Adapt gardenlet to take over management of `machine-controller-mana…

…ger` deployment (gardener#8018)

* Add new feature gate to `gardenlet`

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* Prepare extensions library for MCM management changes

- added a `--gardenlet-manages-mcm` flag to `GeneralOptions` which can be used in extensions
- added a new `mcmManaged` bool value to generic `Worker` actuator (not yet used; will follow in subsequent commits)
- added new `EnsureMachineControllerManager{Deployment,VPA}` methods to the generic `ControlPlane` ensurer (must be implemented by extensions; will follow in subsequent commits)

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* Adapt generic `Worker` actuator

- For existing clusters, we must ensure that the old `ManagedResource` containing the RBAC privileges for MCM gets deleted in case `gardenlet` manages MCM. `gardenlet` deploys its own `ManagedResource` for these permissions.
- After the `Worker` restoration but before the `Worker` reconciliation, we have to make sure MCM gets scaled up. `gardenlet` is not aware of when the restoration is finished, so it has no control over it.

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* Provide utility functions for MCM webhook injections

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* `gardenlet`'s `Seed` controller deploys MCM resources

Similar to the CA, these contain a `ClusterRole` with the needed permission for MCM

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* Initialize MCM component on `Shoot` object in botanist

Replica count determination logic copied from https://github.com/gardener/gardener/blob/master/extensions/pkg/controller/worker/genericactuator/actuator_reconcile.go#L64-L82

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* `gardenlet`'s `Shoot` controller manages MCM

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* `gardenlet`'s `Shoot` controller deploys MCM dashboard for Plutono

Dashboard copied from https://github.com/gardener/gardener/blob/master/charts/gardener/provider-local/internal/machine-controller-manager/seed/mcm-monitoring-dashboard.json

Co-Authored-By: Jens Schneider <schneider@23technologies.cloud>
Co-Authored-By: mreiger <michael@rauschpfeife.net>

* Adapt documentation

* Address PR review feedback

---------

Co-authored-by: Jens Schneider <schneider@23technologies.cloud>
Co-authored-by: mreiger <michael@rauschpfeife.net>

charts/gardener/gardenlet/templates/clusterrole-gardenlet.yaml

@@ -435,3 +435,11 @@ rules:
   - envoyfilters
   verbs:
   - delete
+- apiGroups:
+  - machine.sapcloud.io
+  resources:
+  - machinedeployments
+  verbs:
+  - list
+  - watch
+  - get

charts/images.yaml

@@ -122,6 +122,19 @@ images:
 - name: kube-proxy
   sourceRepository: github.com/kubernetes/kubernetes
   repository: registry.k8s.io/kube-proxy
+- name: machine-controller-manager
+  sourceRepository: github.com/gardener/machine-controller-manager
+  repository: eu.gcr.io/gardener-project/gardener/machine-controller-manager
+  tag: "v0.49.2"
+  labels:
+  - name: gardener.cloud/cve-categorisation
+    value:
+      network_exposure: protected
+      authentication_enforced: false
+      user_interaction: gardener-operator
+      confidentiality_requirement: high
+      integrity_requirement: high
+      availability_requirement: low
 - name: cluster-autoscaler
   sourceRepository: github.com/gardener/autoscaler
   repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler