feat: anyOf readiness condition requirements

Introduces a conditionPolicy field (allOf | anyOf) to NodeReadinessRuleSpec
that controls how the list of node conditions is aggregated when evaluating a rule.

- allOf (default): every condition must match its requiredStatus before the taint is removed — preserves existing behavior.
- anyOf: at least one condition matching its requiredStatus is sufficient to remove the taint.

Additional changes:
- Implement IsConditionsSatisfied() with allOf/anyOf evaluation logic
- Update controller to use conditionPolicy when evaluating conditions
- Add webhook validation to reject conditionPolicy with bootstrap-only mode
- Expand controller test coverage for conditionPolicy scenarios
- Update CRD schema to include conditionPolicy field

Author: vishnukothakapu

api/v1alpha1/nodereadinessrule_types.go

@@ -33,6 +33,18 @@ const (
 	EnforcementModeContinuous EnforcementMode = "continuous"
 )
 
+// ConditionPolicy defines how the list of conditions is aggregated when evaluating a rule.
+// +kubebuilder:validation:Enum=allOf;anyOf
+type ConditionPolicy string
+
+const (
+	// ConditionPolicyAllOf requires ALL conditions to match their requiredStatus (default).
+	ConditionPolicyAllOf ConditionPolicy = "allOf"
+
+	// ConditionPolicyAnyOf requires at least ONE condition to match its requiredStatus.
+	ConditionPolicyAnyOf ConditionPolicy = "anyOf"
+)
+
 // TaintStatus specifies status of the Taint on Node.
 // +kubebuilder:validation:Enum=Present;Absent
 type TaintStatus string
@@ -99,6 +111,16 @@ type NodeReadinessRuleSpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="nodeSelector is immutable"
 	NodeSelector metav1.LabelSelector `json:"nodeSelector,omitempty,omitzero"`
 
+	// conditionPolicy controls how the conditions list is evaluated.
+	// "allOf" (default) requires every condition to match its requiredStatus before the taint is removed.
+	// "anyOf" requires at least one condition to match its requiredStatus.
+	//
+	// Cannot be used with enforcementMode: bootstrap-only.
+	//
+	// +optional
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="conditionPolicy is immutable"
+	ConditionPolicy ConditionPolicy `json:"conditionPolicy,omitempty"`
+
 	// dryRun when set to true, The controller will evaluate Node conditions and log intended taint modifications
 	// without persisting changes to the cluster. Proposed actions are reflected in the resource status.
 	//
@@ -379,6 +401,50 @@ func (c *ConditionRequirement) GetDefaultStatus() corev1.ConditionStatus {
 	return c.DefaultStatus
 }
 
+// GetConditionPolicy returns the effective condition policy, defaulting to allOf
+// when the field is not explicitly set.
+func (spec *NodeReadinessRuleSpec) GetConditionPolicy() ConditionPolicy {
+	if spec.ConditionPolicy == "" {
+		return ConditionPolicyAllOf
+	}
+	return spec.ConditionPolicy
+}
+
+// IsConditionsSatisfied evaluates whether the given condition results meet the
+// policy defined in the spec.
+//
+//   - allOf: every result's effective status must equal its RequiredStatus.
+//   - anyOf: at least one result's effective status must equal its RequiredStatus.
+//
+// The effective status is CurrentStatus, unless the condition was not found on
+// the Node (CurrentStatus == Unknown) and a DefaultStatus is configured — in
+// that case DefaultStatus is used as the fallback, matching the original
+// per-condition evaluation logic in the controller.
+func (spec *NodeReadinessRuleSpec) IsConditionsSatisfied(results []ConditionEvaluationResult) bool {
+	effectiveStatus := func(r ConditionEvaluationResult) corev1.ConditionStatus {
+		if r.CurrentStatus == corev1.ConditionUnknown && r.DefaultStatus != "" {
+			return r.DefaultStatus
+		}
+		return r.CurrentStatus
+	}
+
+	if spec.GetConditionPolicy() == ConditionPolicyAnyOf {
+		for _, r := range results {
+			if effectiveStatus(r) == r.RequiredStatus {
+				return true
+			}
+		}
+		return false
+	}
+	// allOf (default)
+	for _, r := range results {
+		if effectiveStatus(r) != r.RequiredStatus {
+			return false
+		}
+	}
+	return true
+}
+
 func init() {
 	objectTypes = append(objectTypes, &NodeReadinessRule{}, &NodeReadinessRuleList{})
 }

