From 6c0ae2570ec36f3edbb09c8136535b4c1807c273 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 13:23:33 +0300 Subject: [PATCH 1/9] [cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers Cilium 1.19 init containers mount-cgroup, apply-sysctl-overwrites, mount-bpf-fs and clean-cilium-state call nsenter --ptrace, which is denied by the cri-containerd.apparmor.d profile on Ubuntu 22.04+ and any other distro loading this AppArmor profile. As a result cilium agent pods land in Init:CrashLoopBackOff and downstream HelmReleases cascade into "dependency not ready". The modern k8s >= 1.30 pod-level appArmorProfile: Unconfined field is accepted into the DaemonSet spec but not honoured by containerd CRI at runtime (kubernetes/kubernetes#125069), so the deprecated per-container AppArmor annotations remain the only reliable opt-out. Add the annotations via podAnnotations in the wrapper values.yaml. The change is harmless on systems without AppArmor (Talos, RHEL/Rocky/AlmaLinux with SELinux) because kubelet silently ignores unknown AppArmor annotations when the LSM is not loaded. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/values.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index cfb2cd6b5..048c4312c 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -23,3 +23,18 @@ cilium: operator: rollOutPods: true replicas: 1 + # Opt out of the cri-containerd.apparmor.d profile for containers that invoke + # nsenter --ptrace to join the host cgroup/mount namespace. Required on + # Ubuntu 22.04+ and other distros that load this AppArmor profile by default, + # where the denial puts cilium-agent into Init:CrashLoopBackOff. + # The deprecated annotations are used because k8s >= 1.30 pod-level + # appArmorProfile: Unconfined is not honoured by containerd CRI today + # (kubernetes/kubernetes#125069). + # Safe on Talos / RHEL family without AppArmor: kubelet ignores these + # annotations when the AppArmor LSM is not loaded. + podAnnotations: + container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined + container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined + container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined + container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined + container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined From 2531ab661a34ea9f07040db965d8db5d2ffe7201 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 13:41:01 +0300 Subject: [PATCH 2/9] [cilium] Drop mount-bpf-fs from AppArmor unconfined annotations mount-bpf-fs runs as privileged in the vendored chart, and the Linux kernel does not apply AppArmor profiles to privileged containers. The per-container unconfined annotation for this container is a no-op and only widens the pod's admission-policy surface for no reason. Keep the four meaningful annotations (cilium-agent, clean-cilium-state, mount-cgroup, apply-sysctl-overwrites) which target unprivileged agent and init containers actually affected by the cri-containerd.apparmor.d profile. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 048c4312c..4b2e1ff36 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -32,9 +32,10 @@ cilium: # (kubernetes/kubernetes#125069). # Safe on Talos / RHEL family without AppArmor: kubelet ignores these # annotations when the AppArmor LSM is not loaded. + # mount-bpf-fs is intentionally excluded: it runs as privileged, and the + # kernel does not apply AppArmor profiles to privileged containers. podAnnotations: container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined - container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined From 703dbca734c07162036d4d9dc5c12180ce59b438 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 13:54:16 +0300 Subject: [PATCH 3/9] [cilium] Document duplicate-key rendering on unsupported k8s < 1.30 On Kubernetes versions below 1.30 the upstream cilium chart still emits the deprecated per-container AppArmor annotations from its own semverCompare '<1.30.0' branch. Our podAnnotations override then emits the same keys again, yielding a YAML mapping with duplicate entries (identical values, last-wins by kubernetes API server JSON semantics). Cozystack's supported Kubernetes matrix starts at 1.30 (packages/apps/kubernetes/files/versions.yaml), so this rendering quirk never affects any shipped version. Document the behaviour in a comment so future readers are not surprised. No functional change. