An example of what the pod looks like when you do `oc debug node/ocp-worker-0`

debug-pod.yaml

---
kind: Pod
apiVersion: v1
metadata:
  name: debug-pod
  namespace: default
  annotations:
    debug.openshift.io/source-container: container-00
    openshift.io/required-scc: privileged
spec:
  restartPolicy: Never
  serviceAccountName: default
  hostPID: true
  priority: 1000000000
  schedulerName: default-scheduler
  hostNetwork: true
  enableServiceLinks: true
  terminationGracePeriodSeconds: 30
  preemptionPolicy: PreemptLowerPriority
  nodeName: ocp-worker-0
  securityContext: {}
  containers:
    - resources: {}
      stdin: true
      terminationMessagePath: /dev/termination-log
      stdinOnce: true
      name: container-00
      command:
        - /bin/sh
      env:
        - name: TMOUT
          value: '900'
      securityContext:
        privileged: true
        runAsUser: 0
      imagePullPolicy: IfNotPresent
      volumeMounts:
        - name: host
          mountPath: /host
        - name: kube-api-access
          readOnly: true
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      terminationMessagePolicy: File
      tty: true
      image: 'quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:4a76bdb700b15ef27f4040f6076521e986e8a67c79f3eac1b59e4833cb9d2d93'
  hostIPC: true
  serviceAccount: default
  volumes:
    - name: host
      hostPath:
        path: /
        type: Directory
    - name: kube-api-access
      projected:
        sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token
          - configMap:
              name: kube-root-ca.crt
              items:
                - key: ca.crt
                  path: ca.crt
          - downwardAPI:
              items:
                - path: namespace
                  fieldRef:
                    apiVersion: v1
                    fieldPath: metadata.namespace
          - configMap:
              name: openshift-service-ca.crt
              items:
                - key: service-ca.crt
                  path: service-ca.crt
        defaultMode: 420
  dnsPolicy: ClusterFirst
  tolerations:
    - key: node.kubernetes.io/not-ready
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 300
    - key: node.kubernetes.io/unreachable
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 300
  priorityClassName: openshift-user-critical

default-ns.yaml

---
kind: Namespace
apiVersion: v1
metadata:
  name: default
  labels:
    kubernetes.io/metadata.name: default
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
  annotations:
    openshift.io/sa.scc.mcs: 's0:c1,c0'
    openshift.io/sa.scc.supplemental-groups: 1000000000/10000
    openshift.io/sa.scc.uid-range: 1000000000/10000
spec:
  finalizers:
    - kubernetes