[Cilium] Cilium Pods crash when upgraded to K8S 1.30

Khi Upgrade K8s lên 1.30 khả năng cao bạn sẽ gặp lỗi này
Cilium pod crashes cause the mount-group container to constantly restart.

trong log có nhả 1 lỗi:

$ kubectl -n kube-system logs cilium-2bgp7 -c mount-cgroup
nsenter: cannot open /hostproc/1/ns/cgroup: Permission denied

Nếu bạn sử dụng helm để install cilium thì add thêm pod annotations:

...
...

podAnnotations:
  container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined"
  container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined"
  container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined"
  container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined"


...
...

Nó sẽ add thêm SecurityContext:

add thêm annotations:

Refer to:
https://hackmd.io/@7vxmAdNPTmmlYGSRMuvbmw/H1cxr_yGkg