Run gardenlet as nonroot user and group 65532

[AleksandarSavchev]

How to categorize this PR?

/area security quality
/kind bug enhancement

What this PR does / why we need it:
With #9640 kubelet validates that gardenlet runs with non-root user. This checks requires the uid to be set (ref). This PR sets nonroot user and group 65532 for the kubelet for consistency with the control plane components (ref) and to pass the kubelet validation.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

The `gardenlet` now runs as `nonroot` user and group `65532`.

[rfranzke]

Can you explain why this worked in the e2e tests previously?

[ialidzhikov]

Can you explain why this worked in the e2e tests previously?

I assume skaffold does not use the Dockerfile at all (?). Maybe someone more familiar with skaffold can confirm this.

For example skaffold is not using the distroless base images we define in Dockerfile but it is using its own chainguard image. Logs from make gardener-up:

 - europe-docker.pkg.dev/gardener-project/releases/gardener/apiserver: Found Remotely
 - europe-docker.pkg.dev/gardener-project/releases/gardener/controller-manager: Found Remotely
 - europe-docker.pkg.dev/gardener-project/releases/gardener/scheduler: Found Remotely
 - europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller: Found Remotely
 - europe-docker.pkg.dev/gardener-project/releases/gardener/extensions/provider-local: Found Remotely
 - europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet: Not found. Building
 - europe-docker.pkg.dev/gardener-project/releases/gardener/resource-manager: Found Remotely
 - europe-docker.pkg.dev/gardener-project/releases/gardener/node-agent: Found Remotely
Starting build...
Found [kind-gardener-local] context, using local docker daemon.
Building [europe-docker.pkg.dev/gardener-project/releases/gardener/gardenlet]...
Target platforms: [linux/arm64]
Using base cgr.dev/chainguard/static:latest@sha256:dea7cbb98630ecf732c9d840edec0bda5da5c0c7967a25354fb9f3d8c7f87c1a for github.com/gardener/gardener/cmd/gardenlet

Note the

Using base cgr.dev/chainguard/static:latest@sha256:dea7cbb98630ecf732c9d840edec0bda5da5c0c7967a25354fb9f3d8c7f87c1a for github.com/gardener/gardener/cmd/gardenlet

when building the gardenlet image locally.

[ialidzhikov]

/lgtm

[gardener-prow]

LGTM label has been added.

Git tree hash: bde170bfdff086a7435bf5313efc26dd5e01e391

[rfranzke]

Thanks @ialidzhikov and @AleksandarSavchev
/approve

[gardener-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rfranzke

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rfranzke]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gardener-prow]

@AleksandarSavchev: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-gardener-e2e-kind	dbf3604	link	unknown	/test pull-gardener-e2e-kind
pull-gardener-e2e-kind-ha-multi-zone-upgrade	dbf3604	link	unknown	/test pull-gardener-e2e-kind-ha-multi-zone-upgrade

Full PR test history. Your PR dashboard. Command help for this repository.
Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see our testing guideline for how to avoid and hunt flakes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.