diff --git a/frontend/__fixtures__/cloudprofiles.js b/frontend/__fixtures__/cloudprofiles.js
index 2dd300fc89..e7134d92a5 100644
--- a/frontend/__fixtures__/cloudprofiles.js
+++ b/frontend/__fixtures__/cloudprofiles.js
@@ -4,6 +4,118 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
+const DEFAULT_ARCHITECTURE = 'amd64'
+
+const createMachineType = ({
+  name,
+  cpu,
+  memory,
+  gpu = '0',
+  architecture = DEFAULT_ARCHITECTURE,
+  usable = true,
+  storage,
+}) => ({
+  name,
+  cpu,
+  gpu,
+  memory,
+  usable,
+  architecture,
+  ...(storage ? { storage: { ...storage } } : {}),
+})
+
+const createVolumeType = ({
+  name,
+  class: volumeClass,
+  usable = true,
+  minSize,
+}) => ({
+  name,
+  class: volumeClass,
+  usable,
+  ...(minSize ? { minSize } : {}),
+})
+
+const createZone = ({
+  name,
+  unavailableMachineTypes,
+  unavailableVolumeTypes,
+}) => ({
+  name,
+  ...(unavailableMachineTypes ? { unavailableMachineTypes } : {}),
+  ...(unavailableVolumeTypes ? { unavailableVolumeTypes } : {}),
+})
+
+const createRegion = ({
+  name,
+  zones,
+  accessRestrictions,
+}) => ({
+  name,
+  zones,
+  ...(accessRestrictions?.length
+    ? {
+        accessRestrictions: accessRestrictions.map(name => ({ name })),
+      }
+    : {}),
+})
+
+const createCloudProfile = ({
+  metadataName,
+  displayName,
+  type,
+  seedNames,
+  providerConfig,
+  machineTypes,
+  regions,
+  volumeTypes,
+  kubernetes = { versions: [...kubernetesVersions] },
+  machineImagesProfile = [...machineImages],
+}) => ({
+  metadata: {
+    name: metadataName,
+    annotations: {
+      'garden.sapcloud.io/displayName': displayName,
+    },
+  },
+  spec: {
+    ...(seedNames ? { seedNames } : {}),
+    kubernetes,
+    machineImages: machineImagesProfile,
+    machineTypes,
+    providerConfig,
+    regions,
+    type,
+    ...(volumeTypes ? { volumeTypes } : {}),
+  },
+})
+
+const createOpenstackMachineTypes = ({ prefix, gpuType }) => {
+  const storage = {
+    class: 'standard',
+    size: '64Gi',
+    type: 'default',
+  }
+  return [
+    createMachineType({ name: `${prefix}_c2_m16`, cpu: '2', memory: '16Gi', storage }),
+    createMachineType({ name: `${prefix}_c4_m32`, cpu: '4', memory: '32Gi', storage }),
+    createMachineType({ name: `${prefix}_c8_m64`, cpu: '8', memory: '64Gi', storage }),
+    createMachineType({ name: `${prefix}_c16_m128`, cpu: '16', memory: '128Gi', storage }),
+    createMachineType({ name: `${prefix}_c32_m256`, cpu: '32', memory: '256Gi', storage }),
+    createMachineType({
+      name: gpuType,
+      cpu: '32',
+      gpu: '3',
+      memory: '384Gi',
+      storage: {
+        class: 'standard',
+        size: '1966Gi',
+        type: 'default',
+      },
+    }),
+  ]
+}
+
 export const kubernetesVersions = [
   {
     version: '1.29.2',
@@ -153,1007 +265,610 @@ export const machineImages = [
   },
 ]
 
+const alicloudMachineTypes = [
+  createMachineType({ name: 'ecs.c1.small', cpu: '8', memory: '8Gi' }),
+  createMachineType({ name: 'ecs.c2.medium', cpu: '16', memory: '16Gi' }),
+  createMachineType({ name: 'ecs.c2.large', cpu: '16', memory: '32Gi' }),
+  createMachineType({ name: 'ecs.c2.xlarge', cpu: '16', memory: '64Gi' }),
+  createMachineType({ name: 'ecs.c6.large', cpu: '2', memory: '4Gi' }),
+  createMachineType({ name: 'ecs.c6.xlarge', cpu: '4', memory: '8Gi' }),
+]
+
+const awsMachineTypes = [
+  createMachineType({ name: 'm4.large', cpu: '2', memory: '8Gi' }),
+  createMachineType({ name: 'm4.xlarge', cpu: '4', memory: '16Gi' }),
+  createMachineType({ name: 'm4.2xlarge', cpu: '8', memory: '32Gi' }),
+  createMachineType({ name: 'a1.large', cpu: '2', memory: '4Gi', architecture: 'arm64' }),
+  createMachineType({ name: 'a1.xlarge', cpu: '4', memory: '8Gi', architecture: 'arm64' }),
+  createMachineType({ name: 'a1.2xlarge', cpu: '8', memory: '16Gi', architecture: 'arm64' }),
+  createMachineType({ name: 'g5.large', cpu: '2', memory: '8Gi', gpu: '1' }),
+  createMachineType({ name: 'g5.xlarge', cpu: '4', memory: '16Gi', gpu: '1' }),
+  createMachineType({ name: 'g5.2xlarge', cpu: '8', memory: '32Gi', gpu: '1' }),
+]
+
+const azureMachineTypes = [
+  createMachineType({ name: 'Standard_A4_v2', cpu: '4', memory: '8Gi' }),
+  createMachineType({ name: 'Basic_A3', cpu: '4', memory: '7Gi' }),
+  createMachineType({ name: 'Basic_A4', cpu: '8', memory: '14Gi' }),
+]
+
+const gcpMachineTypes = [
