Deploying Elastic Agent on Openshift may require additional permissions depending on the type ofintegration Elastic Agent is supposed to run. In any case, Elastic Agent uses ahostPath volume as its data directory on OpenShift to maintain a stable identity. Therefore, the Service Account used for Elastic Agent needs permissions to use hostPath volumes.

The following example assumes that Elastic Agent is deployed in the Namespaceelastic with the ServiceAccountelastic-agent. You can replace these values according to your environment.

1. Create a dedicated ServiceAccount:

   oc create serviceaccount elastic-agent -n elastic

2. Add the ServiceAccount to the required SCC:

   oc adm policy add-scc-to-user hostaccess -z elastic-agent -n elastic

3. Update the Elastic Agent manifest to use the new ServiceAccount, for example:

   apiVersion: agent.k8s.elastic.co/v1alpha1kind: Agentmetadata:  name: my-agentspec:  version: 9.3.0  daemonSet:    podTemplate:      spec:        serviceAccountName: elastic-agent