webhook: improve nodeSelectorsOverlap to detect subset overlaps

Previously, nodeSelectorsOverlap only detected identical selectors
using string equality. This missed partial overlaps where one selector
is a subset of another, allowing conflicting rules to be created.

Fix by using sel.Matches() to check if one selector's matchLabels
satisfies the other selector, catching subset overlap cases.

Add test case for subset selector overlap scenario.
Add comment noting matchExpressions limitation.

Signed-off-by: Shreya2005-2005 <bhakatmistu@email.com>
Signed-off-by: Shreya2005-2005 <bhakatmistu2005@gmail.com>

Author: Shreya2005-2005

internal/webhook/nodereadinessgaterule_webhook.go

@@ -125,6 +125,8 @@ func (w *NodeReadinessRuleWebhook) nodeSelectorsOverlap(selector1, selector2 met
 
 	// Check overlap: if one selector's matchLabels is a subset of the other,
 	// a node could match both selectors, causing a conflict.
+	// Note: this only covers matchLabels-based overlap; selectors using
+	// matchExpressions may still overlap without being detected here.
 	if sel1.Matches(labels.Set(selector2.MatchLabels)) {
 		return true
 	}

internal/webhook/nodereadinessgaterule_webhook_test.go

@@ -330,6 +330,18 @@ var _ = Describe("NodeReadinessRule Validation Webhook", func() {
 			overlaps := webhook.nodeSelectorsOverlap(selector1, selector2)
 			Expect(overlaps).To(BeFalse()) // Different selectors don't overlap (simple heuristic)
 		})
+		It("should detect subset selectors as overlapping", func() {
+			// selector1 (env=prod) is subset of selector2 (env=prod,region=us)
+			// Both match nodes labeled env=prod,region=us => they overlap
+			selector1 := metav1.LabelSelector{
+				MatchLabels: map[string]string{"env": "prod"},
+			}
+			selector2 := metav1.LabelSelector{
+				MatchLabels: map[string]string{"env": "prod", "region": "us"},
+			}
+			overlaps := webhook.nodeSelectorsOverlap(selector1, selector2)
+			Expect(overlaps).To(BeTrue()) // subset selectors overlap
+		})
 	})
 
 	Context("CustomValidator Interface", func() {