Fix custom_cni manifest apply failure for multi-namespace resources (#13091)

* fix(custom_cni): make namespace optional

Keep kube-system as the default for existing manifests. An empty custom_cni_namespace omits kubectl's namespace flag so manifests spanning multiple namespaces can be applied without changing legacy behavior.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* docs(custom_cni): document multi-namespace manifests

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

tests/files/custom_cni/README.md

@@ -9,3 +9,17 @@ helm repo add cilium https://helm.cilium.io/
 helm repo update
 helm template cilium/cilium -n kube-system -f values.yaml > cilium.yaml
 ```
+
+The generated Cilium manifest contains resources in both the `kube-system` and
+`cilium-secrets` namespaces. Configure the static manifest example without a
+kubectl namespace argument:
+
+```yaml
+custom_cni_manifests:
+  - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+custom_cni_namespace: ""
+```
+
+When `custom_cni_namespace` is empty, every namespaced resource in the
+manifests should declare `metadata.namespace`. Otherwise, kubectl applies the
+resource to the current context's default namespace.

tests/files/debian11-custom-cni.yml

@@ -7,6 +7,7 @@ kube_owner: root
 kube_network_plugin: custom_cni
 custom_cni_manifests:
   - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+custom_cni_namespace: ""
 
 # Use static containerd binary for older distributions like Debian 11.
 containerd_static_binary: true