+  createMachineType({ name: 'n1-standard-2', cpu: '2', memory: '7Gi' }),
+  createMachineType({ name: 'n1-standard-4', cpu: '4', memory: '15Gi' }),
+  createMachineType({ name: 'n1-standard-8', cpu: '8', memory: '30Gi' }),
+  createMachineType({ name: 'n1-standard-16', cpu: '16', memory: '60Gi' }),
+  createMachineType({ name: 't2a-standard-2', cpu: '2', memory: '8Gi', architecture: 'arm64' }),
+  createMachineType({ name: 't2a-standard-4', cpu: '4', memory: '16Gi', architecture: 'arm64' }),
+  createMachineType({ name: 't2a-standard-8', cpu: '8', memory: '32Gi', architecture: 'arm64' }),
+  createMachineType({ name: 't2a-standard-16', cpu: '16', memory: '64Gi', architecture: 'arm64' }),
+]
+
+const metalMachineTypes = [
+  createMachineType({ name: 'c1-metal-small', cpu: '2', memory: '4Gi' }),
+  createMachineType({ name: 'c1-metal-medium', cpu: '4', memory: '8Gi' }),
+]
+
+const onmetalMachineTypes = [
+  createMachineType({ name: 'c1-onmetal-small', cpu: '2', memory: '4Gi' }),
+  createMachineType({ name: 'c1-onmetal-medium', cpu: '4', memory: '8Gi' }),
+]
+
+const localMachineTypes = [
+  createMachineType({ name: 'local-dev-small', cpu: '2', memory: '4Gi' }),
+]
+
+const hcloudMachineTypes = [
+  createMachineType({ name: 'cpx11', cpu: '2', memory: '2Gi' }),
+  createMachineType({ name: 'cpx21', cpu: '3', memory: '4Gi' }),
+]
+
+const stackitMachineTypes = [
+  createMachineType({ name: 'stackit-machine-1', cpu: '2', memory: '8Gi' }),
+  createMachineType({ name: 'stackit-machine-2', cpu: '4', memory: '16Gi' }),
+]
+
+const vsphereMachineTypes = [
+  createMachineType({ name: 'vsphere-machine-1', cpu: '2', memory: '4Gi' }),
+  createMachineType({ name: 'vsphere-machine-2', cpu: '4', memory: '8Gi' }),
+]
+
+const openstack1MachineTypes = createOpenstackMachineTypes({
+  prefix: 'g',
+  gpuType: 'xg1bcm1.medium',
+})
+
+const openstack2MachineTypes = createOpenstackMachineTypes({
+  prefix: 'm',
+  gpuType: 'zg1bcm1.medium',
+})
+
 export default [
-  {
-    metadata: {
-      name: 'alicloud',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'Alibaba Cloud',
-      },
+  createCloudProfile({
+    metadataName: 'alicloud',
+    displayName: 'Alibaba Cloud',
+    type: 'alicloud',
+    machineTypes: alicloudMachineTypes,
+    providerConfig: {
+      apiVersion: 'alicloud.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
     },
-    spec: {
-      kubernetes: {
-        versions: [
-          ...kubernetesVersions,
+    regions: [
+      createRegion({
+        name: 'eu-central-1',
+        zones: [
+          createZone({ name: 'eu-central-1a' }),
+          createZone({ name: 'eu-central-1b' }),
+          createZone({
+            name: 'eu-central-1c',
+            unavailableMachineTypes: [
+              alicloudMachineTypes[0].name,
+              alicloudMachineTypes[1].name,
+            ],
+            unavailableVolumeTypes: [
+              'cloud_ssd',
+            ],
+          }),
         ],
-      },
-      machineImages: [
-        ...machineImages,
-      ],
-      machineTypes: [
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '8Gi',
-          name: 'ecs.c1.small',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '16Gi',
-          name: 'ecs.c2.medium',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '32Gi',
-          name: 'ecs.c2.large',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '64Gi',
-          name: 'ecs.c2.xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '4Gi',
-          name: 'ecs.c6.large',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '8Gi',
-          name: 'ecs.c6.xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'alicloud.provider.extensions.gardener.cloud/v1alpha1',
-        kind: 'CloudProfileConfig',
-      },
-      regions: [
-        {
-          name: 'eu-central-1',
-          zones: [
-            {
-              name: 'eu-central-1a',
-            },
-            {
-              name: 'eu-central-1b',
-            },
-            {
-              name: 'eu-central-1c',
-              unavailableMachineTypes: [
-                'ecs.c1.small',
-                'ecs.c2.medium',
-              ],
-              unavailableVolumeTypes: [
-                'cloud_ssd',
-              ],
-            },
-          ],
-        },
-        {
-          name: 'us-east-1',
-          zones: [
-            {
-              name: 'us-east-1a',
-            },
-            {
-              name: 'us-east-1b',
-            },
-          ],
-        },
-      ],
-      type: 'alicloud',
-      volumeTypes: [
-        {
-          class: 'standard',
-          name: 'cloud',
-          usable: true,
-        },
-        {
-          class: 'standard',
-          name: 'cloud_efficiency',
-          usable: true,
-        },
-        {
-          class: 'premium',
-          name: 'cloud_ssd',
-          usable: true,
-        },
-      ],
-    },
-  },
-  {
-    metadata: {
-      name: 'aws',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'aws',
-      },
-    },
-    spec: {
-      seedNames: [
-        'aws-ha',
-      ],
-      kubernetes: {
-        versions: [
-          ...kubernetesVersions,
+      }),
+      createRegion({
+        name: 'us-east-1',
+        zones: [
+          createZone({ name: 'us-east-1a' }),
+          createZone({ name: 'us-east-1b' }),
         ],
-      },
-      machineImages: [
-        ...machineImages,
-      ],
-      machineTypes: [
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '8Gi',
-          name: 'm4.large',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '16Gi',
-          name: 'm4.xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '32Gi',
-          name: 'm4.2xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '4Gi',
-          name: 'a1.large',
-          usable: true,
-          architecture: 'arm64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '8Gi',
-          name: 'a1.xlarge',
-          usable: true,
-          architecture: 'arm64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '16Gi',
-          name: 'a1.2xlarge',
-          usable: true,
-          architecture: 'arm64',
-        },
-        {
-          cpu: '2',
-          gpu: '1',
-          memory: '8Gi',
-          name: 'g5.large',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '1',
-          memory: '16Gi',
-          name: 'g5.xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '8',
-          gpu: '1',
-          memory: '32Gi',
-          name: 'g5.2xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
-        kind: 'CloudProfileConfig',
-      },
-      regions: [
-        {
-          name: 'eu-central-1',
-          zones: [
-            {
-              name: 'eu-central-1a',
-            },
-            {
-              name: 'eu-central-1b',
-            },
-            {
-              name: 'eu-central-1c',
-              unavailableMachineTypes: [
-                'm4.large',
-                'a1.large',
-                'g5.large',
-              ],
-              unavailableVolumeTypes: [
-                'gp3',
-                'io1',
-              ],
-            },
-          ],
-          accessRestrictions: [{
-            name: 'eu-access-only',
-          }],
-        },
-        {
-          name: 'eu-west-1',
-          zones: [
-            {
-              name: 'eu-west-1a',
-            },
-            {
-              name: 'eu-west-1b',
-            },
-            {
-              name: 'eu-west-1c',
-              unavailableMachineTypes: [
-                'm4.xlarge',
-                'a1.xlarge',
-                'g5.xlarge',
-              ],
-              unavailableVolumeTypes: [
-                'io1',
-              ],
-            },
-          ],
-          accessRestrictions: [{
-            name: 'eu-access-only',
-          }],
-        },
-        {
-          name: 'us-east-1',
-          zones: [
-            {
-              name: 'us-east-1a',
-            },
-            {
-              name: 'us-east-1b',
-            },
-            {
-              name: 'us-east-1c',
-            },
-            {
-              name: 'us-east-1d',
-            },
-          ],
-        },
-      ],
-      type: 'aws',
-      volumeTypes: [
-        {
-          class: 'standard',
-          name: 'gp3',
-          usable: true,
-        },
-        {
-          class: 'standard',
-          name: 'gp2',
-          usable: true,
-        },
-        {
-          class: 'standard',
-          name: 'io1',
-          usable: true,
-          minSize: '4Gi',
-        },
-      ],
-    },
-  },
-  {
-    metadata: {
-      name: 'az',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'Azure',
-      },
+      }),
+    ],
+    volumeTypes: [
+      createVolumeType({ name: 'cloud', class: 'standard' }),
