What is the problem you're trying to solve

Currently, cgroupfs is only writable when containers are running in privileged mode. For unprivileged containers with cgroup v2 enabled, the cgroup interface (/sys/fs/cgroup) is mounted read-only by default, preventing containers from managing their own cgroup hierarchies. Since we have secure delegation, running containers in privileged mode to enable write access seems excessive, it would be nice if we can add support for writable cgroups in unprivileged containers.

Describe the solution you'd like

CRI-O has enabled this feature via annotation io.kubernetes.cri-o.cgroup2-mount-hierarchy-rw. I'm wondering if we could apply the same approach to adjust permissions in a way similar to CRI-O implementation.

Additional context

No response