feat(kyverno): migrate validate-pdb-drain-safe to ValidatingPolicy

[devantler]

🤖 Generated by the Agentic Engineer

Why

The next Kyverno release removes the older policy kind. The rule that warns when a disruption budget could make a node impossible to drain still uses that kind, so it would stop working on upgrade.

What

The same rule is rewritten in the newer policy kind. It keeps the same behaviour: it reports, without blocking, budgets that set a minimum-available count, and it still leaves alone the budgets that the database operator, KSail's own install and the storage system manage themselves.

Fixes #5118

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 04f3d529e7685a26f7872e8829566a2d04f98b59

• CodeRabbit: rate limited — its 10:25Z review on platform#5116 used the plan's one included review for this hour ("0 remain after this review"); no artifact exists on this PR.
• Codex: usage limit since 2026-10-19 22:44Z (lane-health read 09:44Z today); no Codex artifact on this PR.
• Cursor Bugbot: usage limit since 2026-10-19 22:18Z (lane-health read 09:44Z today); no Bugbot check-run on this PR.

Scope read: the whole diff against main. Checked with Kyverno CLI 1.19.1 (the running version): this policy's test 7/7 with each fail carrying the expected message and each exclusion reporting skip, the whole suite 752/752, the per-rule fixture gate, and the failure-action baseline on source and on the production render. Evaluated old and new policy against production's live disruption budgets (read-only, names, the CloudNativePG label and the budget fields only): 54 pass and 0 fail under both; the 18 the old policy excluded are reported as skip by the new one.

Correctness: the three exclusions are carried over one for one. The Longhorn name pattern requires at least one character after the prefix, as the old wildcard did, and applies only inside the Longhorn namespace. Any set minimum-available value fails, including zero, as before. The Audit action and background evaluation are preserved.

Security: no trust, execution or egress boundary changes; the policy stays Audit.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness — head 04f3d529e7685a26f7872e8829566a2d04f98b59

1. Programmatically tested: CI at this head is green (29 success, 9 skipped by path filters); kyverno test ./tests and the policy-actions baseline passed locally when the change was made. No review threads; branch is CLEAN against main.
2. Reviewed green at this head: fallback self-review (CodeRabbit hourly quota exhausted, Codex and Cursor Bugbot at their usage limits) — local-review-verdict.sh returns GREEN self@04f3d529.
3. Tried as a user: applied the old ClusterPolicy and the new ValidatingPolicy side by side over a read-only export of the live disruption budgets — 72 budgets: old 54 pass / 0 fail, new 54 pass / 18 skip (the operator-, KSail- and storage-managed budgets the old rule excluded) / 0 fail. Same audit outcome, nothing newly reported.

Promoting and queueing at this head.