config/crd/bases/readiness.node.x-k8s.io_nodereadinessrules.yaml

@@ -62,6 +62,20 @@ spec:
           spec:
             description: spec defines the desired state of NodeReadinessRule
             properties:
+              conditionPolicy:
+                description: |-
+                  conditionPolicy controls how the conditions list is evaluated.
+                  "allOf" (default) requires every condition to match its requiredStatus before the taint is removed.
+                  "anyOf" requires at least one condition to match its requiredStatus.
+
+                  Cannot be used with enforcementMode: bootstrap-only.
+                enum:
+                - allOf
+                - anyOf
+                type: string
+                x-kubernetes-validations:
+                - message: conditionPolicy is immutable
+                  rule: self == oldSelf
               conditions:
                 description: |-
                   conditions contains a list of the Node conditions that defines the specific

internal/controller/nodereadinessrule_controller.go

@@ -320,8 +320,7 @@ func (r *RuleReadinessController) evaluateRuleForNode(ctx context.Context, rule
 	defer timer.ObserveDuration()
 	log := ctrl.LoggerFrom(ctx)
 
-	// Evaluate all conditions (ALL logic)
-	allConditionsSatisfied := true
+	// Evaluate all conditions
 	conditionResults := make([]readinessv1alpha1.ConditionEvaluationResult, 0, len(rule.Spec.Conditions))
 
 	for _, condReq := range rule.Spec.Conditions {
@@ -340,7 +339,6 @@ func (r *RuleReadinessController) evaluateRuleForNode(ctx context.Context, rule
 		}
 
 		if !satisfied {
-			allConditionsSatisfied = false
 			metrics.ConditionEvaluationFailures.WithLabelValues(rule.Name, condReq.Type).Inc()
 		}
 
@@ -357,12 +355,12 @@ func (r *RuleReadinessController) evaluateRuleForNode(ctx context.Context, rule
 			"satisfied", satisfied)
 	}
 
-	// Determine taint action
-	shouldRemoveTaint := allConditionsSatisfied
+	// Determine taint action using the rule's conditionPolicy (allOf or anyOf)
+	shouldRemoveTaint := rule.Spec.IsConditionsSatisfied(conditionResults)
 	currentlyHasTaint := r.hasTaintBySpec(node, rule.Spec.Taint)
 
 	log.Info("Evaluation result", "node", node.Name, "rule", rule.Name,
-		"allConditionsSatisfied", allConditionsSatisfied, "hasTaint", currentlyHasTaint)
+		"conditionPolicy", rule.Spec.GetConditionPolicy(), "conditionsSatisfied", shouldRemoveTaint, "hasTaint", currentlyHasTaint)
 
 	isFirstEvaluation := r.getPreviousNodeEvaluation(rule, node.Name) == nil
 
@@ -604,9 +602,9 @@ func (r *RuleReadinessController) processDryRun(ctx context.Context, rule *readi
 
 		affectedNodes++
 
-		// Simulate rule evaluation
-		allConditionsSatisfied := true
+		// Simulate rule evaluation using the rule's conditionPolicy
 		missingConditions := 0
+		dryRunResults := make([]readinessv1alpha1.ConditionEvaluationResult, 0, len(rule.Spec.Conditions))
 
 		for _, condReq := range rule.Spec.Conditions {
 			currentStatus, conditionFound := r.getConditionStatus(
@@ -617,12 +615,15 @@ func (r *RuleReadinessController) processDryRun(ctx context.Context, rule *readi
 			if !conditionFound {
 				missingConditions++
 			}
-			if currentStatus != condReq.RequiredStatus {
-				allConditionsSatisfied = false
-			}
+			dryRunResults = append(dryRunResults, readinessv1alpha1.ConditionEvaluationResult{
+				Type:           condReq.Type,
+				CurrentStatus:  currentStatus,
+				RequiredStatus: condReq.RequiredStatus,
+				DefaultStatus:  condReq.GetDefaultStatus(),
+			})
 		}
 
-		shouldRemoveTaint := allConditionsSatisfied
+		shouldRemoveTaint := rule.Spec.IsConditionsSatisfied(dryRunResults)
 		currentlyHasTaint := r.hasTaintBySpec(&node, rule.Spec.Taint)
 
 		if shouldRemoveTaint && currentlyHasTaint {

internal/controller/nodereadinessrule_controller_test.go

@@ -2178,7 +2178,7 @@ var _ = Describe("NodeReadinessRule Controller", func() {
 			Expect(failedNames).To(ContainElement("fail-path-node"))
 		})
 
-		It("should remove stale failedNodes entry when evaluation succeeds and include the node in appliedNodes", func() {
+		It("stale failedNodes entries are cleared after successful evaluation", func() {
 			successNode := &corev1.Node{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:   "stale-recovery-node",
@@ -2235,4 +2235,158 @@ var _ = Describe("NodeReadinessRule Controller", func() {
 			Expect(failedNames).NotTo(ContainElement("stale-recovery-node"))
 		})
 	})
+
+	Context("ConditionPolicy", func() {
+		var (
+			anyOfController *RuleReadinessController
+			anyOfNode       *corev1.Node
+		)
+
+		BeforeEach(func() {
+			anyOfController = &RuleReadinessController{
+				Client:        k8sClient,
+				Scheme:        scheme,
+				clientset:     fakeClientset,
+				ruleCache:     make(map[string]*nodereadinessiov1alpha1.NodeReadinessRule),
+				EventRecorder: record.NewFakeRecorder(10),
+			}
+			anyOfNode = &corev1.Node{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   "anyof-test-node",
+					Labels: map[string]string{"anyof-test": "true"},
+				},
+				Spec:   corev1.NodeSpec{},
+				Status: corev1.NodeStatus{},
+			}
+		})
+
+		It("anyOf: removes taint when at least one condition is satisfied", func() {
+			anyOfNode.Status.Conditions = []corev1.NodeCondition{
+				{Type: "gpu.example.com/HardwareDriverReady", Status: corev1.ConditionTrue},
+				{Type: "gpu.example.com/SoftwareFallbackReady", Status: corev1.ConditionFalse},
+			}
+			anyOfNode.Spec.Taints = []corev1.Taint{
+				{Key: "readiness.k8s.io/GPUReady", Effect: corev1.TaintEffectNoSchedule},
+			}
+
+			rule := &nodereadinessiov1alpha1.NodeReadinessRule{
+				ObjectMeta: metav1.ObjectMeta{Name: "anyof-rule-removes-taint"},
+				Spec: nodereadinessiov1alpha1.NodeReadinessRuleSpec{
+					ConditionPolicy: nodereadinessiov1alpha1.ConditionPolicyAnyOf,
+					Conditions: []nodereadinessiov1alpha1.ConditionRequirement{
+						{Type: "gpu.example.com/HardwareDriverReady", RequiredStatus: corev1.ConditionTrue},
+						{Type: "gpu.example.com/SoftwareFallbackReady", RequiredStatus: corev1.ConditionTrue},
+					},
+					Taint:           corev1.Taint{Key: "readiness.k8s.io/GPUReady", Effect: corev1.TaintEffectNoSchedule},
+					NodeSelector:    metav1.LabelSelector{MatchLabels: map[string]string{"anyof-test": "true"}},
+					EnforcementMode: nodereadinessiov1alpha1.EnforcementModeContinuous,
+				},
+			}
+			anyOfController.updateRuleCache(ctx, rule)
+
+			Expect(k8sClient.Create(ctx, anyOfNode)).To(Succeed())
+			defer func() { Expect(k8sClient.Delete(ctx, anyOfNode)).To(Succeed()) }()
