Move seed-monitoring and shoot-core charts and monitoring-related…

… logic in `Shoot` controller into `monitoring` component (gardener#8243)

* Move `plutono`-related functions in dedicated file

* Component boilerplate

* Deploy component in shoot flow

* Move deletion code into component

* Move custom alerting config code into component

* Move alerting rules/scrape configs computation into component

* Move secrets manager handling into component

* Move Prometheus chart value computation logic into component

* Move Alertmanager chart value computation logic into component

* Move chart and apply it from embedded file system

* Move `DeleteAlertmanager` function into component package

* Namespace UID and components are only known later

* Cleanup `common` package

* Move Prometheus-specific content of `shoot-core` chart into component

* Embed `shoot-core` chart as well

When we raise the minimum Kubernetes version to 1.26, we can drop all this.

* Drop `utils-templates` and `utils-common` Helm charts

* Address PR review feedback

* Address PR review feedback

charts/gardener/controlplane/charts/application/templates/apiservice-v1alpha1-operations-gardener-cloud.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.global.apiserver.enabled }}
-apiVersion: {{ include "apiserviceversion" . }}
+apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
   name: v1alpha1.operations.gardener.cloud

charts/gardener/controlplane/charts/application/templates/apiservice-v1alpha1-seedmanagement-gardener-cloud.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.global.apiserver.enabled }}
-apiVersion: {{ include "apiserviceversion" . }}
+apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
   name: v1alpha1.seedmanagement.gardener.cloud

charts/gardener/controlplane/charts/application/templates/apiservice-v1alpha1-settings-gardener-cloud.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.global.apiserver.enabled }}
-apiVersion: {{ include "apiserviceversion" . }}
+apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
   name: v1alpha1.settings.gardener.cloud

charts/gardener/controlplane/charts/application/templates/apiservice-v1beta1-core-gardener-cloud.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.global.apiserver.enabled }}
-apiVersion: {{ include "apiserviceversion" . }}
+apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
   name: v1beta1.core.gardener.cloud

charts/gardener/controlplane/charts/application/templates/clusterrole-admission-controller.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.admission.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:admission-controller

charts/gardener/controlplane/charts/application/templates/clusterrole-apiserver.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.apiserver.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:apiserver

charts/gardener/controlplane/charts/application/templates/clusterrole-controller-manager.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.controller.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:controller-manager

charts/gardener/controlplane/charts/application/templates/clusterrole-scheduler.yaml

@@ -7,7 +7,7 @@
 # Shoots/binding CREATE on binding subresource of shoots - actual scheduling request that leads to setting shoot.Spec.Cloud.Seed
 # Shoots/status PATCH, UPDATE on status subresource of shoots
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:scheduler

charts/gardener/controlplane/charts/application/templates/clusterrole-seed-bootstrapper.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:seed-bootstrapper

charts/gardener/controlplane/charts/application/templates/clusterrole-seeds.yaml

@@ -1,6 +1,6 @@
 {{- if not .Values.global.rbac.seedAuthorizer.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:seeds

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-admission-controller.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.admission.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:admission-controller

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-apiserver-auth-delegator.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.apiserver.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:apiserver:auth-delegator

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-apiserver.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.apiserver.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:apiserver

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-controller-manager.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.controller.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:controller-manager

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-kube-aggregator-admin.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.apiserver.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:admin

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-scheduler.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.scheduler.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:scheduler

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-seed-bootstrapper.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:seed-bootstrapper

charts/gardener/controlplane/charts/application/templates/clusterrolebinding-seeds.yaml

@@ -1,6 +1,6 @@
 {{- if not .Values.global.rbac.seedAuthorizer.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:seeds

charts/gardener/controlplane/charts/application/templates/mutatingwebhook-admission-controller.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.global.admission.enabled }}
-apiVersion: {{ include "webhookadmissionregistration" . }}
+apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   name: gardener-admission-controller

charts/gardener/controlplane/charts/application/templates/rbac-user.yaml

@@ -1,6 +1,6 @@
 # Cluster role granting full permissions to all resources in the gardener API group.
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:admin
@@ -93,7 +93,7 @@ rules: []
 
