docs, node maintenance: describe the eviction webhook and evacuate-cancel - #1051

What this PR does / why we need it:

docs/cluster_admin/node_maintenance.md still says that "a PodDisruptionBudget is created for each VMI which has an evictionStrategy defined". KubeVirt stopped doing that in v1.6.0 (kubevirt/kubevirt#13764, "KubeVirt doesn't use PDBs anymore"). The page also does not say how to stop an evacuation after the node is made schedulable again.

Changes:

1. Replace the PDB paragraph with what happens now. The virt-launcher-eviction-interceptor.kubevirt.io webhook denies the eviction and sets status.evacuationNodeName, and the evacuation controller creates kubevirt-evacuation-* migrations. Add the kubectl drain output you see while it retries, and what happens to a LiveMigrate VMI that is not live migratable.
2. Add "Canceling an evacuation" under "Re-enabling a Node after Eviction". kubectl uncordon does not stop an evacuation that already started. The new section shows how to check status.evacuationNodeName, how to clear it with virtctl evacuate-cancel (v1.9.1 or later), that the kubevirt.io/drain taint blocks the cancel, and that a running migration has to be deleted separately.

Sources (kubevirt v1.9.0, the same code is on main):

• pkg/virt-api/webhooks/validating-webhook/admitters/pod-eviction-admitter.go L127-183: deny messages, markVMI sets /status/evacuationNodeName.
• pkg/virt-controller/watch/drain/evacuation/evacuation.go L326-334 and L416-424: VMIs marked for eviction keep being selected while they are still on that node, whether or not the node is schedulable. L344: GenerateName: "kubevirt-evacuation-".
• pkg/virt-controller/watch/drain/disruptionbudget/disruptionbudget.go: only deletes old PDBs now.
• pkg/virt-api/rest/evacuate_cancel.go (v1.9.1): JSON patch test + remove of /status/evacuationNodeName, rejected while the node has the drain taint. Nothing touches running migrations.
• The virtctl fix that sends the node name is virtctl, evacuate: Provide required argument kubevirt#17008. It was backported to release-1.9 ([release-1.9] virtctl, evacuate: Provide required argument kubevirt#18864) and first released in v1.9.1.

What I measured on a test cluster (KubeVirt v1.9.0, Kubernetes 1.36, two workers):

• Draining a node with evictionStrategy: LiveMigrate VMIs: kubectl get pdb -A gave No resources found before and during the drain. The drain output had the denials shown in the new example, and a VMI on a ReadWriteOnce PVC was denied with VMI <name> is configured with an eviction strategy but is not live-migratable.
• A VMI running a memory-heavy workload kept failing to converge, and I uncordoned the node after the drain timed out. New kubevirt-evacuation-* migrations for that VMI were still created after the node was schedulable again (once 48 s after an uncordon, once about 5 minutes after a later one). When the load stopped, the last one succeeded and the VMI left the node.
• virtctl evacuate-cancel vmi <name> with virtctl v1.9.0 failed with Internal error occurred: the server rejected our request due to an error in our request (virt-api: Failed to patching VMI, 500). The same PUT with body {"evacuationNodeName":"<node>"} returned 200 and cleared the field, which matches the virtctl fix above. I did not rerun this with a v1.9.1 binary.

I did not build the site locally. The page only uses Markdown that it already uses elsewhere (fenced blocks, !!! note).

Special notes for your reviewer:

This does not overlap with the open live migration docs PRs (they only touch docs/compute/live_migration.md). The new text links to its "Canceling a live migration" heading, which those PRs keep.

Prepared with help from Claude (AI); the measurements come from my own nested test cluster.