vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers

Browse source 
Cilium 1.19 init containers mount-cgroup, apply-sysctl-overwrites,
mount-bpf-fs and clean-cilium-state call nsenter --ptrace, which is
denied by the cri-containerd.apparmor.d profile on Ubuntu 22.04+ and
any other distro loading this AppArmor profile. As a result cilium
agent pods land in Init:CrashLoopBackOff and downstream HelmReleases
cascade into "dependency not ready".

The modern k8s >= 1.30 pod-level appArmorProfile: Unconfined field is
accepted into the DaemonSet spec but not honoured by containerd CRI
at runtime (kubernetes/kubernetes#125069), so the deprecated
per-container AppArmor annotations remain the only reliable opt-out.

Add the annotations via podAnnotations in the wrapper values.yaml.
The change is harmless on systems without AppArmor (Talos,
RHEL/Rocky/AlmaLinux with SELinux) because kubelet silently ignores
unknown AppArmor annotations when the LSM is not loaded.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 6c0ae2570e)
This commit is contained in:
Aleksei Sviridkin 2026-04-11 13:23:33 +03:00 • committed by github-actions[bot]
parent 5674ce73e6
commit 06dce029c9
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
packages/system/cilium/values.yaml
View file

@ -23,3 +23,18 @@ cilium:
operator:
rollOutPods: true
replicas: 1
# Opt out of the cri-containerd.apparmor.d profile for containers that invoke
# nsenter --ptrace to join the host cgroup/mount namespace. Required on
# Ubuntu 22.04+ and other distros that load this AppArmor profile by default,
# where the denial puts cilium-agent into Init:CrashLoopBackOff.
# The deprecated annotations are used because k8s >= 1.30 pod-level
# appArmorProfile: Unconfined is not honoured by containerd CRI today
# (kubernetes/kubernetes#125069).
# Safe on Talos / RHEL family without AppArmor: kubelet ignores these
# annotations when the AppArmor LSM is not loaded.
podAnnotations:
container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined
container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined