10-enable-container-use-devices-sebool.yaml

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: 10-enable-container-use-devices-sebool
spec:
  config:
    ignition:
      version: 2.2.0
    systemd:
      units:
        - name: setsebool-container-use-devices.service
          enabled: true
          contents: |
            [Unit]
            Before=kubelet.service
            [Service]
            Type=oneshot
            ExecStart=setsebool container_use_devices true
            RemainAfterExit=yes
            [Install]
            WantedBy=multi-user.target

on SNO deployments it works only with machineconfiguration.openshift.io/role: master