- mountPath: /var/run/istio-cni
              name: cni-socket-dir
            {{- if .Values.cni.ambient.enabled }}
            - mountPath: /host/var/run/netns
              mountPropagation: HostToContainer
              name: cni-netns-dir
            - mountPath: /var/run/ztunnel
              name: cni-ztunnel-sock-dir
            {{ end }}
          resources:
{{- if .Values.cni.resources }}

* Default mount propagation has changed from `HostToContainer` ("rslave" in Linux terminology), as it was in 1.10, to `None` ("private") to match the behavior in 1.9 and earlier releases; `HostToContainer` as a default caused regressions in some pods. If you are relying on this behavior you will need to set it explicitly. ([#62462](https://github.com/kubernetes/kubernetes/pull/62462),...

		nonPrivilegedContainer,
		false,
	}, {
		// explicitly non-privileged container + HostToContainer
		core.VolumeMount{Name: "foo", MountPath: "/foo", MountPropagation: &propagationHostToContainer},
		nonPrivilegedContainer,
		false,
	}, {
		// explicitly non-privileged container + HostToContainer
		core.VolumeMount{Name: "foo", MountPath: "/foo", MountPropagation: &propagationBidirectional},

* Default mount propagation has changed from "HostToContainer" ("rslave" in Linux terminology) to "None" ("private") to match the behavior in 1.9 and earlier releases. "HostToContainer" as a default caused regressions in some pods. ([#62462](https://github.com/kubernetes/kubernetes/pull/62462), [@jsafrane](https://github.com/jsafrane))

	// containers.
	// Note that this mode is recursively applied to all mounts in the volume
	// ("rslave" in Linux terminology).
	MountPropagationHostToContainer MountPropagationMode = "HostToContainer"
	// MountPropagationBidirectional means that the volume in a container will
	// receive new mounts from the host or other containers, and its own mounts

	// containers.
	// Note that this mode is recursively applied to all mounts in the volume
	// ("rslave" in Linux terminology).
	MountPropagationHostToContainer MountPropagationMode = "HostToContainer"
	// MountPropagationBidirectional means that the volume in a container will
	// receive new mounts from the host or other containers, and its own mounts

mountPath: /host/etc/cni/net.d name: cni-net-dir - mountPath: /var/run/istio-cni name: cni-log-dir {{- if .Values.cni.ambient.enabled }} - mountPath: /etc/ambient-config name: cni-ambient-config-dir - mountPath: /var/run/netns mountPropagation: HostToContainer name: cni-netns-dir {{- if eq .Values.cni.ambient.redirectMode "ebpf"}} - mountPath: /sys/fs/bpf mountPropagation: Bidirectional name: cni-bpffs-dir {{- end }} {{ end }} resources: {{- if .Values.cni.resources }} {{ toYaml .Values.cni.resources...

mounts from the host or other containers, and its own mounts will be propagated from the container to the host or other containers. Note that this mode is recursively applied to all mounts in the volume (\"rshared\" in Linux terminology).\n - `\"HostToContainer\"` means that the volume in a container will receive new mounts from the host or other containers, but filesystems mounted inside the container won't be propagated to the host or other containers. Note that this mode is recursively applied to...