Dan

Just cert-manager and cnpg for those (and an istio-sidecar-injector despite having removed istio a while ago) weirdly cilium did run fine after adding the annotations back? Haven't tried with a...

Yeah but that webhook only applies to cnpg postgress backup objects according to it's rules. Either way the created cilium pods end up with the apparmor context defined as expected...

last I ran across this setting the namespace to restricted prevent the init pods from starting entirely