1 +
 ...mponents_olm_collect_profiles_cronjob.yaml |  1 +
 ...mponents_olm_collect_profiles_cronjob.yaml |  1 +
 ...mponents_olm_collect_profiles_cronjob.yaml |  1 +
 ...mponents_olm_collect_profiles_cronjob.yaml |  1 +
 ...aneComponents_olm_operator_deployment.yaml |  1 +
 ...aneComponents_olm_operator_deployment.yaml |  1 +
 ...aneComponents_olm_operator_deployment.yaml |  1 +
 ...aneComponents_olm_operator_deployment.yaml |  1 +
 ...aneComponents_olm_operator_deployment.yaml |  1 +
 ...onents_openshift_apiserver_deployment.yaml |  1 +
 ...onents_openshift_apiserver_deployment.yaml |  1 +
 ...onents_openshift_apiserver_deployment.yaml |  1 +
 ...onents_openshift_apiserver_deployment.yaml |  1 +
 ...onents_openshift_apiserver_deployment.yaml |  1 +
 ...enshift_controller_manager_deployment.yaml |  1 +
 ...enshift_controller_manager_deployment.yaml |  1 +
 ...enshift_controller_manager_deployment.yaml |  1 +
 ...enshift_controller_manager_deployment.yaml |  1 +
 ...enshift_controller_manager_deployment.yaml |  1 +
 ..._openshift_oauth_apiserver_deployment.yaml |  1 +
 ..._openshift_oauth_apiserver_deployment.yaml |  1 +
 ..._openshift_oauth_apiserver_deployment.yaml |  1 +
 ..._openshift_oauth_apiserver_deployment.yaml |  1 +
 ..._openshift_oauth_apiserver_deployment.yaml |  1 +
 ...t_route_controller_manager_deployment.yaml |  1 +
 ...t_route_controller_manager_deployment.yaml |  1 +
 ...t_route_controller_manager_deployment.yaml |  1 +
 ...t_route_controller_manager_deployment.yaml |  1 +
 ...t_route_controller_manager_deployment.yaml |  1 +
 ...k_cloud_controller_manager_deployment.yaml |  1 +
 ...k_cloud_controller_manager_deployment.yaml |  1 +
 ...k_cloud_controller_manager_deployment.yaml |  1 +
 ...k_cloud_controller_manager_deployment.yaml |  1 +
 ...k_cloud_controller_manager_deployment.yaml |  1 +
 ...neComponents_packageserver_deployment.yaml |  1 +
 ...neComponents_packageserver_deployment.yaml |  1 +
 ...neComponents_packageserver_deployment.yaml |  1 +
 ...neComponents_packageserver_deployment.yaml |  1 +
 ...neComponents_packageserver_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...s_cloud_controller_manager_deployment.yaml |  1 +
 ...redhat_marketplace_catalog_deployment.yaml |  1 +
 ...redhat_marketplace_catalog_deployment.yaml |  1 +
 ...redhat_marketplace_catalog_deployment.yaml |  1 +
 ...redhat_marketplace_catalog_deployment.yaml |  1 +
 ...redhat_marketplace_catalog_deployment.yaml |  1 +
 ...s_redhat_operators_catalog_deployment.yaml |  1 +
 ...s_redhat_operators_catalog_deployment.yaml |  1 +
 ...s_redhat_operators_catalog_deployment.yaml |  1 +
 ...s_redhat_operators_catalog_deployment.yaml |  1 +
 ...s_redhat_operators_catalog_deployment.yaml |  1 +
 ...trolPlaneComponents_router_deployment.yaml |  1 +
 ...trolPlaneComponents_router_deployment.yaml |  1 +
 ...trolPlaneComponents_router_deployment.yaml |  1 +
 ...trolPlaneComponents_router_deployment.yaml |  1 +
 ...trolPlaneComponents_router_deployment.yaml |  1 +
 .../cluster-storage-operator/deployment.yaml  |  1 -
 support/controlplane-component/defaults.go    | 11 ++++++
 .../controlplane-component/defaults_test.go   | 37 +++++++++++++++++++
 228 files changed, 273 insertions(+), 1 deletion(-)

diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
index cb0ec007f745..5ea9385155a0 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 6cd2cf9e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: aws-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
index d2f4684687b8..3f8cc77e4e3b 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 6cd2cf9e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: aws-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
index cb0ec007f745..5ea9385155a0 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 6cd2cf9e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: aws-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
index ec4d646c01b7..ddda1382d817 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 6cd2cf9e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: aws-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
index ec4d646c01b7..ddda1382d817 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_aws_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 6cd2cf9e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: aws-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/AROSwift/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/AROSwift/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
index bcde849ee177..5747ec7715ee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/AROSwift/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/AROSwift/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp,token,tmp-dir
         component.hypershift.openshift.io/config-hash: 2e848593
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: aws-node-termination-handler
         hypershift.openshift.io/control-plane-component: aws-node-termination-handler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/GCP/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/GCP/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
index 298f15ef1a5f..4175c77d5926 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/GCP/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/GCP/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp,token,cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 2e848593
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: aws-node-termination-handler
         hypershift.openshift.io/control-plane-component: aws-node-termination-handler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
index bcde849ee177..5747ec7715ee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/IBMCloud/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp,token,tmp-dir
         component.hypershift.openshift.io/config-hash: 2e848593
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: aws-node-termination-handler
         hypershift.openshift.io/control-plane-component: aws-node-termination-handler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
index 08cd268c852c..3ad3d2b2e090 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp,token,cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 2e848593
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: aws-node-termination-handler
         hypershift.openshift.io/control-plane-component: aws-node-termination-handler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
index 08cd268c852c..3ad3d2b2e090 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/aws-node-termination-handler/zz_fixture_TestControlPlaneComponents_aws_node_termination_handler_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp,token,cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 2e848593
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: aws-node-termination-handler
         hypershift.openshift.io/control-plane-component: aws-node-termination-handler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
index a98d12f53c4d..311076cd68a0 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 23427fb4
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: azure-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
index 82e9a468eded..64cda2e7da4e 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 6390db5f
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: azure-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
index 46764bcf7cbf..107bdc14aea9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 6390db5f
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: azure-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
index db98131c4780..51e414ce82a6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 6390db5f
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: azure-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
index db98131c4780..51e414ce82a6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/azure-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_azure_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 6390db5f
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: azure-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/AROSwift/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/AROSwift/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
index eb227e6bd6de..f88cc154978b 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/AROSwift/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/AROSwift/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: catalog-operator
         hypershift.openshift.io/control-plane-component: catalog-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/GCP/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/GCP/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
index 42bfc698937c..2f6e71963180 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/GCP/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/GCP/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: catalog-operator
         hypershift.openshift.io/control-plane-component: catalog-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
index 002989bb0387..c19e1a4e2ba8 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: catalog-operator
         hypershift.openshift.io/control-plane-component: catalog-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
index eb227e6bd6de..f88cc154978b 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: catalog-operator
         hypershift.openshift.io/control-plane-component: catalog-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
index eb227e6bd6de..f88cc154978b 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/catalog-operator/zz_fixture_TestControlPlaneComponents_catalog_operator_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: catalog-operator
         hypershift.openshift.io/control-plane-component: catalog-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
index cad71545e5e2..6530408a3d0d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: certified-operators-catalog
         hypershift.openshift.io/control-plane-component: certified-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
index 90af9816b5ab..1953b29126aa 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: certified-operators-catalog
         hypershift.openshift.io/control-plane-component: certified-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
index cad71545e5e2..6530408a3d0d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: certified-operators-catalog
         hypershift.openshift.io/control-plane-component: certified-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
index cad71545e5e2..6530408a3d0d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: certified-operators-catalog
         hypershift.openshift.io/control-plane-component: certified-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
index cad71545e5e2..6530408a3d0d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/certified-operators-catalog/zz_fixture_TestControlPlaneComponents_certified_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: certified-operators-catalog
         hypershift.openshift.io/control-plane-component: certified-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
index 8a9ea7d8189d..85d9ab02ccad 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-credential-operator
         hypershift.openshift.io/control-plane-component: cloud-credential-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/GCP/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/GCP/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
index 4949aff66362..90a14c5cb6b4 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/GCP/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/GCP/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-credential-operator
         hypershift.openshift.io/control-plane-component: cloud-credential-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
index 4ea913e42106..c3563e588655 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-credential-operator
         hypershift.openshift.io/control-plane-component: cloud-credential-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
index 8a9ea7d8189d..85d9ab02ccad 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-credential-operator
