va: enabled: false - name: "docker.io/openstorage/*" policy: va: enabled: false - name: "gcr.io/google-containers/*" policy: va: enabled: false - name: "docker.io/lachlanevenson/*" policy: va: enabled: false - name: "docker.io/hrishi/*" policy: va: enabled: false - name: "quay.io/k8scsi/*" policy: va: enabled: false kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: px-account-anyuid-binding roleRef: kind: ClusterRole name: ibm-anyuid-hostaccess-clusterrole apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: px-account namespace: kube-system --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: px-account-privileged-binding roleRef: kind: ClusterRole name: ibm-privileged-clusterrole Example 4-31 Additional ClusterRoleBindings for portworx chart 2. By default IBM Cloud Private in version 3.1.x uses the restricted mode, which means that  the service account used to run pods needs a binding to a cluster role with the proper  cluster RBAC permissions. Portworx chart creates a set of service accounts and roles, but  these are not sufficient in an IBM Cloud Private environment. Create an additional set of  clusterrolebindings as shown Example 4-31. Add the Image policy with the command: kubectl create -f portwokx-imagepolicy.yaml 142  IBM Cloud Private System Administrator’s Guide