markers/OneOf: make order deterministic relative to XValidation

Currently, if both XValidation and AtMostOneOf/ExactlyOneOf constraints
are specified, the ordering of CEL rules can change due to both
sets of markers have the same apply priority. This change ensures that
OneOf markers always run **after** XValidation markers.

Author: shashankram

pkg/crd/markers/validation.go

@@ -672,6 +672,11 @@ func (fields AtMostOneOf) ApplyToSchema(schema *apiext.JSONSchemaProps) error {
 	return xvalidation.ApplyToSchema(schema)
 }
 
+func (_ AtMostOneOf) ApplyPriority() ApplyPriority {
+	// explicitly go after XValidation markers so that the ordering is deterministic
+	return ApplyPriorityDefault + 1
+}
+
 func (fields ExactlyOneOf) ApplyToSchema(schema *apiext.JSONSchemaProps) error {
 	if len(fields) == 0 {
 		return nil
@@ -684,6 +689,11 @@ func (fields ExactlyOneOf) ApplyToSchema(schema *apiext.JSONSchemaProps) error {
 	return xvalidation.ApplyToSchema(schema)
 }
 
+func (_ ExactlyOneOf) ApplyPriority() ApplyPriority {
+	// explicitly go after XValidation markers so that the ordering is deterministic
+	return ApplyPriorityDefault + 1
+}
+
 // fieldsToOneOfCelRuleStr converts a slice of field names to a string representation
 // [has(self.field1),has(self.field1),...].filter(x, x == true).size()
 func fieldsToOneOfCelRuleStr(fields []string) string {

pkg/crd/testdata/oneof/types.go

@@ -34,6 +34,7 @@ type OneofSpec struct {
 	SecondTypeWithExactOneof *TypeWithMultipleExactOneofs `json:"secondTypeWithExactOneof,omitempty"`
 }
 
+// +kubebuilder:validation:XValidation:message="only one of foo|bar may be set",rule="!(has(self.foo) && has(self.bar))"
 // +kubebuilder:validation:AtMostOneOf=foo;bar
 type TypeWithOneofs struct {
 	Foo *string `json:"foo,omitempty"`

pkg/crd/testdata/testdata.kubebuilder.io_oneofs.yaml

@@ -56,6 +56,8 @@ spec:
                     type: string
                 type: object
                 x-kubernetes-validations:
+                - message: only one of foo|bar may be set
+                  rule: '!(has(self.foo) && has(self.bar))'
                 - message: at most one of the fields in [foo bar] may be set
                   rule: '[has(self.foo),has(self.bar)].filter(x,x==true).size() <=
                     1'