If users or groups exist that are bound to roles they must not have, modify the user or group permissions using the following cluster and local role binding commands: Remove a user from a Cluster RBAC role by executing the following: oc adm policy remove-cluster-role-from-user &lt;role&gt; &lt;username&gt; Remove a group from a Cluster RBAC role by executing the following: oc adm policy remove-cluster-role-from-group &lt;role&gt; &lt;groupname&gt; Remove a user from a Local RBAC role by executing the following: oc adm policy remove-role-from-user &lt;role&gt; &lt;username&gt; Remove a group from a Local RBAC role by executing the following: oc adm policy remove-role-from-group &lt;role&gt; &lt;groupname&gt; Note: For additional information, refer to https://docs.openshift.com/container-platform/4.8/authentication/using-rbac.html. Where OpenShift Virtualization is enabled: 1. Ensure kubevirt seccomp profile file permission is set to "700" or more restrictive: $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700 /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json Ensure kubevirt cache directory permission is set to "755" or more restrictive: $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 755 /var/run/kubevirt-private 2. Remove create access to virtualmachineinstancemigration and migrationpolicy objects in the cluster. Example: Remove create access given by the clusterRoleBinding for the migrationpolicy for the test user. # Get all the users and service accounts who can create migrationpolicies $ oc adm policy who-can create migrationpolicy Users: system:admin .. Test # Verify that the test user can create the migrationpolicy $ oc auth can-i create migrationpolicies --as test Warning: resource 'migrationpolicies' is not namespace scoped in group 'migrations.kubevirt.io' yes # Find out which rolebinding or clusterrolbinding associated to the test user $ oc get rolebindings,clusterrolebindings --all-namespaces -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.n ame,SERVICE_ACCOUNTS:subjects[?(@.kind=="User")].name' |grep test ClusterRoleBinding <none> migration-creator test # Inspect the cluster role binding $ oc get clusterrolebindings migration-creator -oyaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBindin g","metadata":{"annotations":{},"name":"migration-creator"},"roleRef": {"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"m igration-creator"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io" ,"kind":"User","name":"test"},{"kind":"ServiceAccount","name":"test"," namespace":"default"}]} creationTimestamp: "2025-03-06T14:05:04Z" name: migration-creator resourceVersion: "1093678" uid: 96be5dc2-2b30-4734-b5ef-16d9342bbdbf roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: migration-creator subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: test - kind: ServiceAccount name: test namespace: default # Remove the cluster role binding $ oc delete clusterrolebindings migration-creator clusterrolebinding.rbac.authorization.k8s.io "migration-creator" deleted # Re-verify that the test user cannot create the migrationpolicy $ oc auth can-i create migrationpolicies --as test Warning: resource 'migrationpolicies' is not namespace scoped in group 'migrations.kubevirt.io' no 3. Add the appropriate kernel arguments to the MachineConfigPools of the workers nodes and reboot them. Refer to https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/installation_configuration/installing-customizing#installation-special-config-kargs_installing-customizing Default Value: OpenShift does not enable nested virtualization by default.