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 4b2e1ff36..cd31c107c 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -34,6 +34,11 @@ cilium: # annotations when the AppArmor LSM is not loaded. # mount-bpf-fs is intentionally excluded: it runs as privileged, and the # kernel does not apply AppArmor profiles to privileged containers. + # On unsupported k8s < 1.30 the upstream chart renders the same keys + # inside its own <1.30 branch, yielding a duplicate mapping with + # identical values (last-wins). The supported matrix starts at 1.30 + # (packages/apps/kubernetes/files/versions.yaml), so this does not + # affect any shipped version. podAnnotations: container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined From 182fc0b52d936a94144d1ba85723d3afd7b090dc Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 14:39:37 +0300 Subject: [PATCH 4/9] [cilium] Strip hardcoded AppArmor annotations from vendored daemonset The upstream chart emits per-container AppArmor unconfined annotations inside a k8s<1.30 branch of cilium-agent/daemonset.yaml. Cozystack now owns these annotations via cilium.podAnnotations in values.yaml so they also take effect on k8s>=1.30 (where upstream drops them in favour of the containerd-broken podSecurityContext.appArmorProfile). Having both sources emit the same keys produced a duplicate mapping on k8s<1.30. Add a new SED_INPLACE invocation to the package Makefile that removes the four hardcoded annotation lines from the vendored template, and apply the patch to the currently vendored copy so make update will reproduce the same state on future refreshes. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/Makefile | 10 ++++++++++ .../cilium/templates/cilium-agent/daemonset.yaml | 4 ---- packages/system/cilium/values.yaml | 5 ----- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile index 07d4ca972..3c90fd21b 100644 --- a/packages/system/cilium/Makefile +++ b/packages/system/cilium/Makefile @@ -12,6 +12,16 @@ update: helm repo update cilium helm pull cilium/cilium --untar --untardir charts --version 1.19 $(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml + # Drop the hardcoded AppArmor unconfined annotations from the cilium-agent + # DaemonSet's k8s<1.30 branch. Cozystack manages these through + # cilium.podAnnotations in values.yaml for all k8s versions, and keeping the + # upstream block would produce duplicate mapping keys on k8s<1.30. + $(SED_INPLACE) \ + -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/cilium-agent: "unconfined"/d' \ + -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/clean-cilium-state: "unconfined"/d' \ + -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/mount-cgroup: "unconfined"/d' \ + -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/apply-sysctl-overwrites: "unconfined"/d' \ + charts/cilium/templates/cilium-agent/daemonset.yaml version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ $(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml index f9a4cec72..bb2c5a151 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml @@ -62,11 +62,7 @@ spec: # Set app AppArmor's profile to "unconfined". The value of this annotation # can be modified as long users know which profiles they have available # in AppArmor. - container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined" - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined" {{- if .Values.cgroup.autoMount.enabled }} - container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined" - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined" {{- end }} {{- end }} {{- end }} diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index cd31c107c..4b2e1ff36 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -34,11 +34,6 @@ cilium: # annotations when the AppArmor LSM is not loaded. # mount-bpf-fs is intentionally excluded: it runs as privileged, and the # kernel does not apply AppArmor profiles to privileged containers. - # On unsupported k8s < 1.30 the upstream chart renders the same keys - # inside its own <1.30 branch, yielding a duplicate mapping with - # identical values (last-wins). The supported matrix starts at 1.30 - # (packages/apps/kubernetes/files/versions.yaml), so this does not - # affect any shipped version. podAnnotations: container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined From 5a50df800d803d3947db70e0bc5bac52891ccb1a Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 14:54:47 +0300 Subject: [PATCH 5/9] [cilium] Strip the entire k8s<1.30 AppArmor block from vendored daemonset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous sed patch removed only the four annotation lines and left an empty nested '{{- if ... }}{{- end }}{{- end }}{{- end }}' skeleton behind. That skeleton was dead code, but it also meant that the next make update would re-fetch the upstream chart with the annotations back inside the same block, and the sed would strip them again — leaving the skeleton behind forever. Replace the per-line sed patch with a single perl -i -0pe multi-line delete that removes the entire <1.30 AppArmor block in one step, and apply the same patch to the currently vendored copy for consistency. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/Makefile | 14 +++++--------- .../cilium/templates/cilium-agent/daemonset.yaml | 9 --------- 2 files changed, 5 insertions(+), 18 deletions(-) diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile index 3c90fd21b..4a9799f09 100644 --- a/packages/system/cilium/Makefile +++ b/packages/system/cilium/Makefile @@ -12,15 +12,11 @@ update: helm repo update cilium helm pull cilium/cilium --untar --untardir charts --version 1.19 $(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml - # Drop the hardcoded AppArmor unconfined annotations from the cilium-agent - # DaemonSet's k8s<1.30 branch. Cozystack manages these through - # cilium.podAnnotations in values.yaml for all k8s versions, and keeping the - # upstream block would produce duplicate mapping keys on k8s<1.30. - $(SED_INPLACE) \ - -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/cilium-agent: "unconfined"/d' \ - -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/clean-cilium-state: "unconfined"/d' \ - -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/mount-cgroup: "unconfined"/d' \ - -e '/container\.apparmor\.security\.beta\.kubernetes\.io\/apply-sysctl-overwrites: "unconfined"/d' \ + # Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent + # DaemonSet. Cozystack manages these annotations through cilium.podAnnotations + # in values.yaml on every k8s version, so keeping the upstream block would + # produce duplicate mapping keys on k8s<1.30. + perl -i -0pe 's|\n \{\{- if not \.Values\.securityContext\.privileged \}\}\n \{\{- if semverCompare "<1\.30\.0".*?\n \{\{- end \}\}\n \{\{- end \}\}\n \{\{- end \}\}||s' \ charts/cilium/templates/cilium-agent/daemonset.yaml version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ $(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml index bb2c5a151..fa3afc149 100644 --- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml +++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml @@ -57,15 +57,6 @@ spec: # ensure pods roll when configmap updates cilium.io/cilium-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-configmap.yaml") . | sha256sum | quote }} {{- end }} - {{- if not .Values.securityContext.privileged }} - {{- if semverCompare "<1.30.0" (printf "%d.%d.0" (semver .Capabilities.KubeVersion.Version).Major (semver .Capabilities.KubeVersion.Version).Minor) }} - # Set app AppArmor's profile to "unconfined". The value of this annotation - # can be modified as long users know which profiles they have available - # in AppArmor. - {{- if .Values.cgroup.autoMount.enabled }} - {{- end }} - {{- end }} - {{- end }} {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} From 39cd2658b53547f570cb57caa667eedfd15cb5ce Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 15:03:54 +0300 Subject: [PATCH 6/9] [cilium] Add fail-fast guard for the vendored daemonset patch The perl multi-line delete in the update: target silently becomes a no-op if the upstream template is ever reformatted. Verify the patch applied by grepping for one of the stripped annotation keys after the perl runs; fail the update: target loudly if it still exists, so a future upstream reformat is caught instead of silently reintroducing the duplicate-key rendering on k8s < 1.30. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/Makefile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile index 4a9799f09..14abbf547 100644 --- a/packages/system/cilium/Makefile +++ b/packages/system/cilium/Makefile @@ -18,6 +18,9 @@ update: # produce duplicate mapping keys on k8s<1.30. perl -i -0pe 's|\n \{\{- if not \.Values\.securityContext\.privileged \}\}\n \{\{- if semverCompare "<1\.30\.0".*?\n \{\{- end \}\}\n \{\{- end \}\}\n \{\{- end \}\}||s' \ charts/cilium/templates/cilium-agent/daemonset.yaml + @! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io/cilium-agent: "unconfined"' \ + charts/cilium/templates/cilium-agent/daemonset.yaml || \ + { echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; } version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ $(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile From 0b0d3de99d63ae02cc7d8d1db234dc34c9c544b4 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 15:13:03 +0300 Subject: [PATCH 7/9] [cilium] Clarify nsenter/AppArmor comment wording Replace the misleading 'nsenter --ptrace' shorthand with an accurate description: nsenter joins the host cgroup/mount namespace, and the cri-containerd.apparmor.d profile reports the denial as a blocked 'ptrace' operation (operation name, not an nsenter CLI flag). Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/values.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 4b2e1ff36..3902287cc 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -24,9 +24,10 @@ cilium: rollOutPods: true replicas: 1 # Opt out of the cri-containerd.apparmor.d profile for containers that invoke - # nsenter --ptrace to join the host cgroup/mount namespace. Required on - # Ubuntu 22.04+ and other distros that load this AppArmor profile by default, - # where the denial puts cilium-agent into Init:CrashLoopBackOff. + # nsenter to join the host cgroup/mount namespace. The kernel reports the + # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and + # other distros that load this AppArmor profile by default, where the + # denial otherwise puts cilium-agent into Init:CrashLoopBackOff. # The deprecated annotations are used because k8s >= 1.30 pod-level # appArmorProfile: Unconfined is not honoured by containerd CRI today # (kubernetes/kubernetes#125069). From fc9ef55c425dcd281f12eeb962282034f561b958 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 15:20:55 +0300 Subject: [PATCH 8/9] [cilium] Harden vendoring guard and clarify Talos annotation comment - Broaden the grep guard in the Makefile update: target to match any container.apparmor.security.beta.kubernetes.io key, not only the quoted cilium-agent line. The previous pattern would silently pass if upstream switched to an unquoted annotation value, masking a failed perl patch; grepping for the prefix catches any residual hardcoded AppArmor annotation regardless of format. - Rewrite the values.yaml comment to distinguish the two Talos-safe reasons: mount-cgroup is simply not rendered when cgroup.autoMount.enabled is false (Talos default), while the other annotations are harmless because kubelet ignores AppArmor metadata on nodes without the LSM loaded. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/Makefile | 2 +- packages/system/cilium/values.yaml | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile index 14abbf547..71b47a77d 100644 --- a/packages/system/cilium/Makefile +++ b/packages/system/cilium/Makefile @@ -18,7 +18,7 @@ update: # produce duplicate mapping keys on k8s<1.30. perl -i -0pe 's|\n \{\{- if not \.Values\.securityContext\.privileged \}\}\n \{\{- if semverCompare "<1\.30\.0".*?\n \{\{- end \}\}\n \{\{- end \}\}\n \{\{- end \}\}||s' \ charts/cilium/templates/cilium-agent/daemonset.yaml - @! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io/cilium-agent: "unconfined"' \ + @! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io' \ charts/cilium/templates/cilium-agent/daemonset.yaml || \ { echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; } version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \ diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 3902287cc..8aee34d97 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -31,10 +31,13 @@ cilium: # The deprecated annotations are used because k8s >= 1.30 pod-level # appArmorProfile: Unconfined is not honoured by containerd CRI today # (kubernetes/kubernetes#125069). - # Safe on Talos / RHEL family without AppArmor: kubelet ignores these - # annotations when the AppArmor LSM is not loaded. - # mount-bpf-fs is intentionally excluded: it runs as privileged, and the - # kernel does not apply AppArmor profiles to privileged containers. + # On Talos mount-cgroup is not rendered (cgroup.autoMount.enabled=false in + # values-talos.yaml) so its annotation is inert there. On RHEL-family and + # other AppArmor-less hosts kubelet silently ignores these annotations + # because the AppArmor LSM is not loaded. + # mount-bpf-fs is intentionally excluded: it renders with its own + # securityContext.privileged=true, and the kernel does not apply AppArmor + # profiles to privileged containers. podAnnotations: container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined From abd6667eb399f7e785c947f55a6fe16a8a8ecbba Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 16:39:58 +0300 Subject: [PATCH 9/9] [cilium] Move AppArmor podAnnotations to a non-Talos-only values file E2E revealed