Add configurable tolerations for PodVolumeBackup and data mover pods (#9575)

* Remove toleration whitelist for PodVolumeBackup and data mover pods

Instead of filtering tolerations through a hardcoded allowlist
(ThirdPartyTolerations), inherit all tolerations from the node-agent
daemonset for PodVolumeBackup/Restore and DataUpload/Download pods,
and from the Velero deployment for maintenance jobs.

This enables backups and restores on nodes with custom NoExecute taints,
which was previously impossible since only two specific toleration keys
were whitelisted.

Fixes #9476

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

* Fix codespell: replace 'whitelist' with 'allowlist' in changelog

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

* Implement deduplication of tolerations and add unit tests for the new function

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* Merge node-agent-configmap tolerations with third-party allowlist

Add a `tolerations` field to the node-agent-configmap so operators can
declare hosting-pod tolerations explicitly, per blackpiglet's review
feedback that tolerations shouldn't be read from the DaemonSet alone.
These are merged with (and deduplicated against) DaemonSet tolerations
matching the existing third-party allowlist
(kubernetes.azure.com/scalesetpriority, CriticalAddonsOnly), restoring
that allowlist per the follow-up suggestion to keep inheriting it
alongside the new config option.

The toleration dedup helper is moved from pkg/exposer to
pkg/util/kube (exported as DeduplicateTolerations) so it can be
shared with pkg/nodeagent without an import cycle.

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* Fix testifylint finding in TestGetTolerations

golangci-lint v2.12.0 (pinned in pr-linter-check.yml) flagged the
shared assert.Equal after the if/else as require-error: use require
for the error assertion so each branch is self-contained, matching
the pattern used elsewhere in this file.

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* Document toleration merge priority in GetTolerations

Per blackpiglet's review feedback: clarify that configured tolerations
take priority over allowlisted daemonset tolerations because they're
appended first and DeduplicateTolerations keeps only the first
occurrence of each exact (Key, Operator, Value, Effect) combination.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

---------

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Happy <yesreply@happy.engineering>

pkg/nodeagent/node_agent_test.go

@@ -884,7 +884,7 @@ func TestGetAnnotationValue(t *testing.T) {
 	}
 }
 
-func TestGetToleration(t *testing.T) {
+func TestGetTolerations(t *testing.T) {
 	daemonSet := &appsv1api.DaemonSet{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: "fake-ns",
@@ -895,7 +895,7 @@ func TestGetToleration(t *testing.T) {
 		},
 	}
 
-	daemonSetWithOtherToleration := &appsv1api.DaemonSet{
+	daemonSetWithTolerations := &appsv1api.DaemonSet{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: "fake-ns",
 			Name:      "node-agent",
@@ -908,7 +908,14 @@ func TestGetToleration(t *testing.T) {
 				Spec: corev1api.PodSpec{
 					Tolerations: []corev1api.Toleration{
 						{
-							Key: "other-toleration-key",
+							Key:   "custom-taint",
+							Value: "true",
+						},
+						{
+							Key:      "kubernetes.azure.com/scalesetpriority",
+							Operator: "Equal",
+							Value:    "spot",
+							Effect:   "NoSchedule",
 						},
 					},
 				},
@@ -916,79 +923,110 @@ func TestGetToleration(t *testing.T) {
 		},
 	}
 
-	daemonSetWithToleration := &appsv1api.DaemonSet{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: "fake-ns",
-			Name:      "node-agent",
-		},
-		TypeMeta: metav1.TypeMeta{
-			Kind: "DaemonSet",
-		},
-		Spec: appsv1api.DaemonSetSpec{
-			Template: corev1api.PodTemplateSpec{
-				Spec: corev1api.PodSpec{
-					Tolerations: []corev1api.Toleration{
-						{
-							Key:   "fake-toleration",
-							Value: "true",
-						},
-					},
-				},
-			},
-		},
+	configuredToleration := corev1api.Toleration{
+		Key:      "dedicated",
+		Operator: "Equal",
+		Value:    "backup",
+		Effect:   "NoSchedule",
 	}
 
