Allow enabling/disabling anonymous auth for the kapi server

[dimityrmirchev]

How to categorize this PR?

/area control-plane
/area security
/kind enhancement

What this PR does / why we need it:
This PR adds the ability for a cluster admin to explicitly set the --anonymous-auth flag via the apiserver configuration. The default value will remain false. This change is needed because most of the OIDC metadata discovery clients do not support authentication as they expect unprotected access to the endpoint https://{kube-apiserver-hostname}/.well-known/openid-configuration.

Which issue(s) this PR fixes:
Fixes #4063

Special notes for your reviewer:
More information about the flag can be read here.

Release note:

It is now possible to enable anonymous authentication on the kube-apiserver for shoots by setting `.spec.kubernetes.kubeAPIServer.enableAnonymousAuthentication=true`. Anonymous authentication will be disabled by default.

[dimityrmirchev]

/assign @mvladev

[vpnachev]

Thanks.

[rfranzke]

Please extend

gardener/example/90-shoot.yaml

Lines 130 to 172 in 28234df

	# kubeAPIServer:
	# featureGates:
	# SomeKubernetesFeature: true
	# runtimeConfig:
	# scheduling.k8s.io/v1alpha1: true
	# oidcConfig:
	# caBundle: |
	# -----BEGIN CERTIFICATE-----
	# Li4u
	# -----END CERTIFICATE-----
	# clientID: client-id
	# groupsClaim: groups-claim
	# groupsPrefix: groups-prefix
	# issuerURL: https://identity.example.com
	# usernameClaim: username-claim
	# usernamePrefix: username-prefix
	# signingAlgs:
	# - RS256
	# - some-other-algorithm
	# requiredClaims:
	# key: value
	# admissionPlugins:
	# - name: PodNodeSelector
	# config:
	# podNodeSelectorPluginConfig:
	# clusterDefaultNodeSelector: <node-selectors-labels>
	# namespace1: <node-selectors-labels>
	# namespace2: <node-selectors-labels>
	# auditConfig:
	# auditPolicy:
	# configMapRef:
	# name: auditpolicy
	# watchCacheSizes: # See: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
	# default: 100
	# resources:
	# - resource: secrets
	# size: 500
	# - apiGroup: apps
	# resource: deployments
	# size: 500
	# requests:
	# maxNonMutatingInflight: 400
	# maxMutatingInflight: 200

[dimityrmirchev]

Please extend

gardener/example/90-shoot.yaml

Lines 130 to 172 in 28234df

	# kubeAPIServer:
	# featureGates:
	# SomeKubernetesFeature: true
	# runtimeConfig:
	# scheduling.k8s.io/v1alpha1: true
	# oidcConfig:
	# caBundle: |
	# -----BEGIN CERTIFICATE-----
	# Li4u
	# -----END CERTIFICATE-----
	# clientID: client-id
	# groupsClaim: groups-claim
	# groupsPrefix: groups-prefix
	# issuerURL: https://identity.example.com
	# usernameClaim: username-claim
	# usernamePrefix: username-prefix
	# signingAlgs:
	# - RS256
	# - some-other-algorithm
	# requiredClaims:
	# key: value
	# admissionPlugins:
	# - name: PodNodeSelector
	# config:
	# podNodeSelectorPluginConfig:
	# clusterDefaultNodeSelector: <node-selectors-labels>
	# namespace1: <node-selectors-labels>
	# namespace2: <node-selectors-labels>
	# auditConfig:
	# auditPolicy:
	# configMapRef:
	# name: auditpolicy
	# watchCacheSizes: # See: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
	# default: 100
	# resources:
	# - resource: secrets
	# size: 500
	# - apiGroup: apps
	# resource: deployments
	# size: 500
	# requests:
	# maxNonMutatingInflight: 400
	# maxMutatingInflight: 200

Done.

[dimityrmirchev]

/reviewed ok-to-test

[rfranzke]

/rebase

[rfranzke]

looks good, can you please provide a release note?

[rfranzke]

/lgtm

[gardener-robot]

@dimityrmirchev You need rebase this pull request with latest master branch. Please check.

[vpnachev]

/lgtm