         hypershift.openshift.io/control-plane-component: cloud-credential-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
index 8a9ea7d8189d..85d9ab02ccad 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cloud-credential-operator/zz_fixture_TestControlPlaneComponents_cloud_credential_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-credential-operator
         hypershift.openshift.io/control-plane-component: cloud-credential-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
index a9ba12e8b505..0196d7cff65f 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-autoscaler
         hypershift.openshift.io/control-plane-component: cluster-autoscaler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/GCP/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/GCP/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
index e069b9085a0a..526b7fed3053 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/GCP/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/GCP/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-autoscaler
         hypershift.openshift.io/control-plane-component: cluster-autoscaler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
index 3c9569b8cac6..21c0d3367bab 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-autoscaler
         hypershift.openshift.io/control-plane-component: cluster-autoscaler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
index 2948dd778b6c..8c9c5728b496 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-autoscaler
         hypershift.openshift.io/control-plane-component: cluster-autoscaler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
index 2948dd778b6c..8c9c5728b496 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-autoscaler/zz_fixture_TestControlPlaneComponents_cluster_autoscaler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-autoscaler
         hypershift.openshift.io/control-plane-component: cluster-autoscaler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
index c840a91be6d0..eb40503663e9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: apiserver-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 7ab93c6087ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-image-registry-operator
         hypershift.openshift.io/control-plane-component: cluster-image-registry-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
index 845dcda2b06a..e6dd199b26b7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,apiserver-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 7ab93c6087ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-image-registry-operator
         hypershift.openshift.io/control-plane-component: cluster-image-registry-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
index 850861aec12f..c022af01d69e 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: apiserver-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 7ab93c6087ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-image-registry-operator
         hypershift.openshift.io/control-plane-component: cluster-image-registry-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
index 42b20da37b9c..3a4c6ce0b378 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,apiserver-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 7ab93c6087ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-image-registry-operator
         hypershift.openshift.io/control-plane-component: cluster-image-registry-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
index 42b20da37b9c..3a4c6ce0b378 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,apiserver-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 7ab93c6087ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-image-registry-operator
         hypershift.openshift.io/control-plane-component: cluster-image-registry-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
index 58a04bebbe74..76c71b9bf9a7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: configs,client-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 87ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-network-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
index ca8e4f005c76..dfea41573a37 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: configs,client-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 87ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-network-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
index aca3cf07158e..fa38895d3ccc 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: configs,client-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 87ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-network-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
index f708a7d5cd60..15c666cb5aee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: configs,client-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 87ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-network-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
index f708a7d5cd60..15c666cb5aee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-network-operator/zz_fixture_TestControlPlaneComponents_cluster_network_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: configs,client-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 87ecf31a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-network-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
index dc71ab4c2407..23732fda7980 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-node-tuning-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
index 3219736d4436..570f81deaf3e 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-node-tuning-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
index dc71ab4c2407..23732fda7980 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-node-tuning-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
index dc71ab4c2407..23732fda7980 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-node-tuning-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
index dc71ab4c2407..23732fda7980 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-node-tuning-operator/zz_fixture_TestControlPlaneComponents_cluster_node_tuning_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-node-tuning-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
index aff5610a1c1f..942c46ea3d2f 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: affa15d1
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-policy-controller
         hypershift.openshift.io/control-plane-component: cluster-policy-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/GCP/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/GCP/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
index f2606c456a85..a000e376bf74 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/GCP/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/GCP/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: dd705937
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-policy-controller
         hypershift.openshift.io/control-plane-component: cluster-policy-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
index 8932f405ae20..7c4dd4243802 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: affa15d1
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-policy-controller
         hypershift.openshift.io/control-plane-component: cluster-policy-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
index 53e1186a93fe..3915f11bdcee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: dd705937
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-policy-controller
         hypershift.openshift.io/control-plane-component: cluster-policy-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
index aff5610a1c1f..942c46ea3d2f 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-policy-controller/zz_fixture_TestControlPlaneComponents_cluster_policy_controller_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: affa15d1
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-policy-controller
         hypershift.openshift.io/control-plane-component: cluster-policy-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
index 2d9b1f3026d5..cdb31ae9ae62 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
@@ -31,6 +31,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payload,update-payloads,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-version-operator
         hypershift.openshift.io/control-plane-component: cluster-version-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
index 1b3c7f44f78c..97de414644a9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
@@ -31,6 +31,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payload,update-payloads,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-version-operator
         hypershift.openshift.io/control-plane-component: cluster-version-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
index 553aad2bbe4e..237be771795d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
@@ -31,6 +31,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payload,update-payloads,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-version-operator
         hypershift.openshift.io/control-plane-component: cluster-version-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
index e1230b097c4a..eba20277345b 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
@@ -31,6 +31,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payload,update-payloads,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-version-operator
         hypershift.openshift.io/control-plane-component: cluster-version-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
index 2d9b1f3026d5..cdb31ae9ae62 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-version-operator/zz_fixture_TestControlPlaneComponents_cluster_version_operator_deployment.yaml
@@ -31,6 +31,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payload,update-payloads,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-version-operator
         hypershift.openshift.io/control-plane-component: cluster-version-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
index 9f6db6682ba2..4596ac3f0b5d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: community-operators-catalog
         hypershift.openshift.io/control-plane-component: community-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
index 604e76c6ba95..acb92b7c9e77 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: community-operators-catalog
         hypershift.openshift.io/control-plane-component: community-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
index 9f6db6682ba2..4596ac3f0b5d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: community-operators-catalog
         hypershift.openshift.io/control-plane-component: community-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
index 9f6db6682ba2..4596ac3f0b5d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: community-operators-catalog
         hypershift.openshift.io/control-plane-component: community-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
index 9f6db6682ba2..4596ac3f0b5d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/community-operators-catalog/zz_fixture_TestControlPlaneComponents_community_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: community-operators-catalog
         hypershift.openshift.io/control-plane-component: community-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/AROSwift/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/AROSwift/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
index 01055a9b6799..4351e95cc2b1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/AROSwift/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/AROSwift/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: control-plane-pki-operator
         hypershift.openshift.io/control-plane-component: control-plane-pki-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/GCP/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/GCP/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
index 52c5c4848b78..b3834ed8a819 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/GCP/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/GCP/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: control-plane-pki-operator
