[adziauho]

Closes https://github.wdf.sap.corp/cc/unified-kubernetes/issues/1498

Problem

cloud-profile-sync was always fetching Kubernetes versions from the latest RBSC OCI tag. During a Gardener rollout, a newer RBSC tag may already be published before the corresponding imageVectorOverwrite is deployed to all seeds. This creates a window where the generated CloudProfile exposes Kubernetes versions whose container images are not yet mirrored in the internal registry, causing shoots to run on non-overwritten images.

Solution

Resolve the RBSC tag whose embedded component descriptor matches the currently deployed Gardener version, rather than always using the latest tag.

How the Gardener version is determined

Each shoot's .status.gardener.version is stamped by gardenlet at the start of every reconciliation. During a rolling Gardener update, different seeds may be at different versions. To be conservative, the minimum semver version across all shoots is used — this ensures we never expose Kubernetes versions that aren't yet safe on every seed.

How the RBSC tag is resolved

Each RBSC OCI tag's artifact contains a component-descriptor.yaml with a componentReferences[] array. The entry with componentName: github.com/gardener/gardener holds the Gardener version that tag was built for. Tags are compared on major.minor only (patch is ignored), consistent with the existing lss-tags-get.sh tooling.

Bootstrap fallback

On first CloudProfile creation, no shoots exist yet. In this case gardenerVersionFromShoots returns ErrNoShoots and the controller falls back to the latest RBSC tag to get things bootstrapped. Subsequent reconciles automatically switch to version-pinned behaviour once shoots are present.

Changes

• LandscapeKubernetesSource.FetchVersions now accepts *string gardener version (nil = use latest tag)
• New TagForGardenerVersion method scans tags in descending semver order and returns the first whose component descriptor matches the requested Gardener minor version
• Shoots are listed once per reconcile at the top of reconcileCloudProfile, shared between GC and Kubernetes version resolution
• gardenerVersionFromShoots collects unique versions into a set, sorts by semver, returns the minimum raw string
• No API changes — ManagedCloudProfile spec is unchanged

[github-actions]

Merging this branch changes the coverage (1 decrease, 1 increase)

Impacted Packages	Coverage Δ	🤖
github.com/cobaltcore-dev/cloud-profile-sync/cloudprofilesync/k8ssync	100.00% (ø)
github.com/cobaltcore-dev/cloud-profile-sync/cloudprofilesync/k8ssync/source/landscape	79.75% (+0.72%)	👍
github.com/cobaltcore-dev/cloud-profile-sync/controllers	76.53% (-0.05%)	👎

Coverage details

_{Compared to commit 9243ed2 (run #38893105497)}

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/cobaltcore-dev/cloud-profile-sync/cloudprofilesync/k8ssync/k8s_image_updater.go	100.00% (ø)	14	14	0
github.com/cobaltcore-dev/cloud-profile-sync/cloudprofilesync/k8ssync/source/landscape/landscape_source.go	79.75% (+0.72%)	163 (+39)	130 (+32)	33 (+7)	👍
github.com/cobaltcore-dev/cloud-profile-sync/controllers/cloud_profile.go	73.47% (-2.07%)	147 (+8)	108 (+3)	39 (+5)	👎
github.com/cobaltcore-dev/cloud-profile-sync/controllers/cloud_profile_helpers.go	61.29% (+12.40%)	62 (+17)	38 (+16)	24 (+1)	🎉

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files:

• github.com/cobaltcore-dev/cloud-profile-sync/cloudprofilesync/k8ssync/k8s_image_updater_test.go
• github.com/cobaltcore-dev/cloud-profile-sync/cloudprofilesync/k8ssync/source/landscape/landscape_source_test.go
• github.com/cobaltcore-dev/cloud-profile-sync/controllers/cloud_profile_helpers_test.go