Allow running firewall-controller from PRs

[Gerrit91]

Currently we rely on Github releases and assets / the semver version of a release such that we have no simple way of running the firewall-controller from a pull request.

Maybe there is some way to make this possible?

[Gerrit91]

Here's a small idea that establishes some more similarities to our other artifacts:

• Publish PR and release binaries on images.metal-stack.io as well (this way we also have a backup of Github releases)
• Add available firewall-controller versions for a user to choose from to the CloudProfile, analogue to OS images and firewall images (https://github.com/metal-stack/gardener-extension-provider-metal/blob/master/pkg/apis/metal/v1alpha1/types_cloudprofile.go#L27-L28)
  • This way, we can validate updates through the webhook validation and prevent users from entering unmanaged versions
  • We have to include the download URLs in the CloudProfile, too
• Another benefit to me is that we can get rid off the Github Asset dependency, which is locking us to a certain provider + uses an API with rate limiting

[Gerrit91]

We should remove the CRD deployment from the gardener-extension-provider-metal and just let the firewall-controller deploy the CRDs. This will likely cause a slowdown in cluster provisioning time since the controller has to wait until the firewall-controller was able to deploy the CRD definitions.

[mwindower]

CRD needs to be deployed in the gepm - otherwise it would remove it on reconcilation.

[eberlep]

Done