[gardener]

🏃 Others

• [OPERATOR] VPA minAllowed configuration for node-exporter. (#3871, @rfranzke)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.20.3
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.20.3
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.20.3
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.20.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.20.3
seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.20.3
landscaper-gardenlet: eu.gcr.io/gardener-project/gardener/landscaper-gardenlet:v1.20.3

[gardener]

🏃 Others

• [OPERATOR] VPA minAllowed configuration for node-exporter. (#3870, @rfranzke)
• [OPERATOR] Fix a bug which could block seed deletion due to an already deleted etcd crd (#3842, @BeckerMax)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.19.3
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.19.3
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.19.3
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.19.3
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.19.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.19.3

[gardener]

🐛 Bug Fixes

• [USER] An issue has been fixed which prevented DNS entries being created correctly. Only requests coming from shoot clusters were affected. (#3864, @timuthy)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.20.2
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.20.2
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.20.2
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.20.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.20.2
seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.20.2
landscaper-gardenlet: eu.gcr.io/gardener-project/gardener/landscaper-gardenlet:v1.20.2

[gardener]

🐛 Bug Fixes

• [USER] Several regressions related to the AuditPolicy validation are fixed. (#3856, @timebertt)
• [OPERATOR] Gardener care operations now only consider conditions of relevant BackupEntries. Earlier, the controller retrieved all entries instead of only checking the one that is associated to the processed shoot. (#3859, @timebertt)
• [OPERATOR] An issue has been fixed which led to Shoots not being reconciled immediately after changing the referenced AuditPolicy ConfigMap. (#3849, @timebertt)

🏃 Others

• [OPERATOR] Fix a bug which could block seed deletion due to an already deleted etcd crd (#3841, @BeckerMax)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.20.1
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.20.1
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.20.1
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.20.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.20.1
seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.20.1
landscaper-gardenlet: eu.gcr.io/gardener-project/gardener/landscaper-gardenlet:v1.20.1

[gardener]

⚠️ Breaking Changes

• [USER] Extension resources configs, namely ControlPlaneConfig and WorkerConfig, are now deserialized in "strict" mode. This means that deserializing resources with fields that are not allowed by the API schema will result in errors. Shoots containing such resources will fail with an appropriate error until you manually update the shoot to make sure any extension resources contained in it are valid. Note that due to other changes will not be able to create new shoots containing such resources, since they will be rejected by validation. (#3804, @stoyanr)

✨ New Features

• [OPERATOR] Seed clusters with less than three nodes are now supported. In earlier versions of Gardener the seed-admission-controller deployment was causing unhealthy managed resources for small seed clusters, preventing seed bootstrapping from succeeding. (#3811, @Gerrit91)
• [OPERATOR] Gardener-Controller-Manager now reads Gardener configuration secrets like internal-domain, default-domain, etc. dynamically during reconciliation. Earlier the secrets were only read and stored in memory during start-up, so that any changes to those secrets were not reflected until the next restart. (#3700, @timuthy)
• [OPERATOR] Gardenlet now reads Gardener configuration secrets like internal-domain, default-domain, etc. dynamically during shoot reconciliation. Earlier the secrets were only read and stored in memory during start-up, so that any changes to those secrets were not reflected until the next restart. (#3700, @timuthy)
• [DEVELOPER] A new package pkg/envtest has been added, which can be used to bootstrap a temporary Kubernetes control plane including gardener-apiserver in integration tests. With this, developers can start writing integration tests for controllers, webhooks and so on that work on Gardener API resources. (#3796, @timebertt)

🐛 Bug Fixes

• [USER] An issue causing the deletion of hibernated Shoot to fail is now fixed. (#3790, @ialidzhikov)
• [USER] A rare issue with the Infrastructure destruction that may result in Shoot resources stuck in deletion has been fixed. (#3738, @rfranzke)
• [USER] A transient error which may occur when a hibernated shoot cluster is woken up again right away has been fixed. (#3727, @rfranzke)
• [OPERATOR] Logging integration test get the name of the Loki PriorityClass from the Loki StatefulSet (#3827, @vlvasilev)
• [OPERATOR] The Gardenlet is now creating/updating the Seed resource from GardenletConfiguration.seedConfig earlier in the start-up flow to allow Gardener Controller Manager to replicate the required credentials in the namespace dedicated to the configured seed. (#3822, @vpnachev)
• [OPERATOR] A bug in the internal domain secret admission controller preventing the replication of the internal domain secrets in seed namespaces is now fixed. (#3819, @vpnachev)
• [OPERATOR] A bug in the internal domain secret admission controller preventing deletion of the internal domain secret replica in the seed namespace when there is no shoot scheduled on the seed is now fixed. (#3819, @vpnachev)
• [OPERATOR] Fix a bug where the gardenlet was not updating the allow-to-seed-apiserver network policy with the IP address of the seed's API server when the APIServerSNI feature gate is just enabled. (#3741, @vpnachev)

🏃 Others

• [OPERATOR] EnovyFilters now use V3 for envoy API configuration and the new fully qualified filter names. (#3817, @mvladev)
• [OPERATOR] Gardener administrators are now allowed to access leases. (#3807, @timebertt)
• [OPERATOR] Fixes a nil pointer dereference panic that happens when migrating a hibernated shoot and SNI is enabled. (#3805, @plkokanov)
• [OPERATOR] The timeout seconds for the istiod webhook in the seed clusters managed by Gardener when ManagedIstio feature gate is enabled, is now set to 10s. (#3797, @vpnachev)
• [OPERATOR] Infrastructure dependency errors containing the RetryableError will not stop automatic reconciliation attempts. (#3762, @kon-angelo)
• [OPERATOR] Make garden/loki-0 PriorityClass value configurable via Gardenlet configuration. (#3722, @vlvasilev)
• [OPERATOR] Audit policies referenced by shoots are now validated upon updating shoot or configmap resources. (#3720, @BeckerMax)
• [OPERATOR] Adds the initial version of the landscaper component to deploy the Gardenlet. (#3627, @danielfoehrKn)
• [OPERATOR] On Seed deletion resources related to the managed Ingress are now properly cleaned up. (#3575, @BeckerMax)
• [DEVELOPER] The OperatingSystemConfig is now created after ControlPlane has been deployed (#3761, @kon-angelo)

📰 Noteworthy

• [USER] Shoot clusters with production purpose have now at least two kube-apiserver replicas. (#3764, @rfranzke)
• [OPERATOR] The gardener-admission-controller does now have a new handler for validating the internal domain Secret (earlier, there was no API validation at all). (#3756, @rfranzke)
• [DEVELOPER] The Golang version has been updated to v1.16.2. Support of packr and go-bindata has been dropped in favor of the native go:embed. (#3739, @rfranzke)

Docker Images

admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.20.0
apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.20.0
controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.20.0
scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.20.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.20.0
seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.20.0
landscaper-gardenlet: eu.gcr.io/gardener-project/gardener/landscaper-gardenlet:v1.20.0

[gardener]

🐛 Bug Fixes

• [USER] An issue causing causing the deletion of hibernated Shoot to fail is now fixed. (#3791, @ialidzhikov)

🏃 Others

• [OPERATOR] Infrastructure dependency errors containing the RetryableError will not stop automatic reconciliation attempts. (#3792, @ialidzhikov)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.19.2
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.19.2
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.19.2
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.19.2
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.19.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.19.2

[gardener]

🐛 Bug Fixes

• [USER] A potential nil pointer exception in the Shoot validation (leading to 503 responses from gardener-apiserver) when validating PID reservations (e.g., in kubeReserved or systemReserved) has been fixed. (#3635, @ialidzhikov)
• [OPERATOR] The istiod deployment in the istio-system namespace now has replicas set to 2 and can be properly scaled by its corresponding VPA. (#3694, @ialidzhikov)
• [OPERATOR] Added resource requests and limits to the apiserver-proxy-pod-mutator container which should allow the corresponding HPA to properly read CPU metrics from the kube-apiserver when SNI is enabled. (#3694, @ialidzhikov)

🏃 Others

• [OPERATOR] istio-ingressgateway memory limit is increased to 2048Mi (#3736, @vpnachev)
• [OPERATOR] VPA minAllowed configuration for metrics-server. (#3698, @vpnachev)
• [OPERATOR] istiod is now scaled automatically by VerticalPodAutoscaler instead of HorizontalPodAutoscaler. This fixes OOMKilled issues on big Seed clusters. (#3639, @mvladev)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.16.5
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.16.5
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.16.5
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.16.5
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.16.5
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.16.5

[gardener]

🐛 Bug Fixes

• [USER] A transient error which may occur when a hibernated shoot cluster is woken up again right away has been fixed. (#3751, @vpnachev)
• [OPERATOR] Fix a bug where the gardenlet was not updating the allow-to-seed-apiserver network policy with the IP address of the seed's API server when the APIServerSNI feature gate is just enabled. (#3752, @vpnachev)

🏃 Others

• [OPERATOR] istio-ingressgateway memory limit is increased to 2048Mi (#3735, @vpnachev)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.17.3
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.17.3
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.17.3
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.17.3
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.17.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.17.3

[gardener]

🐛 Bug Fixes

• [USER] A transient error which may occur when a hibernated shoot cluster is woken up again right away has been fixed. (#3750, @vpnachev)
• [OPERATOR] Fix a bug where the gardenlet was not updating the allow-to-seed-apiserver network policy with the IP address of the seed's API server when the APIServerSNI feature gate is just enabled. (#3744, @vpnachev)
• [DEPENDENCY] An issue causing nil pointer dereference in the extension library is now fixed. (#3731, @ialidzhikov)

🏃 Others

• [OPERATOR] istio-ingressgateway memory limit is increased to 2048Mi (#3734, @vpnachev)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.18.2
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.18.2
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.18.2
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.18.2
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.18.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.18.2

[gardener]

🐛 Bug Fixes

• [USER] A transient error which may occur when a hibernated shoot cluster is woken up again right away has been fixed. (#3749, @vpnachev)
• [OPERATOR] Fix a bug where the gardenlet was not updating the allow-to-seed-apiserver network policy with the IP address of the seed's API server when the APIServerSNI feature gate is just enabled. (#3743, @vpnachev)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.19.1
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.19.1
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.19.1
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.19.1
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.19.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.19.1

