Protect Service Accounts Against Deletion/Remedy Deletions

[gardener-robot-ci-1]

By @vlerenc: Customers may break their own clusters by deleting service accounts, which were created by the API server. Without an API server restart, these service accounts won't come back, so we either need to monitor them and either recreate them (without duplicating what the API server is doing) or restart the API server when we see somebody tampered with them.

[mvladev]

@vlerenc which ServiceAccounts are you referring to? Every service account created by the kube-addon-manager will be recreated automatically.

[vlerenc]

The ones I wrote above: the ones created by the API server implicitly (not by the addon-manager).

[rfranzke]

We have seen a case where a user deleted the standard/default APIService resources. This is related to this issue (cc @ialidzhikov) - there are resources managed by the Kubernetes components that are worth to be protected.
Though, to me it's not clear how we could implement this if we don't want to "hard-code" the resources that shall be protected.

[rfranzke]

/close as there are a thousand ways to break the cluster and we cannot provide remediation for each of them. Given that the issue is open since a very long time with no attention and no activity, it's unlikely that it'll be picked up anytime soon.