NonPrivileg mode is not working in calico 3.31.2 version

[ashiru]

I tried to bring up calico using operator installation by setting nonPrivileg to Enabled, its failing to start the daemon
below is the error

{"level":"error","ts":"2025-12-11T19:52:23Z","logger":"controller_installation","msg":"Error creating / updating resource","Request.Namespace":"","Request.Name":"calico","reason":"ResourceUpdateError","error":"DaemonSet.apps \"calico-node\" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: \"var-run-calico\"","stacktrace":"github.com/tigera/operator/pkg/controller/status.(*statusManager).SetDegraded\n\t/go/src/github.com/tigera/operator/pkg/controller/status/status.go:356\ngithub.com/tigera/operator/pkg/controller/installation.(*ReconcileInstallation).Reconcile\n\t/go/src/github.com/tigera/operator/pkg/controller/installation/core_controller.go:1613\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}

Repro steps:

kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/manifests/tigera-operator.yaml

kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/manifests/custom-resources.yaml (I am using it for 
IPTables dataplane. update CIDR with proper value as per your kubernetes cluster)

kubectl patch installation default --type=merge -p '{"spec": {"nonPrivileged": "Enabled"}}'

kubectl logs -n tigera-operator -l k8s-app=tigera-operator

and i see below error

{"level":"error","ts":"2025-12-11T20:29:17Z","logger":"controller_installation","msg":"Failed to create or update object","component":"*render.nodeComponent","key":{"name":"calico-node","namespace":"calico-system"},"error":"DaemonSet.apps \"calico-node\" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: \"var-run-calico\"","stacktrace":"github.com/tigera/operator/pkg/controller/utils.(*componentHandler).CreateOrUpdateOrDelete\n\t/go/src/github.com/tigera/operator/pkg/controller/utils/component.go:464\ngithub.com/tigera/operator/pkg/controller/installation.(*ReconcileInstallation).Reconcile\n\t/go/src/github.com/tigera/operator/pkg/controller/installation/core_controller.go:1612\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"error","ts":"2025-12-11T20:29:17Z","logger":"controller_installation","msg":"Error creating / updating resource","Request.Namespace":"","Request.Name":"default","reason":"ResourceUpdateError","error":"DaemonSet.apps \"calico-node\" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: \"var-run-calico\"","stacktrace":"github.com/tigera/operator/pkg/controller/status.(*statusManager).SetDegraded\n\t/go/src/github.com/tigera/operator/pkg/controller/status/status.go:356\ngithub.com/tigera/operator/pkg/controller/installation.(*ReconcileInstallation).Reconcile\n\t/go/src/github.com/tigera/operator/pkg/controller/installation/core_controller.go:1613\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}
{"level":"error","ts":"2025-12-11T20:29:17Z","msg":"Reconciler error","controller":"tigera-installation-controller","object":{"name":"default"},"namespace":"","name":"default","reconcileID":"1e77ee90-5df2-436c-86c9-7d27e3601bff","error":"DaemonSet.apps \"calico-node\" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: \"var-run-calico\"","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:202"}

output of installation yaml after this:

conditions:
  - lastTransitionTime: "2025-12-11T20:29:35Z"
    message: 'Error creating / updating resource: DaemonSet.apps "calico-node" is
      invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found:
      "var-run-calico"'
    observedGeneration: 12
    reason: ResourceUpdateError
    status: "True"
    type: Degraded
  - lastTransitionTime: "2025-12-11T20:29:35Z"
    message: ""
    observedGeneration: 12
    reason: Unknown
    status: "False"
    type: Ready
  - lastTransitionTime: "2025-12-11T20:29:35Z"
    message: ""
    observedGeneration: 12
    reason: Unknown
    status: "False"
    type: Progressing
  mtu: 8951
  variant: Calico

I am using kubernetes 1.34 version and CCM for AWS and EBS_CSI_DRIVER before bringng up the Calico.

please help me here on how to fix it.

[frozenprocess]

This seems like a bug
@caseydavenport WDYT?
https://github.com/tigera/operator/blob/076feeb163410f4bbb700270f802b6e31c989312/pkg/render/node.go#L1376-L1387