Unable to create a Shoot when ManagedIstio and APIServerSNI feature gates are disabled

[ialidzhikov]

/area quality
/kind bug
/platform aws

What happened:
It is currently not possible to create a Shoot with aws-lb-readvertiser (ManagedIstio and APIServerSNI feature gates are disabled).

What you expected to happen:
To be able to create a Shoot when ManagedIstio and APIServerSNI feature gates are disabled.

How to reproduce it (as minimally and precisely as possible):

1. Start gardenlet with ManagedIstio and APIServerSNI feature gates are disabled.

2. Create a Shoot.

3. Make sure that the Shoot creation fails while waiting the VPN connection to be established.

After investigation we see that the kubernetes.default svc does not have any endpoint:

$ k get svc
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.223.0.1   <none>        443/TCP   6m1s

$ k get ep
No resources found in default namespace.

Logs of aws-lb-readvertiser:

E0419 12:42:48.181163       1 reflector.go:178] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:aws-lb-readvertiser" cannot list resource "endpoints" in API group "" at the cluster scope
E0419 12:43:24.612774       1 reflector.go:178] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:aws-lb-readvertiser" cannot list resource "endpoints" in API group "" at the cluster scope
E0419 12:44:06.036715       1 reflector.go:178] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:aws-lb-readvertiser" cannot list resource "endpoints" in API group "" at the cluster scope
E0419 12:44:45.580903       1 reflector.go:178] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:aws-lb-readvertiser" cannot list resource "endpoints" in API group "" at the cluster scope
E0419 12:45:29.654929       1 reflector.go:178] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:aws-lb-readvertiser" cannot list resource "endpoints" in API group "" at the cluster scope
E0419 12:46:08.150211       1 reflector.go:178] k8s.io/client-go/informers/factory.go:135: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:aws-lb-readvertiser" cannot list resource "endpoints" in API group "" at the cluster scope

Anything else we need to know?:

Environment:

• Gardener version (if relevant):
• Extension version: v1.34.4
• Kubernetes version (use kubectl version):
• Cloud provider or hardware configuration:
• Others: