What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR is to promote feature CustomResourceValidationExpressions to beta as it's proposed in KEP.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

The feature is in alpha since v1.23. For v1.25 cycle, we focus on performance optimization, test coverage, bug fix, metrics adding, dependency bumping, etc. The related PR FYI:

• Optimize away repeated structural schema and CEL DeclType construction in CRD validation #110135
• Pick up major changes from cel-go latest release #111071
• metrics for CEL compilation and evaluation #111035
• Bump cel-go to v0.11.2 #109804
• Add x-kubernetes-validations cost limit integration test #111005
• Add second set of additional CRD validation E2E tests #110576
• Only provide an oldSelf binding when referenced by a CEL rule. #110549
• Do test fixture setup outside cel.UnstructuredToVal benchmark loop. #110548
• Add additional CRD validation E2E tests #110330
• Use CEL EagerlyValidateDeclarations to improve compilation performance #109835
• Bump cel-go to v0.12.3 #111008
• Benchmark cel.UnstructuredToVal #108011

Graduation to beta criteria from the KEP

• Resolve topic of what support we should provide for access to the previous versions of object (ie. 'oldSelf' feature) -- resolved in

  kubernetes/staging/src/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel/validation_test.go

  Lines 1701 to 1753 in 631a5a8

  	{name: "transition rules",
  	obj: map[string]interface{}{
  	"v": "new",
  	},
  	oldObj: map[string]interface{}{
  	"v": "old",
  	},
  	schema: objectTypePtr(map[string]schema.Structural{
  	"v": stringType,
  	}),
  	valid: []string{
  	"oldSelf.v != self.v",
  	"oldSelf.v == 'old' && self.v == 'new'",
  	},
  	},
  	{name: "skipped transition rule for nil old primitive",
  	expectSkipped: true,
  	obj: "exists",
  	oldObj: nil,
  	schema: &stringType,
  	valid: []string{
  	"oldSelf == self",
  	},
  	},
  	{name: "skipped transition rule for nil old array",
  	expectSkipped: true,
  	obj: []interface{}{},
  	oldObj: nil,
  	schema: listTypePtr(&stringType),
  	valid: []string{
  	"oldSelf == self",
  	},
  	},
  	{name: "skipped transition rule for nil old object",
  	expectSkipped: true,
  	obj: map[string]interface{}{"f": "exists"},
  	oldObj: nil,
  	schema: objectTypePtr(map[string]schema.Structural{
  	"f": stringType,
  	}),
  	valid: []string{
  	"oldSelf.f == self.f",
  	},
  	},
  	{name: "skipped transition rule for old with non-nil interface but nil value",
  	expectSkipped: true,
  	obj: []interface{}{},
  	oldObj: nilInterfaceOfStringSlice(),
  	schema: listTypePtr(&stringType),
  	valid: []string{
  	"oldSelf == self",
  	},
  	},

• x-kubernetes-int-or-string is upgraded to use a union type of just int or string, not a dynamic type (CEL go support is planned in lates 2021) -- resolved in

  kubernetes/staging/src/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel/validation_test.go

  Lines 793 to 842 in 631a5a8

  	{name: "string in intOrString",
  	obj: map[string]interface{}{
  	"something": "25%",
  	},
  	schema: objectTypePtr(map[string]schema.Structural{
  	"something": intOrStringType(),
  	}),
  	valid: []string{
  	// In Kubernetes 1.24 and later, the CEL type returns false for an int-or-string comparison against the
  	// other type, making it safe to write validation rules like:
  	"self.something == '25%'",
  	"self.something != 1",
  	"self.something == 1 || self.something == '25%'",
  	"self.something == '25%' || self.something == 1",
  	// In Kubernetes 1.23 and earlier, all int-or-string access must be guarded by a type check to prevent
  	// a runtime error attempting an equality check between string and int types.
  	"type(self.something) == string && self.something == '25%'",
  	"type(self.something) == int ? self.something == 1 : self.something == '25%'",
  	// Because the type is dynamic it receives no type checking, and evaluates to false when compared to
  	// other types at runtime.
  	"self.something != ['anything']",
  	},
  	},
  	{name: "int in intOrString",
  	obj: map[string]interface{}{
  	"something": int64(1),
  	},
  	schema: objectTypePtr(map[string]schema.Structural{
  	"something": intOrStringType(),
  	}),
  	valid: []string{
  	// In Kubernetes 1.24 and later, the CEL type returns false for an int-or-string comparison against the
  	// other type, making it safe to write validation rules like:
  	"self.something == 1",
  	"self.something != 'some string'",
  	"self.something == 1 || self.something == '25%'",
  	"self.something == '25%' || self.something == 1",
  	// In Kubernetes 1.23 and earlier, all int-or-string access must be guarded by a type check to prevent
  	// a runtime error attempting an equality check between string and int types.
  	"type(self.something) == int && self.something == 1",
  	"type(self.something) == int ? self.something == 1 : self.something == '25%'",
  	// Because the type is dynamic it receives no type checking, and evaluates to false when compared to
  	// other types at runtime.
  	"self.something != ['anything']",
  	},
  	},

• Understanding of upper bounds of CPU/memory usage and appropriate limits set to prevent abuse.(Done in Add CEL runtime cost into CR validation #108482; Update CEL runtime cost limit #108595; Calculate CEL cost totals #108612; Reduce CEL runtime cost limits by 1/2 based on latency goals #109122)
• Build-in macro/function library is comprehensive and stable (any changes to this will be a breaking change) - The later addition of quantity appears to complicate this. See CEL Validation Use Cases where it is postponed as a use-case (Add CEL function library #108312)
• CEL numeric comparison issue is resolved (e.g. ability to compare ints to doubles) (Added test here)
• Reduce noise of invalid data messages reported from cel.UnstructuredToVal #106440 Asking for clarification of the fix
• Benchmark cel.UnstructuredToVal and optimize away repeated wrapper object construction #106438
• Demonstrate adoption and successful feature usage in the community -- confirmed against the list in CEL Validation Use Cases. quantity to be rejected by supported releases when it is added.
• Optimization on super-linear complexity growth (Optimize away repeated structural schema and CEL DeclType construction in CRD validation #110135)
• Adding metric of the latency of CEL evaluation for CRD evaluation

Does this PR introduce a user-facing change?

Graduated `CustomResourceValidationExpressions` to `beta`. The `CustomResourceValidationExpressions` feature gate is now enabled by default.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/2876-crd-validation-expression-language/README.md