         hypershift.openshift.io/control-plane-component: control-plane-pki-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
index 01055a9b6799..4351e95cc2b1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: control-plane-pki-operator
         hypershift.openshift.io/control-plane-component: control-plane-pki-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
index 01055a9b6799..4351e95cc2b1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: control-plane-pki-operator
         hypershift.openshift.io/control-plane-component: control-plane-pki-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
index 01055a9b6799..4351e95cc2b1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/control-plane-pki-operator/zz_fixture_TestControlPlaneComponents_control_plane_pki_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: control-plane-pki-operator
         hypershift.openshift.io/control-plane-component: control-plane-pki-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/AROSwift/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/AROSwift/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
index 07016bf089fa..cf0f79382c94 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/AROSwift/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/AROSwift/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: csi-snapshot-controller-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/GCP/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/GCP/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
index 8d212f3809e3..8a511663a62d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/GCP/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/GCP/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: csi-snapshot-controller-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
index 36b1916e0f50..f342b03bb2e1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: csi-snapshot-controller-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
index 07016bf089fa..cf0f79382c94 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: csi-snapshot-controller-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
index 07016bf089fa..cf0f79382c94 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/csi-snapshot-controller-operator/zz_fixture_TestControlPlaneComponents_csi_snapshot_controller_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: csi-snapshot-controller-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/AROSwift/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/AROSwift/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
index 1306b80065cd..bcf6bd611260 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/AROSwift/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/AROSwift/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: dns-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/GCP/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/GCP/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
index 3545eeabd59e..46b0a10cfb29 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/GCP/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/GCP/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: dns-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
index 3e771d6eae6f..1e88df9c9063 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: dns-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
index 1306b80065cd..bcf6bd611260 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: dns-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
index 1306b80065cd..bcf6bd611260 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/dns-operator/zz_fixture_TestControlPlaneComponents_dns_operator_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: dns-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/AROSwift/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/AROSwift/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
index 34830f3cc338..f939522bd209 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/AROSwift/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/AROSwift/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: endpoint-resolver
         hypershift.openshift.io/control-plane-component: endpoint-resolver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/GCP/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/GCP/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
index b00127e04536..14e51042eadf 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/GCP/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/GCP/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: endpoint-resolver
         hypershift.openshift.io/control-plane-component: endpoint-resolver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/IBMCloud/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/IBMCloud/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
index 34830f3cc338..f939522bd209 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/IBMCloud/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/IBMCloud/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: endpoint-resolver
         hypershift.openshift.io/control-plane-component: endpoint-resolver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
index 34830f3cc338..f939522bd209 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: endpoint-resolver
         hypershift.openshift.io/control-plane-component: endpoint-resolver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
index 34830f3cc338..f939522bd209 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/endpoint-resolver/zz_fixture_TestControlPlaneComponents_endpoint_resolver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: endpoint-resolver
         hypershift.openshift.io/control-plane-component: endpoint-resolver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
index 2e312b368f3d..5d67830603b7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/AROSwift/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cluster-state,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: etcd
         hypershift.openshift.io/control-plane-component: etcd
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
index 2398e8d0301e..ae9b1288bcf6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/GCP/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cluster-state,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: etcd
         hypershift.openshift.io/control-plane-component: etcd
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
index 2e312b368f3d..5d67830603b7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/IBMCloud/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cluster-state,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: etcd
         hypershift.openshift.io/control-plane-component: etcd
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
index 2e312b368f3d..5d67830603b7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cluster-state,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: etcd
         hypershift.openshift.io/control-plane-component: etcd
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
index 2e312b368f3d..5d67830603b7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/etcd/zz_fixture_TestControlPlaneComponents_etcd_statefulset.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cluster-state,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: etcd
         hypershift.openshift.io/control-plane-component: etcd
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/AROSwift/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/AROSwift/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
index 5963cfc64fb0..5e21ad1636fc 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/AROSwift/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/AROSwift/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
@@ -21,6 +21,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: manifests,work,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: featuregate-generator
         hypershift.openshift.io/control-plane-component: featuregate-generator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/GCP/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/GCP/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
index a74d6598ac08..9b00d65eb459 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/GCP/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/GCP/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
@@ -21,6 +21,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: manifests,work,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: featuregate-generator
         hypershift.openshift.io/control-plane-component: featuregate-generator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/IBMCloud/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/IBMCloud/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
index 5963cfc64fb0..5e21ad1636fc 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/IBMCloud/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/IBMCloud/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
@@ -21,6 +21,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: manifests,work,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: featuregate-generator
         hypershift.openshift.io/control-plane-component: featuregate-generator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
index 3a72ac3bb11f..1a361d342a4e 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
@@ -21,6 +21,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: manifests,work,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: featuregate-generator
         hypershift.openshift.io/control-plane-component: featuregate-generator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
index 5963cfc64fb0..5e21ad1636fc 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/featuregate-generator/zz_fixture_TestControlPlaneComponents_featuregate_generator_job.yaml
@@ -21,6 +21,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: manifests,work,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: featuregate-generator
         hypershift.openshift.io/control-plane-component: featuregate-generator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
index baf2c753d6ae..49db1384d2e4 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: eafd03f7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: gcp-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
index c53dfc1673bc..8346a89f26c6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: eafd03f7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: gcp-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
index baf2c753d6ae..49db1384d2e4 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: eafd03f7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: gcp-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
index 2eea788e4996..f13cf04553b1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: eafd03f7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: gcp-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
index 2eea788e4996..f13cf04553b1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/gcp-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_gcp_cloud_controller_manager_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: eafd03f7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: gcp-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/AROSwift/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/AROSwift/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
index d52b249da30e..b16c3a2ff541 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/AROSwift/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/AROSwift/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: hosted-cluster-config-operator
         hypershift.openshift.io/control-plane-component: hosted-cluster-config-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/GCP/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/GCP/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
index e0bde097e234..b893fd343cb6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/GCP/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/GCP/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: hosted-cluster-config-operator
