Migrate remaining bootstrap-only validations from admission webhook to CEL

[vishnukothakapu]

Is your feature request related to a problem or existing issue? Please describe.

As discussed with @ajaysundark in PR #418:

Currently, some configuration constraints for the bootstrap-only enforcement mode are implemented in the Go admission webhook rather than natively via CRD CEL validation (+kubebuilder:validation:XValidation).

The constraints currently living in the webhook are:

1. defaultStatus should not be used with bootstrap-only mode.
2. anyOf conditionPolicy is not supported with bootstrap-only mode.

Describe the solution you'd like

To move closer to our goal of eventually deprecating and removing the validating webhook entirely in favor of native Kubernetes CEL, we should migrate the remaining bootstrap-only validations to CEL expressions on the NodeReadinessRuleSpec.

We can enforce these natively by adding the following XValidation markers:

// +kubebuilder:validation:XValidation:rule="!has(self.enforcementMode) || self.enforcementMode != 'bootstrap-only' || !has(self.conditionPolicy) || self.conditionPolicy != 'anyOf'",message="anyOf conditionPolicy is not supported with bootstrap-only enforcementMode"
// +kubebuilder:validation:XValidation:rule="!has(self.enforcementMode) || self.enforcementMode != 'bootstrap-only' || !has(self.conditions) || self.conditions.all(c, !has(c.defaultStatus))",message="defaultStatus should not be used with bootstrap-only enforcementMode"

Once these are added and tested, the corresponding Go validation logic and unit tests can be cleanly removed from internal/webhook/nodereadinessgaterule_webhook.go.

Describe alternatives you've considered

N/A

[vishnukothakapu]

/assign

[tejassinghbhati]

@vishnukothakapu heads up so we do not collide, I have taken the nodeSelector one in #454 and #455, since #451 covers the two bootstrap-only constraints and not that.

Two things that might save you time on #451. CRD validation runs ahead of validating webhooks, so once your CEL rules land the matching Go branches are unreachable and can be deleted rather than kept as a second line. And the webhook specs that use an invalid spec as their input need repointing at something the webhook still owns, otherwise they quietly pass for the wrong reason.

After both of ours land, the only thing left in the webhook is the cross-object taint conflict check, which cannot move to CEL since it has to list other rules.

[vishnukothakapu]

@vishnukothakapu heads up so we do not collide, I have taken the nodeSelector one in #454 and #455, since #451 covers the two bootstrap-only constraints and not that.

Two things that might save you time on #451. CRD validation runs ahead of validating webhooks, so once your CEL rules land the matching Go branches are unreachable and can be deleted rather than kept as a second line. And the webhook specs that use an invalid spec as their input need repointing at something the webhook still owns, otherwise they quietly pass for the wrong reason.

After both of ours land, the only thing left in the webhook is the cross-object taint conflict check, which cannot move to CEL since it has to list other rules.

@tejassinghbhati Thanks for the heads-up! Yep, I’ve completely removed the unreachable Go branches for the bootstrap-only constraints in this PR. I also cleaned up and updated the webhook tests that were relying on those now-invalid combinations, so we don’t get any false positives. I left the nodeSelector ones for your PR!