that the kube-apiserver rejects a DaemonSet carrying a per-container AppArmor annotation for a container that is not present in the pod spec: DaemonSet.apps 'cilium' is invalid: spec.template.annotations[container.apparmor.security.beta.kubernetes.io/mount-cgroup]: Invalid value: 'mount-cgroup': container not found On Talos (isp-full bundle) values-talos.yaml sets cgroup.autoMount.enabled=false, so the upstream chart does not render the mount-cgroup init container, and our unconditional podAnnotations entry for it becomes an invalid reference. Move the podAnnotations block from the shared values.yaml into a new values-apparmor.yaml and include it only in the cilium-generic and kubeovn-cilium-generic PackageSource variants, where cgroup.autoMount.enabled is explicitly true. Talos variants (cilium, cilium-kilo, kubeovn-cilium) get no AppArmor annotations, which is safe because the Talos kernel does not load the AppArmor LSM anyway. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../core/platform/sources/networking.yaml | 2 ++ packages/system/cilium/values-apparmor.yaml | 20 +++++++++++++++++++ packages/system/cilium/values.yaml | 20 ------------------- 3 files changed, 22 insertions(+), 20 deletions(-) create mode 100644 packages/system/cilium/values-apparmor.yaml diff --git a/packages/core/platform/sources/networking.yaml b/packages/core/platform/sources/networking.yaml index 8e8485b30..bece76f8b 100644 --- a/packages/core/platform/sources/networking.yaml +++ b/packages/core/platform/sources/networking.yaml @@ -66,6 +66,7 @@ spec: path: system/cilium valuesFiles: - values.yaml + - values-apparmor.yaml install: privileged: true namespace: cozy-cilium @@ -117,6 +118,7 @@ spec: path: system/cilium valuesFiles: - values.yaml + - values-apparmor.yaml - values-kubeovn.yaml install: privileged: true diff --git a/packages/system/cilium/values-apparmor.yaml b/packages/system/cilium/values-apparmor.yaml new file mode 100644 index 000000000..0712836cf --- /dev/null +++ b/packages/system/cilium/values-apparmor.yaml @@ -0,0 +1,20 @@ +cilium: + # Opt out of the cri-containerd.apparmor.d profile for containers that invoke + # nsenter to join the host cgroup/mount namespace. The kernel reports the + # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and + # other distros that load this AppArmor profile by default, where the + # denial otherwise puts cilium-agent into Init:CrashLoopBackOff. + # The deprecated annotations are used because k8s >= 1.30 pod-level + # appArmorProfile: Unconfined is not honoured by containerd CRI today + # (kubernetes/kubernetes#125069). + # Only applied on non-Talos cilium variants where cgroup.autoMount.enabled is + # true — on Talos mount-cgroup is not rendered and the kube-apiserver would + # reject an annotation referencing a non-existent container. + # mount-bpf-fs is intentionally excluded: it renders with its own + # securityContext.privileged=true, and the kernel does not apply AppArmor + # profiles to privileged containers. + podAnnotations: + container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined + container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined + container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined + container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 8aee34d97..cfb2cd6b5 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -23,23 +23,3 @@ cilium: operator: rollOutPods: true replicas: 1 - # Opt out of the cri-containerd.apparmor.d profile for containers that invoke - # nsenter to join the host cgroup/mount namespace. The kernel reports the - # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and - # other distros that load this AppArmor profile by default, where the - # denial otherwise puts cilium-agent into Init:CrashLoopBackOff. - # The deprecated annotations are used because k8s >= 1.30 pod-level - # appArmorProfile: Unconfined is not honoured by containerd CRI today - # (kubernetes/kubernetes#125069). - # On Talos mount-cgroup is not rendered (cgroup.autoMount.enabled=false in - # values-talos.yaml) so its annotation is inert there. On RHEL-family and - # other AppArmor-less hosts kubelet silently ignores these annotations - # because the AppArmor LSM is not loaded. - # mount-bpf-fs is intentionally excluded: it renders with its own - # securityContext.privileged=true, and the kernel does not apply AppArmor - # profiles to privileged containers. - podAnnotations: - container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined - container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined