Fix custom_cni manifest apply failure for multi-namespace resources

[yankay]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Remove the hardcoded namespace: "kube-system" parameter from the Custom CNI | Start Resources task in roles/network_plugin/custom_cni/tasks/main.yml.

After #13002 bumped the custom_cni test Cilium version to 1.18.6, the regenerated cilium.yaml manifest now includes resources in the cilium-secrets namespace (Namespace object, Roles, and RoleBindings for TLS interception policy secrets). The kube module's namespace: "kube-system" parameter causes kubectl apply --namespace=kube-system, which conflicts with these resources:

error: the namespace from the provided object "cilium-secrets" does not match
the namespace "kube-system". You must pass '--namespace=cilium-secrets' to
perform this operation.

By removing the hardcoded namespace, kubectl apply will respect the namespace declared in each resource's metadata. This is:

• Consistent with how kube-ovn applies its manifests (no hardcoded namespace)
• Semantically correct for custom_cni, where users bring their own complete manifests that may target multiple namespaces
• Safe, because all namespaced resources in the test manifest already have explicit namespace declarations

Which issue(s) this PR fixes:

Fixes the debian11-custom-cni CI failure introduced by #13002.

Special notes for your reviewer:

The kube module (in library/kube.py) only adds --namespace to the kubectl command when the parameter is provided. Without it, kubectl uses whatever namespace is specified in each resource's metadata, which is the desired behavior for multi-namespace manifests.

Other network plugins that apply whole YAML files (kube-ovn) also omit the namespace parameter, while plugins that apply individual known resources (kube-router, multus) use it — this change aligns custom_cni with the correct pattern.

Does this PR introduce a user-facing change?:

Custom CNI manifests with resources targeting multiple namespaces are now correctly applied.
Previously, all resources were forced into kube-system, causing failures for multi-namespace manifests.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[yankay]

/release-note-none

[yankay]

/ok-to-test

[Copilot]

Pull request overview

Removes the hardcoded kube-system namespace from the Custom CNI manifest application step so that user-supplied manifests are applied as-is (consistent with kubectl apply -f semantics and manifest-defined namespaces).

Changes:

• Drop namespace: "kube-system" from the kube task that applies custom_cni_manifests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yankay]

/retest