I get the exact same result if I start the server via

rke2 server --selinux true --cni cilium --write-kubeconfig-mode 644

kubectl describe pod/cilium-operator-97b9d9bc6-dszwf                                                                                at ○ default/kube-system with root@lab at 09:19:12
Name:                 cilium-operator-97b9d9bc6-dszwf
Namespace:            kube-system
Priority:             2000000000
Priority Class Name:  system-cluster-critical
Service Account:      cilium-operator
Node:                 <none>
Labels:               app.kubernetes.io/name=cilium-operator
                      app.kubernetes.io/part-of=cilium
                      io.cilium/app=operator
                      name=cilium-operator
                      pod-template-hash=97b9d9bc6
Annotations:          prometheus.io/port: 9963
                      prometheus.io/scrape: true
Status:               Pending
IP:
IPs:                  <none>
Controlled By:        ReplicaSet/cilium-operator-97b9d9bc6
Containers:
  cilium-operator:
    Image:      rancher/mirrored-cilium-operator-generic:v1.14.4
    Port:       9963/TCP
    Host Port:  9963/TCP
    Command:
      cilium-operator-generic
    Args:
      --config-dir=/tmp/cilium/config-map
      --debug=$(CILIUM_DEBUG)
    Liveness:   http-get <http://127.0.0.1:9234/healthz> delay=60s timeout=3s period=10s #success=1 #failure=3
    Readiness:  http-get <http://127.0.0.1:9234/healthz> delay=0s timeout=3s period=5s #success=1 #failure=5
    Environment:
      K8S_NODE_NAME:          (v1:spec.nodeName)
      CILIUM_K8S_NAMESPACE:  kube-system (v1:metadata.namespace)
      CILIUM_DEBUG:          <set to the key 'debug' of config map 'cilium-config'>  Optional: true
    Mounts:
      /tmp/cilium/config-map from cilium-config-path (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-hb2hq (ro)
Conditions:
  Type           Status
  PodScheduled   False
Volumes:
  cilium-config-path:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      cilium-config
    Optional:  false
  kube-api-access-hb2hq:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              kubernetes.io/os=linux
Tolerations:                 op=Exists
Events:
  Type     Reason            Age                    From               Message
  ----     ------            ----                   ----               -------
  Warning  FailedScheduling  18m (x245 over 20h)    default-scheduler  0/1 nodes are available: 1 node(s) didn't have free ports for the requested pod ports. preemption: 0/1 nodes are available: 1 node(s) didn't have free ports for the requested pod ports..