Specify the kubelet flag runtime-cgroups when using containerd

The runtime cgroup is the cgroup path the container runtime is expected
to be isolated in.
https://github.com/kubernetes/kubernetes/blob/efa5692c0b5f01bd33d8a112ab98b386300198e7/pkg/kubelet/config/flags.go#L31

Without this flag, the cadvisor metrics exposed by the kubelet via

```
k proxy
curl -s http://localhost:8001/api/v1/nodes/<node>/proxy/metrics/cadvisor
```

in a cluster with containerd as container runtime, only contain metrics
for the `/system.slice/kubelet.service`.

With this command line flag, metrics are reported for both
`/system.slice/kubelet.service` and `/system.slice/containerd.service`.

This is the expected behavior based on the experience with clusters
that use docker as container runtime: in those clusters, metrics
are reported for both the kubelet.service and the docker.service.

Consequently in clusters with containerd, one would expect
metrics for both the kubelet.service and the containerd.service.

See the system services panels in the issue
gardener#2800

Co-authored-by: Wesley Bermbach <wesley.bermbach@sap.com>
Co-authored-by: Istvan Zoltan Ballok <istvan.zoltan.ballok@sap.com>
Co-authored-by: Jeremy Rickards <jeremy.rickards@sap.com>

pkg/operation/botanist/component/extensions/operatingsystemconfig/original/components/kubelet/cliflags.go

@@ -50,6 +50,7 @@ func CLIFlags(kubernetesVersion *semver.Version, criName extensionsv1alpha1.CRIN
 		flags = append(flags,
 			"--container-runtime=remote",
 			"--container-runtime-endpoint="+containerd.PathSocketEndpoint,
+			"--runtime-cgroups=/system.slice/containerd.service",
 		)
 	} else if criName == extensionsv1alpha1.CRINameDocker {
 		flags = append(flags,

pkg/operation/botanist/component/extensions/operatingsystemconfig/original/components/kubelet/cliflags_test.go

@@ -77,6 +77,7 @@ var _ = Describe("CLIFlags", func() {
 				"--volume-plugin-dir=/var/lib/kubelet/volumeplugins",
 				"--container-runtime=remote",
 				"--container-runtime-endpoint=unix:///run/containerd/containerd.sock",
+				"--runtime-cgroups=/system.slice/containerd.service",
 				"--v=2",
 			),
 		),
@@ -115,6 +116,7 @@ var _ = Describe("CLIFlags", func() {
 				"--volume-plugin-dir=/var/lib/kubelet/volumeplugins",
 				"--container-runtime=remote",
 				"--container-runtime-endpoint=unix:///run/containerd/containerd.sock",
+				"--runtime-cgroups=/system.slice/containerd.service",
 				"--v=2",
 			),
 		),
@@ -151,6 +153,7 @@ var _ = Describe("CLIFlags", func() {
 				"--node-labels=worker.gardener.cloud/kubernetes-version=1.19.1",
 				"--container-runtime=remote",
 				"--container-runtime-endpoint=unix:///run/containerd/containerd.sock",
+				"--runtime-cgroups=/system.slice/containerd.service",
 				"--v=2",
 			),
 		),
@@ -187,6 +190,7 @@ var _ = Describe("CLIFlags", func() {
 				"--node-labels=worker.gardener.cloud/kubernetes-version=1.20.1",
 				"--container-runtime=remote",
 				"--container-runtime-endpoint=unix:///run/containerd/containerd.sock",
+				"--runtime-cgroups=/system.slice/containerd.service",
 				"--v=2",
 			),
 		),
@@ -223,6 +227,7 @@ var _ = Describe("CLIFlags", func() {
 				"--node-labels=worker.gardener.cloud/kubernetes-version=1.21.1",
 				"--container-runtime=remote",
 				"--container-runtime-endpoint=unix:///run/containerd/containerd.sock",
+				"--runtime-cgroups=/system.slice/containerd.service",
 				"--v=2",
 			),
 		),
@@ -259,6 +264,7 @@ var _ = Describe("CLIFlags", func() {
 				"--node-labels=worker.gardener.cloud/kubernetes-version=1.22.1",
 				"--container-runtime=remote",
 				"--container-runtime-endpoint=unix:///run/containerd/containerd.sock",
+				"--runtime-cgroups=/system.slice/containerd.service",
 				"--v=2",
 			),
 		),