[controller-manager] Switch remaining Project controllers to controller-runtime

[rfranzke]

How to categorize this PR?

/area dev-productivity scalability
/kind enhancement

What this PR does / why we need it:
Refactor the remaining Project controller to controller-runtime. The main reconciler was already refactored as part of #6645.

Which issue(s) this PR fixes:
Part of #4251

Special notes for your reviewer:
Generally, we want to follow this cookbook while refactoring existing controllers:

1. Add documentation
2. Add integration test based on envtest
3. Switch controller to controller-runtime

I successfully stress-tested both new integration tests against an existing Gardener system.

Release note:

NONE

[rfranzke]

@rfranzke: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-gardener-check-vulnerabilities 2dcf326 link false /test pull-gardener-check-vulnerabilities
pull-gardener-e2e-kind 2dcf326 link true /test pull-gardener-e2e-kind
Full PR test history. Your PR dashboard. Command help for this repository. Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see our testing guideline for how to avoid and hunt flakes.

Opened #6669

/test pull-gardener-e2e-kind

[shafeeqes]

/assign

[shafeeqes]

Very nice PR!
Few nits.

[shafeeqes]

Thanks!
/lgtm

[rfranzke]

/approve

[gardener-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rfranzke

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rfranzke]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gardener-prow]

@rfranzke: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-gardener-check-vulnerabilities	3c3ad53	link	false	/test pull-gardener-check-vulnerabilities

Full PR test history. Your PR dashboard. Command help for this repository.
Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see our testing guideline for how to avoid and hunt flakes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[rfranzke]

/test pull-gardener-integration

ref #6679 (comment)

[shafeeqes]

Previously, it was like this,

gardener/pkg/controllermanager/controller/project/project_activity_control.go

Lines 103 to 123 in 958fec3

	func (c *Controller) projectActivityObjectUpdate(ctx context.Context, oldObj, newObj interface{}, withLabel bool) {
	oldObjMeta, err := meta.Accessor(oldObj)
	if err != nil {
	return
	}
	newObjMeta, err := meta.Accessor(newObj)
	if err != nil {
	return
	}
	if withLabel {
	// skip queueing if the object(secret or quota) doesn't have the "referred by a secretbinding" label
	_, oldObjHasLabel := oldObjMeta.GetLabels()[v1beta1constants.LabelSecretBindingReference]
	_, newObjHasLabel := newObjMeta.GetLabels()[v1beta1constants.LabelSecretBindingReference]
	if !oldObjHasLabel && !newObjHasLabel {
	return
	}
	} else if oldObjMeta.GetGeneration() == newObjMeta.GetGeneration() {
	return
	}

which is not the case now.
On simple words, we were acting if either of the object has the label. If the new doesn't have the label and the old had, which means the deletion of the last secretbinding referring this secret. Don't we want to consider this as "activity"?
If not, then we should only consider the newObject. The first time the secret is "referred" the oldObject won't have label, but we want to consider this as activity too.

[rfranzke]

I don't remember to have changed this on purpose, so probably it was a mistake. @shafeeqes can you open a PR to fix it and preserve the old behaviour?

[shafeeqes]

Sure, but should we consider the deletion of the last secretbinding (which can be in a different namespace) as an activity?

[rfranzke]

Yes, let's consider it as activity 👍🏻

[shafeeqes]

Okay, then I'll go ahead.