[ci:component:github.com/gardener/gardener-extension-provider-gcp:v1.20.0->v1.21.3]

[gardener-robot-ci-3]

Release Notes:

An issue preventing load balancers from being functional for K8s 1.23 clusters has been fixed.

typo stopping scaleDown disabling during cluster rollout is fixed

An issue has been fixed with the `csi-driver-node` PodSecurityPolicy which blocked the creation of new CSI-Driver pods because `projected` volumes are not permitted.

The CPU limit of `csi-driver-node/csi-driver` is increased from 50m to 100m to allow bigger bursts.

The validation of the Worker's `.providerConfig.serviceAccount.email` is no longer omitted and the field cannot be empty or invalid.

The following dependency is updated:
- github.com/gardener/gardener: v1.39.0 -> v1.39.4

The GCP extension does now support shoot clusters with Kubernetes version 1.23. You should consider the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md) before upgrading to 1.23.

This extension does now support `gardener/gardener`'s `WorkerPoolKubernetesVersion` feature gate, i.e., having [worker pools with overridden Kubernetes versions](https://github.com/gardener/gardener/blob/8a9c88866ec5fce59b5acf57d4227eeeb73669d7/example/90-shoot.yaml#L69-L70).

In case `gardener/gardener`'s `WorkerPoolKubernetesVersion` feature gate is enabled, it's possible having [worker pools with overridden Kubernetes versions](https://github.com/gardener/gardener/blob/8a9c88866ec5fce59b5acf57d4227eeeb73669d7/example/90-shoot.yaml#L69-L70) for `Shoot`s whose `.spec.kubernetes.version` is greater or equal than the CSI migration version (`1.18`).

`gardener-extension-admission-gcp` now supports configuration for enabling service account token volume projection. It is exposed through the `.Values.global.serviceAccountTokenVolumeProjection` section in the respective chart's values.

It is now possible to configure a `user` instead of a `serviceaccount` subject in the `clusterrolebinding` for the `gardener-extension-admission-gcp` when using virtual garden setup by setting `.Values.global.virtualGarden.user.name`.

The following terraform provider plugin is updated:
- `aliyun/terraform-provider-alicloud`: `1.124.2` -> `1.149.0`

The following terraform provider plugins are updated:
- hashicorp/terraform-provider-aws: 3.63.0 -> 3.66.0

terraform has been upgraded to 0.14.11

orphan collection is also triggered if machine obj is updated with having multiple backing VMs

Updated golang version to v1.17

The default leader election resource lock of `machine-controller-manager` has been changed from `endpoints` to `endpointsleases`.

Components that deploy the `machine-controller-manager` will now have to adapt the RBAC rules to allow `machine-controller-manager` to maintain its leader election resource lock in `leases` as well.

The following images are updated:
- gcr.io/gke-release/gcp-compute-persistent-disk-csi-driver v1.0.1-gke.0 -> v1.3.4-gke.0

The extension controller uses a projected `ServiceAccount` token in case it runs on a seed with a gardenlet of at least `v1.37` or higher. Similarly, the components deployed into shoot namespaces will no longer use a client certificate but an auto-rotated `ServiceAccount` token which is only valid for `12h`.

`k8s.io/legacy-cloud-providers` is now updated to `v1.23.2`.

The alpine version has been updated to `v3.13.7`.

`k8s.io/legacy-cloud-providers` is now updated to `v0.22.6`.

`k8s.io/legacy-cloud-providers` is now updated to `v0.21.9`.

`k8s.io/legacy-cloud-providers` is now updated to `v0.20.15`.

[gardener-robot]

@gardener-robot-ci-3 Thank you for your contribution.