- there is no VPN :)

- They might serve webhooks necessary for the subsequent steps (e.g.,
  deployment of `kube-proxy`)

- only for autonomous shoots
- we now deploy the control plane amespace (i.e., in fact we apply
  some labels to kube-system (besides others, gardener.cloud/role=shoot
  will be added) to make the webhooks work)

- This basically adds the `gardener.cloud/purpose=kube-system` label
  to the `kube-system` namespace (see
  https://github.com/gardener/gardener/blob/0df3391737ca7c36cd58279845a46c832ce4b422/pkg/component/shoot/namespaces/namespaces.go#L90-L101)

- the `ControllerInstallation` controller now passes information to
  extension controller Helm charts (when deploying them) in case the
  shoot is an autonomous shoot cluster
- extensions can then use this information to adapt their behaviour (see
  next commit)

- if extension runs in an ASC, it now merges the shoot webhooks into the
  seed webhooks (without this, they would only be deployed when
  `gardenadm` or `gardenlet` create the `ControlPlane` resource later
  (not yet implemented))
- the `ControlPlane` controller does not include the shoot webhooks as
  part of its reconciliation in case the `ControlPlane` is for an ASC
  (no need since they are already deployed via the seed webhooks)

- Otherwise, the pods in the pod network cannot talk to the API server
  (or resolve DNS)

- without `.spec.region`, the validation webhook fails with
  `2025-04-16T11:44:57.927Z	ERROR	Error	{"flow": "init", "task":
"Deploying shoot control plane components", "error": "admission webhook
\"validation.extensions.controlplanes.resources.gardener.cloud\" denied
the request: ControlPlane.extensions.gardener.cloud \"root\" is invalid:
spec.region: Required value: field is required"}`

- without a cloud provider secret, the generic control plane actuator
  fails with `	* task "Waiting until shoot control plane has been
reconciled" failed: Error while waiting for ControlPlane
kube-system/root to become ready: error during reconciliation: Error
reconciling ControlPlane: could not get secret
'kube-system/cloudprovider': Secret "cloudprovider" not found`

…nction

Otherwise, we would attempt to deploy a real pod into the cluster (which
we don't want). Instead, we want a `StatefulSet` with `replicas=0` that
we can translate into a static pod.

Result:

```
root@machine-0:/# k get deploy,sts
NAME                                                 READY   UP-TO-DATE   AVAILABLE   AGE
...
deployment.apps/kube-apiserver                       0/0     0            0           2m14s
deployment.apps/kube-controller-manager              0/0     0            0           2m14s
deployment.apps/kube-scheduler                       0/0     0            0           2m14s

NAME                             READY   AGE
statefulset.apps/etcd-events-0   0/0     2m14s
statefulset.apps/etcd-main-0     0/0     2m14s
```

- we have to deactivate the NodeAgentAuthorizer feature for now since it
  only works with Machine objects (which we don't have) - we have to
  adapt the feature later (separately)
- we don't have a machine image name/type for now, and that's a sane
  configuration

- GRM's system-components-config webhook now propagates respective
  tolerations to the pods managed by Gardener
- GRM itself tolerates the taint if it is configured to propagate it to
  system component pods