admission-openstack: Adapt Secrets webhook to rely on the provider label

[ialidzhikov]

/area robustness
/area cost
/kind enhancement
/platform openstack

What this PR does / why we need it:
This PR:

• Adapts the Secrets webhook to rely on the provider label (similar to admission-gcp: Adapt Secrets webhook to rely on the provider label gardener-extension-provider-gcp#396). With this the Secrets webhook:
  1. no longer intercepts every Secret UPDATE request but only requests for Secrets with label provider.shoot.gardener.cloud/openstack="true"
  2. no longer needs to list Shoots (hence, no longer has a cache for Shoots based on Informers) to understand whether a Secret is in-use by a Shoot from the same provider type ("openstack")
• Adds a new SecretBinding webhook (similar to admission-gcp: Add SecretBinding validator gardener-extension-provider-gcp#428). This is to prevent creating SecretBindings that refer Secret from wrong provider type and hence block update request for this Secret as the admission will fail because the Secret does not contain valid credentials.

Which issue(s) this PR fixes:
Part of gardener/gardener-extension-provider-gcp#143 but for admission-openstack

Special notes for your reviewer:
Unlike admission-{gcp,aws,azure} for admission-openstack we cannot drop the cache for SecretBindings as the Shoot validator has to get the SecretBinding -> then the Secret to fetch the domainName from it - the domainName is later used for validation.

gardener-extension-provider-openstack/pkg/admission/validator/shoot.go

Lines 216 to 236 in 1d8ffd8

	func (s *shoot) getCloudProviderSecretForShoot(ctx context.Context, shoot *core.Shoot) (*corev1.Secret, error) {
	var (
	secretBinding = &gardencorev1beta1.SecretBinding{}
	secretBindingKey = kutil.Key(shoot.Namespace, shoot.Spec.SecretBindingName)
	)
	if err := kutil.LookupObject(ctx, s.client, s.apiReader, secretBindingKey, secretBinding); err != nil {
	return nil, err
	}
	var (
	secret = &corev1.Secret{}
	secretKey = kutil.Key(secretBinding.SecretRef.Namespace, secretBinding.SecretRef.Name)
	)
	// Explicitly use the client.Reader to prevent controller-runtime to start Informer for Secrets
	// under the hood. The latter increases the memory usage of the component.
	if err := s.apiReader.Get(ctx, secretKey, secret); err != nil {
	return nil, err
	}
	return secret, nil
	}

gardener-extension-provider-openstack/pkg/admission/validator/shoot.go

Lines 120 to 122 in 1d8ffd8

	allErrs = append(allErrs, openstackvalidation.ValidateInfrastructureConfigAgainstCloudProfile(nil, valContext.infraConfig, credentials.DomainName, valContext.shoot.Spec.Region, valContext.cloudProfileConfig, infraConfigPath)...)
	allErrs = append(allErrs, openstackvalidation.ValidateControlPlaneConfigAgainstCloudProfile(nil, valContext.cpConfig, credentials.DomainName, valContext.shoot.Spec.Region, valContext.infraConfig.FloatingPoolName, valContext.cloudProfileConfig, cpConfigPath)...)
	allErrs = append(allErrs, s.validateShoot(valContext, credentials)...)

Release note:

This version of admission-openstack requires the SecretBinding provider controller to be enabled - enabled by default for gardener-controller-manager >= 1.42 or can be enabled via the gardener-controller-manager component config.

The Secrets webhook of admission-openstack:
- no longer intercepts every Secret UPDATE request but only requests for Secrets that are associated with a SecretBinding with `provider.type=openstack`.
- no longer needs to list Shoots (hence, no cache for Shoots)

The admission-openstack component introduces a new SecretBinding validator. It validates requests for SecretBindings and checks whether the SecretBinding refers to a valid OpenStack Secret.

[rfranzke]

/lgtm