diff --git a/ansible/roles/k3s-install/files/k3s b/ansible/roles/k3s-install/files/k3s
deleted file mode 100644
index d2a08a61..00000000
Binary files a/ansible/roles/k3s-install/files/k3s and /dev/null differ
diff --git a/ansible/roles/k3s-install/tasks/main.yml b/ansible/roles/k3s-install/tasks/main.yml
index 4d411cfd..a6461ae2 100644
--- a/ansible/roles/k3s-install/tasks/main.yml
+++ b/ansible/roles/k3s-install/tasks/main.yml
@@ -3,12 +3,16 @@
 
 #- name: "execute k3s install"
 #  shell: curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | INSTALL_K3S_MIRROR=cn INSTALL_K3S_SKIP_ENABLE=true  sh -
-- name: "copy k3s to destination"
-  copy:
-    src: "{{ role_path }}/files/k3s"
-    dest: /usr/bin/
+
+- name: "get k3s to dest"
+  get_url:
+    url: https://repo.geedge.net/filerepo/install/release/os-build-files/k3s/v1.28.4/k3s
+    dest: /usr/bin/k3s
+    url_username: "{{ lookup('env', 'PULP_REPO_USERNAME') }}"
+    url_password: "{{ lookup('env', 'PULP_REPO_PASSWORD') }}"
     mode: 0755
 
+
 - name: "Create /var/lib/rancher/k3s/agent/images directory"
   file:
     path: "/var/lib/rancher/k3s/agent/images"
@@ -22,7 +26,7 @@
 
 - name: "get k3s-airgap-images-amd64.tar to dest"
   get_url:
-    url: https://repo.geedge.net/filerepo/install/release/os-build-files/k3s/k3s-airgap-images-amd64.tar
+    url: https://repo.geedge.net/filerepo/install/release/os-build-files/k3s/v1.28.4/k3s-airgap-images-amd64.tar
     dest: /var/lib/rancher/k3s/agent/images/k3s-airgap-images-amd64.tar
     url_username: "{{ lookup('env', 'PULP_REPO_USERNAME') }}"
     url_password: "{{ lookup('env', 'PULP_REPO_PASSWORD') }}"
diff --git a/ansible/roles/mrzcpd/files/helm/templates/deployment-mrzcpd.yaml b/ansible/roles/mrzcpd/files/helm/templates/deployment-mrzcpd.yaml
index bafbbe2c..19f1107b 100644
--- a/ansible/roles/mrzcpd/files/helm/templates/deployment-mrzcpd.yaml
+++ b/ansible/roles/mrzcpd/files/helm/templates/deployment-mrzcpd.yaml
@@ -34,6 +34,24 @@ spec:
       - key: node-role.kubernetes.io/master
         operator: Exists
         effect: NoSchedule
+      initContainers:
+      - name: confd
+        image: "registry.gdnt-cloud.website/tsg-packet-io-engine:{{ .Chart.AppVersion }}"
+        restartPolicy: Always
+        imagePullPolicy: Never
+        command:
+          - "bash"
+          - "-ec"
+          - |
+            chmod +x /opt/tsg/mrzcpd/bin/signal.sh
+            /opt/confd/bin/confd -watch -backend file -file /opt/tsg/config/mrzcpd-reload-conf/reload-conf.yaml -log-level debug
+        volumeMounts:
+        - name: shared-dir
+          mountPath: /opt/tsg/config/shared
+        - name: mrzcpd-reload-conf
+          mountPath: /opt/tsg/config/mrzcpd-reload-conf/
+        securityContext:
+          privileged: true
       containers:
       - name: packet-io-engine
         image: "registry.gdnt-cloud.website/tsg-packet-io-engine:{{ .Chart.AppVersion }}"
@@ -140,26 +158,6 @@ spec:
         securityContext:
           privileged: true
 
-
-      - name: confd
-        image: "registry.gdnt-cloud.website/tsg-packet-io-engine:{{ .Chart.AppVersion }}"
-        imagePullPolicy: Never
-        lifecycle:
-          type: Sidecar
-        command:
-          - "bash"
-          - "-ec"
-          - |
-            chmod +x /opt/tsg/mrzcpd/bin/signal.sh
-            /opt/confd/bin/confd -watch -backend file -file /opt/tsg/config/mrzcpd-reload-conf/reload-conf.yaml -log-level debug
-        volumeMounts:
-        - name: shared-dir
-          mountPath: /opt/tsg/config/shared
-        - name: mrzcpd-reload-conf
-          mountPath: /opt/tsg/config/mrzcpd-reload-conf/
-        securityContext:
-          privileged: true
-
       - command:
         - /opt/tsg/mrzcpd/bin/monit_device
         - --prometheus-client
diff --git a/ansible/roles/tsg-os-HAL/files/script/tsg-os-HAL.sh b/ansible/roles/tsg-os-HAL/files/script/tsg-os-HAL.sh
index c009382e..19342b3c 100644
--- a/ansible/roles/tsg-os-HAL/files/script/tsg-os-HAL.sh
+++ b/ansible/roles/tsg-os-HAL/files/script/tsg-os-HAL.sh
@@ -101,6 +101,9 @@ kubelet-arg:
   - "kube-reserved=memory=${KUBE_RESERVED}Gi"
   - "system-reserved=memory=${system_mem}Gi"
   - "sync-frequency=1s"
+  - "feature-gates=SidecarContainers=true"
+kube-apiserver-arg:
+  - "feature-gates=SidecarContainers=true"
 EOF
 }