[gardener]

⚠️ Breaking Changes

• [OPERATOR] The default leader election resource lock of gardener-controller-manager, gardener-scheduler and gardenlet has been changed to leases. (#3719, @timebertt)
  • Please make sure, that the components have permissions to create, get, watch and update leases.coordination.k8s.io in the respective clusters.
  • And please make sure, that you had at least [email protected] running before upgrading to v1.19, so that all components have successfully required leadership with the hybrid resource lock (configmapsleases) at least once.
• [OPERATOR] The ManagedIstio and APIServerSNI feature gates in the gardenlet have been promoted to beta and are now enabled by default. If you run your own istio installation then you have to disable the ManagedIstio feature gate (and probably also the APIServerSNI) in your gardenlet configurations. (#3633, @rfranzke)

🐛 Bug Fixes

• [OPERATOR] The istiod deployment in the istio-system namespace now has replicas set to 2 and can be properly scaled by its corresponding VPA. (#3691, @plkokanov)
• [OPERATOR] Added resource requests and limits to the apiserver-proxy-pod-mutator container which should allow the corresponding HPA to properly read CPU metrics from the kube-apiserver when SNI is enabled. (#3691, @plkokanov)
• [OPERATOR] A bug preventing seed deletion to hang due to already deleted CRD etcds.druid.gardener.cloud is now fixed. (#3686, @stoyanr)
• [OPERATOR] An issue preventing kube-controller-manager to approve the CSR for kubelet certificate renewal is now fixed. (#3684, @majst01)
• [OPERATOR] An issue causing gardenlet to fail to remove the finalizer of the Seed Secret (.spec.secretRef) is now fixed. (#3677, @ialidzhikov)
• [OPERATOR] Increase CoreDNS memory limits to avoid OOMKill. (#3675, @amshuman-kr)
• [OPERATOR] An issue preventing the status of the BackupBucket to be properly updated is now fixed. (#3673, @MartinWeindel)
• [OPERATOR] Some issues with hanging ControllerInstallations have been resolved, that caused the Seed deletion to deadlock and required manual cleanup. (#3653, @timebertt)
• [OPERATOR] extensions/pkg/controller/controlplane/genericactuator.Actuator can now use a separate ManagedResource for ControlPlane CRDs that are installed in the Shoot cluster to separate the deletion of CRDs from the deletion of the RBAC for controller leader election. (#3562, @ialidzhikov)
• [DEPENDENCY] An issue causing nil pointer dereference in the extension library is now fixed. (#3730, @ialidzhikov)

🏃 Others

• [OPERATOR] istio-ingressgateway memory limit is increased to 2048Mi (#3732, @mvladev)
• [OPERATOR] Allow ingress traffic to coredns from a pod running with hostNetwork: true and dnsPolicy: ClusterFirstWithHostNet (#3687, @DockToFuture)
• [OPERATOR] VPA minAllowed configuration for metrics-server. (#3682, @amshuman-kr)
• [DEVELOPER] The golang base image is updated to 1.15.9. The alpine base image is updated to 3.13.2. (#3688, @ialidzhikov)
• [DEVELOPER] The GEP template and process description was updated. Please take a few minutes to familiarize yourself with the latest changes before working on a GEP. (#3657, @timebertt)

📰 Noteworthy

• [USER] Every shoot worker node now randomly delays the execution of the cloud-config user data by up to 5m (earlier, the maximum delay was ~30s). This is to prevent too many systemd unit restarts (e.g., kubelet restarts) at the ~same time when there is a change (e.g., a Kubernetes patch version update). (#3715, @rfranzke)
• [DEPENDENCY] ⚠️ Go dependencies to kubernetes/* and kubernetes-sigs/controller-runtime were updated to v0.20.2 and v0.8.3 respectively. (#3651, @rfranzke)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.19.0
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.19.0
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.19.0
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.19.0
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.19.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.19.0

[gardener]

🐛 Bug Fixes

• [OPERATOR] An issue preventing kube-controller-manager to approve the CSR for kubelet certificate renewal is now fixed. (#3704, @ialidzhikov)
• [OPERATOR] The istiod deployment in the istio-system namespace now has replicas set to 2 and can be properly scaled by its corresponding VPA. (#3692, @ialidzhikov)
• [OPERATOR] Added resource requests and limits to the apiserver-proxy-pod-mutator container which should allow the corresponding HPA to properly read CPU metrics from the kube-apiserver when SNI is enabled. (#3692, @ialidzhikov)
• [OPERATOR] A bug preventing seed deletion to hang due to already deleted CRD etcds.druid.gardener.cloud is now fixed. (#3689, @vpnachev)
• [OPERATOR] An issue causing gardenlet to fail to remove the finalizer of the Seed Secret (.spec.secretRef) is now fixed. (#3678, @ialidzhikov)

🏃 Others

• [OPERATOR] VPA minAllowed configuration for metrics-server. (#3695, @vpnachev)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.18.1
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.18.1
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.18.1
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.18.1
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.18.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.18.1

[gardener]

