Gardenlet uses seed-admission-controller in seeds

charts/seed-bootstrap/charts/fluentd-es/templates/fluent-bit-configmap.yaml

@@ -103,7 +103,7 @@ data:
         Name                parser
         Match               kubernetes.etcd*backup-restore*
         Key_Name            log
-        Parser              geacParser
+        Parser              gsacParser
         Reserve_Data        True
 
     [FILTER]

charts/seed-bootstrap/templates/extensions/crd-backupbucket.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: backupbuckets.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-backupentry.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: backupentries.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-controlplane.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: controlplanes.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-dnsentry.yaml

@@ -3,6 +3,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: dnsentries.dns.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   scope: Namespaced
   group: dns.gardener.cloud

charts/seed-bootstrap/templates/extensions/crd-dnsprovider.yaml

@@ -3,6 +3,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: dnsproviders.dns.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: dns.gardener.cloud
   scope: Namespaced

charts/seed-bootstrap/templates/extensions/crd-extension.yaml

@@ -3,6 +3,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: extensions.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-infrastructure.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: infrastructures.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-managedresources.yaml

@@ -3,6 +3,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: managedresources.resources.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: resources.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-network.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: networks.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-operatingsystemconfig.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: operatingsystemconfigs.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/extensions/crd-worker.yaml

@@ -2,6 +2,8 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: workers.extensions.gardener.cloud
+  labels:
+    gardener.cloud/deletion-protected: "true"
 spec:
   group: extensions.gardener.cloud
   versions:

charts/seed-bootstrap/templates/gardener-seed-admission-controller/deployment.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: {{ include "deploymentversion" . }}
+kind: Deployment
+metadata:
+  name: gardener-seed-admission-controller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gardener
+    role: seed-admission-controller
+spec:
+  revisionHistoryLimit: 0
+  replicas: {{ .Values.gardenerSeedAdmissionController.replicas }}
+  selector:
+    matchLabels:
+      app: gardener
+      role: seed-admission-controller
+  template:
+    metadata:
+      labels:
+        app: gardener
+        role: seed-admission-controller
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: labels
+                operator: In
+                values:
+                - gardener
+              - key: role
+                operator: In
+                values:
+                - seed-admission-controller
+            topologyKey: kubernetes.io/hostname
+      containers:
+      - name: gardener-seed-admission-controller
+        image: {{ index .Values.global.images "gardener-seed-admission-controller" }}
+        imagePullPolicy: IfNotPresent
+        command:
+        - /gardener-seed-admission-controller
+        - --port=9443
+        - --tls-cert-path=/srv/gardener-seed-admission-controller/tls.crt
+        - --tls-private-key-path=/srv/gardener-seed-admission-controller/tls.key
+        {{- if .Values.gardenerSeedAdmissionController.resources }}
+        resources:
+{{ toYaml .Values.gardenerSeedAdmissionController.resources | indent 10 }}
+        {{- end }}
+        volumeMounts:
+          - mountPath: /srv/gardener-seed-admission-controller
+            name: gardener-seed-admission-controller-tls
+            readOnly: true
+      serviceAccountName: gardener-seed-admission-controller
+      volumes:
+        - name: gardener-seed-admission-controller-tls
+          secret:
+            secretName: gardener-seed-admission-controller-tls

charts/seed-bootstrap/templates/gardener-seed-admission-controller/poddisruptionbudget.yaml

@@ -0,0 +1,16 @@
+{{- if gt (int .Values.gardenerSeedAdmissionController.replicas) 1 }}
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: gardener-seed-admission-controller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gardener
+    role: seed-admission-controller
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: gardener
+      role: seed-admission-controller
+{{- end }}

charts/seed-bootstrap/templates/gardener-seed-admission-controller/rbac.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: {{ include "rbacversion" . }}
+kind: ClusterRole
+metadata:
+  name: gardener-seed-admission-controller
+  labels:
+    app: gardener
+    role: seed-admission-controller
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - backupbuckets
+  - backupentries
+  - controlplanes
+  - extensions
+  - infrastructures
+  - networks
+  - operatingsystemconfigs
+  - workers
+  verbs:
+  - get
+  - list
+---
+apiVersion: {{ include "rbacversion" . }}
+kind: ClusterRoleBinding
+metadata:
+  name: gardener-seed-admission-controller
+  labels:
+    app: gardener
+    role: seed-admission-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gardener-seed-admission-controller
+subjects:
+- kind: ServiceAccount
+  name: gardener-seed-admission-controller
+  namespace: {{ .Release.Namespace }}

