In the specific case of installing cilium on a manual-install derived from kairos-alpine-v1.0.0-k3sv1.24.3+k3s1.iso (configuration turns on k3s but not edgevpn), this error appears in the pod event log for cilium-agent, blocking installation:

Warning  Failed     36s               kubelet            Error: failed to generate container "a1698747caae77ac00219af8b3157b1435fb952a0f3c7761d599c9d3f3f6ffd4" spec: failed to generate spec: path "/sys/fs/bpf" is mounted on "/sys/fs/bpf" but it is not a shared mount

While I could be more fastidious with providing steps to reproduce, I think there is a basic issue with /sys/fs/bpf not being a shared mount, which I suspect would be a general issue for CNIs that want to use eBPF.