Description

Since updating to 3033.2.2, all of my Cilium pods are in a CrashLoopBackoff state with the following error message:

level=fatal msg="IPSec with tunneling requires support for xfrm state output masks (Linux 4.19 or later)." error="invalid argument" subsys=daemon

After rolling back to 3033.2.1, cilium starts up again.

Impact

Cilium fails -> all other pods can't get network -> general mayhem 😈

Environment and steps to reproduce

1. Set-up:

• Flatcar Linux 3033.2.2 on x86s
• Cilium set up as CNI with the cilium/cilium Helm chart at 1.11.0 and the following Helm values: https://gist.github.com/shosti/f8c93283a200af0f8dd9de0f73f794bd

2. Task: Automatic upgrade
3. Action(s): Update from 3033.2.1 to 3033.2.2, check kubectl logs for a cilium pod
4. Error:

level=fatal msg="IPSec with tunneling requires support for xfrm state output masks (Linux 4.19 or later)." error="invalid argument" subsys=daemon

Expected behavior

Cilium pods start up correctly.