[ci:component:github.com/gardener/gardener:v1.32.1->v1.33.1]

[gardener-robot-ci-1]

Release Notes:

Creating owner check watchdogs will no longer fail if the `Shoot` field in the `Cluster` resource is nil or the `dnsrecords` CRD is not present.

Fixed a bug that caused owner `DNSRecord` resources to be never reconciled again after they are in an `Error` state.

During the restore phase of control plane migration, the kube-controller-manager deployment will be properly created with 1 replica if the shoot is not hibernated.

Fix bug in gardener fluent-bit-to-loki plugin where `__gardener_multitenant_id__` is removed from a shared label set.

Fixed an issue that was preventing hibernated shoots from being migrated with the following error: `missing information for required secret EtcdEncryptionConfig`

Upgrade prometheus version to v2.30.2

A bug was fixed that caused shoot creations to fail at the `Deploying owner domain DNS record` step.

The Gardener-Controller-Manager now also caches `Secret` objects if the `CachedRuntimeClients` feature gate is enabled.

It is now possible to control the `--service-account-{extend-token-expiration,max-token-expiration}` kube-apiserver flags by configuring `.spec.kubernetes.kubeAPIServer.serviceAccountConfig.{extendTokenExpiration,maxTokenExpiration}` in the `Shoot` resource.

Fixed a deadlock issue in the owner check watchdogs implementation.

Logs can be spread across Shoot control-plane Loki and central Loki base on the Shoot state.

A reserved Loki stream label `__gardener_multitenant_id__` is introduced to specify multiple tenants separated by semicolon.

Adapt the logging integration tests to use the gardener fluent-bit-to-loki plugin version 0.37.1

The health checks executed on the shoot cluster nodes to detect if the cloud-config is up-to-date now skip the nodes that are about to be deleted during node rollout.

gardener-controller-manager does no longer try to update needed ControllerInstallation that is being deleted. Previously gardener-controller-manager was trying to update such ControllerInstallation and the update calls were failing with reason `field is immutable`. With this change gardener-controller-manager properly indicates that it is waiting until the deletion of the needed ControllerInstallation is completed.

`make test-integration` works with bash version 3 now.

Increased the `kube-rback-proxy` and `telegraf` container resources in Loki pod to withstand higher resource usage spikes.

Fix a nil pointer exception during control plane migration restore phase that can happen when the `UseDNSRecords` feature gate is enabled.

Added a missing `sideEffects` field to the ValidatingWebhookConfiguration template in the Gardener control plane helm chart.

Fixes an issue when scraping the gardenlet. Https is now used instead of http.

Add kube-state-metrics metrics to the seed-prometheus

Seed prometheus scrapes itself for meta information

Potential deadlock in gardenlet on sequential ControllerInstallation deletion and creation is now fixed.

The fluent-bit version is upgraded from 1.7.8 to 1.8.7.

The Promtail version is upgraded from 2.1.0 to 2.2.1.

Stop Promtail server which runs on the shoot nodes.

Allows configuration of `MaxGracefulTerminationSeconds` flag on ClusterAutoscaler. This allows end-users to configure maximum graceful termination (drain) seconds beyond which the node is force deleted during scale-down of cluster nodes. The default value is 600 seconds.

kubelet flags which only have an effect when using the `docker` container runtime are no longer set when using `containerd`

`botanist.WaitUntilTunnelConnectionExists` step is now enhanced to do not fail right away when the tunnel connection cannot be established. Instead, the step will retry tunnel connection check until the configured timeout is exceeded.

Extension controller reconciliations will now not be started or aborted if already running if it is detected that the shoot owner has changed compared to the one found in the `owner` DNSRecord resource in the seed cluster.

A bug in the seed bootstrap flow which was failing due to attempts to deploy VPA resource before the VPA CRD to be deployed has been fixed.

[gardener-robot]

@gardener-robot-ci-1 Thank you for your contribution.