         hypershift.openshift.io/control-plane-component: hosted-cluster-config-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
index 0599dcd6b830..7b6c913808d2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: hosted-cluster-config-operator
         hypershift.openshift.io/control-plane-component: hosted-cluster-config-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
index 5ed3a4c9b78b..81de04ead744 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: hosted-cluster-config-operator
         hypershift.openshift.io/control-plane-component: hosted-cluster-config-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
index 5ed3a4c9b78b..81de04ead744 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/hosted-cluster-config-operator/zz_fixture_TestControlPlaneComponents_hosted_cluster_config_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: hosted-cluster-config-operator
         hypershift.openshift.io/control-plane-component: hosted-cluster-config-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
index 7eced87e90dd..1f831a66fa23 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server-proxy
         hypershift.openshift.io/control-plane-component: ignition-server-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
index 8316e1da3184..c37c20223d98 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server-proxy
         hypershift.openshift.io/control-plane-component: ignition-server-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
index 7eced87e90dd..1f831a66fa23 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server-proxy
         hypershift.openshift.io/control-plane-component: ignition-server-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
index 7eced87e90dd..1f831a66fa23 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server-proxy
         hypershift.openshift.io/control-plane-component: ignition-server-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
index 7eced87e90dd..1f831a66fa23 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server-proxy/zz_fixture_TestControlPlaneComponents_ignition_server_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server-proxy
         hypershift.openshift.io/control-plane-component: ignition-server-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
index 97345c8a628c..0fb37b0d1e59 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/AROSwift/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payloads,bootstrap-manifests,manifests,shared,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server
         hypershift.openshift.io/control-plane-component: ignition-server
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
index 38f86f95bb46..5d2cfc2fa9f6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/GCP/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payloads,bootstrap-manifests,manifests,shared,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server
         hypershift.openshift.io/control-plane-component: ignition-server
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
index 725863927a90..c2cd6ebd5011 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/IBMCloud/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payloads,bootstrap-manifests,manifests,shared,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server
         hypershift.openshift.io/control-plane-component: ignition-server
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
index f1ab40a12b25..945eabd94aa1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payloads,bootstrap-manifests,manifests,shared,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server
         hypershift.openshift.io/control-plane-component: ignition-server
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
index ea22bb4e008f..717d6ea675ea 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ignition-server/zz_fixture_TestControlPlaneComponents_ignition_server_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: payloads,bootstrap-manifests,manifests,shared,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: ignition-server
         hypershift.openshift.io/control-plane-component: ignition-server
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/AROSwift/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/AROSwift/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
index e5c553e336d3..0cacb2c6f8e8 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/AROSwift/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/AROSwift/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: ingress-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/GCP/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/GCP/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
index 4ffbeb92446f..c05c3e33d5ec 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/GCP/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/GCP/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: ingress-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
index 258ac5ba9c73..9526c1a3a868 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: ingress-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
index 20270519640a..0706949cbcc5 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: ingress-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
index 20270519640a..0706949cbcc5 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/ingress-operator/zz_fixture_TestControlPlaneComponents_ingress_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: ingress-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/AROSwift/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/AROSwift/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
index 70f23e83145a..df8fd461fb34 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/AROSwift/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/AROSwift/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: konnectivity-agent
         hypershift.openshift.io/control-plane-component: konnectivity-agent
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/GCP/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/GCP/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
index 5a6073a46c2e..f0e37275cb59 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/GCP/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/GCP/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: konnectivity-agent
         hypershift.openshift.io/control-plane-component: konnectivity-agent
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/IBMCloud/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/IBMCloud/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
index 70f23e83145a..df8fd461fb34 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/IBMCloud/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/IBMCloud/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: konnectivity-agent
         hypershift.openshift.io/control-plane-component: konnectivity-agent
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
index 70f23e83145a..df8fd461fb34 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: konnectivity-agent
         hypershift.openshift.io/control-plane-component: konnectivity-agent
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
index 70f23e83145a..df8fd461fb34 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/konnectivity-agent/zz_fixture_TestControlPlaneComponents_konnectivity_agent_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: konnectivity-agent
         hypershift.openshift.io/control-plane-component: konnectivity-agent
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
index 18f63c6fd7cf..5120cee48f66 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: bootstrap-manifests,logs,kms-socket,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e1d8949e2360eec75741638a5741638a5741638a5741638a5794dc8cc8b110e88a2a4098ca7ac042de7e69167
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-apiserver
         hypershift.openshift.io/control-plane-component: kube-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
index c39706a399ce..eea5c9170740 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/GCP/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: bootstrap-manifests,logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e1d8949e2312ad2fb360eec758b110e88a2a4098ce7e69167
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-apiserver
         hypershift.openshift.io/control-plane-component: kube-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
index aabc4bde6a7b..e4946a1d5a7c 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: bootstrap-manifests,logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed8111f89b319dc307e1d8949e228a0ede7360eec758b110e88e7e69167
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-apiserver
         hypershift.openshift.io/control-plane-component: kube-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
index b0199139eced..cdd13a65c3e3 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: bootstrap-manifests,logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e1d8949e2312ad2fb360eec75741638a5741638a5741638a5741638a58b110e88a2a4098ce7e69167
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-apiserver
         hypershift.openshift.io/control-plane-component: kube-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
index 796b4b2358be..938930dc3fee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-apiserver/zz_fixture_TestControlPlaneComponents_kube_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: bootstrap-manifests,logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e1d8949e2360eec75741638a5741638a5741638a5741638a5794dc8cc8b110e88a2a4098ce7e69167
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-apiserver
         hypershift.openshift.io/control-plane-component: kube-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
index 454af316d3f8..d6637a398bc1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,certs,tmp-dir
         component.hypershift.openshift.io/config-hash: 1252551487ecf31a87ecf31ab4d55cfed6265674
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-controller-manager
         hypershift.openshift.io/control-plane-component: kube-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
index 2d4b2cc3e9f0..c6723ed3cb48 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,certs,tmp-dir
         component.hypershift.openshift.io/config-hash: 1252551487ecf31a87ecf31ab4d55cfed6265674
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-controller-manager
         hypershift.openshift.io/control-plane-component: kube-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
index 6870a64673e7..45cfe8ef9445 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,certs,tmp-dir
         component.hypershift.openshift.io/config-hash: 1252551440ea5fe187ecf31a87ecf31ad6265674
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-controller-manager
         hypershift.openshift.io/control-plane-component: kube-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
index ecd016215afd..4c9a7c831589 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,certs,tmp-dir
         component.hypershift.openshift.io/config-hash: 1252551487ecf31a87ecf31ab4d55cfed6265674
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-controller-manager
         hypershift.openshift.io/control-plane-component: kube-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
index e9b07a2f1e57..99e7b1962e0b 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-controller-manager/zz_fixture_TestControlPlaneComponents_kube_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,certs,tmp-dir
         component.hypershift.openshift.io/config-hash: 1252551487ecf31a87ecf31ab4d55cfed6265674
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-controller-manager
         hypershift.openshift.io/control-plane-component: kube-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
index 43cad14d1924..528a5ba7d02a 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/AROSwift/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
         component.hypershift.openshift.io/config-hash: 022a8a3ab4d55cfe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-scheduler