charts/seed-bootstrap/templates/gardener-seed-admission-controller/secret.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gardener-seed-admission-controller-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gardener
+    role: seed-admission-controller
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwekNDQXJ1Z0F3SUJBZ0lVYURNcnF4MFZSb09tR0hNMWFmZFp0MzllMnRNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZURVRNQkVHQTFVRUF4TUthM1ZpWlhKdVpYUmxjekFlRncweU1EQXpNVFl4T0RFNE1EQmFGdzB6TURBegpNVFF4T0RFNE1EQmFNQzB4S3pBcEJnTlZCQU1USW1kaGNtUmxibVZ5TFhObFpXUXRZV1J0YVhOemFXOXVMV052CmJuUnliMnhzWlhJd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURGcUZPUkxLMFAKK2gySnhoeXFDSzg1MHl2aUYwZkJ5UnFmZnBIZmFSeWZrR3QzM1ZyRlhldWhHTCtzdVRpY2ZoelpTV01Wb2prLwo5UjNSOEZrSzAyRW1xNTQ0bzlZWTVIby9GR3dsRTlzMWw0NTZkVzRGN29ibHZ3N2RnY1JGZE82TjRoL3hyVmFiCjVxZE5PUm54UklaVEozcXoxWmpnY3NPd2p5ekp3eU85UGlkbEc2TVcwcXFYOUFiK2c4UHgwZVNQMnpCaHFjTFYKNnVHeTRnWWMyK1JpWGZLZ1lDc091K0h1TmI0REZWZWRpTTgySjBaWXpjaE1lNVVxcCtQWWlCSUFIMFhxcXozNgpHVzlyYjVPNDNWNVIxSFNWRGlvRnJJMEVreldZTEZHeG9sKzRUUlROQTRzalBYakFKRlNYRHI2Z3k2bU5ZcWVJCjZEYlRoaERQTVB3dEFnTUJBQUdqZ2dFQk1JSCtNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUsKQmdnckJnRUZCUWNEQVRBTUJnTlZIUk1CQWY4RUFqQUFNQjBHQTFVZERnUVdCQlFmLzhZMjN4UWNvSDhFWW5XaAp5TEdaMzFCazREQWZCZ05WSFNNRUdEQVdnQlNGQTNMdkpNMjFkOHFzWlZWQ2U2UnJUVDl3aVRDQmlBWURWUjBSCkJJR0FNSDZDSW1kaGNtUmxibVZ5TFhObFpXUXRZV1J0YVhOemFXOXVMV052Ym5SeWIyeHNaWEtDS1dkaGNtUmwKYm1WeUxYTmxaV1F0WVdSdGFYTnphVzl1TFdOdmJuUnliMnhzWlhJdVoyRnlaR1Z1Z2kxbllYSmtaVzVsY2kxegpaV1ZrTFdGa2JXbHpjMmx2YmkxamIyNTBjbTlzYkdWeUxtZGhjbVJsYmk1emRtTXdEUVlKS29aSWh2Y05BUUVMCkJRQURnZ0VCQUxFc254K1pjdjNJTUUvWHM4MngwUEF4RHVJRlY0Wm5HUGJ3ZUNaNUpLS2xBdEh0cnEySlRZb1EKekhiR1RqMklFcHpkcTA0UnlScVkwZWpEMjVIV2VWSGNBbGhTTEd2S0t1dU16bklsNmU0Ry9LZm1nME5Md2lNSwo3anNTanBOZEhuSk9zUGczajNpYmxQMFpTWThBNXAxMnVxTXpmdktQTkZLNjJFdXlxbUVmSTllYzZQNndOQWNaClIzRWp1bTh5Q2NPQ1psT2N6T0gvOFpJZElDMWpsRlltNFd3em0xdVVnb1NrMjQwbnFodUJpcldxQVJqSk5oZnUKLzBIRG15NlpzLzJGbFJOSVd1c2twTklnT3RNYTNBMjc3cXgyTzU0MitVaEt2MmphSVh0WDFCblJMVENGVnlEWgpnajU1OTNBSllEajhRRkh1bEZlTWVoNWJhT2trc2pjPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeGFoVGtTeXREL29kaWNZY3FnaXZPZE1yNGhkSHdja2FuMzZSMzJrY241QnJkOTFhCnhWM3JvUmkvckxrNG5INGMyVWxqRmFJNVAvVWQwZkJaQ3ROaEpxdWVPS1BXR09SNlB4UnNKUlBiTlplT2VuVnUKQmU2RzViOE8zWUhFUlhUdWplSWY4YTFXbSthblRUa1o4VVNHVXlkNnM5V1k0SExEc0k4c3ljTWp2VDRuWlJ1agpGdEtxbC9RRy9vUEQ4ZEhrajlzd1lhbkMxZXJoc3VJR0hOdmtZbDN5b0dBckRydmg3alcrQXhWWG5ZalBOaWRHCldNM0lUSHVWS3FmajJJZ1NBQjlGNnFzOStobHZhMitUdU4xZVVkUjBsUTRxQmF5TkJKTTFtQ3hSc2FKZnVFMFUKelFPTEl6MTR3Q1JVbHc2K29NdXBqV0tuaU9nMjA0WVF6ekQ4TFFJREFRQUJBb0lCQUZmVXZwMnFIcFVVN1g5RgpXNE5yTElJamhrS0hXY21RMVpXK0pwQUNJMGY4WXVUMnBkbENMT3gvRk4xcHlQQXhVaHh6OGVXeEdvT0RKbWNkCnlGTjVMcGlDZG1KdzJ6aGdmcm45RnprNm81UWk3cHNZQjNYM1VsWlJHZ2Z3SEFsSk5xQXh0VVF0WkdrT2k1VlQKSkdZRHJ6VFFQRVFoVERlZ2g3aXpScEc1ZHU0bUlYcWtybXpUV0l3UHpuTFJtQXBzMGZKUXVROVdJVVAwaUpTdApDTUxaMDg5OEdBTmNkRGJFOFRhM2VtUGUzY2dKamRVVHlIM3pNc25KVDAxNE4wenpYK2U1YVhjZnhDd0FhTitUCmZHTGFRZTFQVjcxNFNJaHVEbytLQlNKbzBLMHBvVUE4ZDVsTkllZXRsOFdEMGNwQUtqQnpwZjNDdkY3OGNUM2kKYy9acnhJRUNnWUVBekJuRG9zWXh1S0lrOGlWVGUrZVRSUndac2k3c3ZhTVRubWxjYzYvM3E1dkxiM2kxejVWOQpuL0NFUDVabHZpa2hOQi9EdDNXWG1ncHJIelFOMmxqbklKbjJLSGtSMGdXZTU3YUNiWXRHeE9DaWp2c1pHVW9KCkYyaU9MZlRIQnNueGlOUDN1empzdWNlQ3VpU0Q4N2UwYlZCSm9uNG96Nlk3ZUY2a3pLUkdGbjBDZ1lFQTkrc2oKVVl0akdaZnNFWUNodFRPYkMwU0xYYXdrekFHVWdKVU4xTkFoMnc1bzlHcjYxSXR0K1N3d2hxUUZRaFh5VzUwZAorYnNjazNKazZVNkhrZStoOUlUVUIzSG5xZzNLVzlMOHNQWVBxQ0JUNkVRL3FaUG1XT0tqWlR5aVNqTzFrS3g2CithUE00TktadHR6Sk9jVndRVTltMTlkdk0zeHFVZlhGUGtDdmUzRUNnWUFIRmNIZnphZCtORXE2Q1NlcnZtOHoKVC9Wb1pRNmN5cU5zdFZXYlFubURnSVlBV1oxZUZsOWxCUEZpVDdNNmRhME1aU25qSFhia3h3WE84SHltbnIxdgpPVWo5UUs2b3JyOUVaZWFETFBtSTdnOVdqVXJpd05vdDhOZzJxaSthZ2JvYnVOZjVyTkV5NWNVWTl4bUpoVkFECkYyMW04YUF6RFI4MVgzdXpDdVRQOVFLQmdRQ3U5emZaMlBGN29vaHNZY2UrUmtscHpsbzlKYnhpYmNzTVpDVjYKeDlqYzdIS043T0pSRm9YcWtKRSt0SXN4ZEtPeW5GUUhaMUpualJoQ3Y3VlYvVFRqaU1ySzVreUU2MjZoRjJwVwp5WkdMS2lXTmluMFRoTm5RYVVLL3MrY2xUeEVZcFdHMHhURldpY3NLRHcvRXdkN1RlT0l2K2s3MG14Mjk4aUhlCktYQ3ZRUUtCZ0dkSTNiWjF4eEtNV0RlVTVRYW1EYU9rSGVabDJTYWNFUStDMDkvTzk3NUhMZkUwNStnc1BZREUKK1lOZzA2b1FsTy9VOXRtT3Z5R1grQ2E2eUxGL1hRTXE2Mm9ObHAxYTBvcW5XbFFudjU3cmdLckdYY3YyKzZzUApMaEFmYndEUi9OTmlpbVppb1BlSkVHUG9jVXEyMU9MNVJGamoyU3o1bDROWWs2TW1leWZ6Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