+			Expect(anyOfController.evaluateRuleForNode(ctx, rule, anyOfNode)).To(Succeed())
+
+			// Taint should have been removed because HardwareDriverReady=True satisfies anyOf
+			Expect(anyOfController.hasTaintBySpec(anyOfNode, rule.Spec.Taint)).To(BeFalse())
+
+			// conditionResults in status should reflect actual observed values
+			eval := anyOfController.getPreviousNodeEvaluation(rule, anyOfNode.Name)
+			Expect(eval).NotTo(BeNil())
+			Expect(eval.ConditionResults).To(HaveLen(2))
+		})
+
+		It("anyOf: keeps taint when no conditions are satisfied", func() {
+			anyOfNode.Status.Conditions = []corev1.NodeCondition{
+				{Type: "gpu.example.com/HardwareDriverReady", Status: corev1.ConditionFalse},
+				{Type: "gpu.example.com/SoftwareFallbackReady", Status: corev1.ConditionFalse},
+			}
+			// Node has no taint; controller should add one
+			anyOfNode.Spec.Taints = nil
+
+			rule := &nodereadinessiov1alpha1.NodeReadinessRule{
+				ObjectMeta: metav1.ObjectMeta{Name: "anyof-rule-adds-taint"},
+				Spec: nodereadinessiov1alpha1.NodeReadinessRuleSpec{
+					ConditionPolicy: nodereadinessiov1alpha1.ConditionPolicyAnyOf,
+					Conditions: []nodereadinessiov1alpha1.ConditionRequirement{
+						{Type: "gpu.example.com/HardwareDriverReady", RequiredStatus: corev1.ConditionTrue},
+						{Type: "gpu.example.com/SoftwareFallbackReady", RequiredStatus: corev1.ConditionTrue},
+					},
+					Taint:           corev1.Taint{Key: "readiness.k8s.io/GPUReady", Effect: corev1.TaintEffectNoSchedule},
+					NodeSelector:    metav1.LabelSelector{MatchLabels: map[string]string{"anyof-test": "true"}},
+					EnforcementMode: nodereadinessiov1alpha1.EnforcementModeContinuous,
+				},
+			}
+			anyOfController.updateRuleCache(ctx, rule)
+
+			Expect(k8sClient.Create(ctx, anyOfNode)).To(Succeed())
+			defer func() { Expect(k8sClient.Delete(ctx, anyOfNode)).To(Succeed()) }()
+			Expect(anyOfController.evaluateRuleForNode(ctx, rule, anyOfNode)).To(Succeed())
+
+			// Taint should have been added because neither condition is satisfied
+			Expect(anyOfController.hasTaintBySpec(anyOfNode, rule.Spec.Taint)).To(BeTrue())
+		})
+
+		It("allOf (explicit): keeps taint when only one of two conditions is satisfied", func() {
+			anyOfNode.Status.Conditions = []corev1.NodeCondition{
+				{Type: "example.com/CondA", Status: corev1.ConditionTrue},
+				{Type: "example.com/CondB", Status: corev1.ConditionFalse},
+			}
+			anyOfNode.Spec.Taints = []corev1.Taint{
+				{Key: "readiness.k8s.io/MultiCond", Effect: corev1.TaintEffectNoSchedule},
+			}
+
+			rule := &nodereadinessiov1alpha1.NodeReadinessRule{
+				ObjectMeta: metav1.ObjectMeta{Name: "allof-explicit-rule"},
+				Spec: nodereadinessiov1alpha1.NodeReadinessRuleSpec{
+					ConditionPolicy: nodereadinessiov1alpha1.ConditionPolicyAllOf,
+					Conditions: []nodereadinessiov1alpha1.ConditionRequirement{
+						{Type: "example.com/CondA", RequiredStatus: corev1.ConditionTrue},
+						{Type: "example.com/CondB", RequiredStatus: corev1.ConditionTrue},