         hypershift.openshift.io/control-plane-component: kube-scheduler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
index 09c9b2546376..9ad8d2052bef 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/GCP/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
         component.hypershift.openshift.io/config-hash: 022a8a3ab4d55cfe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-scheduler
         hypershift.openshift.io/control-plane-component: kube-scheduler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
index 0225d00a823d..c51082eba105 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/IBMCloud/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
         component.hypershift.openshift.io/config-hash: 022a8a3a40ea5fe1
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-scheduler
         hypershift.openshift.io/control-plane-component: kube-scheduler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
index 435e2113074e..a289e6ca8ff1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
         component.hypershift.openshift.io/config-hash: 022a8a3ab4d55cfe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-scheduler
         hypershift.openshift.io/control-plane-component: kube-scheduler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
index 43cad14d1924..528a5ba7d02a 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kube-scheduler/zz_fixture_TestControlPlaneComponents_kube_scheduler_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cert-work,tmp-dir
         component.hypershift.openshift.io/config-hash: 022a8a3ab4d55cfe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kube-scheduler
         hypershift.openshift.io/control-plane-component: kube-scheduler
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
index b84879a1e7e4..d3b358bfcace 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: b833e1fe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: kubevirt-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
index bebaf6d9afcf..86f49ac58494 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: b833e1fe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: kubevirt-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
index b84879a1e7e4..d3b358bfcace 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: b833e1fe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: kubevirt-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
index b84879a1e7e4..d3b358bfcace 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: b833e1fe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: kubevirt-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
index b84879a1e7e4..d3b358bfcace 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_kubevirt_cloud_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: b833e1fe
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cloud-controller-manager
         hypershift.openshift.io/control-plane-component: kubevirt-cloud-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
index 4db401485d97..34db7375a4f2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/AROSwift/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: socket-dir,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kubevirt-csi-driver
         hypershift.openshift.io/control-plane-component: kubevirt-csi-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
index 634be21803d1..6d9b3c262b2f 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/GCP/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: socket-dir,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kubevirt-csi-driver
         hypershift.openshift.io/control-plane-component: kubevirt-csi-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
index 4db401485d97..34db7375a4f2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/IBMCloud/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: socket-dir,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kubevirt-csi-driver
         hypershift.openshift.io/control-plane-component: kubevirt-csi-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
index 4db401485d97..34db7375a4f2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: socket-dir,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kubevirt-csi-driver
         hypershift.openshift.io/control-plane-component: kubevirt-csi-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
index 4db401485d97..34db7375a4f2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/kubevirt-csi-controller/zz_fixture_TestControlPlaneComponents_kubevirt_csi_controller_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: socket-dir,tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: kubevirt-csi-driver
         hypershift.openshift.io/control-plane-component: kubevirt-csi-controller
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
index 4a1aaf2dd634..d5ed6d0796b2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: a53d18cd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: machine-approver
         hypershift.openshift.io/control-plane-component: machine-approver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
index 1ac7c5325d0b..70ecbd364164 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: a53d18cd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: machine-approver
         hypershift.openshift.io/control-plane-component: machine-approver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
index 3b4d3565e692..2dda4b6a9972 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: a53d18cd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: machine-approver
         hypershift.openshift.io/control-plane-component: machine-approver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
index 4a1aaf2dd634..d5ed6d0796b2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: a53d18cd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: machine-approver
         hypershift.openshift.io/control-plane-component: machine-approver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
index 4a1aaf2dd634..d5ed6d0796b2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: a53d18cd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: machine-approver
         hypershift.openshift.io/control-plane-component: machine-approver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
index a7d8789ac4d5..30a595f775c9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/AROSwift/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a587ecf31a87ecf31af44079cb
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: metrics-proxy
         hypershift.openshift.io/control-plane-component: metrics-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/GCP/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/GCP/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
index 8968c9a332b5..c7c5efecbc3d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/GCP/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/GCP/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a587ecf31a87ecf31af44079cb
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: metrics-proxy
         hypershift.openshift.io/control-plane-component: metrics-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
index a7d8789ac4d5..30a595f775c9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/IBMCloud/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a587ecf31a87ecf31af44079cb
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: metrics-proxy
         hypershift.openshift.io/control-plane-component: metrics-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
index a7d8789ac4d5..30a595f775c9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a587ecf31a87ecf31af44079cb
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: metrics-proxy
         hypershift.openshift.io/control-plane-component: metrics-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
index a7d8789ac4d5..30a595f775c9 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/metrics-proxy/zz_fixture_TestControlPlaneComponents_metrics_proxy_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a587ecf31a87ecf31af44079cb
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: metrics-proxy
         hypershift.openshift.io/control-plane-component: metrics-proxy
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/AROSwift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/AROSwift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
index 42d593217228..a0847b7498af 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/AROSwift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/AROSwift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 19dc307e3b105d444ebc1fdd60b54b1d741638a5a0dd232cbcc341c5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: oauth-openshift
         hypershift.openshift.io/control-plane-component: oauth-openshift
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/GCP/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/GCP/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
index 3b98ee0a7138..ee61f9b4d832 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/GCP/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/GCP/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 19dc307e3b105d444ebc1fdd60b54b1d741638a5a0dd232cbcc341c5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: oauth-openshift
         hypershift.openshift.io/control-plane-component: oauth-openshift
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/IBMCloud/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/IBMCloud/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
index 430aa1c80ccb..4dea12f6d583 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/IBMCloud/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/IBMCloud/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 19dc307e3b105d444ebc1fdd60b54b1d741638a5a0dd232cbcc341c5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: oauth-openshift
         hypershift.openshift.io/control-plane-component: oauth-openshift
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
index 42d593217228..a0847b7498af 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 19dc307e3b105d444ebc1fdd60b54b1d741638a5a0dd232cbcc341c5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: oauth-openshift
         hypershift.openshift.io/control-plane-component: oauth-openshift
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
index 42d593217228..a0847b7498af 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/oauth-openshift/zz_fixture_TestControlPlaneComponents_oauth_openshift_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 19dc307e3b105d444ebc1fdd60b54b1d741638a5a0dd232cbcc341c5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: oauth-openshift
         hypershift.openshift.io/control-plane-component: oauth-openshift
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/AROSwift/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/AROSwift/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
index f5dd8ad44674..fb1fbaeb1a35 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/AROSwift/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/AROSwift/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
@@ -23,6 +23,7 @@ spec:
             cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
             component.hypershift.openshift.io/config-hash: fe7dc514
             hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+            openshift.io/required-scc: restricted-v2
           labels:
             app: olm-collect-profiles
             hypershift.openshift.io/control-plane-component: olm-collect-profiles
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/GCP/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/GCP/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
index 4cc0d4d0ef5e..1a948352bc04 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/GCP/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/GCP/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
@@ -23,6 +23,7 @@ spec:
             cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
             component.hypershift.openshift.io/config-hash: fe7dc514
             hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+            openshift.io/required-scc: restricted-v2
           labels:
             app: olm-collect-profiles
             hypershift.openshift.io/control-plane-component: olm-collect-profiles
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
index f5dd8ad44674..fb1fbaeb1a35 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
@@ -23,6 +23,7 @@ spec:
             cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
             component.hypershift.openshift.io/config-hash: fe7dc514
             hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+            openshift.io/required-scc: restricted-v2
           labels:
             app: olm-collect-profiles
             hypershift.openshift.io/control-plane-component: olm-collect-profiles
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
index f5dd8ad44674..fb1fbaeb1a35 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
@@ -23,6 +23,7 @@ spec:
             cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
             component.hypershift.openshift.io/config-hash: fe7dc514
             hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+            openshift.io/required-scc: restricted-v2
           labels:
             app: olm-collect-profiles
             hypershift.openshift.io/control-plane-component: olm-collect-profiles
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
index f5dd8ad44674..fb1fbaeb1a35 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-collect-profiles/zz_fixture_TestControlPlaneComponents_olm_collect_profiles_cronjob.yaml
@@ -23,6 +23,7 @@ spec:
             cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
             component.hypershift.openshift.io/config-hash: fe7dc514
             hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+            openshift.io/required-scc: restricted-v2
           labels:
             app: olm-collect-profiles
             hypershift.openshift.io/control-plane-component: olm-collect-profiles
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/AROSwift/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/AROSwift/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
index 005de1c94808..d2296e8ade80 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/AROSwift/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/AROSwift/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: olm-operator
         hypershift.openshift.io/control-plane-component: olm-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/GCP/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/GCP/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
index ac12acf26592..b56f949c50f6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/GCP/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/GCP/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: olm-operator
         hypershift.openshift.io/control-plane-component: olm-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
index 4b8a9d32f735..4db9a8046045 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: olm-operator
         hypershift.openshift.io/control-plane-component: olm-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
index 005de1c94808..d2296e8ade80 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: olm-operator
         hypershift.openshift.io/control-plane-component: olm-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
index 005de1c94808..d2296e8ade80 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/olm-operator/zz_fixture_TestControlPlaneComponents_olm_operator_deployment.yaml
@@ -27,6 +27,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: olm-operator
         hypershift.openshift.io/control-plane-component: olm-operator
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
index f8d123a12151..651086e79571 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,oas-trust-anchor,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e56859177829b997b
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-apiserver
         hypershift.openshift.io/control-plane-component: openshift-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
index b7fc460440d1..380f89254bc8 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,oas-trust-anchor,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e829b997b86ed74e7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-apiserver
         hypershift.openshift.io/control-plane-component: openshift-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
index d12e522a577e..f8b1ff7ce1ab 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,oas-trust-anchor,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e56859177829b997b
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-apiserver
         hypershift.openshift.io/control-plane-component: openshift-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
index b4ad280ded2c..c544cd81dc2f 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,oas-trust-anchor,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e829b997b86ed74e7
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-apiserver
         hypershift.openshift.io/control-plane-component: openshift-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
index f8d123a12151..651086e79571 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-apiserver/zz_fixture_TestControlPlaneComponents_openshift_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,oas-trust-anchor,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e56859177829b997b
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-apiserver
         hypershift.openshift.io/control-plane-component: openshift-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
index 968f57b523a9..a68b27e337a7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: da3c0e77
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
index 748d9974722b..457780e4e85e 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: eb66b081
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
index 968f57b523a9..a68b27e337a7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: da3c0e77
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
index aa6e9dcb6f64..416ba89e5128 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: eb66b081
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
index 968f57b523a9..a68b27e337a7 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: da3c0e77
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
index cf04e43f20e1..8b77627e210d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-oauth-apiserver
         hypershift.openshift.io/control-plane-component: openshift-oauth-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
index 9594e7d5de4c..6d53d1a889ee 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/GCP/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-oauth-apiserver
         hypershift.openshift.io/control-plane-component: openshift-oauth-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
index cd61efc34b9c..604eef80a562 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-oauth-apiserver
         hypershift.openshift.io/control-plane-component: openshift-oauth-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
index cf04e43f20e1..8b77627e210d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-oauth-apiserver
         hypershift.openshift.io/control-plane-component: openshift-oauth-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
index cf04e43f20e1..8b77627e210d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-oauth-apiserver/zz_fixture_TestControlPlaneComponents_openshift_oauth_apiserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: work-logs,tmp-dir
         component.hypershift.openshift.io/config-hash: 0fd3eed819dc307e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-oauth-apiserver
         hypershift.openshift.io/control-plane-component: openshift-oauth-apiserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
index 9d447616c95e..e0ca1b2e4d37 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 130905bd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-route-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-route-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
index 8a7b805b1c38..c17fe4754e09 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 130905bd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-route-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-route-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
index 9d447616c95e..e0ca1b2e4d37 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 130905bd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-route-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-route-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
index 9d447616c95e..e0ca1b2e4d37 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 130905bd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-route-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-route-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
index 9d447616c95e..e0ca1b2e4d37 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openshift-route-controller-manager/zz_fixture_TestControlPlaneComponents_openshift_route_controller_manager_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 130905bd
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: openshift-route-controller-manager
         hypershift.openshift.io/control-plane-component: openshift-route-controller-manager
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
index 17b2e66ea0e5..b87103f97035 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 1cdcee0c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: openstack-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
index 6efc8bb2cdf1..ec71d2f3b08d 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 1cdcee0c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: openstack-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
index 17b2e66ea0e5..b87103f97035 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 1cdcee0c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: openstack-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
index 17b2e66ea0e5..b87103f97035 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 1cdcee0c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: openstack-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
index 17b2e66ea0e5..b87103f97035 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/openstack-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_openstack_cloud_controller_manager_deployment.yaml
@@ -28,6 +28,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 1cdcee0c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: openstack-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/AROSwift/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/AROSwift/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
index 49b5a18de7c1..2eaf6aa9ebc1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/AROSwift/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/AROSwift/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmpfs,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: packageserver
         hypershift.openshift.io/control-plane-component: packageserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/GCP/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/GCP/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
index 8c8ec7ae10db..0e44b07fd948 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/GCP/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/GCP/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmpfs,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: packageserver
         hypershift.openshift.io/control-plane-component: packageserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/IBMCloud/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/IBMCloud/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
index 3b7af9cf6102..da377b4d3e53 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/IBMCloud/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/IBMCloud/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmpfs,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: packageserver
         hypershift.openshift.io/control-plane-component: packageserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
