NonPrivileg mode is not working in calico 3.31.2 version

[ashiru]

I tried to bring up calico using operator installation by setting nonPrivileg to Enabled, its failing to start the daemon
below is the error

{"level":"error","ts":"2025-12-11T19:52:23Z","logger":"controller_installation","msg":"Error creating / updating resource","Request.Namespace":"","Request.Name":"calico","reason":"ResourceUpdateError","error":"DaemonSet.apps "calico-node" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: "var-run-calico"","stacktrace":"github.com/tigera/operator/pkg/controller/status.(*statusManager).SetDegraded\n\t/go/src/github.com/tigera/operator/pkg/controller/status/status.go:356\ngithub.com/tigera/operator/pkg/controller/installation.(*ReconcileInstallation).Reconcile\n\t/go/src/github.com/tigera/operator/pkg/controller/installation/core_controller.go:1613\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:202"}

Repro steps:
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/manifests/tigera-operator.yaml
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/manifests/custom-resources.yaml (I am using it for IPTables dataplane. update CIDR with proper value as per your kubernetes cluster)
kubectl patch installation default --type=merge -p '{"spec": {"nonPrivileged": "Enabled"}}'

kubectl logs -n tigera-operator -l k8s-app=tigera-operator and i see below error

{"level":"error","ts":"2025-12-11T20:29:17Z","logger":"controller_installation","msg":"Failed to create or update object","component":"*render.nodeComponent","key":{"name":"calico-node","namespace":"calico-system"},"error":"DaemonSet.apps "calico-node" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: "var-run-calico"","stacktrace":"github.com/tigera/operator/pkg/controller/utils.(*componentHandler).CreateOrUpdateOrDelete\n\t/go/src/github.com/tigera/operator/pkg/controller/utils/component.go:464\ngithub.com/tigera/operator/pkg/controller/installation.(*ReconcileInstallation).Reconcile\n\t/go/src/github.com/tigera/operator/pkg/controller/installation/core_controller.go:1612\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:202"}
{"level":"error","ts":"2025-12-11T20:29:17Z","logger":"controller_installation","msg":"Error creating / updating resource","Request.Namespace":"","Request.Name":"default","reason":"ResourceUpdateError","error":"DaemonSet.apps "calico-node" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: "var-run-calico"","stacktrace":"github.com/tigera/operator/pkg/controller/status.(*statusManager).SetDegraded\n\t/go/src/github.com/tigera/operator/pkg/controller/status/status.go:356\ngithub.com/tigera/operator/pkg/controller/installation.(*ReconcileInstallation).Reconcile\n\t/go/src/github.com/tigera/operator/pkg/controller/installation/core_controller.go:1613\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:340\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:202"}
{"level":"error","ts":"2025-12-11T20:29:17Z","msg":"Reconciler error","controller":"tigera-installation-controller","object":{"name":"default"},"namespace":"","name":"default","reconcileID":"1e77ee90-5df2-436c-86c9-7d27e3601bff","error":"DaemonSet.apps "calico-node" is invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found: "var-run-calico"","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:353\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:300\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.1\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:202"}

output of installation yaml after this:
conditions:

• lastTransitionTime: "2025-12-11T20:29:35Z"
  message: 'Error creating / updating resource: DaemonSet.apps "calico-node" is
  invalid: spec.template.spec.initContainers[1].volumeMounts[1].name: Not found:
  "var-run-calico"'
  observedGeneration: 12
  reason: ResourceUpdateError
  status: "True"
  type: Degraded
• lastTransitionTime: "2025-12-11T20:29:35Z"
  message: ""
  observedGeneration: 12
  reason: Unknown
  status: "False"
  type: Ready
• lastTransitionTime: "2025-12-11T20:29:35Z"
  message: ""
  observedGeneration: 12
  reason: Unknown
  status: "False"
  type: Progressing
  mtu: 8951
  variant: Calico

I am using kubernetes 1.34 version and CCM for AWS and EBS_CSI_DRIVER before bringng up the Calico.

please help me here on how to fix it.