🐛 Bug Fixes

• [USER] A potential nil pointer exception in the Shoot validation (leading to 503 responses from gardener-apiserver) when validating PID reservations (e.g., in kubeReserved or systemReserved) has been fixed. (#3634, @ialidzhikov)
• [OPERATOR] An issue preventing kube-controller-manager to approve the CSR for kubelet certificate renewal is now fixed. (#3705, @ialidzhikov)
• [OPERATOR] The istiod deployment in the istio-system namespace now has replicas set to 2 and can be properly scaled by its corresponding VPA. (#3693, @ialidzhikov)
• [OPERATOR] Added resource requests and limits to the apiserver-proxy-pod-mutator container which should allow the corresponding HPA to properly read CPU metrics from the kube-apiserver when SNI is enabled. (#3693, @ialidzhikov)

🏃 Others

• [OPERATOR] VPA minAllowed configuration for metrics-server. (#3697, @vpnachev)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.17.2
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.17.2
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.17.2
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.17.2
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.17.2
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.17.2

[gardener]

⚠️ Breaking Changes

• [OPERATOR] The gardener-admission-controller configuration API and http endpoints were changed in several aspects: (#3577, @timebertt)
  • the fields server.https.tls.server{Cert,Key}Path have been removed in favor of server.https.tls.serverCertDir (the cert directory is expected to contain a tls.crt and tls.key file)
  • metrics and health endpoints are now exposed as plain HTTP endpoints on dedicated ports (configurable via server.{healthProbes,metrics}.port
  • the gardener-admission-controller service included in Gardener's helm chart has a new named port (metrics) for exposing the metrics endpoint
  • If you deploy this component/configuration manually, please adapt your usage accordingly. Gardener's helm charts were adapted to the changes.
• [OPERATOR] The .controllers.shootedSeedRegistration field has been removed from the GardenletConfiguration in favor of the newly introduced ManagedSeed controller (configurable via .controllers.managedSeed). Please adapt your Gardenlet Helm chart values and/or example Gardenlet configuration files. (#3418, @stoyanr)
• [DEVELOPER] Semantics of controllerutils.{EnsureFinalizer,RemoveFinalizer} were changed. Both funcs now use PATCH requests instead of UPDATE and RemoveFinalizer expects an additional client.Reader for reading from the API server. (#3641, @timebertt)
  • Please use controllerutils.{PatchFinalizers,PatchRemoveFinalizers} preferably were applicable, if your controller is able to tolerate conflict errors tolerated by stale reads.
• [DEVELOPER] The .controllers.shootedSeedRegistration field has been removed from the GardenletConfiguration in favor of the newly introduced ManagedSeed controller (configurable via .controllers.managedSeed). Please run make dev-setup or manually copy example/20-componentconfig-gardenlet.yaml over your old configuration file. (#3418, @stoyanr)
• [DEPENDENCY] Semantics of controllerutils.{EnsureFinalizer,RemoveFinalizer} were changed. Both funcs now use PATCH requests instead of UPDATE and RemoveFinalizer expects an additional client.Reader for reading from the API server. (#3641, @timebertt)
  • extensioncontroller.{EnsureFinalizer,DeleteFinalizer} have been removed in favor of the funcs in controllerutils.
  • controllerutils.PatchFinalizers was renamed to PatchAddFinalizers.
• [DEPENDENCY] The mocks for Gardener packages were moved to dedicated folders in the respective package directories, i.e., if there is package foo in ./pkg/path/to/foo then the mock would be in pkg/path/to/foo/mock instead of ./pkg/mock/gardener/path/to/foo. Only the mocks for third-party/vendored packages remain in ./pkg/mock. (#3640, @rfranzke)
• [DEPENDENCY] The already deprecated packages github.com/gardener/gardener/pkg/version and github.com/gardener/gardener/pkg/version/verflag are now removed. (#3626, @ialidzhikov)

✨ New Features

• [OPERATOR] It is now configurable for which shoot purposes the BackupEntry deletion grace period applies. An empty list (default) means that it applies for all shoot purposes (as it was earlier). If you want to only select specific purposes then please configure .controllers.backupEntry.deletionGracePeriodShootPurposes[] in the gardenlet's component configuration. (#3637, @rfranzke)
• [OPERATOR] CoreDNS deployment of shoot clusters can now be automatically restarted during the shoot's maintenance time window. This is used to solve problems with clients stuck to single replica of the deployment and thus overloading it. The feature can be enabled via the ControllerManagerConfiguration under .controllers.shootMaintecance.enableShootCoreAddonRestarter (see example/20-componentconfig-gardener-controller-manager.yaml). (#3596, @vpnachev)
• [OPERATOR] An additional change detection mechanism for the file download-cloud-config.sh is now used to ensure the file is up-to-date even after VM reboot. (#3583, @vpnachev)
• [OPERATOR] A new Seed reconciler was added to the Gardener-Controller-Manager. It creates a dedicated namespace per seed in the Garden cluster seed-<seed-name> and copies common secrets from the garden Namespace (labelled with gardener.cloud/role) to the seed namespace. Gardenlets are supposed to read secrets (or namespaced objects in general) from seed dedicated namespaces only in the future. (#3582, @timuthy)
• [OPERATOR] gardener-admission-controller now exposes several metrics about its webhooks (e.g. controller_runtime_webhook_latency_seconds_bucket, controller_runtime_webhook_requests_in_flight and controller_runtime_webhook_requests_total) (#3577, @timebertt)
  • The metric gardener_admission_controller_invalid_webhook_requests_total was removed in favor of the newly added metrics.
• [OPERATOR] Seed resources now have a new condition type BackupBucketsReady that is added when the corresponding seed has a backup configuration or related BackupBuckets. Seeds whose BackupBucketsReady condition is status: "False" are considered NotReady and thus are excluded from scheduling during that time. (#3531, @timuthy)
• [OPERATOR] A new ManagedSeed resource and its corresponding controller have been added and the existing shooted seed registration controller has been reworked to use them. (#3418, @stoyanr)