charts/seed-bootstrap/templates/gardener-seed-admission-controller/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gardener-seed-admission-controller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gardener
+    role: seed-admission-controller
+spec:
+  type: ClusterIP
+  selector:
+    app: gardener
+    role: seed-admission-controller
+  ports:
+  - name: web
+    port: 443
+    protocol: TCP
+    targetPort: 9443

charts/seed-bootstrap/templates/gardener-seed-admission-controller/serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gardener-seed-admission-controller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gardener
+    role: seed-admission-controller

charts/seed-bootstrap/templates/gardener-seed-admission-controller/validatingwebhookconfiguration.yaml

@@ -0,0 +1,47 @@
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: gardener-seed-admission-controller
+  labels:
+    app: gardener
+    role: seed-admission-controller
+webhooks:
+  - name: seed.admission.core.gardener.cloud
+    rules:
+    - apiGroups:
+      - apiextensions.k8s.io
+      apiVersions:
+      - v1beta1
+      - v1
+      operations:
+      - DELETE
+      resources:
+      - customresourcedefinitions
+    - apiGroups:
+      - extensions.gardener.cloud
+      apiVersions:
+      - v1alpha1
+      operations:
+      - DELETE
+      resources:
+      - backupbuckets
+      - backupentries
+      - controlplanes
+      - extensions
+      - infrastructures
+      - networks
+      - operatingsystemconfigs
+      - workers
+    failurePolicy: Fail
+    {{- if semverCompare ">= 1.15-0" .Capabilities.KubeVersion.GitVersion -}}
+    objectSelector:
+      matchLabels:
+        gardener.cloud/deletion-protected: "true"
+    {{- end -}}
+    namespaceSelector: {}
+    clientConfig:
+      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMrakNDQWVLZ0F3SUJBZ0lVVHAzWHZocldPVk04WkdlODZZb1hNVi9VSjdBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZURVRNQkVHQTFVRUF4TUthM1ZpWlhKdVpYUmxjekFlRncweE9UQXlNamN4TlRNME1EQmFGdzB5TkRBeQpNall4TlRNME1EQmFNQlV4RXpBUkJnTlZCQU1UQ210MVltVnlibVYwWlhNd2dnRWlNQTBHQ1NxR1NJYjNEUUVCCkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDeWkwUUdPY3YyYlRmM044T0xOOTdSd3NnSDZRQXI4d1NwQU9ydHRCSmcKRm5mblUyVDFSSGd4bTdxZDE5MFdMOERDaHYwZFpmNzZkNmVTUTRacmpqeUFyVHp1ZmI0RHRQd2crVldxN1h2RgpCTnluKzJoZjRTeVNrd2Q2azdYTGhVVFJ4MDQ4SWJCeUM0ditGRXZtb0xBd3JjMGQwRzE0ZWM2c25EKzdqTzdlCmt5a1EvTmdBT0w3UDZrRHM5ejYrYk9mZ0YwbkdOK2JtZVdRcUplalIwdCtPeVFEQ3g1L0ZNdFVmRVZSNVFYODAKYWVlZmdwM0pGWmI2ZkF3OUtoTHRkUlYzRlAwdHo2aFMrZTRTZzBtd0FBT3FpalpzVjg3a1A1R1l6anRjZkExMgpsRFlsL25iMUd0VnZ2a1FENDlWblY3bURubDZtRzNMQ01OQ05INldsWk52M0FnTUJBQUdqUWpCQU1BNEdBMVVkCkR3RUIvd1FFQXdJQkJqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU0ZBM0x2Sk0yMWQ4cXMKWlZWQ2U2UnJUVDl3aVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQW5zL0VKM3lLc2p0SVNvdGVRNzE0cjJVbQpCTVB5VVlUVGRSSEQ4TFpNZDNSeWt2c2FjRjJsMnk4OE56NndKY0F1b1VqMWg4YUJEUDVvWFZ0Tm1GVDlqeWJTClRYclJ2V2krYWVZZGI1NTZuRUE1L2E5NGUrY2IrQ2szcXkvMXhnUW9TNDU3QVpRT0Rpc0RaTkJZV2tBRnMyTGMKdWNwY0F0WEp0SXRoVm03RmpvQUhZY3NyWTA0eUFpWUVKTEQwMlRqVURYZzRpR09HTWtWSGRtaGF3QkRCRjNBagplc2ZjcUZ3amk2SnlBS0ZSQUNQb3d5a1FPTkZ3VVNvbTg5dVlFU1NDSkZ2TkNrOU1KbWpKMlB6RFV0NkN5cFI0CmVwRmRkMWZYTHd1d243ZnZQTW1KcUQzSHRMYWxYMUFabVBrK0JJOGV6ZkFpVmNWcW5USlFNWGxZUHBZZTlBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+      service:
+        name: gardener-seed-admission-controller
+        namespace: garden
+        path: /webhooks/validate-extension-crd-deletion

