Configurable Firewall Controller Version

[mwindower]

Current situation

• the firewall-controller version used in a cluster is not included in the shoot spec
• it is not easily visible which firewall-controller version is
• it is hard to further develop the firewall-controller because of the long loop: firewall-controller, metal-images, gepm

Wanted

• controllerVersion should be fully configurable by the user with the shoot spec
• there should be an additional field controllerVersionAutoUpdate which indicates whether gepm manages the controllerVersion field
• gepm holds a default version in its imageVector

Constraints

• if there are api changes in the objects btw. firewall-controller and gepm (FirewallSpec) those need to be visible with the version number! - we'll use semver for that
• a gepm release supports only minor / patch level changes of the firewall-controller (cluster update with a new major release will be declined)
• controllerVersion must be a released GitHub artifact of https://github.com/metal-stack/firewall-controller

How can we initially introduce this feature?

• you need to get a new firewall image that has the firewall-controller self replacement enabled
• older firewall-images work as expected (because the controllerVersion field will be omitted if empty during serialization)
• you may enable the auto update to the firewall-controller version mentioned in gepm's imageVector with controllerVersionAutoUpdate: true
• reconcilation works for clusters having the feature enabled as well as those that don't have it

How to do major version upgrades?

• use the new firewall-controller in metal-images and release it
• exchange firewalls and release gepm with the new major version of firewall-controller containing the api changes
• Problem: reconcilation of existing clusters with old firewall-controllers will fail
  ALTERNATIVE:
• versioning the Custom Resource Definition for firewalls and support multiple versions in gepm

[Gerrit91]

The gardener-resource-manager update has to be mentioned in our release notes.