🐛 Bug Fixes

• [USER] A potential nil pointer exception in the Shoot validation (leading to 503 responses from gardener-apiserver) when validating PID reservations (e.g., in kubeReserved or systemReserved) has been fixed. (#3632, @rfranzke)
• [OPERATOR] Fixed nil pointer exception that occurs when there are still extension resources in the Seed, but the Cluster resource has been deleted. (#3622, @plkokanov)
• [OPERATOR] Fix a bug where cloud-config-downloder systemd service is set to Failed with status start-limit-hit if it is requested to be restarted via the node annotation worker.gardener.cloud/restart-systemd-services. (#3593, @vpnachev)
• [OPERATOR] Fixed an issue with enabling KonnectivtyTunnel via annotation (alpha.featuregates.shoot.gardener.cloud/konnectivity-tunnel: "false") on APIServerSNI-enabled Seed cluster causing the tunnel to not be opened. (#3586, @mvladev)
• [OPERATOR] An issue causing gardener-controller-manager to not be able to delete a Plant when the Plant Secret is not found is now fixed. (#3584, @ialidzhikov)
• [OPERATOR] gardener-controller-manager now waits for a project's namespace to be empty before continuing with releasing the namespace and deleting the project. (#3578, @timebertt)

🏃 Others

• [USER] The external DNS record for the kubernetes API server is now deleted after the kubernetes API server. This is useful for shoot cluster owners that need to clean some kubernetes resources that can cause the shoot cluster deletion to stuck. (#3576, @vpnachev)
• [OPERATOR] A new error code for retryable configuration problems (for example misconfigured PodDisruptoinBudget that does not allow voluntary Pod evictions) is now added. (#3665, @danielfoehrKn)
• [OPERATOR] istiod is now scaled automatically by VerticalPodAutoscaler instead of HorizontalPodAutoscaler. This fixes OOMKilled issues on big Seed clusters. (#3613, @mvladev)
• [OPERATOR] Gardener now deploys the Cluster-Autoscaler earlier during the shoot creation which enables self healing for creation failures due to over-provisioned small machines. (#3612, @timuthy)
• [OPERATOR] Node exporter provides the metric node_uname_info (#3587, @dschmo)
• [OPERATOR] gardener-admission-controller's webhooks now also accept reviews in version admission/v1. Also, webhook timeouts have been lowered to 10s. (#3577, @timebertt)
• [OPERATOR] Use PATCH to update the extensions' state and relevant resource data to the ShootState. (#3550, @plkokanov)

📰 Noteworthy

• [USER] When a shoot is erroring with ERR_INFRA_INSUFFICIENT_PRIVILEGES, ERR_INFRA_QUOTA_EXCEEDED or ERR_INFRA_DEPENDENCIES then it is now immediately set to the Failed status (this already happens also for ERR_INFRA_UNAUTHORIZED or ERR_CONFIGURATION_PROBLEM). This prevents Gardener from automatically retrying the operation. If you are hit by it, please manually retry the operation once you have resolved the issue. (#3669, @rfranzke)
• [USER] When a shoot is erroring with ERR_INFRA_INSUFFICIENT_PRIVILEGES, ERR_INFRA_QUOTA_EXCEEDED or ERR_INFRA_DEPENDENCIES then it is now immediately set to the Failed status (this already happens also for ERR_INFRA_UNAUTHORIZED or ERR_CONFIGURATION_PROBLEM). This prevents Gardener from automatically retrying the operation. If you are hit by it, please manually retry the operation once you have resolved the issue. (#3662, @rfranzke)
• [OPERATOR] Starting with Gardener v1.18, the shoot.gardener.cloud/use-as-seed annotation is deprecated. The new ManagedSeed resource should be used instead to register shoots as seeds. (#3579, @stoyanr)
• [DEPENDENCY] In the generic worker actuator's migration flow, the MCM finalizer of the secret that is referenced by the Worker is not removed. We have now added functionality that checks that secret and removes only the MCM finalizers if necessary. (#3560, @kris94)
• [DEPENDENCY] The Terraformer interface has now a new function RemoveTerraformerFinalizerFromConfig which will remove the "terraformer" finalizer from the Secret/ConfigMap resources. (#3556, @kris94)

[gardener-resource-manager]

⚠️ Breaking Changes

• [OPERATOR] Gardener-Resource-Manager now needs permission to get, create, update and watch Lease objects named gardener-resource-manager in order to perform leader election. For a reference, please have a look at the pre-delivered Helm chart in charts/gardener-resource-manager. (gardener/gardener-resource-manager#105, @timuthy)

