Align fields with provisioner: Static Kubetoken + Network Filter

internal/gardener/shoot/converter.go

@@ -74,7 +74,7 @@ func NewConverter(config ConverterConfig) Converter {
 	extenders := []Extend{
 		extender.ExtendWithAnnotations,
 		extender.ExtendWithLabels,
-		extender.NewKubernetesVersionExtender(config.Kubernetes.DefaultVersion),
+		extender.NewKubernetesExtender(config.Kubernetes.DefaultVersion),
 		extender.NewProviderExtender(config.Provider.AWS.EnableIMDSv2, config.MachineImage.DefaultVersion),
 		extender.NewDNSExtender(config.DNS.SecretName, config.DNS.DomainPrefix, config.DNS.ProviderType),
 		extender.ExtendWithOIDC,

internal/gardener/shoot/extender/kubernetes.go

@@ -0,0 +1,25 @@
+package extender
+
+import (
+	gardener "github.com/gardener/gardener/pkg/apis/core/v1beta1"
+	imv1 "github.com/kyma-project/infrastructure-manager/api/v1"
+	"k8s.io/utils/ptr"
+)
+
+// NewKubernetesExtender creates a new Kubernetes extender function.
+// It sets the Kubernetes version of the Shoot to the version specified in the Runtime.
+// If the version is not specified in the Runtime, it sets the version to the `defaultKubernetesVersion`, set in `converter_config.json`.
+// It sets the EnableStaticTokenKubeconfig field of the Shoot to false.
+func NewKubernetesExtender(defaultKubernetesVersion string) func(runtime imv1.Runtime, shoot *gardener.Shoot) error {
+	return func(runtime imv1.Runtime, shoot *gardener.Shoot) error {
+		kubernetesVersion := runtime.Spec.Shoot.Kubernetes.Version
+		if kubernetesVersion == nil || *kubernetesVersion == "" {
+			kubernetesVersion = &defaultKubernetesVersion
+		}
+
+		shoot.Spec.Kubernetes.Version = *kubernetesVersion
+		shoot.Spec.Kubernetes.EnableStaticTokenKubeconfig = ptr.To(false)
+
+		return nil
+	}
+}

internal/gardener/shoot/extender/kubernetes_version_test.go → internal/gardener/shoot/extender/kubernetes_test.go

@@ -16,14 +16,28 @@ func TestKubernetesVersionExtender(t *testing.T) {
 		runtime := imv1.Runtime{}
 
 		// when
-		kubernetesVersionExtender := NewKubernetesVersionExtender("1.99")
+		kubernetesVersionExtender := NewKubernetesExtender("1.99")
 		err := kubernetesVersionExtender(runtime, &shoot)
 
 		// then
 		require.NoError(t, err)
 		assert.Equal(t, "1.99", shoot.Spec.Kubernetes.Version)
 	})
 
+	t.Run("Disable static token kubeconfig", func(t *testing.T) {
+		// given
+		shoot := fixEmptyGardenerShoot("test", "kcp-system")
+		runtime := imv1.Runtime{}
+
+		// when
+		kubernetesVersionExtender := NewKubernetesExtender("1.99")
+		err := kubernetesVersionExtender(runtime, &shoot)
+
+		// then
+		require.NoError(t, err)
+		assert.Equal(t, false, *shoot.Spec.Kubernetes.EnableStaticTokenKubeconfig)
+	})
+
 	t.Run("Use version provided in the Runtime CR", func(t *testing.T) {
 		// given
 		shoot := fixEmptyGardenerShoot("test", "kcp-system")
@@ -38,7 +52,7 @@ func TestKubernetesVersionExtender(t *testing.T) {
 		}
 
 		// when
-		kubernetesVersionExtender := NewKubernetesVersionExtender("1.99")
+		kubernetesVersionExtender := NewKubernetesExtender("1.99")
 		err := kubernetesVersionExtender(runtime, &shoot)
 
 		// then

internal/gardener/shoot/extender/network_filter.go

@@ -3,15 +3,15 @@ package extender
 import (
 	gardener "github.com/gardener/gardener/pkg/apis/core/v1beta1"
 	imv1 "github.com/kyma-project/infrastructure-manager/api/v1"
-	"k8s.io/utils/ptr"
 )
 
 const NetworkFilterType = "shoot-networking-filter"
 
 func ExtendWithNetworkFilter(runtime imv1.Runtime, shoot *gardener.Shoot) error { //nolint:revive
 	networkingFilter := gardener.Extension{
-		Type:     NetworkFilterType,
-		Disabled: ptr.To(false),
+		Type: NetworkFilterType,
+		// this pointer is safe, because runtime is fully pass-by-value
+		Disabled: &runtime.Spec.Security.Networking.Filter.Egress.Enabled,
 	}
 
 	shoot.Spec.Extensions = append(shoot.Spec.Extensions, networkingFilter)