From abd6667eb399f7e785c947f55a6fe16a8a8ecbba Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 16:39:58 +0300 Subject: [PATCH] [cilium] Move AppArmor podAnnotations to a non-Talos-only values file E2E revealed that the kube-apiserver rejects a DaemonSet carrying a per-container AppArmor annotation for a container that is not present in the pod spec: DaemonSet.apps 'cilium' is invalid: spec.template.annotations[container.apparmor.security.beta.kubernetes.io/mount-cgroup]: Invalid value: 'mount-cgroup': container not found On Talos (isp-full bundle) values-talos.yaml sets cgroup.autoMount.enabled=false, so the upstream chart does not render the mount-cgroup init container, and our unconditional podAnnotations entry for it becomes an invalid reference. Move the podAnnotations block from the shared values.yaml into a new values-apparmor.yaml and include it only in the cilium-generic and kubeovn-cilium-generic PackageSource variants, where cgroup.autoMount.enabled is explicitly true. Talos variants (cilium, cilium-kilo, kubeovn-cilium) get no AppArmor annotations, which is safe because the Talos kernel does not load the AppArmor LSM anyway. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../core/platform/sources/networking.yaml | 2 ++ packages/system/cilium/values-apparmor.yaml | 20 +++++++++++++++++++ packages/system/cilium/values.yaml | 20 ------------------- 3 files changed, 22 insertions(+), 20 deletions(-) create mode 100644 packages/system/cilium/values-apparmor.yaml diff --git a/packages/core/platform/sources/networking.yaml b/packages/core/platform/sources/networking.yaml index 8e8485b3..bece76f8 100644 --- a/packages/core/platform/sources/networking.yaml +++ b/packages/core/platform/sources/networking.yaml @@ -66,6 +66,7 @@ spec: path: system/cilium valuesFiles: - values.yaml + - values-apparmor.yaml install: privileged: true namespace: cozy-cilium @@ -117,6 +118,7 @@ spec: path: system/cilium valuesFiles: - values.yaml + - values-apparmor.yaml - values-kubeovn.yaml install: privileged: true diff --git a/packages/system/cilium/values-apparmor.yaml b/packages/system/cilium/values-apparmor.yaml new file mode 100644 index 00000000..0712836c --- /dev/null +++ b/packages/system/cilium/values-apparmor.yaml @@ -0,0 +1,20 @@ +cilium: + # Opt out of the cri-containerd.apparmor.d profile for containers that invoke + # nsenter to join the host cgroup/mount namespace. The kernel reports the + # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and + # other distros that load this AppArmor profile by default, where the + # denial otherwise puts cilium-agent into Init:CrashLoopBackOff. + # The deprecated annotations are used because k8s >= 1.30 pod-level + # appArmorProfile: Unconfined is not honoured by containerd CRI today + # (kubernetes/kubernetes#125069). + # Only applied on non-Talos cilium variants where cgroup.autoMount.enabled is + # true — on Talos mount-cgroup is not rendered and the kube-apiserver would + # reject an annotation referencing a non-existent container. + # mount-bpf-fs is intentionally excluded: it renders with its own + # securityContext.privileged=true, and the kernel does not apply AppArmor + # profiles to privileged containers. + podAnnotations: + container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined + container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined + container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined + container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 8aee34d9..cfb2cd6b 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -23,23 +23,3 @@ cilium: operator: rollOutPods: true replicas: 1 - # Opt out of the cri-containerd.apparmor.d profile for containers that invoke - # nsenter to join the host cgroup/mount namespace. The kernel reports the - # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and - # other distros that load this AppArmor profile by default, where the - # denial otherwise puts cilium-agent into Init:CrashLoopBackOff. - # The deprecated annotations are used because k8s >= 1.30 pod-level - # appArmorProfile: Unconfined is not honoured by containerd CRI today - # (kubernetes/kubernetes#125069). - # On Talos mount-cgroup is not rendered (cgroup.autoMount.enabled=false in - # values-talos.yaml) so its annotation is inert there. On RHEL-family and - # other AppArmor-less hosts kubelet silently ignores these annotations - # because the AppArmor LSM is not loaded. - # mount-bpf-fs is intentionally excluded: it renders with its own - # securityContext.privileged=true, and the kernel does not apply AppArmor - # profiles to privileged containers. - podAnnotations: - container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined - container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined