fix(cilium): stop early if kube_owner is not root (#13385)

Cilium's init containers run as UID 0 with capabilities (including
CAP_DAC_OVERRIDE) dropped, so host paths it writes to (e.g. /opt/cni/bin)
must be owned by root or it will fail with a permission error.

Add a pre-flight assert that fails fast with a clear message when
kube_network_plugin == cilium and kube_owner != root, instead of
changing CNI bin ownership defaults for all network plugins.

roles/kubernetes/preinstall/tasks/0040-verify-settings.yml

@@ -68,6 +68,18 @@
     - kube_network_plugin == 'cilium' or cilium_deploy_additionally
     - not ignore_assert_errors
 
+- name: Stop if kube_owner is not root when using cilium
+  assert:
+    that: kube_owner == 'root'
+    fail_msg: |
+      kube_owner is set to '{{ kube_owner }}', but cilium requires it to be 'root'.
+      Cilium's init containers run as UID 0 with capabilities (including CAP_DAC_OVERRIDE) dropped,
+      so host paths it writes to (e.g. /opt/cni/bin) must be owned by root or it will fail with
+      a permission error. See https://github.com/kubernetes-sigs/kubespray/issues/13378
+  when:
+    - kube_network_plugin == 'cilium' or cilium_deploy_additionally
+    - not ignore_assert_errors
+
 - name: Stop if kernel version is too low for nftables
   assert:
     that: ansible_facts['kernel'].split('-')[0] is version('5.13', '>=')