Nothing changes until a node is labelled: - post-crds/cilium-nodeconfig.yaml: CiliumNodeConfig cni-uninstall (label cni.renner.uno/cilium-uninstall) arms the agent's preStop conflist cleanup; multus-sole-writer (label cni.renner.uno/multus-sole-writer) moves write-cni-conf-when-ready to /host/etc/cni/net.d/multus/05-cilium.conflist, a subdirectory libcni does not read. - multus/multus-subdir.yaml: kube-multus-ds-subdir with multusAutoconfigDir /host/etc/cni/net.d/multus, scheduled only on labelled nodes; kube-multus-ds gets the inverse affinity. The kube-multus-ds template change rolls Multus node by node once on merge. Refs #832 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>