[ci:component:github.com/gardener/gardener-extension-provider-openstack:v1.32.1->v1.33.0]

[gardener-robot-ci-1]

Release Notes:

Optional CSI Manila driver deployment to support NFS persistent volumes out-of-the-box.

Adapted extension components to support the [FullNetworkPoliciesInRuntimeCluster](https://github.com/gardener/gardener/blob/master/docs/deployment/feature_gates.md#list-of-feature-gates) feature gate introduced by `gardener/gardener` v1.66, see [here](https://github.com/gardener/gardener/blob/master/docs/concepts/resource-manager.md#networkpolicy-controller) and [#7352](https://github.com/gardener/gardener/pull/7589) for more information.

Add machine labels to the `ProviderConfig` of a worker pool to support rolling of its machines on label changes.

Add support for user-provided `NodeTemplate`s

`csi-driver-node` is annotated with the `wait-for-csi-node` annotation. Gardener uses this to only schedule workload pods to a `Node` once the driver has been successfully registered with the `CSINode` object.

Update TF_VERSION `0.15.5` -> `1.3.9` and update how the local providers are fetched and stored to be compatible with the latest TF specification.

The `csi-snapshot-validation` Service deployed by the provider-openstack extension can now be topology-aware (depending on the Seed setting and the Shoot HA failure tolerance type). For more details, see the [Topology-aware Traffic Routing documentation](https://github.com/gardener/gardener/blob/v1.66.0/docs/usage/topology_aware_routing.md).

The stale healthcheck conditions from the extension are now properly cleaned up.

Switched images from DockerHub to copies in Gardener GCR

provider-openstack does no longer use Gardener GCR copies for `openstack-cloud-controller-manager` and `cinder-csi-plugin` in versions 1.24, 1.25 and 1.26. Instead, the upstream GCR container images are used (`registry.k8s.io/provider-os/openstack-cloud-controller-manager` and `registry.k8s.io/provider-os/cinder-csi-plugin`).

The following images are updated:
- registry.k8s.io/provider-os/cinder-csi-plugin: v1.24.5 -> v1.24.6 (for Kubernetes 1.24 Shoots)
- registry.k8s.io/provider-os/cinder-csi-plugin: v1.25.3 -> v1.25.5 (for Kubernetes 1.25 Shoots)
- registry.k8s.io/provider-os/cinder-csi-plugin: v1.26.0 -> v1.26.2 (for Kubernetes 1.26 Shoots)

Cloud-controller-manager Loadbalancer configuration has been updated: `monitorDelay: 60s -> 20s`, `monitorMaxRetries: 5 -> 2`

An edge case where all the machineSets were scaled down to zero has been dealt with.

An issue has been fixed which caused undesired `PATCH` requests when updating the state in the `Worker` or `ShootState` resources.

The `gardener-extension-admission-openstack` Service in the `gardener-extension-admission-openstack` chart can now be configured to be topology-aware.

Adapt worker node hash calculation. Shoots that are currently using the server group feature will be rolled out. You can prevent the rollout if the shoot is annotated with `openstack.provider.extensions.gardener.cloud/worker-preserve-hash`.

An issue causing provider-openstack to wrongly delete the `extensions.gardener.cloud:provider-openstack:csi-snapshot-validation` ClusterRole and ClusterRoleBinding from the Seed cluster on every Shoot deletion is now fixed.

[gardener-robot]

@gardener-robot-ci-1 Thank you for your contribution.