feat: admission validators for the capacity planners (OP-345)

[kristina-solovyova]

Eleven new WekaCluster validators, so a spec that can never converge is reported at
apply time instead of after a failed formation.

Auto-full-drives (daemonset) specific:

• cluster_auto_full_drives_pin_exceeds_node_drives — a numDrives (or unpinned-
  numDrives driveCores) pin above a node's signed full drive count.
• cluster_auto_full_drives_compute_hugepages — compute hugepages scale with the
  claimed capacity and can exceed what any compute-eligible node has.
• cluster_auto_full_drives_min_nodes — a role nodeSelector matching fewer nodes
  than the form-cluster floor.
• cluster_sizing_mode_flip (update-only) — changing the derived sizing mode under
  a live cluster, except the two transitions the operator can carry over.

Shared across both planners:

• cluster_min_containers, cluster_cores_per_container_limit,
  cluster_compute_drive_cores_floor, cluster_drive_cores_below_capacity,
  cluster_num_drives_below_required_cores, cluster_drives_unsigned_advisory,
  cluster_capacity_min_drive_containers.

cluster_signed_drives and cluster_min_drives_feasibility narrow to the modes they
still own, and cluster_drive_compute_core_ratio takes its ratio from
capacityPlannerConstraints instead of a hardcoded 1:2. Drive-role node listing is
shared via listDriveRoleNodes.

admission/defaults.go and the values.yaml policy documentation move with the
validators: evaluator_test.go checks registry and defaults for completeness in both
directions, so a defaults entry without its validator fails the build.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[kristina-solovyova]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix: tlc drive core capping and address linting issues #2792 : 2 dependent PRs (#2800 , #2801 )
• fix: upgrade weka-sign-tool default image #2787
• fix: bump go version to 1.27.0 #2786
• fix: detect compute-blocked drive growth, split per-cause warnings, fix infeasibility binding #2785
• fix: tighten auto-full-drives compute sizing and per-role hugepages admission checks #2780
• fix: refactor the new wekacluster admission validators #2769
• fix: avoid deep-copying nodes, containers, and pods in planner inventory read #2770
• fix: aggregate auto-full-drives planner warnings into one event per condition instead of per node #2768
• docs: document act-as-daemonset mode (OP-345) #2748
• feat: weka-capacity dry-run for auto-full-drives (OP-345) #2747
• feat: admission validators for the capacity planners (OP-345) #2746 👈 (View in Graphite)
• feat: support full-drive wekacluster acting as a daemonset and using all drives (OP-345) #2742
• refactor: share node-eligibility, pod-status and drive-ordering helpers (OP-345) #2745
• main

---

How to use the Graphite Merge Queue

Add the label main-merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has required the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[graphite-app]

Graphite Automations

"Add anton/matt/sergey/kristina as reviwers on operator PRs" took an action on this PR • (08/19/26)

2 reviewers were added to this PR based on Anton Bykov's automation.