+      createVolumeType({ name: 'cloud_efficiency', class: 'standard' }),
+      createVolumeType({ name: 'cloud_ssd', class: 'premium' }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'aws',
+    displayName: 'aws',
+    type: 'aws',
+    seedNames: [
+      'aws-ha',
+    ],
+    machineTypes: awsMachineTypes,
+    providerConfig: {
+      apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
     },
-    spec: {
-      seedNames: [
-        'az-ha',
-      ],
-      kubernetes: {
-        versions: [
-          ...kubernetesVersions,
+    regions: [
+      createRegion({
+        name: 'eu-central-1',
+        zones: [
+          createZone({ name: 'eu-central-1a' }),
+          createZone({ name: 'eu-central-1b' }),
+          createZone({
+            name: 'eu-central-1c',
+            unavailableMachineTypes: [
+              awsMachineTypes[0].name,
+              awsMachineTypes[3].name,
+              awsMachineTypes[6].name,
+            ],
+            unavailableVolumeTypes: [
+              'gp3',
+              'io1',
+            ],
+          }),
         ],
-      },
-      machineImages: [
-        ...machineImages,
-      ],
-      machineTypes: [
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '8Gi',
-          name: 'Standard_A4_v2',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '7Gi',
-          name: 'Basic_A3',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '14Gi',
-          name: 'Basic_A4',
-          usable: true,
-          architecture: 'amd64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'azure.provider.extensions.gardener.cloud/v1alpha1',
-        kind: 'CloudProfileConfig',
-      },
-      regions: [
-        {
-          name: 'westeurope',
-          zones: [
-            {
-              name: '1',
-            },
-            {
-              name: '2',
-            },
-            {
-              name: '3',
-              unavailableMachineTypes: [
-                'Standard_A4_v2',
-              ],
-              unavailableVolumeTypes: [
-                'StandardSSD_LRS',
-              ],
-            },
-          ],
-          accessRestrictions: [{
-            name: 'eu-access-only',
-          }],
-        },
-        {
-          name: 'eastus',
-          zones: [
-            {
-              name: '1',
-            },
-            {
-              name: '2',
-            },
-            {
-              name: '3',
-            },
-          ],
-        },
-      ],
-      type: 'azure',
-      volumeTypes: [
-        {
-          class: 'premium',
-          name: 'StandardSSD_LRS',
-          usable: true,
-          minSize: '20Gi',
-        },
-        {
-          class: 'standard',
-          name: 'Standard_LRS',
-          usable: true,
-          minSize: '20Gi',
-        },
-        {
-          class: 'premium',
-          name: 'Premium_LRS',
-          usable: true,
-          minSize: '20Gi',
-        },
-      ],
-    },
-  },
-  {
-    metadata: {
-      name: 'openstack-1',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'Openstack 1',
-      },
+        accessRestrictions: ['eu-access-only'],
+      }),
+      createRegion({
+        name: 'eu-west-1',
+        zones: [
+          createZone({ name: 'eu-west-1a' }),
+          createZone({ name: 'eu-west-1b' }),
+          createZone({
+            name: 'eu-west-1c',
+            unavailableMachineTypes: [
+              awsMachineTypes[1].name,
+              awsMachineTypes[4].name,
+              awsMachineTypes[7].name,
+            ],
+            unavailableVolumeTypes: [
+              'io1',
+            ],
+          }),
+        ],
+        accessRestrictions: ['eu-access-only'],
+      }),
+      createRegion({
+        name: 'us-east-1',
+        zones: [
+          createZone({ name: 'us-east-1a' }),
+          createZone({ name: 'us-east-1b' }),
+          createZone({ name: 'us-east-1c' }),
+          createZone({ name: 'us-east-1d' }),
+        ],
+      }),
+    ],
+    volumeTypes: [
+      createVolumeType({ name: 'gp3', class: 'standard' }),
+      createVolumeType({ name: 'gp2', class: 'standard' }),
+      createVolumeType({ name: 'io1', class: 'standard', minSize: '4Gi' }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'az',
+    displayName: 'Azure',
+    type: 'azure',
+    seedNames: [
+      'az-ha',
+    ],
+    machineTypes: azureMachineTypes,
