The ksync daemonset require non-trivial PSP: ability to mount hostPath. But because the daemon set doesn't use a service account it is impossible to grant that permission specifically and it should be granted by default.

The first level of a solution would be creation and usage of a service account for ksync.

A nice to have would be an option to create (and bind) the PSP from sync init