Aleksei Sviridkin 06dce029c9 [cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers ...

Cilium 1.19 init containers mount-cgroup, apply-sysctl-overwrites,
mount-bpf-fs and clean-cilium-state call nsenter --ptrace, which is
denied by the cri-containerd.apparmor.d profile on Ubuntu 22.04+ and
any other distro loading this AppArmor profile. As a result cilium
agent pods land in Init:CrashLoopBackOff and downstream HelmReleases
cascade into "dependency not ready".

The modern k8s >= 1.30 pod-level appArmorProfile: Unconfined field is
accepted into the DaemonSet spec but not honoured by containerd CRI
at runtime (kubernetes/kubernetes#125069), so the deprecated
per-container AppArmor annotations remain the only reliable opt-out.

Add the annotations via podAnnotations in the wrapper values.yaml.
The change is harmless on systems without AppArmor (Talos,
RHEL/Rocky/AlmaLinux with SELinux) because kubelet silently ignores
unknown AppArmor annotations when the LSM is not loaded.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 6c0ae2570e)

2026-04-12 09:32:15 +00:00

..

application-definition-crd

refactor(api): rename CozystackResourceDefinition to ApplicationDefinition

2026-01-15 22:35:56 +01:00

backup-controller

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

backupstrategy-controller

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

bootbox

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

bootbox-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

bucket

Prepare release v1.2.0

2026-03-27 14:00:46 +00:00

bucket-rd

fix(bucket): regenerate schema and docs from values.yaml annotations

2026-03-03 19:32:32 +03:00

capi-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

capi-providers-bootstrap

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

capi-providers-core

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

capi-providers-cpprovider

fix(capi-provider): update Kamaji CAPI provider to v0.16.0

2026-02-19 22:12:33 +03:00

capi-providers-infraprovider

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

cert-manager

[cert-manager] Added cleanup before crds upgrade

2026-02-26 18:32:35 +05:00

cert-manager-crds

[cert-manager] Updated cert-manager to 1.19.3 with new crd packaging

2026-02-26 15:28:19 +03:00

cert-manager-issuers

feat(platform): Added parameters to override ClusterIssuer

2026-02-20 10:43:48 +05:00

cilium

[cilium] Opt-out of cri-containerd.apparmor.d for nsenter init containers

2026-04-12 09:32:15 +00:00

cilium-networkpolicy

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

clickhouse-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

clickhouse-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

cluster-autoscaler

feat(cluster-autoscaler): enable enforce-node-group-min-size by default

2026-02-14 11:42:52 +01:00

clustersecret-operator

Add clustersecret-operator system package

2026-02-10 22:47:20 +05:00

coredns

fix coredns serviceaccount to match kubernetes bootstrap rbac

2026-02-02 15:32:50 +01:00

cozy-proxy

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

cozystack-api

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

cozystack-basics

[system] Fix tenant RBAC for endpointslices read access (#2257)

2026-03-27 17:48:46 +05:00

cozystack-controller

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

cozystack-scheduler

[cozystack-scheduler] Update to v0.2.0

2026-03-18 18:05:51 +03:00

dashboard

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

etcd-operator

fix(etcd-operator): replace deprecated kube-rbac-proxy image

2026-03-10 08:30:43 +01:00

etcd-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

external-dns

feat(extra): add external-dns as standalone extra package

2026-03-10 12:48:01 +01:00

external-dns-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

external-secrets-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

flux-plunger

Fix pre-commit check

2026-01-20 03:24:32 +01:00

fluxcd

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

fluxcd-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

foundationdb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

foundationdb-rd

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

gateway-api-crds

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

goldpinger

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

gpu-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

grafana-operator

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

harbor

feat(postgres): extend v17 hardcode to all system components

2026-03-31 08:15:51 +00:00

harbor-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

hetzner-robotlb

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

http-cache-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

info-rd

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

ingress-nginx

Replaced direct chart edits with patch files

2026-03-02 12:35:14 +05:00

ingress-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

kafka-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

kafka-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

kamaji

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

keycloak

feat(postgres): extend v17 hardcode to all system components

2026-03-31 08:15:51 +00:00

keycloak-configure

[keycloak-operator] Update to v1.32.0

2026-03-11 15:15:09 +03:00

keycloak-operator

[keycloak-operator] Update to v1.32.0

2026-03-11 15:15:09 +03:00

kilo

[kilo] Switch from fork to upstream squat/kilo

2026-03-23 15:18:23 +03:00

kubeovn

Update Kube-OVN to v1.15.3

2026-02-10 22:16:11 +01:00

kubeovn-plunger

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

kubeovn-webhook

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

kubernetes-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

kubevirt

fix(kubevirt): disable serial console log to fix VM pod initialization

2026-02-21 20:46:31 +01:00

kubevirt-cdi

feat(cdi): switch clone strategy to csi-clone

2026-03-10 12:42:01 +01:00

kubevirt-cdi-operator

[cdi-operator] Update to v1.64.0

2026-02-20 20:16:33 +01:00

kubevirt-csi-node

Prepare release v1.2.0

2026-03-27 14:00:46 +00:00

kubevirt-instancetypes

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

kubevirt-operator

[kubevirt-operator] Update to v1.6.4

2026-02-20 20:16:34 +01:00

lineage-controller-webhook

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

linstor

linstor: bump piraeus-server from v1.33.1 to v1.33.2

2026-04-12 09:20:47 +00:00

linstor-scheduler

Replaced direct chart edits with patch files

2026-03-02 12:35:14 +05:00

local-ccm

Update local-ccm v0.3.0

2026-02-10 20:19:03 +01:00

mariadb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mariadb-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

metallb

Prepare release v1.0.0-alpha.1

2026-01-15 23:32:41 +00:00

metrics-server

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mongodb-operator

Fix pre-commit check

2026-01-20 03:24:32 +01:00

mongodb-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

monitoring

[monitoring] Fix infra dashboards missing in default variant

2026-04-09 23:23:18 +00:00

monitoring-agents

feat(monitoring): migrate VictoriaLogs from VLogs to VLCluster

2026-03-10 12:04:12 +05:00

monitoring-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

multus

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

nats

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

nats-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

nfs-driver

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

objectstorage-controller

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

openbao

feat(openbao): add system chart with vendored upstream

2026-02-17 20:03:01 +03:00

openbao-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

opencost

Fix pre-commit check

2026-01-20 03:24:32 +01:00

opensearch-operator

[opensearch] Address PR review feedback

2026-03-17 11:20:44 +01:00

opensearch-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

piraeus-operator

[piraeus-operator] Split LINSTOR controller availability and metrics alerts

2026-03-25 16:11:14 +03:00

piraeus-operator-crds

Move CRDs installation logic to piraeus-operator-crds chart

2026-02-11 22:54:56 +01:00

postgres-operator

[postgres-operator] Update to v1.27.3

2026-03-17 01:59:28 +03:00

postgres-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

prometheus-operator-crds

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

qdrant

[qdrant] Add Qdrant vector database application

2026-02-06 13:30:58 +03:00

qdrant-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

rabbitmq-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

rabbitmq-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

redis-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

redis-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

reloader

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

seaweedfs

Prepare release v1.2.1

2026-03-31 11:32:30 +00:00

seaweedfs-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

snapshot-controller

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tcp-balancer-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

telepresence

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tenant-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

velero

[backups] Add kubevirt plugin to velero

2026-02-10 17:49:44 +03:00

vertical-pod-autoscaler

Post upgrade fixes for v1.0 packagesources

2026-01-28 20:08:35 +03:00

vertical-pod-autoscaler-crds

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

victoria-metrics-operator

feat(monitoring): upgrade victoria-metrics-operator to v0.68.1

2026-03-10 12:03:51 +05:00

virtualprivatecloud-rd

[docs] Update cozyvalues-gen

2026-03-25 15:59:22 +05:00

vm-disk-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

vm-instance-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

vpn-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

vsnap-crd

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00