feat: migrate bootstrap-only validations to CEL

[vishnukothakapu]

Description

This PR completes the migration of the remaining bootstrap-only enforcement validations from the admission webhook to native CEL XValidation markers on the NodeReadinessRuleSpec.

Specifically, it blocks two invalid configurations directly at the API level:

1. enforcementMode: bootstrap-only combined with defaultStatus
2. enforcementMode: bootstrap-only combined with conditionPolicy: anyOf

This aligns with the clean hybrid approach established in PR #418, ensuring standard user templates using allOf continue to work while safely short-circuiting unsupported bootstrap-only configurations without the need for a webhook round-trip.

Changes include:

• Addition of two CEL XValidation markers to nodereadinessrule_types.go
• Regeneration of the CRD schema
• Removal of the legacy Go validation logic and associated unit tests from nodereadinessgaterule_webhook.go
• Addition of mirroring CEL controller envtest test cases
• Minor documentation update reflecting that the API server (not the webhook) now handles these rejections.

Related Issue

Fixes #449

Type of Change

/kind feature
/kind api-change
/kind cleanup

Testing

• Automated envtest cases were added to nodereadinessrule_controller_test.go to explicitly verify that the API server rejects these invalid manifests during creation.
• Webhook unit tests were cleaned up and verified to pass.
• Manual verification of the generated CRD schema confirmed the CEL markers propagated correctly.

Checklist

• make test passes
• make lint passes

Does this PR introduce a user-facing change?

Migrated the remaining `bootstrap-only` validation logic from the admission webhook to native CRD CEL validations, improving API server efficiency when creating or updating NodeReadinessRules.

[netlify]

✅ Deploy Preview for node-readiness-controller canceled.

Name	Link
🔨 Latest commit	6115d07
🔍 Latest deploy log	https://app.netlify.com/projects/node-readiness-controller/deploys/6a8dac3a3b4638000873d446

[kubernetes-prow]

Hi @vishnukothakapu. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tejassinghbhati]

Heads up on a collision with #455, which migrates the nodeSelector check to CEL. Different constraint to yours, but we overlap on four files.

Two concrete spots. You delete the accumulate errors across nodeSelector, defaultStatus, and conditionPolicy violations spec, I edit it, so that will conflict.

The one worth knowing about is in should perform comprehensive validation. Your diff leaves this as context.

Expect(allErrs).To(HaveLen(1)) // Empty nodeSelector validation
Expect(allErrs[0].Field).To(Equal("spec.nodeSelector"))

That holds today but stops holding once #455 removes the empty check from the webhook, so whichever of ours merges second needs that repointed at an unparseable selector rather than an empty one.

Happy to rebase mine on yours if you land first, no preference.

[yindia]

Same thing I flagged on #455: the chart CRD didn't get regenerated. Both new bootstrap-only rules are in config/crd/bases/ but not in charts/node-readiness-controller/crds/. So verify-chart-drift.sh will fail and Helm installs won't actually enforce them. Could you sync the chart CRD?

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vishnukothakapu, yindia
Once this PR has been reviewed and has the lgtm label, please assign mrunalp for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vishnukothakapu]

/cc @ajaysundark