SysctlForbidden for services following pod deletion

Cluster information:

Kubernetes version:

  • Client Version: v1.25.3+k3s-9afcd6b9-dirty
  • Kustomize Version: v4.5.7
  • Server Version: v1.25.3+k3s-9afcd6b9-dirty

Cloud being used: Bare-metal
Installation method: Included with TrueNAS Scale
Host OS: Debian 11 (TrueNAS Scale 22.12.3)
Load balancer: SVCLB
CRI and version: “docker://Unknown”

Following deletion of a pod, the associated services fail to delete (as far as I understand), please see the following (abbreviated) outputs

k3s kubectl get pods -A
kube-system svclb-unifi-truecharts-guestportal-7e6ba1e7-l6hzl 0/2 SysctlForbidden 0 8m10s
kube-system svclb-unifi-truecharts-comm-ab39ece8-f84w9 0/1 SysctlForbidden 0 8m9s
kube-system svclb-unifi-truecharts-1cd9a1a9-4hxvg 0/1 SysctlForbidden 0 8m9s
kube-system svclb-unifi-truecharts-speedtest-0c138923-8v7t5 0/1 SysctlForbidden 0 8m8s
kube-system svclb-unifi-truecharts-stun-75de3720-jwsvt 0/1 SysctlForbidden 0 8m7s

k3s kubectl get svc -A
ix-unifi-truecharts unifi-truecharts-comm LoadBalancer 9080:53804/TCP 116d
ix-unifi-truecharts unifi-truecharts-guestportal LoadBalancer 9880:10663/TCP,9843:22164/TCP 116d
ix-unifi-truecharts unifi-truecharts LoadBalancer 9443:35886/TCP 116d
ix-unifi-truecharts unifi-truecharts-speedtest LoadBalancer 9789:44115/TCP 116d
ix-unifi-truecharts unifi-truecharts-stun LoadBalancer 9478:46340/UDP 116d

when “k3s kubectl get ns -A” does not show the pod.

Could someone please explain this to a home lab noob, trying to grasp the Kubernetes concepts? Thanks in advance :blush:

root@truenas[~]# k3s kubectl describe svc unifi-truecharts --namespace=ix-unifi-truecharts
Name: unifi-truecharts
Namespace: ix-unifi-truecharts
Labels: xyz=unifi-truecharts
Annotations: unifi-truecharts ix-unifi-truecharts unifi-truecharts https
Type: LoadBalancer
IP Family Policy: SingleStack
IP Families: IPv4
LoadBalancer Ingress:
Port: main 9443/TCP
TargetPort: 8443/TCP
NodePort: main 35886/TCP
Session Affinity: None
External Traffic Policy: Cluster

If it helps I was able to trigger a clean from the UI by toggling the “Enable Integrated Loadbalancer” under the advanced settings