ci: run the Ansible controller as an unprivileged user (#13527)

* ci: run the Ansible controller as an unprivileged user

* ci: clarify non-root controller check

* ci: make the sudo privilege check fail when sudo succeeds

Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds.

Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.

.gitlab-ci/lint.yml

@@ -16,11 +16,24 @@ pre-commit:
     when: 'always'
   needs: []
 
+# Verify non-root Git setup, CI file writes, and local Ansible execution.
+non-root-controller:
+  extends: .job
+  stage: test
+  script:
+  - test "$(id -u)" -ne 0
+  - if sudo -n true; then exit 1; fi
+  - test "$HOME" = /home/kubespray
+  - |
+    for directory in "$HOME" "$CI_PROJECT_DIR" "$CI_PROJECT_DIR/.git" "$CI_PROJECT_DIR"/contrib/terraform/*/; do
+      probe=$(mktemp "$directory/.write-check.XXXXXX")
+      rm "$probe"
+    done
+  - ansible localhost --connection=local -m setup -a 'filter=ansible_user_uid'
+
 vagrant-validate:
   extends: .job
   stage: test
   tags: [ffci]
-  variables:
-    VAGRANT_VERSION: 2.3.7
   script:
   - ./tests/scripts/vagrant-validate.sh