Provider-specific webhooks in Garden cluster

[rfranzke]

From gardener-attic/gardener-extensions#407

With the new core.gardener.cloud/v1alpha1.Shoot API Gardener does no longer understand the provider-specifics, e.g., the infrastructure config, control plane config, worker config, etc.
This allows end-users to harm themselves and create invalid Shoot resources the Garden cluster. Errors will only become present during reconciliation part creation of the resource.

Also, it's not possible to default any of the provider specific sections. Hence, we could also think about mutating webhooks in the future.

As we are using the controller-runtime maintained by the Kubernetes SIGs it should be relatively easy to implement these webhooks as the library abstracts already most of the things.

We should have a separate, dedicated binary incorporating the webhooks for each provider, and a separate Helm chart for the deployment in the Garden cluster.

Similarly, the networking and OS extensions could have such webhooks as well to check on the providerConfig for the networking and operating system config.

Part of gardener/gardener#308

[ialidzhikov]

Comment gardener/gardener-extension-provider-aws#30 (comment).

$index is used also in the alicloud infra chart. We can keep in mind to add the same validation check also there once we introduce the validator for provider-alicloud.

[rfranzke]

@jia-jerry @minchaow @EmoinLanyu There is a "reference implementation for Azure that you can look at: gardener/gardener-extension-provider-azure#45.
And https://github.com/gardener/gardener-extension-provider-aws/tree/master/cmd/gardener-extension-validator-aws, of course, which is more close to Alicloud.