 	tests := []struct {
-		name          string
-		kubeClientObj []runtime.Object
-		namespace     string
-		expectedValue corev1api.Toleration
-		expectErr     string
+		name                  string
+		kubeClientObj         []runtime.Object
+		namespace             string
+		configuredTolerations []corev1api.Toleration
+		expectedValues        []corev1api.Toleration
+		expectErr             string
 	}{
-		// {
-		// 	name:      "ds get error",
-		// 	namespace: "fake-ns",
-		// 	expectErr: "error getting node-agent daemonset: daemonsets.apps \"node-agent\" not found",
-		// },
 		{
-			name:      "no toleration",
-			namespace: "fake-ns",
-			kubeClientObj: []runtime.Object{
-				daemonSet,
-			},
-			expectErr: ErrNodeAgentTolerationNotFound.Error(),
+			name:           "no tolerations",
+			namespace:      "fake-ns",
+			kubeClientObj:  []runtime.Object{daemonSet},
+			expectedValues: []corev1api.Toleration{},
 		},
 		{
-			name:      "no expecting toleration",
+			name:      "only non-allowlisted daemonset tolerations are dropped",
 			namespace: "fake-ns",
 			kubeClientObj: []runtime.Object{
-				daemonSetWithOtherToleration,
+				daemonSetWithTolerations,
+			},
+			expectedValues: []corev1api.Toleration{
+				{
+					Key:      "kubernetes.azure.com/scalesetpriority",
+					Operator: "Equal",
+					Value:    "spot",
+					Effect:   "NoSchedule",
+				},
 			},
-			expectErr: ErrNodeAgentTolerationNotFound.Error(),
 		},
 		{
-			name:      "expecting toleration",
+			name:                  "configured tolerations only",
+			namespace:             "fake-ns",
+			kubeClientObj:         []runtime.Object{daemonSet},
+			configuredTolerations: []corev1api.Toleration{configuredToleration},
+			expectedValues:        []corev1api.Toleration{configuredToleration},
+		},
+		{
+			name:      "configured and allowlisted daemonset tolerations are merged",
 			namespace: "fake-ns",
 			kubeClientObj: []runtime.Object{
-				daemonSetWithToleration,
+				daemonSetWithTolerations,
 			},
-			expectedValue: corev1api.Toleration{
-				Key:   "fake-toleration",
-				Value: "true",
+			configuredTolerations: []corev1api.Toleration{configuredToleration},
+			expectedValues: []corev1api.Toleration{
+				configuredToleration,
+				{
+					Key:      "kubernetes.azure.com/scalesetpriority",
+					Operator: "Equal",
+					Value:    "spot",
+					Effect:   "NoSchedule",
+				},
 			},
 		},
+		{
+			name:      "duplicate between configured and daemonset tolerations is deduplicated",
+			namespace: "fake-ns",
+			kubeClientObj: []runtime.Object{
+				daemonSetWithTolerations,
+			},
+			configuredTolerations: []corev1api.Toleration{
+				{
+					Key:      "kubernetes.azure.com/scalesetpriority",
+					Operator: "Equal",
+					Value:    "spot",
+					Effect:   "NoSchedule",
+				},
+			},
+			expectedValues: []corev1api.Toleration{
+				{
+					Key:      "kubernetes.azure.com/scalesetpriority",
+					Operator: "Equal",
+					Value:    "spot",
+					Effect:   "NoSchedule",
+				},
+			},
+		},
+		{
+			name:                  "daemonset get error still returns configured tolerations",
+			namespace:             "fake-ns",
+			kubeClientObj:         []runtime.Object{},
+			configuredTolerations: []corev1api.Toleration{configuredToleration},
+			expectedValues:        []corev1api.Toleration{configuredToleration},
+			expectErr:             "error getting node-agent daemonset: daemonsets.apps \"node-agent\" not found",
+		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			fakeKubeClient := fake.NewSimpleClientset(test.kubeClientObj...)
 
-			value, err := GetToleration(t.Context(), fakeKubeClient, test.namespace, "fake-toleration", kube.NodeOSLinux)
+			values, err := GetTolerations(t.Context(), fakeKubeClient, test.namespace, kube.NodeOSLinux, test.configuredTolerations)
 			if test.expectErr == "" {
 				require.NoError(t, err)
-				assert.Equal(t, test.expectedValue, *value)
+				assert.Equal(t, test.expectedValues, values)
 			} else {
-				assert.EqualError(t, err, test.expectErr)
+				require.EqualError(t, err, test.expectErr)
+				assert.Equal(t, test.expectedValues, values)
 			}
 		})
 	}