feat: add validation to prevent anyOf misconfiguration

[vishnukothakapu]

Description
This PR adds CEL validation to the CRD to explicitly reject NodeReadinessRule configurations where the conditionPolicy is set to anyOf and any of the defined conditions has a defaultStatus equal to its requiredStatus.

As discussed with @ajaysundark & @AnuragThePathak in PR #315, allowing defaultStatus == requiredStatus within an anyOf rule creates a silent logical short-circuit, causing the rule to be considered satisfied even if the condition is never reported by the Node.

By enforcing this natively via CEL XValidation, we keep the webhook lean while still preventing the misconfiguration. This PR also adds a warning to the concepts documentation.

Related Issue
Fixes #414

Type of Change
/kind feature
/kind documentation

Testing

• Restructured nodereadinessrule_controller_test.go to include envtest coverage verifying that the API server actively rejects anyOf + defaultStatus configurations via CEL.
• Verified all Ginkgo test suites pass.

Checklist

• make test passes
• make lint passes

Does this PR introduce a user-facing change?

Feature: Added CEL validation to the NodeReadinessRule CRD to reject configurations using `conditionPolicy: anyOf` when a condition's `defaultStatus` is equal to its `requiredStatus`, as this results in a silent evaluation short-circuit.

[netlify]

✅ Deploy Preview for node-readiness-controller ready!

Name	Link
🔨 Latest commit	95c0b0e
🔍 Latest deploy log	https://app.netlify.com/projects/node-readiness-controller/deploys/6a8890ac8da5d40008e99583
😎 Deploy Preview	https://deploy-preview-418--node-readiness-controller.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kubernetes-prow]

Hi @vishnukothakapu. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[vishnukothakapu]

/assign @ajaysundark

[vitorfloriano]

/test pull-node-readiness-controller-junit-report-canary

[kubernetes-prow]

@vishnukothakapu: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/test pull-node-readiness-controller-verify-all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[AvineshTripathi]

/ok-to-test

[ajaysundark]

/retitle feat: add validation to prevent anyOf misconfiguration

[ajaysundark]

@vishnukothakapu please update release notes and description to keep it in sync with the implementation

[AnuragThePathak]

Rest LGTM

[AnuragThePathak]

Approving it from my side. @ajaysundark PTAL at your convenience.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AnuragThePathak, vishnukothakapu
Once this PR has been reviewed and has the lgtm label, please ask for approval from ajaysundark. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment