Agreed, the existing runtime implementations will simply draw the whitelist from a default one in the kubelet as described in https://github.com/kubernetes/kubernetes/pull/33614#discussion_r81045331, unless it is overriden by the PSP. 