OCPNODE: cover graceful shutdown KubeletConfig validation

.coderabbit.yaml

@@ -0,0 +1,6 @@
+inheritance: true
+reviews:
+  path_instructions:
+    - path: "pkg/controller/kubelet-config/**"
+      instructions: |
+        Treat KubeletConfig override changes as platform-safety changes. Flag user overrides of platform-owned fields or feature gates, unaccounted MachineConfigPool rollout and reboot impact, and changes lacking Node-team review or focused validation coverage.

pkg/controller/kubelet-config/kubelet_config_controller_test.go

@@ -7,6 +7,7 @@ import (
 	"sort"
 	"strings"
 	"testing"
+	"time"
 
 	ign3types "github.com/coreos/ignition/v2/config/v3_5/types"
 	"github.com/stretchr/testify/assert"
@@ -1018,6 +1019,42 @@ func TestKubeletConfigDenylistedOptions(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "user cannot configure shutdownGracePeriod through GracefulNodeShutdown",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				ShutdownGracePeriod: metav1.Duration{Duration: 30 * time.Second},
+				FeatureGates:        map[string]bool{"GracefulNodeShutdown": true},
+			},
+		},
+		{
+			name: "user cannot configure shutdownGracePeriodCriticalPods through GracefulNodeShutdown",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				ShutdownGracePeriodCriticalPods: metav1.Duration{Duration: 10 * time.Second},
+				FeatureGates:                    map[string]bool{"GracefulNodeShutdown": true},
+			},
+		},
+		{
+			name: "user cannot configure shutdownGracePeriodByPodPriority through GracefulNodeShutdownBasedOnPodPriority",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				ShutdownGracePeriodByPodPriority: []kubeletconfigv1beta1.ShutdownGracePeriodByPodPriority{{
+					Priority:                   0,
+					ShutdownGracePeriodSeconds: 30,
+				}},
+				FeatureGates: map[string]bool{"GracefulNodeShutdownBasedOnPodPriority": true},
+			},
+		},
+		{
+			name: "user cannot supply GracefulNodeShutdown feature gate",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				FeatureGates: map[string]bool{"GracefulNodeShutdown": true},
+			},
+		},
+		{
+			name: "user cannot supply GracefulNodeShutdownBasedOnPodPriority feature gate",
+			config: &kubeletconfigv1beta1.KubeletConfiguration{
+				FeatureGates: map[string]bool{"GracefulNodeShutdownBasedOnPodPriority": true},
+			},
+		},
 		{
 			name: "test banned failSwapOn",
 			config: &kubeletconfigv1beta1.KubeletConfiguration{