Add support for PriorityClass in FileIntegrity

[cturiel]

Add PriorityClass support to FileIntegrity

This PR adds a priorityClassName field to the FileIntegrity CR so you can set pod priority for the daemon pods.

Why?

In clusters under resource pressure, the file integrity daemon pods may fail to schedule because nodes don't have enough available resources. By setting a PriorityClass, these pods can preempt lower-priority workloads, ensuring they get scheduled and can run successfully on all nodes. PriorityClass documentation

Right now there's no way to control this, so file integrity monitoring can fail on busy nodes.

The compliance-operator already has this feature, so I followed the same pattern. ComplianceAsCode/compliance-operator#71

What changed

API:

• Added optional priorityClassName field to FileIntegrity spec
• Updated CRDs and bundle

Controller:

• Validates PriorityClass exists before applying it
• Clears invalid values and logs a warning + emits event
• Detects changes and restarts DaemonSet when needed
• Added RBAC to read PriorityClass resources

Tests:

• E2E tests for valid and invalid PriorityClass

Docs:

• Updated README with example usage
• Updated CRD descriptions

Example

apiVersion: fileintegrity.openshift.io/v1alpha1
kind: FileIntegrity
metadata:
  name: example-fileintegrity
  namespace: openshift-file-integrity
spec:
  priorityClassName: system-node-critical
  config: {}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cturiel
Once this PR has been reviewed and has the lgtm label, please assign xiaojiey for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @cturiel. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.