diff --git a/charts/kubeadm/templates/_helpers.tpl b/charts/kubeadm/templates/_helpers.tpl
index 5aafc4b..88f32ed 100644
--- a/charts/kubeadm/templates/_helpers.tpl
+++ b/charts/kubeadm/templates/_helpers.tpl
@@ -2,8 +2,9 @@
 {{- /* Issues: "MemoryQoS" */ -}}
 {{- /* v1.30?: "NodeSwap" */ -}}
 {{- /* v1.29: remove/beta now "SidecarContainers" */ -}}
+{{- /* v1.28: "PodAndContainerStatsFromCRI" still not working */ -}}
 {{- define "kubeadm.featuregates" }}
-{{- $gates := list "CustomCPUCFSQuotaPeriod" "SidecarContainers" "PodAndContainerStatsFromCRI" }}
+{{- $gates := list "CustomCPUCFSQuotaPeriod" "SidecarContainers" }}
 {{- if eq .return "csv" }}
 {{- range $key := $gates }}
 {{- $key }}=true,
diff --git a/charts/kubezero-network/values.yaml b/charts/kubezero-network/values.yaml
index 8c51a4c..38892c3 100644
--- a/charts/kubezero-network/values.yaml
+++ b/charts/kubezero-network/values.yaml
@@ -84,6 +84,11 @@ cilium:
     tolerations:
     - key: node-role.kubernetes.io/control-plane
       effect: NoSchedule
+    # the operator removes the taints,
+    # so we need to break chicken egg on single controller
+    - key: node.cilium.io/agent-not-ready
+      effect: NoSchedule
+
     nodeSelector:
       node-role.kubernetes.io/control-plane: ""
     prometheus: