SeedAuthorizer restricting gardenlet permission in garden cluster

[rfranzke]

With #1601 we have introduced the gardenlet, a component comparable with the kubelet in Kubernetes.

Kubernetes has a dedicated NodeAuthorizer admission plugin which ensures that a kubelet responsible for node X may only touch resources (like Pods, Secrets, etc.) that are related to node X.

In our first introduction of the Gardenlet we haven't implemented such mechanism yet.
Instead, similar to Gardener v0 (where the gardener-controller-manager was bound to the cluster-admin role), the gardenlet gets full administrator privileges in the garden cluster.

Let's follow Kubernetes' approach and implement a SeedAuthorizer admission plugin which ensures that gardenlets only touch resources related to the Seeds they are responsible for.

	Status
✅	completed
🚧	in progress
❔	to be clarified
ℹ️	interesting, but not relevant (yet)
❌	incomplete

Prerequisites:

• ✅ Copy secrets into separate and seed dedicated namespace (see Dynamically refresh configuration secrets in the garden namespace #1725)
• ✅ Transfer Gardener-Admission-Controller into Controller-Runtime handler (see ☂️-Issue for upgrading to k/*@v0.19 and controller-runtime@v0.7 #3109)

To-Dos:

• ✅ Skeleton for "SeedAuthorizer" authorization webhook ➡️ Boilerplate for SeedAuthorizer authorization plugin and SeedRestriction admission plugin #3571
• ✅ Skeleton for "SeedRestriction" admission webhook ➡️ Boilerplate for SeedAuthorizer authorization plugin and SeedRestriction admission plugin #3571
• ✅ Resource Dependency Graph ➡️ Resource Dependency Graph for SeedAuthorizer #3631
• ✅ Functionality for identifying seed identity from a user info ➡️ Seed name identification from user information #3671
• ✅ Adapt gardenlet to properly read global secrets from its seed namespace (see Dynamically refresh configuration secrets in the garden namespace #1725)
• ✅ Implementation for various and involved kinds (CloudProfiles, Shoots, Secrets, etc.).
• ✅ Prevent that a gardenlet can issue a certificate for a seed it is not responsible for

[rfranzke]

/remove lifecycle/rotten

[rfranzke]

/cc @donistz

[rfranzke]

/touch

[rfranzke]

/assign @timuthy @rfranzke
/security
/normal

[timebertt]

Is the envtest for Seed{Authorizer,Restriction} still on your list?

[rfranzke]

No, I think I mentioned this in a Daily meeting some weeks back. I consider the current test coverage is quite good and I would now move to the next topic instead of implementing an envtest (which probably would make the current unit tests mostly obsolete).

[timebertt]

Ok, sounds good. Missed this update :)