Support the configuration of seeds within the same region as the shoot [KIM/feature]

[tobiscr]

Description

As part of EPIC kyma-project/kyma#18182, we are going to offer customers the option request a shoot and seed in the same region.

This requires a modification of KIM to be able to

• Receive the information that seed and shoot should be in the same region (will be an additional boolean flag in RuntimeCR)
• Set the proper fields in the Shoot-spec for Gardener (label-selectors for seeds)

AC:

• KIM contract (RuntimeCR) gets extended to support a boolean-field which indicates whether seed and shoot have to be in the same region
• If this field is set, the Shoot-spec includes the required configuration (label-selectors for seed) to enforce that the shoot will only be created if a corresponding seed exists
• Failure cases during the shoot provisioning (e.g. shoot hangs forever in Pending state) are detected and returned as failure to KEB: Runtime has to switch into ERROR state if Gardener cannot find a seed in same region as shoot: Shoot-Spec is staying endless in PENDING state #511
• Fail fast for Shoot/Seed in same region: before creating the Shoot-spec, KIM will evaluate whether a seed exists in the requested region #561
  • Communicate with Gardener team and merge the proposed PR for making the Shoot-determining logic accessible for other applications (see POC: Refactoring - moving seed determiner logic into dedicated struct gardener/gardener#9843) -> new PR is Make determineSeed public gardener/gardener#10917

Reasons

Enforce seed and shoot in same region to improve latency and address security related concerns.

Attachments

Relates to
kyma-project/kyma#18182

[tobiscr]

See https://github.com/gardener/gardener/blob/v1.84.1/example/90-shoot.yaml#L365-L368 for the Shoot-spec related section that needs to be touched

[tobiscr]

PR on Gardener Side is open: it changes the determineSeed function to public. This allows us to reuse Gardener's determination logic for Seeds within KIM:

gardener/gardener#10917

[tobiscr]

Opened another PR for Gardener with an proposal to add an unique suffix to each error message replied by Gardener's reconciler: gardener/gardener#10983

This would help to reliably map error messages to Gardener reconciler problems (e.g. no seed in region found etc.).