From 06dce029c9dc8e07e44cd8fb0329d6544ab42e4d Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 13:23:33 +0300 Subject: [PATCH] [cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers Cilium 1.19 init containers mount-cgroup, apply-sysctl-overwrites, mount-bpf-fs and clean-cilium-state call nsenter --ptrace, which is denied by the cri-containerd.apparmor.d profile on Ubuntu 22.04+ and any other distro loading this AppArmor profile. As a result cilium agent pods land in Init:CrashLoopBackOff and downstream HelmReleases cascade into "dependency not ready". The modern k8s >= 1.30 pod-level appArmorProfile: Unconfined field is accepted into the DaemonSet spec but not honoured by containerd CRI at runtime (kubernetes/kubernetes#125069), so the deprecated per-container AppArmor annotations remain the only reliable opt-out. Add the annotations via podAnnotations in the wrapper values.yaml. The change is harmless on systems without AppArmor (Talos, RHEL/Rocky/AlmaLinux with SELinux) because kubelet silently ignores unknown AppArmor annotations when the LSM is not loaded. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin (cherry picked from commit 6c0ae2570ec36f3edbb09c8136535b4c1807c273) --- packages/system/cilium/values.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index cfb2cd6b..048c4312 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -23,3 +23,18 @@ cilium: operator: rollOutPods: true replicas: 1 + # Opt out of the cri-containerd.apparmor.d profile for containers that invoke + # nsenter --ptrace to join the host cgroup/mount namespace. Required on + # Ubuntu 22.04+ and other distros that load this AppArmor profile by default, + # where the denial puts cilium-agent into Init:CrashLoopBackOff. + # The deprecated annotations are used because k8s >= 1.30 pod-level + # appArmorProfile: Unconfined is not honoured by containerd CRI today + # (kubernetes/kubernetes#125069). + # Safe on Talos / RHEL family without AppArmor: kubelet ignores these + # annotations when the AppArmor LSM is not loaded. + podAnnotations: + container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined + container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined + container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined + container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined + container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined