Repository: kubernetes
Issue: API Server fails validation for CRDs embedding resources with optional fields without omitempty when there is webhook
Labels: kind/bug,sig/api-machinery,priority/important-longterm,triage/accepted

### What happened?

Validation errors are returned by API server when trying to create a valid JobSet 0.5.2 embedding JobTemplate with pod failure policy, using k8s 1.30.2. The Job template is correct - there is no validation error when created without the JobSet wrapper. The errors are only returned when the JobSet webhook is installed.


### What did you expect to happen?

No validation errors when creating JobSet which embeds a valid JobTemplate.

### How can we reproduce it (as minimally and precisely as possible)?

0. Start a k8s cluster on kind in version 1.30.2 (the last version before the mitigation in https://github.com/kubernetes/kubernetes/pull/126046)
1. Install JobSet 0.5.2 in `kubectl apply --server-side -f https://github.com/kubernetes-sigs/jobset/releases/download/v0.5.2/manifests.yaml` (note that JobSet is running a JobSet webhook)
2. Attempt to create the following JobSet

```yaml
apiVersion: jobset.x-k8s.io/v1alpha2
kind: JobSet
metadata:
  generateName: failurepolicy-abcdef
spec:
  replicatedJobs:
  - name: leader
    replicas: 1
    template:
      spec:
        completions: 2
        parallelism: 2
        template:
          spec:
            restartPolicy: Never
            containers:
            - name: leader
              image: bash:latest
              command:
              - bash
              - -xc
              - |
                for i in $(seq 1 1000)
                do
                  echo "$i"
                  sleep 1
                done
        podFailurePolicy:
          rules:
          - action: FailJob
            onPodConditions:
            - type: DisruptionTarget
          - action: Ignore
            onExitCodes:
              operator: In
              values: [ 42 ]
```
Issue: the creation fails with 
```
> k create -f jobset.yaml
The JobSet "failurepolicy-abcdef" is invalid: 
* spec.replicatedJobs[0].template.spec.podFailurePolicy.rules[0].onExitCodes: Invalid value: "null": spec.replicatedJobs[0].template.spec.podFailurePolicy.rules[0].onExitCodes in body must be of type object: "null"
* spec.replicatedJobs[0].template.spec.podFailurePolicy.rules[1].onExitCodes.containerName: Invalid value: "null": spec.replicatedJobs[0].template.spec.podFailurePolicy.rules[1].onExitCodes.containerName in body must be of type string: "null"
* spec.replicatedJobs[0].template.spec.podFailurePolicy.rules[1].onPodConditions: Invalid value: "null": spec.replicatedJobs[0].template.spec.podFailurePolicy.rules[1].onPodConditions in body must be of type array: "null"
* <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation
```



### Anything else we need to know?

This is a root cause of https://github.com/kubernetes/kubernetes/issues/126040 which was mitigated by  https://github.com/kubernetes/kubernetes/pull/126046.

Note that the creation succeeds when the JobSet webhook is deleted. Example response from the webook intercepted at level 10 (as per [comment](https://github.com/kubernetes/kubernetes/pull/126046#issuecomment-2225932024):

```
[{"op":"add","path":"/metadata/creationTimestamp","value":null},
{"op":"add","path":"/spec/replicatedJobs/0/template/metadata","value":{"creationTimestamp":null}},
{"op":"add","path":"/spec/replicatedJobs/0/template/spec/template/metadata","value":{"creationTimestamp":null}},
{"op":"add","path":"/spec/replicatedJobs/0/template/spec/template/spec/containers/0/resources","value":{}},
{"op":"add","path":"/spec/replicatedJobs/0/template/spec/completionMode","value":"Indexed"},
{"op":"add","path":"/spec/replicatedJobs/0/template/spec/podFailurePolicy/rules/0/onExitCodes","value":null},
{"op":"add","path":"/spec/replicatedJobs/0/template/spec/podFailurePolicy/rules/0/onPodConditions/0/status","value":""},
{"op":"add","path":"/spec/replicatedJobs/0/template/spec/podFailurePolicy/rules/1/onExitCodes/containerName","value"
:null},{"op":"add","path":"/spec/replicatedJobs/0/template/spec/podFailurePolicy/rules/1/onPodConditions","value":null},
{"op":"add","path":"/spec/network","value":{"enableDNSHostnames":true}},
{"op":"add","path":"/spec/successPolicy","value":{"operator":"All"}},{"op":"add","path":"/spec/startupPolicy","value":
{"startupPolicyOrder":"AnyOrder"}},{"op":"add","path":"/status","value":{}}]
```
The probable root cause: https://github.com/kubernetes/kubernetes/pull/126046#issuecomment-2233773781


### Kubernetes version

<details>

1.30.2

</details>


### Cloud provider

<details>
Kind, GKE
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>