Deploy lakom based on deployseedresources flag

hack/api-reference/config.md

@@ -128,6 +128,17 @@ bool
 <p>AllowInsecureRegistries allows Lakom to use HTTP for communication with the registries</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>deploySeedResources</code></br>
+<em>
+bool
+</em>
+</td>
+<td>
+<p>DeploySeedResources instruct the lakom-controller whether it should deploy lakom to the seed cluster.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="lakom.extensions.config.gardener.cloud/v1alpha1.DebugConfig">DebugConfig

pkg/apis/config/types.go

@@ -33,6 +33,8 @@ type Configuration struct {
 	// AllowInsecureRegistries sets the lakom webhook to allow HTTP communication with OCI registries.
 	// It first tries HTTPS and then falls back to HTTP.
 	AllowInsecureRegistries bool
+	// DeploySeedResources instruct the lakom-controller whether it should deploy lakom to the seed cluster.
+	DeploySeedResources bool
 }
 
 // DebugConfig contains debug configurations for the controller.

pkg/apis/config/v1alpha1/types.go

@@ -36,6 +36,8 @@ type Configuration struct {
 	AllowUntrustedImages bool `json:"allowUntrustedImages"`
 	// AllowInsecureRegistries allows Lakom to use HTTP for communication with the registries
 	AllowInsecureRegistries bool `json:"allowInsecureRegistries"`
+	// DeploySeedResources instruct the lakom-controller whether it should deploy lakom to the seed cluster.
+	DeploySeedResources bool `json:"deploySeedResources"`
 }
 
 // DebugConfig contains debug configurations for the controller.

pkg/controller/seed/reconciler.go

@@ -80,6 +80,16 @@ func (kcr *kubeSystemReconciler) reconcile(ctx context.Context, logger logr.Logg
 	const (
 		kubeSystemNamespaceName = metav1.NamespaceSystem
 	)
+	var (
+		ownerNamespace = kcr.serviceConfig.SeedBootstrap.OwnerNamespace
+	)
+
+	if !kcr.serviceConfig.DeploySeedResources {
+		if err := managedresources.DeleteForSeed(ctx, kcr.client, ownerNamespace, constants.ManagedResourceNamesSeed); err != nil {
+			return err
+		}
+		return nil
+	}
 
 	secretsConfig := ConfigsFor(kubeSystemNamespaceName)
 	secretsManager, err := secretsmanager.New(ctx, logger.WithName("seed-secretsmanager"), clock.RealClock{}, kcr.client, kubeSystemNamespaceName, ManagerIdentity, secretsmanager.Config{CASecretAutoRotation: true})
@@ -122,10 +132,6 @@ func (kcr *kubeSystemReconciler) reconcile(ctx context.Context, logger logr.Logg
 		return err
 	}
 
-	var (
-		ownerNamespace = kcr.serviceConfig.SeedBootstrap.OwnerNamespace
-	)
-
 	if err := managedresources.CreateForSeed(ctx, kcr.client, ownerNamespace, constants.ManagedResourceNamesSeed, false, resources); err != nil {
 		return err
 	}