Cilium v1.19.1 not working out-of-the-box - node taints

[codepainters]

My test setup involves:

• 3 master nodes, 2 worker nodes
• CiIlium v1.19.1 with native routing, custom cilium-values file

Note:

• with v1.17.2 everything goes smooth, hetzner-k3s completes successfully (Note: due to native routign mode I had to ip route add 10.244.0.0/16 via 10.0.0.1 on each node manually, to make PodCIDR actually routable across the private network).
• with v1.19.1 it gets stuck waiting for Cilium agents to be ready

I've found that:

• cilium (agent pods) crashes, because cillium-operator didn't create Cilium CRDs yet
• cillium-operator pod is not schedullable due to node taints

Node taints are:

NAME           TAINTS
test-master1   [map[effect:NoExecute key:CriticalAddonsOnly value:true] map[effect:NoSchedule key:node.cloudprovider.kubernetes.io/uninitialized value:true]]
test-master2   [map[effect:NoExecute key:CriticalAddonsOnly value:true] map[effect:NoSchedule key:node.cloudprovider.kubernetes.io/uninitialized value:true]]
test-master3   [map[effect:NoExecute key:CriticalAddonsOnly value:true] map[effect:NoSchedule key:node.cloudprovider.kubernetes.io/uninitialized value:true]]

The cilium-operator deployment tolerations are:

[
  {
    "key": "node-role.kubernetes.io/control-plane",
    "operator": "Exists"
  },
  {
    "key": "node-role.kubernetes.io/master",
    "operator": "Exists"
  },
  {
    "key": "node.kubernetes.io/not-ready",
    "operator": "Exists"
  },
  {
    "key": "node.cilium.io/agent-not-ready",
    "operator": "Exists"
  },
  {
    "effect": "NoExecute",
    "key": "node.kubernetes.io/unreachable",
    "operator": "Exists",
    "tolerationSeconds": 300
  }
]

Manually adding CriticalAddonsOnly toleration to the cilium-operator deployment tolerations solves the issue.

[codepainters]

Note: v1.17.2 works, because it tolerates anything:

[
  {
    "operator": "Exists"
  }
]

The exact CIlium change causing this, fir released in v1.19.0:

commit 589164b4b582eda8ad49b2e80b431f3797242e5e
Author: Murat Parlakisik <murat@parlakisik.com>
Date:   Sun Jun 15 15:14:25 2025 -0700

    Adding taint to block deployment to drained nodes
    
    Cilium-operator pod automatically rescheduled onto drained mode.
    This can cause to block some kubernete upgrades.
    
    Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>

 Documentation/helm-values.rst                |  4 ++--
 Documentation/operations/upgrade.rst         |  3 +++
 install/kubernetes/cilium/README.md          |  2 +-
 install/kubernetes/cilium/values.schema.json | 38 +++++++++++++++++++++++++++++++++++++-
 install/kubernetes/cilium/values.yaml        | 16 +++++++++++-----
 install/kubernetes/cilium/values.yaml.tmpl   | 18 ++++++++++++------
 6 files changed, 66 insertions(+), 15 deletions(-)

I'm not sure if missing CriticalAddonsOnly should be considered an upstream problem.

Hope that helps.