 # Cluster role granting viewer permissions for the resources in the gardener API group
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:viewer
@@ -208,7 +208,7 @@ rules: []
 
 # Cluster role with cluster role binding allowing all authenticated users to read some global resources
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:read-global-resources
@@ -229,7 +229,7 @@ rules:
   - list
   - watch
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:read-global-resources
@@ -249,7 +249,7 @@ subjects:
 
 # Cluster role with cluster role binding allowing all authenticated users create tokenreviews and selfsubjectaccessreviews
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:user-auth
@@ -272,7 +272,7 @@ rules:
   verbs:
   - create
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: gardener.cloud:system:user-auth
@@ -294,7 +294,7 @@ subjects:
 # IMPORTANT: You need to define a corresponding ClusterRoleBinding binding specific users/
 #            groups/serviceaccounts to this ClusterRole on your own.
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-creation
@@ -315,7 +315,7 @@ rules:
 # in a respective project namespace.
 # It aggregates all ClusterRoles labeled with rbac.gardener.cloud/aggregate-to-project-member: "true"
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-member
@@ -330,7 +330,7 @@ aggregationRule:
   - matchLabels:
       rbac.gardener.cloud/aggregate-to-project-member: "true"
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-member-aggregation
@@ -439,7 +439,7 @@ rules:
 # in a respective project namespace.
 # It aggregates all ClusterRoles labeled with rbac.gardener.cloud/aggregate-to-project-serviceaccountmanager: "true"
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-serviceaccountmanager
@@ -454,7 +454,7 @@ aggregationRule:
   - matchLabels:
       rbac.gardener.cloud/aggregate-to-project-serviceaccountmanager: "true"
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-serviceaccountmanager-aggregation
@@ -489,7 +489,7 @@ rules:
 # in a respective project namespace.
 # It aggregates all ClusterRoles labeled with rbac.gardener.cloud/aggregate-to-project-viewer: "true"
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-viewer
@@ -504,7 +504,7 @@ aggregationRule:
   - matchLabels:
       rbac.gardener.cloud/aggregate-to-project-viewer: "true"
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: gardener.cloud:system:project-viewer-aggregation

charts/gardener/controlplane/charts/application/templates/rolebinding-apiserver-auth-reader.yaml

@@ -1,6 +1,6 @@
 {{- if .Values.global.apiserver.enabled }}
 ---
-apiVersion: {{ include "rbacversion" . }}
+apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: gardener.cloud:apiserver:auth-reader

charts/gardener/controlplane/charts/application/templates/secret-alerting.yaml

@@ -1 +1,43 @@
+{{- define "gardener.secret-alerting" -}}
+{{- range $key, $config := .Values.global.alerting }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: alerting-{{ $key }}
+  namespace: garden
+  labels:
+    app: gardener
+    chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
+    release: "{{ $.Release.Name }}"
+    heritage: "{{ $.Release.Service }}"
+    gardener.cloud/role: alerting
+type: Opaque
+data:
+  auth_type: {{ ( required ".alerting[].auth_type is required" $config.auth_type ) | b64enc }}
+{{- if eq $config.auth_type "smtp" }}
+  to: {{ ( required ".alerting[].to is required" $config.to ) | b64enc }}
+  from: {{ ( required ".alerting[].from is required" $config.from ) | b64enc }}
+  smarthost: {{ ( required ".alerting[].smarthost is required" $config.smarthost ) | b64enc }}
+  auth_username: {{ ( required ".alerting[].auth_username is required" $config.auth_username ) | b64enc }}
+  auth_identity: {{ ( required ".alerting[].auth_identity is required" $config.auth_identity ) | b64enc }}
+  auth_password: {{ ( required ".alerting[].auth_password is required" $config.auth_password ) | b64enc }}
+{{- end }}
+{{- if eq $config.auth_type "none" }}
+  url: {{ ( required ".alerting[].url is required" $config.url ) | b64enc }}
+{{- end }}
+{{- if eq $config.auth_type "basic" }}
+  url: {{ ( required ".alerting[].url is required" $config.url ) | b64enc }}
+  username: {{ ( required ".alerting[].username is required" $config.username ) | b64enc }}
+  password: {{ ( required ".alerting[].password is required" $config.password ) | b64enc }}
+{{- end }}
+{{- if eq $config.auth_type "certificate" }}
+  url: {{ ( required ".alerting[].url is required" $config.url ) | b64enc }}
+  ca.crt: {{ ( required ".alerting[].ca_crt is required" $config.ca_crt ) | b64enc }}
+  tls.crt: {{ ( required ".alerting[].tls_crt is required" $config.tls_cert ) | b64enc }}
+  tls.key: {{ ( required ".alerting[].tls_key is required" $config.tls_key ) | b64enc }}
+  insecure_skip_verify: {{ ( required ".alerting[].insecure_skip_verify is required" $config.insecure_skip_verify ) | b64enc }}
+{{- end }}
+{{- end }}
+{{- end -}}
 {{- include "gardener.secret-alerting" . }}