index 49b5a18de7c1..2eaf6aa9ebc1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmpfs,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: packageserver
         hypershift.openshift.io/control-plane-component: packageserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
index 49b5a18de7c1..2eaf6aa9ebc1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/packageserver/zz_fixture_TestControlPlaneComponents_packageserver_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmpfs,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: packageserver
         hypershift.openshift.io/control-plane-component: packageserver
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
index c71b53fdc08c..f6a9a1299038 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/AROSwift/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 774b434c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: powervs-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
index faa641e9470b..0e2d92ed15a2 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/GCP/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 774b434c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: powervs-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
index c71b53fdc08c..f6a9a1299038 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/IBMCloud/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 774b434c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: powervs-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
index c71b53fdc08c..f6a9a1299038 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 774b434c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: powervs-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
index c71b53fdc08c..f6a9a1299038 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/powervs-cloud-controller-manager/zz_fixture_TestControlPlaneComponents_powervs_cloud_controller_manager_deployment.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 774b434c
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         hypershift.openshift.io/control-plane-component: powervs-cloud-controller-manager
         hypershift.openshift.io/hosted-control-plane: hcp-namespace
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
index f92cb5fc4f7e..2e3eecd513c6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
@@ -29,6 +29,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-marketplace-catalog
         hypershift.openshift.io/control-plane-component: redhat-marketplace-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
index 608fffb57bf7..f0e073e8ea92 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
@@ -29,6 +29,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-marketplace-catalog
         hypershift.openshift.io/control-plane-component: redhat-marketplace-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
index f92cb5fc4f7e..2e3eecd513c6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
@@ -29,6 +29,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-marketplace-catalog
         hypershift.openshift.io/control-plane-component: redhat-marketplace-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
index f92cb5fc4f7e..2e3eecd513c6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
@@ -29,6 +29,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-marketplace-catalog
         hypershift.openshift.io/control-plane-component: redhat-marketplace-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
index f92cb5fc4f7e..2e3eecd513c6 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-marketplace-catalog/zz_fixture_TestControlPlaneComponents_redhat_marketplace_catalog_deployment.yaml
@@ -29,6 +29,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-marketplace-catalog
         hypershift.openshift.io/control-plane-component: redhat-marketplace-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
index 1ebf8b2d89a3..1ed069740556 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/AROSwift/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-operators-catalog
         hypershift.openshift.io/control-plane-component: redhat-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
index 5bed86f2b232..099f04167892 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/GCP/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-operators-catalog
         hypershift.openshift.io/control-plane-component: redhat-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
index 1ebf8b2d89a3..1ed069740556 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/IBMCloud/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-operators-catalog
         hypershift.openshift.io/control-plane-component: redhat-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
index 1ebf8b2d89a3..1ed069740556 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-operators-catalog
         hypershift.openshift.io/control-plane-component: redhat-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
index 1ebf8b2d89a3..1ed069740556 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/redhat-operators-catalog/zz_fixture_TestControlPlaneComponents_redhat_operators_catalog_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: utilities,catalog-content,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: redhat-operators-catalog
         hypershift.openshift.io/control-plane-component: redhat-operators-catalog
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/AROSwift/zz_fixture_TestControlPlaneComponents_router_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/AROSwift/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
index f8d35dc894c0..30e399884358 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/AROSwift/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/AROSwift/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 7f056b1e
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: private-router
         hypershift.openshift.io/control-plane-component: router
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/GCP/zz_fixture_TestControlPlaneComponents_router_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/GCP/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
index 3e61ccc10f59..7ab1ce517b36 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/GCP/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/GCP/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 417672c4
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: private-router
         hypershift.openshift.io/control-plane-component: router
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/IBMCloud/zz_fixture_TestControlPlaneComponents_router_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/IBMCloud/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
index c34cdf62987c..1269848364d1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/IBMCloud/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/IBMCloud/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 417672c4
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: private-router
         hypershift.openshift.io/control-plane-component: router
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_router_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
index c34cdf62987c..1269848364d1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 417672c4
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: private-router
         hypershift.openshift.io/control-plane-component: router
diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/zz_fixture_TestControlPlaneComponents_router_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
index c34cdf62987c..1269848364d1 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/testdata/router/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/router/zz_fixture_TestControlPlaneComponents_router_deployment.yaml
@@ -30,6 +30,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 417672c4
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: private-router
         hypershift.openshift.io/control-plane-component: router
diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-storage-operator/deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-storage-operator/deployment.yaml
index 94499d47e878..a9747a081a62 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-storage-operator/deployment.yaml
+++ b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-storage-operator/deployment.yaml
@@ -10,7 +10,6 @@ spec:
   template:
     metadata:
       annotations:
-        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         app: cluster-storage-operator
diff --git a/support/controlplane-component/defaults.go b/support/controlplane-component/defaults.go
index a1f0f2fcc8f3..dc097b8c90dd 100644
--- a/support/controlplane-component/defaults.go
+++ b/support/controlplane-component/defaults.go
@@ -14,6 +14,8 @@ import (
 	"github.com/openshift/hypershift/support/config"
 	"github.com/openshift/hypershift/support/util"
 
+	securityv1 "github.com/openshift/api/security/v1"
+
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -41,6 +43,11 @@ const (
 	// podSafeToEvictLocalVolumesAnnotation is an annotation denoting the local volumes of a pod that can be safely evicted.
 	// This is needed for the CA operator to make sure it can properly drain the nodes with those volumes.
 	podSafeToEvictLocalVolumesAnnotation = "cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes"
+
+	// defaultRequiredSCC is the SCC pinned on all control plane pod templates to
+	// prevent permissive global SCCs from preempting the namespace PSA profile.
+	// See https://issues.redhat.com/browse/OCPBUGS-78145
+	defaultRequiredSCC = "restricted-v2"
 )
 
 var (
@@ -186,6 +193,10 @@ func (c *controlPlaneWorkload[T]) setAnnotations(podTemplate *corev1.PodTemplate
 		podTemplate.Annotations = map[string]string{}
 	}
 
+	if _, exists := podTemplate.Annotations[securityv1.RequiredSCCAnnotation]; !exists {
+		podTemplate.Annotations[securityv1.RequiredSCCAnnotation] = defaultRequiredSCC
+	}
+
 	podTemplate.Annotations[hyperv1.ReleaseImageAnnotation] = util.HCPControlPlaneReleaseImage(hcp)
 	if restartDate, ok := hcp.Annotations[hyperv1.RestartDateAnnotation]; ok {
 		podTemplate.Annotations[hyperv1.RestartDateAnnotation] = restartDate
diff --git a/support/controlplane-component/defaults_test.go b/support/controlplane-component/defaults_test.go
index f1c726fe2af7..fa6d802ca855 100644
--- a/support/controlplane-component/defaults_test.go
+++ b/support/controlplane-component/defaults_test.go
@@ -10,6 +10,7 @@ import (
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/ptr"
 
@@ -310,3 +311,39 @@ func TestSetDefaultOptions(t *testing.T) {
 	g.Expect(workloadObject.Spec.Template.Spec.SecurityContext.RunAsUser).To(Equal(ptr.To(int64(1002))))
 	g.Expect(workloadObject.Spec.Template.Spec.SecurityContext.FSGroup).To(Equal(ptr.To(int64(1002))))
 }
+
+func TestSetAnnotations_RequiredSCCDefault(t *testing.T) {
+	g := NewGomegaWithT(t)
+
+	cpw := &controlPlaneWorkload[*appsv1.Deployment]{
+		name:             "test-component",
+		workloadProvider: &deploymentProvider{},
+	}
+	hcp := &hyperv1.HostedControlPlane{}
+	podTemplate := &corev1.PodTemplateSpec{}
+
+	cpw.setAnnotations(podTemplate, hcp)
+
+	g.Expect(podTemplate.Annotations).To(HaveKeyWithValue("openshift.io/required-scc", "restricted-v2"))
+}
+
+func TestSetAnnotations_RequiredSCCExplicitOverridePreserved(t *testing.T) {
+	g := NewGomegaWithT(t)
+
+	cpw := &controlPlaneWorkload[*appsv1.Deployment]{
+		name:             "test-component",
+		workloadProvider: &deploymentProvider{},
+	}
+	hcp := &hyperv1.HostedControlPlane{}
+	podTemplate := &corev1.PodTemplateSpec{
+		ObjectMeta: metav1.ObjectMeta{
+			Annotations: map[string]string{
+				"openshift.io/required-scc": "privileged",
+			},
+		},
+	}
+
+	cpw.setAnnotations(podTemplate, hcp)
+
+	g.Expect(podTemplate.Annotations).To(HaveKeyWithValue("openshift.io/required-scc", "privileged"))
+}

From edaf76f163a31c3a765ec9497ad9299ced631f3f Mon Sep 17 00:00:00 2001
From: Divyam pateriya <dpateriy@redhat.com>
Date: Tue, 31 Mar 2026 01:02:40 +0530
Subject: [PATCH 2/2] fix: treat empty required-scc annotation as unset

If openshift.io/required-scc is present but empty or whitespace-only,
apply the default restricted-v2 pin so pods are not left unpinned.

