Adopt CSI for OpenStack extension beginning with Kubernetes 1.19

[gardener]

Adopt CSI for OpenStack extension beginning with Kubernetes 1.19

[rfranzke]

The CSI migration is beta with 1.18, though, the CSI plugins for OpenStack are not yet ready to cater with Gardener needs. We will have to contribute there before we can migrate to CSI. Hence, postponing this issue until 1.19.

[rfranzke]

We should only adopt CSI for the OpenStack extension beginning with Kubernetes 1.18 according to the beta promotion plan: https://kubernetes.io/blog/2019/12/09/kubernetes-1-17-feature-csi-migration-beta/

[rfranzke]

Adopting CSI together with support for 1.18 seems to be a good plan:

• The OpenStack Cinder CSI driver migration feature is still alpha, but according to this document it will be promoted to beta with 1.18.
• The CSI migration process is not yet sufficiently documented (there is only https://kubernetes.io/blog/2019/12/09/kubernetes-1-17-feature-csi-migration-beta/ and the design proposal). SIG storage might work on a dedicated migration instruction document, let's see. Particularly, it seems that it is necessary to drain the worker nodes before enabling the CSIMigration* feature gates on the kubelet --> introducing the CSI migration together with a minor release update seems feasible as we get new nodes anyways here and don't need to implement special migration logic.
• There is an open bug with deleting volumes that have been provisioned with the in-tree volume plugin (i.e., prior CSI migration): kubernetes/kubernetes#79043. SIG storage is working on a fix (and it will probably be cherry-picked to 1.17, but for the mentioned reasons above migrating to CSI with 1.18 seems to make most sense).

[rfranzke]

I opened kubernetes/cloud-provider-openstack#1021 to allow disabling the individual driver services so that we can run the controller service in the seed and the node service in the shoot. However, the node service is also still depending on/requiring the cloud config and the OpenStack credentials. Anyways, this is already like it is today (the kubelet needs the credentials today as well), so it's at least not getting worse with CSI. kubernetes/cloud-provider-openstack#1020 was opened to track this.

[vlerenc]

Wow, despite CSI still. I saw @kayrus opened the ticket. Thanks!