charts/gardener/controlplane/charts/application/templates/secret-default-domain.yaml

@@ -1 +1,26 @@
+{{- define "gardener.secret-default-domain" -}}
+{{- range $key, $domain := .Values.global.defaultDomains }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: default-domain-{{ ( required ".defaultDomains[].domain is required" (replace "." "-" $domain.domain) ) }}
+  namespace: garden
+  labels:
+    app: gardener
+    chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
+    release: "{{ $.Release.Name }}"
+    heritage: "{{ $.Release.Service }}"
+    gardener.cloud/role: default-domain
+  annotations:
+    dns.gardener.cloud/provider: {{ ( required ".defaultDomains[].provider is required" $domain.provider ) }}
+    dns.gardener.cloud/domain: {{ ( required ".defaultDomains[].domain is required" $domain.domain ) }}
+    {{- if $domain.zone }}
+    dns.gardener.cloud/zone: {{ $domain.zone }}
+    {{- end }}
+type: Opaque
+data:
+{{ toYaml $domain.credentials | indent 2 }}
+{{- end }}
+{{- end -}}
 {{- include "gardener.secret-default-domain" . }}

charts/gardener/controlplane/charts/application/templates/secret-internal-domain.yaml

@@ -1 +1,24 @@
+{{- define "gardener.secret-internal-domain" -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: internal-domain-{{ ( required ".internalDomain.domain is required" (replace "." "-" .Values.global.internalDomain.domain) ) }}
+  namespace: garden
+  labels:
+    app: gardener
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    gardener.cloud/role: internal-domain
+  annotations:
+    dns.gardener.cloud/provider: {{ ( required ".internalDomain.provider is required" .Values.global.internalDomain.provider ) }}
+    dns.gardener.cloud/domain: {{ ( required ".internalDomain.domain is required" .Values.global.internalDomain.domain ) }}
+    {{- if .Values.global.internalDomain.zone }}
+    dns.gardener.cloud/zone: {{ .Values.global.internalDomain.zone }}
+    {{- end }}
+type: Opaque
+data:
+{{ toYaml .Values.global.internalDomain.credentials | indent 2 }}
+{{- end -}}
 {{- include "gardener.secret-internal-domain" . }}

charts/gardener/controlplane/charts/application/templates/secret-openvpn-diffie-hellman.yaml

@@ -1 +1,19 @@
+{{- define "gardener.secret-openvpn-diffie-hellman" -}}
+{{- if .Values.global.openVPNDiffieHellmanKey }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: openvpn-diffie-hellman-key
+  namespace: garden
+  labels:
+    app: gardener
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    gardener.cloud/role: openvpn-diffie-hellman
+type: Opaque
+data:
+  dh2048.pem: {{ .Values.global.openVPNDiffieHellmanKey | b64enc }}
+{{- end }}
+{{- end -}}
 {{- include "gardener.secret-openvpn-diffie-hellman" . }}

charts/gardener/controlplane/charts/application/templates/validatingwebhook-admission-controller.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.global.admission.enabled }}
-apiVersion: {{ include "webhookadmissionregistration" . }}
+apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: gardener-admission-controller