Adds table-driven tests for empty and whitespace-only values.

Made-with: Cursor
---
 .../zz_fixture_TestReconcileComponents.yaml   |  1 +
 .../zz_fixture_TestReconcileComponents.yaml   |  1 +
 .../zz_fixture_TestReconcileComponents.yaml   |  1 +
 .../zz_fixture_TestReconcileComponents.yaml   |  1 +
 support/controlplane-component/defaults.go    |  2 +-
 .../controlplane-component/defaults_test.go   | 33 +++++++++++++++++++
 6 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/hypershift-operator/controllers/hostedcluster/testdata/capi-provider/zz_fixture_TestReconcileComponents.yaml b/hypershift-operator/controllers/hostedcluster/testdata/capi-provider/zz_fixture_TestReconcileComponents.yaml
index bef8e2986811..5bc6dfe4206c 100644
--- a/hypershift-operator/controllers/hostedcluster/testdata/capi-provider/zz_fixture_TestReconcileComponents.yaml
+++ b/hypershift-operator/controllers/hostedcluster/testdata/capi-provider/zz_fixture_TestReconcileComponents.yaml
@@ -22,6 +22,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: token,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: capi-provider-controller-manager
         control-plane: capi-provider-controller-manager
diff --git a/hypershift-operator/controllers/hostedcluster/testdata/cluster-api/zz_fixture_TestReconcileComponents.yaml b/hypershift-operator/controllers/hostedcluster/testdata/cluster-api/zz_fixture_TestReconcileComponents.yaml
index 41854ee0f0a0..9b871f99e149 100644
--- a/hypershift-operator/controllers/hostedcluster/testdata/cluster-api/zz_fixture_TestReconcileComponents.yaml
+++ b/hypershift-operator/controllers/hostedcluster/testdata/cluster-api/zz_fixture_TestReconcileComponents.yaml
@@ -26,6 +26,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: tmp-dir
         component.hypershift.openshift.io/config-hash: 741638a5741638a5
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: cluster-api
         hypershift.openshift.io/control-plane-component: cluster-api
diff --git a/hypershift-operator/controllers/hostedcluster/testdata/control-plane-operator/zz_fixture_TestReconcileComponents.yaml b/hypershift-operator/controllers/hostedcluster/testdata/control-plane-operator/zz_fixture_TestReconcileComponents.yaml
index a2499aca7d07..d5f110614293 100644
--- a/hypershift-operator/controllers/hostedcluster/testdata/control-plane-operator/zz_fixture_TestReconcileComponents.yaml
+++ b/hypershift-operator/controllers/hostedcluster/testdata/control-plane-operator/zz_fixture_TestReconcileComponents.yaml
@@ -25,6 +25,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: ""
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: control-plane-operator
         hypershift.openshift.io/control-plane-component: control-plane-operator
diff --git a/hypershift-operator/controllers/hostedcluster/testdata/karpenter-operator/zz_fixture_TestReconcileComponents.yaml b/hypershift-operator/controllers/hostedcluster/testdata/karpenter-operator/zz_fixture_TestReconcileComponents.yaml
index c49b2bd66512..1ece85f1e596 100644
--- a/hypershift-operator/controllers/hostedcluster/testdata/karpenter-operator/zz_fixture_TestReconcileComponents.yaml
+++ b/hypershift-operator/controllers/hostedcluster/testdata/karpenter-operator/zz_fixture_TestReconcileComponents.yaml
@@ -20,6 +20,7 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: cloud-token,tmp-dir
         component.hypershift.openshift.io/config-hash: 295d966a
         hypershift.openshift.io/release-image: quay.io/openshift-release-dev/ocp-release:4.16.10-x86_64
+        openshift.io/required-scc: restricted-v2
       labels:
         app: karpenter-operator
         hypershift.openshift.io/control-plane-component: karpenter-operator
diff --git a/support/controlplane-component/defaults.go b/support/controlplane-component/defaults.go
index dc097b8c90dd..03147752cb4b 100644
--- a/support/controlplane-component/defaults.go
+++ b/support/controlplane-component/defaults.go
@@ -193,7 +193,7 @@ func (c *controlPlaneWorkload[T]) setAnnotations(podTemplate *corev1.PodTemplate
 		podTemplate.Annotations = map[string]string{}
 	}
 
-	if _, exists := podTemplate.Annotations[securityv1.RequiredSCCAnnotation]; !exists {
+	if scc, exists := podTemplate.Annotations[securityv1.RequiredSCCAnnotation]; !exists || strings.TrimSpace(scc) == "" {
 		podTemplate.Annotations[securityv1.RequiredSCCAnnotation] = defaultRequiredSCC
 	}
 
diff --git a/support/controlplane-component/defaults_test.go b/support/controlplane-component/defaults_test.go
index fa6d802ca855..7c2c8966bfdd 100644
--- a/support/controlplane-component/defaults_test.go
+++ b/support/controlplane-component/defaults_test.go
@@ -347,3 +347,36 @@ func TestSetAnnotations_RequiredSCCExplicitOverridePreserved(t *testing.T) {
 
 	g.Expect(podTemplate.Annotations).To(HaveKeyWithValue("openshift.io/required-scc", "privileged"))
 }
+
+func TestSetAnnotations_RequiredSCCEmptyStringDefaults(t *testing.T) {
+	tests := []struct {
+		name             string
+		existingSCCValue string
+	}{
+		{name: "empty string", existingSCCValue: ""},
+		{name: "whitespace only", existingSCCValue: "   \t  "},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			g := NewGomegaWithT(t)
+
+			cpw := &controlPlaneWorkload[*appsv1.Deployment]{
+				name:             "test-component",
+				workloadProvider: &deploymentProvider{},
+			}
+			hcp := &hyperv1.HostedControlPlane{}
+			podTemplate := &corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						"openshift.io/required-scc": tt.existingSCCValue,
+					},
+				},
+			}
+
+			cpw.setAnnotations(podTemplate, hcp)
+
+			g.Expect(podTemplate.Annotations).To(HaveKeyWithValue("openshift.io/required-scc", "restricted-v2"))
+		})
+	}
+}