feat: conditionPolicy anyOf/allOf implementation

Author: vishnukothakapu

README.md

@@ -25,7 +25,7 @@ With this controller you can:
 
 ### Key Features
 
-- **Multi-condition Rules**: Define rules that require ALL specified conditions to be satisfied
+- **Multi-condition Rules**: Define rules with flexible condition policies (`allOf` or `anyOf`) to require ALL or ANY specified conditions to be satisfied
 - **Flexible Enforcement**: Support for bootstrap-only and continuous enforcement modes
 - **Conflict Prevention**: Validation webhook prevents conflicting taint configurations
 - **Dry Run Mode**: Preview rule impact before applying changes

api/v1alpha1/nodereadinessrule_types.go

@@ -33,6 +33,18 @@ const (
 	EnforcementModeContinuous EnforcementMode = "continuous"
 )
 
+// ConditionPolicy defines how the list of conditions is aggregated when evaluating a rule.
+// +kubebuilder:validation:Enum=allOf;anyOf
+type ConditionPolicy string
+
+const (
+	// ConditionPolicyAllOf requires ALL conditions to match their requiredStatus (default).
+	ConditionPolicyAllOf ConditionPolicy = "allOf"
+
+	// ConditionPolicyAnyOf requires at least ONE condition to match its requiredStatus.
+	ConditionPolicyAnyOf ConditionPolicy = "anyOf"
+)
+
 // TaintStatus specifies status of the Taint on Node.
 // +kubebuilder:validation:Enum=Present;Absent
 type TaintStatus string
@@ -46,6 +58,14 @@ const (
 )
 
 // NodeReadinessRuleSpec defines the desired state of NodeReadinessRule.
+//
+// We put the conditionPolicy immutability validation at `NodeReadinessRuleSpec` level instead of
+// putting it on `conditionPolicy`. This is required because conditionPolicy is optional field. If a
+// user transitions from an omitted field to an explicit "allOf" or vice-versa, field-level
+// transition rules are not evaluated, since validations are only performed only when both self and
+// oldSelf are present. By evaluating it at the struct level, we can safely use the `has()` macro to
+// normalize absent values and force evaluation under any condition.
+// +kubebuilder:validation:XValidation:rule="(!has(oldSelf.conditionPolicy) ? 'allOf' : oldSelf.conditionPolicy) == (!has(self.conditionPolicy) ? 'allOf' : self.conditionPolicy)",message="conditionPolicy is immutable"
 type NodeReadinessRuleSpec struct {
 	// conditions contains a list of the Node conditions that defines the specific
 	// criteria that must be met for taints to be managed on the target Node.
@@ -99,6 +119,15 @@ type NodeReadinessRuleSpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="nodeSelector is immutable"
 	NodeSelector metav1.LabelSelector `json:"nodeSelector,omitempty,omitzero"`
 
+	// conditionPolicy controls how the conditions list is evaluated.
+	// "allOf" (default) requires every condition to match its requiredStatus before the taint is removed.
+	// "anyOf" requires at least one condition to match its requiredStatus.
+	//
+	// anyOf cannot be used with enforcementMode: bootstrap-only.
+	//
+	// +optional
+	ConditionPolicy ConditionPolicy `json:"conditionPolicy,omitempty"` // Use GetConditionPolicy() for safe access; field may be empty even when allOf applies.
+
 	// dryRun when set to true, The controller will evaluate Node conditions and log intended taint modifications
 	// without persisting changes to the cluster. Proposed actions are reflected in the resource status.
 	//
@@ -379,6 +408,20 @@ func (c *ConditionRequirement) GetDefaultStatus() corev1.ConditionStatus {
 	return c.DefaultStatus
 }
 
+// GetConditionPolicy returns the effective condition policy, defaulting to allOf
+// when the field is not explicitly set.
+//
+// Always use this method instead of reading ConditionPolicy directly. The field
+// is intentionally left without an OpenAPI schema default (kubebuilder:default
+// is forbidden by project policy) and the Spec is immutable, so defaulting
+// must happen at read time via this accessor.
+func (spec *NodeReadinessRuleSpec) GetConditionPolicy() ConditionPolicy {
+	if spec.ConditionPolicy == "" {
+		return ConditionPolicyAllOf
+	}
+	return spec.ConditionPolicy
+}
+
 func init() {
 	objectTypes = append(objectTypes, &NodeReadinessRule{}, &NodeReadinessRuleList{})
 }

charts/node-readiness-controller/crds/nodereadinessrules.readiness.node.x-k8s.io.yaml

@@ -62,6 +62,17 @@ spec:
           spec:
             description: spec defines the desired state of NodeReadinessRule
             properties:
+              conditionPolicy:
+                description: |-
+                  conditionPolicy controls how the conditions list is evaluated.
+                  "allOf" (default) requires every condition to match its requiredStatus before the taint is removed.
+                  "anyOf" requires at least one condition to match its requiredStatus.
+
+                  anyOf cannot be used with enforcementMode: bootstrap-only.
+                enum:
+                - allOf
+                - anyOf
+                type: string
               conditions:
                 description: |-
                   conditions contains a list of the Node conditions that defines the specific
@@ -251,6 +262,10 @@ spec:
             - nodeSelector
             - taint
             type: object
+            x-kubernetes-validations:
+            - message: conditionPolicy is immutable
+              rule: '(!has(oldSelf.conditionPolicy) ? ''allOf'' : oldSelf.conditionPolicy)
+                == (!has(self.conditionPolicy) ? ''allOf'' : self.conditionPolicy)'
           status:
             description: status defines the observed state of NodeReadinessRule
             minProperties: 1

config/crd/bases/readiness.node.x-k8s.io_nodereadinessrules.yaml

@@ -62,6 +62,17 @@ spec:
           spec:
             description: spec defines the desired state of NodeReadinessRule
             properties:
+              conditionPolicy:
+                description: |-
+                  conditionPolicy controls how the conditions list is evaluated.
+                  "allOf" (default) requires every condition to match its requiredStatus before the taint is removed.
+                  "anyOf" requires at least one condition to match its requiredStatus.
+
+                  anyOf cannot be used with enforcementMode: bootstrap-only.
+                enum:
+                - allOf
+                - anyOf
+                type: string
               conditions:
                 description: |-
                   conditions contains a list of the Node conditions that defines the specific
@@ -251,6 +262,10 @@ spec:
             - nodeSelector
             - taint
             type: object
+            x-kubernetes-validations:
+            - message: conditionPolicy is immutable
+              rule: '(!has(oldSelf.conditionPolicy) ? ''allOf'' : oldSelf.conditionPolicy)
+                == (!has(self.conditionPolicy) ? ''allOf'' : self.conditionPolicy)'
           status:
             description: status defines the observed state of NodeReadinessRule
             minProperties: 1