Setting up Cilium with K3S failed. What should check?

[Magicloud]

I have a newly installed NixOS in VirtualBox in Windows. I installed K3S and Containerd in it. Detailed configurations are in following comment. The cluster worked well. Then I cleared K3S data and added two new options. "--flannel-backend none", "--disable-network-policy true". And started K3S.

Now all pods are pending since there is no network. Then I installed Cilium as cilium install --set=ipam.mode=kubernetes --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.42.0.0/16" --set=cni.confPath=/var/lib/rancher/k3s/agent/etc/cni/net.d/ --set=cni.binPath=/var/lib/rancher/k3s/data/cni/ --set=bpf.masquerade=true --set=nodePort.enabled=true && cilium status --wait. It went through. Three its pods were READY. But the node is never READY.

Describing the node, I saw Ready False Fri, 12 Dec 2025 14:42:14 +0000 Fri, 12 Dec 2025 14:15:33 +0000 KubeletNotReady container runtime network not ready: NetworkReady=false reason:NetworkPluginNotReady message:Network plugin returns error: cni plugin not initialized.

The Cilium CNI binary file appears in the binPath. 05-cilium.conflist appears in the confPath.

So what should I check for more about the error?

[Magicloud]

NixOS Config.

  virtualisation = {
    containerd = {
      enable = true;
      settings =
        let
          fullCNIPlugins = pkgs.buildEnv {
            name = "full-cni";
            paths = with pkgs; [
              cni-plugins
              cni-plugin-flannel
            ];
          };
        in {
          plugins."io.containerd.grpc.v1.cri".cni = {
            bin_dir = "/var/lib/rancher/k3s/data/cni";
            conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
          };
        };
    };
  };
  services.k3s = {
    enable = true;
    role = "server";
    extraFlags = toString [
      "--container-runtime-endpoint unix:///run/containerd/containerd.sock"
      "--write-kubeconfig-mode 644"
      "--flannel-backend none"
      "--disable-network-policy true"
    ];
  };

[brandond]

I'm not sure why you're trying to get containerd and cilium to use the k3s cni paths when you're not using the k3s bundled containerd or cni. Have you tried just using the default cni paths?

[Magicloud]

Yes. That was how I did it at first. Same result.