Fix custom_cni manifest apply failure for multi-namespace resources (#13091)

* fix(custom_cni): make namespace optional

Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* docs(custom_cni): document multi-namespace manifests

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml

@@ -9,10 +9,16 @@
 ## List of Kubernetes resource manifest files
 ## See tests/files/custom_cni/README.md for example
 # custom_cni_manifests: []
+#
+## Namespace passed to kubectl when applying manifests.
+## Set to an empty string for multi-namespace manifests where every namespaced
+## resource declares metadata.namespace.
+# custom_cni_namespace: "kube-system"
 
 ## OPTION 1 EXAMPLE - Cilium static manifests in Kubespray tree
 # custom_cni_manifests:
 #   - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+# custom_cni_namespace: ""
 
 ## OPTION 2 - Helm chart application
 ## This allows the CNI backend to be deployed to Kubespray cluster

roles/network_plugin/custom_cni/defaults/main.yml

@@ -1,6 +1,7 @@
 ---
 
 custom_cni_manifests: []
+custom_cni_namespace: kube-system
 
 custom_cni_chart_namespace: kube-system
 custom_cni_chart_release_name: ""

roles/network_plugin/custom_cni/tasks/main.yml

@@ -19,7 +19,7 @@
 
   - name: Custom CNI | Start Resources
     kube:
-      namespace: "kube-system"
+      namespace: "{{ custom_cni_namespace | default(omit, true) }}"
       kubectl: "{{ bin_dir }}/kubectl"
       filename: "{{ kube_config_dir }}/{{ item | basename | replace('.j2', '') }}"
       state: "latest"

tests/files/custom_cni/README.md

@@ -9,3 +9,17 @@ helm repo add cilium https://helm.cilium.io/
 helm repo update
 helm template cilium/cilium -n kube-system -f values.yaml > cilium.yaml
 ```
+
+The generated Cilium manifest contains resources in both the `kube-system` and
+`cilium-secrets` namespaces. Configure the static manifest example without a
+kubectl namespace argument:
+
+```yaml
+custom_cni_manifests:
+  - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+custom_cni_namespace: ""
+```
+
+When `custom_cni_namespace` is empty, every namespaced resource in the
+manifests should declare `metadata.namespace`. Otherwise, kubectl applies the
+resource to the current context's default namespace.

tests/files/debian11-custom-cni.yml

@@ -7,6 +7,7 @@ kube_owner: root
 kube_network_plugin: custom_cni
 custom_cni_manifests:
   - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+custom_cni_namespace: ""
 
 # Use static containerd binary for older distributions like Debian 11.
 containerd_static_binary: true