charts/seed-bootstrap/templates/gardener-seed-admission-controller/vpa.yaml

@@ -0,0 +1,15 @@
+apiVersion: "autoscaling.k8s.io/v1beta2"
+kind: VerticalPodAutoscaler
+metadata:
+  name: gardener-seed-admission-controller-vpa
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: gardener
+    role: seed-admission-controller
+spec:
+  targetRef:
+    apiVersion: {{ include "deploymentversion" . }}
+    kind: Deployment
+    name: gardener-seed-admission-controller
+  updatePolicy:
+    updateMode: "Auto"

charts/seed-bootstrap/values.yaml

@@ -154,6 +154,7 @@ global:
     elasticsearch-searchguard-oss: image-repository:image-tag
     fluentd-es: image-repository:image-tag
     gardener-resource-manager: image-repository:image-tag
+    gardener-seed-admission-controller: image-repository:image-tag
     grafana: image-repository:image-tag
     kibana-oss: image-repository:image-tag
     pause-container: image-repository:image-tag
@@ -206,3 +207,13 @@ gardenerResourceManager:
   healthSyncPeriod: 1m0s
   concurrentSyncs: 20
   podAnnotations: {}
+
+gardenerSeedAdmissionController:
+  resources:
+    requests:
+      cpu: 20m
+      memory: 50Mi
+    limits:
+      cpu: 100m
+      memory: 100Mi
+  replicas: 3

docs/README.md

@@ -11,6 +11,7 @@
 * [Gardener API server](concepts/apiserver.md)
 * [Gardener Scheduler](concepts/scheduler.md)
 * [Gardenlet](concepts/gardenlet.md)
+* [Gardener Seed Admission Controller](concepts/seed-admission-controller.md)
 
 ## Usage
 

docs/concepts/seed-admission-controller.md

@@ -0,0 +1,22 @@
+# Gardener Seed Admission Controller
+
+The Gardener Seed admission controller is deployed by the Gardenlet as part of its seed bootstrapping phase and, consequently, running in every seed cluster.
+It's main purpose is to serve webhooks (validating or mutating) in order to admit or deny certain requests to the seed's API server. 
+
+## What is it doing concretely?
+
+### Validating Webhooks
+
+#### Unconfirmed Deletion Prevention
+As part of Gardener's [extensibility concepts](../extensions/overview.md) a lot of `CustomResourceDefinition`s are deployed to the seed clusters that serve as extension points for provider-specific controllers.
+For example, the [`Infrastructure` CRD](../extensions/infrastructure.md) triggers the provider extension to prepare the IaaS infrastructure of the underlying cloud provider for a to-be-created shoot cluster.
+Consequently, these extension CRDs have a lot of power and control large portions of the end-user's shoot cluster.
+Accidental or undesired deletions of those resource can cause tremendous and hard-to-recover-from outages and should be prevented.
+
+Together with the deployment of the Gardener seed admission controller a `ValidatingWebhookConfiguration` for `CustomResourceDefintions` and most (custom) resources in the `extensions.gardener.cloud/v1alpha1` API group is registered.
+It prevents `DELETE` requests for those `CustomResourceDefinitions` labeled with `gardener.cloud/deletion-protected=true`, and for all mentioned custom resources if they were not previously annotated with the `confirmation.gardener.cloud/deletion=true`.
+This prevents that undesired `kubectl delete <...>` requests are accepted.
+
+### Mutating Webhooks
+
+It doesn't serve any mutating webhooks yet.