+					},
+					Taint:           corev1.Taint{Key: "readiness.k8s.io/MultiCond", Effect: corev1.TaintEffectNoSchedule},
+					NodeSelector:    metav1.LabelSelector{MatchLabels: map[string]string{"anyof-test": "true"}},
+					EnforcementMode: nodereadinessiov1alpha1.EnforcementModeContinuous,
+				},
+			}
+			anyOfController.updateRuleCache(ctx, rule)
+
+			Expect(k8sClient.Create(ctx, anyOfNode)).To(Succeed())
+			defer func() { Expect(k8sClient.Delete(ctx, anyOfNode)).To(Succeed()) }()
+			Expect(anyOfController.evaluateRuleForNode(ctx, rule, anyOfNode)).To(Succeed())
+
+			// Taint must remain because CondB is still False
+			Expect(anyOfController.hasTaintBySpec(anyOfNode, rule.Spec.Taint)).To(BeTrue())
+		})
+
+		It("anyOf: missing condition evaluated via defaultStatus does not auto-satisfy", func() {
+			// Node has NO conditions at all
+			anyOfNode.Status.Conditions = nil
+			anyOfNode.Spec.Taints = nil
+
+			rule := &nodereadinessiov1alpha1.NodeReadinessRule{
+				ObjectMeta: metav1.ObjectMeta{Name: "anyof-missing-condition-rule"},
+				Spec: nodereadinessiov1alpha1.NodeReadinessRuleSpec{
+					ConditionPolicy: nodereadinessiov1alpha1.ConditionPolicyAnyOf,
+					Conditions: []nodereadinessiov1alpha1.ConditionRequirement{
+						// No defaultStatus set — will resolve to Unknown, which != True
+						{Type: "gpu.example.com/HardwareDriverReady", RequiredStatus: corev1.ConditionTrue},
+					},
+					Taint:           corev1.Taint{Key: "readiness.k8s.io/GPUReady", Effect: corev1.TaintEffectNoSchedule},
+					NodeSelector:    metav1.LabelSelector{MatchLabels: map[string]string{"anyof-test": "true"}},
+					EnforcementMode: nodereadinessiov1alpha1.EnforcementModeContinuous,
+				},
+			}
+			anyOfController.updateRuleCache(ctx, rule)
+
+			Expect(k8sClient.Create(ctx, anyOfNode)).To(Succeed())
+			defer func() { Expect(k8sClient.Delete(ctx, anyOfNode)).To(Succeed()) }()
+			Expect(anyOfController.evaluateRuleForNode(ctx, rule, anyOfNode)).To(Succeed())
+
+			// Missing condition resolves to Unknown != True, so anyOf is not satisfied
+			// Taint should have been added (node has none, conditions not satisfied)
+			Expect(anyOfController.hasTaintBySpec(anyOfNode, rule.Spec.Taint)).To(BeTrue())
+		})
+	})
 })

internal/webhook/nodereadinessgaterule_webhook.go

@@ -90,6 +90,19 @@ func (w *NodeReadinessRuleWebhook) validateSpec(
 			}
 		}
 	}
+
+	// validate anyOf conditionPolicy is not combined with bootstrap-only mode.
+	// The semantics are undefined: once the taint is permanently removed after
+	// the first condition satisfies, subsequent condition changes have no effect,
+	// making the "any" relationship unverifiable.
+	if spec.ConditionPolicy == readinessv1alpha1.ConditionPolicyAnyOf &&
+		spec.EnforcementMode == readinessv1alpha1.EnforcementModeBootstrapOnly {
+		allErrs = append(allErrs, field.Forbidden(
+			field.NewPath("spec", "conditionPolicy"),
+			"anyOf conditionPolicy is not supported with bootstrap-only enforcementMode",
+		))
+	}
+
 	return allErrs
 }