[pull] master from gardener:master

dev-setup/skaffold-gardenadm.yaml

@@ -389,6 +389,7 @@ build:
             - pkg/utils/managedresources/builder
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/structuredmap
             - pkg/utils/validation
@@ -510,6 +511,7 @@ build:
             - pkg/utils/kubernetes/unstructured
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/admissionplugins
@@ -775,6 +777,7 @@ build:
             - pkg/utils/gardener/secretsrotation
             - pkg/utils/gardener/shootstate
             - pkg/utils/gardener/tokenrequest
+            - pkg/utils/hibernation
             - pkg/utils/imagevector
             - pkg/utils/istio
             - pkg/utils/kubernetes

dev-setup/skaffold-operator.yaml

@@ -359,6 +359,7 @@ build:
             - pkg/utils/kubernetes/unstructured
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/admissionplugins
@@ -532,6 +533,7 @@ build:
             - pkg/utils/kubernetes/unstructured
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/admissionplugins
@@ -689,6 +691,7 @@ build:
             - pkg/controllerutils/predicate
             - pkg/controllerutils/routes
             - pkg/features
+            - pkg/gardenlet/bootstrap/util
             - pkg/healthz
             - pkg/logger
             - pkg/operator/client
@@ -700,6 +703,7 @@ build:
             - pkg/utils/flow
             - pkg/utils/gardener
             - pkg/utils/gardener/gardenlet
+            - pkg/utils/hibernation
             - pkg/utils/imagevector
             - pkg/utils/kubernetes
             - pkg/utils/kubernetes/bootstraptoken
@@ -709,6 +713,7 @@ build:
             - pkg/utils/managedresources/builder
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/admissionplugins
@@ -789,6 +794,7 @@ build:
             - pkg/utils/kubernetes/unstructured
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/cidr
@@ -889,6 +895,7 @@ build:
             - pkg/utils/kubernetes/unstructured
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/kubernetesversion

dev-setup/skaffold-seed.yaml

@@ -292,6 +292,7 @@ build:
             - pkg/utils/gardener/secretsrotation
             - pkg/utils/gardener/shootstate
             - pkg/utils/gardener/tokenrequest
+            - pkg/utils/hibernation
             - pkg/utils/imagevector
             - pkg/utils/istio
             - pkg/utils/kubernetes
@@ -453,6 +454,7 @@ build:
             - pkg/utils/kubernetes/unstructured
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/validation
             - pkg/utils/validation/admissionplugins
@@ -578,6 +580,7 @@ build:
             - pkg/utils/managedresources/builder
             - pkg/utils/retry
             - pkg/utils/secrets
+            - pkg/utils/secrets/manager
             - pkg/utils/signals
             - pkg/utils/structuredmap
             - pkg/utils/validation

docs/usage/shoot-operations/shoot_credentials_rotation.md

@@ -276,6 +276,8 @@ The encryption key has no expiration date.
 **Unless automatic credentials rotation is enabled, it is the responsibility of the end-user to regularly rotate those credentials.**
 Refer to [Automatic Credentials Rotation](../shoot/shoot_maintenance.md#automatic-credentials-rotation) for instructions on enabling automatic rotation for etcd encryption key.
 
+Automatic ETCD encryption key rotation requires a running ETCD and `kube-apiserver`, so it is skipped while the Shoot is hibernated. If an overdue automatic rotation cannot run during the next maintenance window because of the hibernation schedule, Gardener reports the `AutomaticCredentialsRotationPossible` constraint in the Shoot status. Adjust the maintenance window or hibernation schedule so that maintenance runs while the Shoot is awake.
+
 The rotation happens in three stages:
 
 - In stage one, a new encryption key is created and added to the bundle (together with the old encryption key).

docs/usage/shoot/shoot_maintenance.md

@@ -107,6 +107,7 @@ spec:
 > See [ETCD Encryption Config](../security/etcd_encryption_config.md) for more details.
 
 During the daily maintenance, the `gardener-controller-manager` starts the rotation for specific credentials if the Shoot opted-in for automatic rotation for the given credential and the set period has passed since the last rotation completion.
+Automatic ETCD encryption key rotation requires a running ETCD and `kube-apiserver`, so it is skipped while the Shoot is hibernated. If an overdue automatic rotation cannot run during the next maintenance window because of the hibernation schedule, Gardener reports the `AutomaticCredentialsRotationPossible` constraint in the Shoot status. Adjust the maintenance window or hibernation schedule so that maintenance runs while the Shoot is awake.
 Automatic rotation can be disabled for specific credential by setting the `rotationPeriod` field to `0`.
 
 ## Cluster Reconciliation

docs/usage/shoot/shoot_status.md

@@ -131,6 +131,12 @@ If it's visible, operators should be aware that the annotated resources may dive
 This constraint indicates that one or more machines in `Failed` phase are currently being preserved (i.e., not terminated) to allow for debugging and analysis. The constraint is not added to `.status.constraints` when no failed machines are currently preserved.
 See [Machine Preservation](shoot_machine_preservation.md) for more details.
 
+**`AutomaticCredentialsRotationPossible`**:
+
+This optional constraint indicates whether an overdue automatic ETCD encryption key rotation can run during the next maintenance window.
+The constraint is omitted when automatic rotation is not required or can run. It is added with status `False` when the next maintenance window is affected by hibernation, because ETCD encryption key rotation requires a running ETCD and `kube-apiserver`.
+If it is present, adjust the maintenance window or hibernation schedule so that maintenance runs while the Shoot is awake. See [ETCD Encryption Key](../shoot-operations/shoot_credentials_rotation.md#etcd-encryption-key) for details.
+
 
 ### Last Operation