[cvas22]

What this PR does / why we need it:

Adds spec.podDisruptionBudget to the Fluentd resource, so the operator can manage a PodDisruptionBudget for the Fluentd StatefulSet. Without one, a node drain can take all Fluentd collectors down at once, and the only workaround today is a hand-written PDB next to the operator (#1825).

apiVersion: fluentd.fluent.io/v1alpha1
kind: Fluentd
metadata:
  name: fluentd
  namespace: fluent
spec:
  replicas: 3
  podDisruptionBudget:
    maxUnavailable: 1      # or minAvailable: 2, or a percentage such as "50%"

How it works:

• Collector mode (StatefulSet): the operator creates and updates a policy/v1 PodDisruptionBudget named like the Fluentd resource. It reuses the StatefulSet's own selector, so it always matches the same pods, including extra labels from the Fluentd metadata. The PDB is owned by the Fluentd resource, and the controller now watches PDBs (Owns).
• Field unset, or agent mode (DaemonSet): the operator deletes the PDB if it exists. A PDB doesn't stop DaemonSet pods from being evicted on drain, so it only applies to the StatefulSet. This follows how replicas is "applicable when the mode is collector".
• Validation: a CEL rule requires exactly one of minAvailable and maxUnavailable. Each accepts a number or a percentage.
• Permissions: the operator needs poddisruptionbudgets permissions in the policy group. I added the kubebuilder RBAC marker, which regenerates config/rbac/role.yaml and manifests/setup/setup.yaml, and the same rule in the chart's fluent-operator-clusterRole.yaml.

Which issue(s) this PR fixes:

Fixes #1825

Does this PR introduced a user-facing change?

Fluentd supports spec.podDisruptionBudget (minAvailable or maxUnavailable). In collector mode, the operator creates a PodDisruptionBudget for the Fluentd StatefulSet. The operator's ClusterRole needs the new poddisruptionbudgets permission, which the Helm chart and setup manifests include.

Notes

Generated files come from make generate manifests docs-update, run in WSL with controller-gen v0.18.0: the Fluentd deepcopy and CRDs (config, both charts, manifests/setup/setup.yaml), the RBAC role, and docs/fluentd.md. The chart's ClusterRole template isn't generated, so I edited it by hand.

Tested locally:

• make test passes. It runs the whole suite with the race detector, including the controllers envtest tests.
• The new TestMakeFluentdPodDisruptionBudget covers no budget, minAvailable (and that the selector matches the StatefulSet's) and a maxUnavailable percentage.
• go build ./... succeeds and make lint reports 0 issues.

I haven't run it against a real cluster, so the create, update and delete path in the controller is only exercised through the build and the envtest suite, not with a live StatefulSet.