✨ New Features

• [OPERATOR] Gardener-Resource-Manager now adds latest warning events to a ManagedResource's .status.conditions in case a Kubernetes Service cannot be deleted. This allows to get more context about the underlying problem e.g., when Cloud-Controller-Manager cannot delete the backing load balancer. (gardener/gardener-resource-manager#106, @timuthy)
• [OPERATOR] If a ManagedResource refers to a Service object of type LoadBalancer, the Gardener Resource Manager now regularly checks if the Service has an Ingress status and contributes the result of this check to the ResourcesHealthy condition. (gardener/gardener-resource-manager#106, @timuthy)
• [OPERATOR] With this release for all objects managed by a ManagedResource an annotation resources.gardener.cloud/origin is set describing the ManagedResource that caused this object to be created. The format of the origin annotation is [cluster id:]namespace/object-name. For multi-cluster scenarios the GRM can be started with a --cluster-id options to enable the extended annotation format (see https://github.com/gardener/gardener-resource-manager/blob/master/docs/concepts/managed-resource.md for further details). (gardener/gardener-resource-manager#89, @mandelsoft)

🐛 Bug Fixes

• [OPERATOR] A problem with long running ManagedResource reconciliations caused by unavailable APIServices was fixed. (gardener/gardener-resource-manager#112, @timebertt)
• [OPERATOR] The client QPS and burst settings do now also apply for the uncached client. (gardener/gardener-resource-manager#111, @rfranzke)
• [OPERATOR] The .spec.loadBalancerIP value for Services is now preserved. (gardener/gardener-resource-manager#108, @deitch)

🏃 Others

• [OPERATOR] The CheckDaemonSet function does now lead to more accurate results. (gardener/gardener-resource-manager#103, @rfranzke)

📰 Noteworthy

• [OPERATOR] The controller reconciliations are now limited to 1m. (gardener/gardener-resource-manager#102, @rfranzke)
• [DEVELOPER] Go dependencies have been updated to: (gardener/gardener-resource-manager#105, @timuthy)
  • github.com/gardener/gardener v1.16.0
  • sigs.k8s.io/controller-runtime v0.7.1
  • k8s.io/* v0.19.6

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.18.0
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.18.0
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.18.0
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.18.0
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.18.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.18.0

[gardener]

✨ New Features

• [OPERATOR] An additional change detection mechanism for the file download-cloud-config.sh is now used to ensure the file is up-to-date even after VM reboot. (#3603, @rfranzke)

🐛 Bug Fixes

• [OPERATOR] Fix a bug where cloud-config-downloder systemd service is set to Failed with status start-limit-hit if it is requested to be restarted via the node annotation worker.gardener.cloud/restart-systemd-services. (#3616, @rfranzke)
• [OPERATOR] gardener-controller-manager now waits for a project's namespace to be empty before continuing with releasing the namespace and deleting the project. (#3606, @rfranzke)
• [OPERATOR] Fix a bug where cloud-config-downloder systemd service is set to Failed with status start-limit-hit if it is requested to be restarted via the node annotation worker.gardener.cloud/restart-systemd-services. (#3593, @vpnachev)

🏃 Others

• [OPERATOR] istiod is now scaled automatically by VerticalPodAutoscaler instead of HorizontalPodAutoscaler. This fixes OOMKilled issues on big Seed clusters. (#3620, @mvladev)
• [OPERATOR] An issue causing gardener-controller-manager to not be able to delete a Plant when the Plant Secret is not found is now fixed. (#3615, @rfranzke)
• [OPERATOR] Fixed an issue with enabling KonnectivtyTunnel via annotation (alpha.featuregates.shoot.gardener.cloud/konnectivity-tunnel: "false") on APIServerSNI-enabled Seed cluster causing the tunnel to not be opened. (#3605, @rfranzke)

📰 Noteworthy

• [DEPENDENCY] In the generic worker actuator's migration flow, the MCM finalizer of the secret that is referenced by the Worker is not removed. We have now added functionality that checks that secret and removes only the MCM finalizers if necessary. (#3607, @rfranzke)
• [DEPENDENCY] The Terraformer interface has now a new function RemoveTerraformerFinalizerFromConfig which will remove the "terraformer" finalizer from the Secret/ConfigMap resources. (#3604, @rfranzke)

[gardener-resource-manager]

🐛 Bug Fixes

• [OPERATOR] A problem with long running ManagedResource reconciliations caused by unavailable APIServices was fixed. (gardener/gardener-resource-manager#116, @rfranzke)
• [OPERATOR] The .spec.loadBalancerIP value for Services is now preserved. (gardener/gardener-resource-manager#114, @rfranzke)

🏃 Others

• [OPERATOR] The CheckDaemonSet function does now lead to more accurate results. (gardener/gardener-resource-manager#113, @rfranzke)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.17.1
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.17.1
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.17.1
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.17.1
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.17.1
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.17.1

[gardener-resource-manager]

🐛 Bug Fixes

• [OPERATOR] A problem with long running ManagedResource reconciliations caused by unavailable APIServices was fixed. (gardener/gardener-resource-manager#116, @rfranzke)
• [OPERATOR] The .spec.loadBalancerIP value for Services is now preserved. (gardener/gardener-resource-manager#114, @rfranzke)

🏃 Others

• [OPERATOR] The CheckDaemonSet function does now lead to more accurate results. (gardener/gardener-resource-manager#113, @rfranzke)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.16.4
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.16.4
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.16.4
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.16.4
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.16.4
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.16.4

[gardener-resource-manager]

🐛 Bug Fixes

• [OPERATOR] A problem with long running ManagedResource reconciliations caused by unavailable APIServices was fixed. (gardener/gardener-resource-manager#116, @rfranzke)
• [OPERATOR] The .spec.loadBalancerIP value for Services is now preserved. (gardener/gardener-resource-manager#114, @rfranzke)

🏃 Others

• [OPERATOR] The CheckDaemonSet function does now lead to more accurate results. (gardener/gardener-resource-manager#113, @rfranzke)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.15.7
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.15.7
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.15.7
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.15.7
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.15.7
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.15.7

[gardener]

⚠️ Breaking Changes

• [OPERATOR] The default leader election resource lock of gardener-controller-manager, gardener-scheduler and gardenlet has been changed to configmapsleases. This is a preparation to eventually migrate to leases after a few releases. Please make sure, that the components have permissions to create, get, watch and update leases.coordination.k8s.io in the respective clusters. (#3535, @timebertt)
• [OPERATOR] Gardener components now use the protobuf content type wherever possible when talking to the Gardener or Kubernetes APIs, if the content type fields are left empty in the respective component configs. (#3467, @timebertt)
  • Operators can override this behavior by explicitly specifying application/json as the content type in the respective component configs.
• [DEVELOPER] The CopyValues function has been moved from pkg/utils/chart to pkg/utils and was renamed to ShallowCopyMapStringInterface. (#3454, @rfranzke)
• [DEVELOPER] The ImageMapToValues function has been moved from pkg/utils/chart to pkg/utils/imagevector. (#3454, @rfranzke)
• [DEPENDENCY] Some helper functions and interface types have been changed to accept client.{Object,ObjectList} instead of runtime.Object where applicable to have a clearer contract of what is expected from passed parameters. (#3476, @timebertt)
• [DEPENDENCY] The kubernetes.Interface.RESTMapper func has been removed in favor of the client.RESTMapper func. Please adapt your usage accordingly. (#3473, @timebertt)
• [DEPENDENCY] Several deprecated / duplicated helper funcs were removed: (#3463, @timebertt)
  • kutils.KeyFromObject in favor of client.ObjectKeyFromObject
  • controllerutils.HasFinalizer in favor of controllerutil.ContainsFinalizer
  • extensionscontroller.HasFinalizer in favor of controllerutil.ContainsFinalizer
  • controllerutils.BoolPtrDerefOr in favor of pointer.BoolPtrDerefOr
  • flow.SimpleTaskFn
• [DEPENDENCY] The FileContentInlineCodec and UnitSerializer interfaces have been moved from extensions/pkg/webhook/controlplane to pkg/operation/botanist/extensions/operatingsystemconfig/utils. (#3454, @rfranzke)
• [DEPENDENCY] The KubeletConfigCodec interface has been moved from extensions/pkg/webhook/controlplane to pkg/operation/botanist/extensions/operatingsystemconfig/original/components/kubelet and was renamed to ConfigCodec. (#3454, @rfranzke)

✨ New Features

• [OPERATOR] Enabling the usage of internal load balancers for the kube-api servers of the shoots. (#3507, @hassbert)
• [OPERATOR] The new ShootVPAEnabledByDefault admission plugin of the gardener-apiserver (disabled by default) controls whether the .spec.kubernetes.verticalPodAutoscaler.enabled field for newly created Shoot resources is defaulted to true. Existing Shoots are not modified, i.e., if VPA shall be enabled then it needs to be explicitly set. Also Shoot's can still explicitly disable the VPA by setting .spec.kubernetes.verticalPodAutoscaler.enabled=false. See this document. (#3468, @timebertt)
• [OPERATOR] konnectivity-server is no longer a sidecar to kube-apiserver when APIServerSNI and KonnectivityTunnel feature gates are enabled. This allows for existing opened tunnel connections from konnectivity-agents to not be interrupted when kube-apiserver is auto-scaled. (#3399, @mvladev)
• [DEVELOPER] The pkg/utils/kubernetes does now have a new DeleteObjectsFromListConditionally utility function. (#3454, @rfranzke)
• [DEPENDENCY] The extensions library now allows to specify the leader election resource lock (currently defaulted to configmapsleases). Please read through the doc string of the respective field (ManagerOptions.LeaderElectionResourceLock) carefully before changing the default resource lock. (#3479, @timebertt)

