Gardener: Invalid health checks for shoots w/ confineSpecUpdateRollout

[timuthy]

How to categorize this issue?

/area control-plane
/area operations
/kind bug
/priority normal

What happened:
The confineSpecUpdateRollout (https://github.com/gardener/gardener/pull/2233) feature leads to shoot specs which will get active during the next maintenance window (or manual reconciliation) only. Gardener on the contrary determines the set of required health checks for an individual shoot based on exactly these yet inactive specs and this can lead to failed conditions until the spec gets active.

What you expected to happen:
The set of executed health checks is based on the actual/active spec of the shoot cluster.

Anything else we need to know?:
https://github.com/gardener/gardener/pull/2698/commits/7ddaf77a94f591e67077d4a41164f50e1cf3397c already changed this behavior for VPA, and cluster autoscaler deployment checks but other places might still be missing, e.g. Alertmanager.

Environment:

• Gardener version: v1.8.0

[gardener-robot]

@timuthy Label area/operations does not exist.

[rfranzke]

/touch
We hit this again, see #3183. /cc @timebertt
If time allows, we should refactor these health conditions to make them less error-prone, and more easy and intuitive to use.

[timuthy]

/assign