The applicable requirements can be automated on OpenShift.
However, the payment entity will still need to apply the same requirement
onto their payment application.

Among many requirements not applicable one is supported.

Sections 8.2 and 8.3 are heavily dependant on the selected identity
provider and removal of kubeadmin user.
So rules for these tow aspects were added to the controls.

The choice of which identity provider to use falls onto the payment
entity. But we already know that htpaswd cannot satisfy PCI-DSS's needs,
and LDAP provider needs to be restrained.

Restrict usage of htpasswd as the identity provider, it cannot provide
user lockout feature required by PCI-DSS.

Do not allow the LDAP provider to transmit clear text passwords.