Skip non-Windows pods in Hyper-V mutating webhook

[rzlink]

What this PR does

Fixes the Hyper-V mutating webhook to skip pods that have custom nodeSelectors but no kubernetes.io/os selector. These are test fixture pods (e.g., ResourceQuota tests with x-test.k8s.io/unsatisfiable selectors) that are not intended to run as Windows workloads.

Why this is needed

After PR #560 added Pod Overhead (512Mi memory, 100m CPU) to the runhcs-wcow-hypervisor RuntimeClass, the webhook injects this RuntimeClass into all pods that aren't explicitly Linux, HostProcess, or HostNetwork. This includes test fixture pods that never run on Windows nodes, causing 4 consistent ResourceQuota test failures on capz-windows-master-hyperv:

pods "test-pod" is forbidden: exceeded quota: test-quota,
  requested: memory=764Mi,     <- 252Mi (pod) + 512Mi (overhead)
  limited: memory=500Mi

How the fix works

Pod nodeSelector	Before	After
{} (empty, common in e2e tests)	INJECT	INJECT (unchanged)
{kubernetes.io/os: windows}	INJECT	INJECT (unchanged)
{kubernetes.io/os: linux}	SKIP	SKIP (unchanged)
{x-test.k8s.io/unsatisfiable: ...}	INJECT (wrong)	SKIP (fixed)
{tier: frontend} (no OS)	INJECT	SKIP (fixed)

CI Impact

Fixes 4 consistent failures on capz-windows-master-hyperv:

• ResourceQuota should create a ResourceQuota and capture the life of a pod
• ResourceQuota should verify ResourceQuota with terminating scopes
• ResourceQuota should verify ResourceQuota with terminating scopes through scope selectors
• ResourceQuota priority class scope (cpu, memory quota set)

/cc @jsturtevant @kiashok

[k8s-ci-robot]

Hi @rzlink. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[marosset]

/ok-to-test

[marosset]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: marosset, rzlink

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [marosset]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment