Set containerd as default container runtime for k8s>=1.22

[voelzmo]

How to categorize this PR?

/kind api-change

What this PR does / why we need it:
An empty cri.name field for a worker pool means all nodes are configured with docker as the container runtime. When users upgrade their shoots to k8s>=1.22 (or create new ones) the default is changed to containerd. This also means that starting with k8s 1.22 the shoot object will always contain an explicit configuration of the container runtime.

Which issue(s) this PR fixes:
related #4110

Release note:

Shoots created with or updated to Kubernetes version >= 1.22 will get `containerd` as default container runtime. If you upgrade an existing shoot which doesn't specify a `cri.name` property in its worker pools, this will trigger a graceful node rollout and the container runtime is switched from `docker` to `containerd`.

/cc @BeckerMax

[vpnachev]

Just one topic that I think we should discuss.
In the Cloud Profile, each machine version can specify the supporter CRs and CRIs.
Defaulting to containerd for OS name/version that does not support containerd should result in a shoot validation failure later, hence I think the static validation is fine, but wanted to mention this as I might be wrong.

[voelzmo]

In the Cloud Profile, each machine version can specify the supporter CRs and CRIs.
Defaulting to containerd for OS name/version that does not support containerd should result in a shoot validation failure later, hence I think the static validation is fine, but wanted to mention this as I might be wrong.

You're absolutely correct, this is what happens when you (or the defaulting mechanism implemented here) is setting worker.cri.name to containerd, but your cloudprofile doesn't list containerd as supported in the MachineImageVersion you're using:

shoots.core.gardener.cloud "shoot-gcp-contd" is forbidden: [spec.provider.workers[0].cri.name: Unsupported value: "containerd"]

It doesn't quite hint at how to resolve this (use a MachineImageVersion which supports the selected container runtime or switch to one of the supported runtimes of your MachineImageVersion). Maybe we could add a hint to the CloudProfile's MachineImageVersion as the source of "supported runtimes" in the error message, wdyt?

[vpnachev]

Maybe we could add a hint to the CloudProfile's MachineImageVersion as the source of "supported runtimes" in the error message, wdyt?

Yes, this makes sense. The error message can return the list of the supported runtimes for the selected OS/version.

[voelzmo]

The error message can return the list of the supported runtimes for the selected OS/version.

I think this is what the error message already does, for example

shoots.core.gardener.cloud "shoot-gcp-contd" is forbidden: [spec.provider.workers[0].cri.name: Unsupported value: "docker": supported values: "containerd"]

When I first encountered this issue, it was hard for me to understand that this is due to the MachineImageVersion I'm using. Therefore, I was thinking to add something like "Selected machine image gardenlinux version 0.184 supports these values: ["containerd"]", but given that we're constructing the error message with a generic field.NotSupported, I'm not sure if that's possible or even desired. WDYT?

[rfranzke]

/assign @vpnachev

[vpnachev]

/lgtm

Just a small suggestion for the for loop.

[vpnachev]

/lgtm