🐛 Bug Fixes

• [USER] metrics-server's version is updated from v0.4.1 to v0.4.2 to adopt upstream fix that was causing metrics-server to be unavailable for a while after rolling update of Nodes. (#3515, @ialidzhikov)
• [OPERATOR] Fixed a bug causing KonnectivityTunnel to break when kubeconfig rotation occurs. (#3538, @mvladev)
• [OPERATOR] The affinity section is removed from the Loki StatefulSet for the integration tests (#3524, @vlvasilev)
• [OPERATOR] An issue causing the generic Worker actuator to not wait until the finalizer of the out-of-tree machine controller provider is removed from the credentials secret is now fixed. (#3497, @ialidzhikov)
• [OPERATOR] Keep VPA namespace env variable in sync in all cases. If they are out of sync between the admission controller and the updater, the updater might become inactive and stop actively scaling targets that have update mode Auto or Recreate. (#3474, @amshuman-kr)

🏃 Others

• [USER] A few metrics about ReplicaSets have been added to the Shoot monitoring stack. (#3503, @timebertt)
• [OPERATOR] An issue has been fixed which caused Gardener to incorrectly label shoot clusters as unhealthy (shoot.gardener.cloud/status: unhealthy) for a short period of time. (#3564, @timuthy)
• [OPERATOR] An issue causing github.com/gardener/gardener/pkg/utils/imagevector.FindImages to not give a higher score on exact matched targetVersion or runtimeVersion is now fixed. (#3555, @ialidzhikov)
• [OPERATOR] Konnectivity components are upgraded to v0.0.15 (#3542, @mvladev)
• [OPERATOR] Deploy the Gardener Resource Manager after the KCM to prevent edge case during cluster deletion. (#3539, @danielfoehrKn)
• [OPERATOR] incoming_logs_with_endpoint_total metric is added to count the number of logs with endpoints which are going to be forwarded to Promtail client. (#3532, @Kristian-ZH)
• [OPERATOR] Loki curator will ensure that Loki's Inodes and Storage limits are not reached (#3532, @Kristian-ZH)
• [OPERATOR] LokiDown alert is triggered after Loki is not in running state for 30 minutes (#3514, @vlvasilev)
• [OPERATOR] An issue causing Shoots to be marked as Failed (and no longer retried) on transient not found error is now fixed. (#3500, @ialidzhikov)
• [OPERATOR] MaintenanceTimeWindow for scale-down is added to Loki's hvpa in garden namespace (#3482, @Kristian-ZH)
• [OPERATOR] gardener-seed-admission-controller's webhooks now also accept reviews in version admission/v1. (#3459, @timebertt)
  • Also, webhook timeouts have been lowered to 10s for the extension deletion protection webhooks.
• [DEPENDENCY] The packages github.com/gardener/gardener/pkg/version and github.com/gardener/gardener/pkg/version/verflag are now deprecated in favour of k8s.io/component-base/version and k8s.io/component-base/version/verflag. (#3472, @ialidzhikov)

📰 Noteworthy

• [USER] The Grafana dashboards for the kube-apiserver have been enhanced and are now providing more information for the various metrics. (#3502, @rfranzke)

[autoscaler]

🏃 Others

• [USER] Support the latest zone label topology.kubernetes.io/zone in addition to the existing failure-domain.beta.kubernetes.io/zone while determining the zone for AWS machines. (gardener/autoscaler#70, @prashanth26)
• [USER] Allow scaling up from zero using the latest stable zone, region, arch, OS, instanceType labels on node objects. (gardener/autoscaler#70, @prashanth26)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.17.0
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.17.0
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.17.0
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.17.0
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.17.0
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.17.0

[gardener]

🐛 Bug Fixes

• [OPERATOR] An issue has been fixed which caused Gardener to incorrectly label shoot clusters as unhealthy (shoot.gardener.cloud/status: unhealthy) for a short period of time. (#3567, @timuthy)

🏃 Others

• [OPERATOR] An issue causing github.com/gardener/gardener/pkg/utils/imagevector.FindImages to not give a higher score on exact matched targetVersion or runtimeVersion is now fixed. (#3568, @ialidzhikov)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.16.3
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.16.3
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.16.3
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.16.3
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.16.3
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.16.3

[gardener]

🐛 Bug Fixes

• [USER] metrics-server's version is updated from v0.4.1 to v0.4.2 to adopt upstream fix that was causing metrics-server to be unavailable for a while after rolling update of Nodes. (#3517, @ialidzhikov)
• [OPERATOR] An issue causing the generic Worker actuator to not wait until the finalizer of the out-of-tree machine controller provider is removed from the credentials secret is now fixed. (#3499, @ialidzhikov)

🏃 Others

• [OPERATOR] Keep VPA namespace env variable in sync in all cases. If they are out of sync between the admission controller and the updater, the updater might become inactive and stop actively scaling targets that have update mode Auto or Recreate. (#3480, @amshuman-kr)

Docker Images

gardener-apiserver: eu.gcr.io/gardener-project/gardener/apiserver:v1.15.6
gardener-controller-manager: eu.gcr.io/gardener-project/gardener/controller-manager:v1.15.6
gardener-scheduler: eu.gcr.io/gardener-project/gardener/scheduler:v1.15.6
gardener-admission-controller: eu.gcr.io/gardener-project/gardener/admission-controller:v1.15.6
gardener-seed-admission-controller: eu.gcr.io/gardener-project/gardener/seed-admission-controller:v1.15.6
gardenlet: eu.gcr.io/gardener-project/gardener/gardenlet:v1.15.6