+    providerConfig: {
+      apiVersion: 'azure.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
     },
-    spec: {
-      seedNames: [
-        'openstack-ha',
-      ],
-      kubernetes: {
-        versions: [
-          ...kubernetesVersions,
+    regions: [
+      createRegion({
+        name: 'westeurope',
+        zones: [
+          createZone({ name: '1' }),
+          createZone({ name: '2' }),
+          createZone({
+            name: '3',
+            unavailableMachineTypes: [
+              azureMachineTypes[0].name,
+            ],
+            unavailableVolumeTypes: [
+              'StandardSSD_LRS',
+            ],
+          }),
         ],
-      },
-      machineImages: [
-        ...machineImages,
-      ],
-      machineTypes: [
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '16Gi',
-          name: 'g_c2_m16',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
-          },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '32Gi',
-          name: 'g_c4_m32',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
-          },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '64Gi',
-          name: 'g_c8_m64',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
-          },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '128Gi',
-          name: 'g_c16_m128',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
+        accessRestrictions: ['eu-access-only'],
+      }),
+      createRegion({
+        name: 'eastus',
+        zones: [
+          createZone({ name: '1' }),
+          createZone({ name: '2' }),
+          createZone({ name: '3' }),
+        ],
+      }),
+    ],
+    volumeTypes: [
+      createVolumeType({ name: 'StandardSSD_LRS', class: 'premium', minSize: '20Gi' }),
+      createVolumeType({ name: 'Standard_LRS', class: 'standard', minSize: '20Gi' }),
+      createVolumeType({ name: 'Premium_LRS', class: 'premium', minSize: '20Gi' }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'openstack-1',
+    displayName: 'Openstack 1',
+    type: 'openstack',
+    seedNames: [
+      'openstack-ha',
+    ],
+    machineTypes: openstack1MachineTypes,
+    providerConfig: {
+      apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
+      constraints: {
+        floatingPools: [
+          {
+            name: 'FloatingIP*',
+            region: 'eu-de-1',
           },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '32',
-          gpu: '0',
-          memory: '256Gi',
-          name: 'g_c32_m256',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
+          {
+            name: 'FloatingIP*',
+            region: 'na-us-1',
           },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '32',
-          gpu: '3',
-          memory: '384Gi',
-          name: 'xg1bcm1.medium',
-          storage: {
-            class: 'standard',
-            size: '1966Gi',
-            type: 'default',
+        ],
+        loadBalancerProviders: [
+          {
+            name: 'f5',
           },
-          usable: true,
-          architecture: 'amd64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
-        constraints: {
-          floatingPools: [
-            {
-              name: 'FloatingIP*',
-              region: 'eu-de-1',
-            },
-            {
-              name: 'FloatingIP*',
-              region: 'na-us-1',
-            },
-          ],
-          loadBalancerProviders: [
-            {
-              name: 'f5',
-            },
-          ],
-        },
-        kind: 'CloudProfileConfig',
-      },
-      regions: [
-        {
-          name: 'eu-de-1',
-          zones: [
-            {
-              name: 'eu-de-1a',
-            },
-            {
-              name: 'eu-de-1b',
-            },
-            {
-              name: 'eu-de-1d',
-              unavailableMachineTypes: [
-                'g_c2_m16',
-              ],
-            },
-          ],
-          accessRestrictions: [{
-            name: 'eu-access-only',
-          }],
-        },
-        {
-          name: 'na-us-1',
-          zones: [
-            {
-              name: 'na-us-1a',
-            },
-            {
-              name: 'na-us-1b',
-            },
-            {
-              name: 'na-us-1d',
-            },
-          ],
-        },
-      ],
-      type: 'openstack',
-    },
-  },
-  {
-    metadata: {
-      name: 'openstack-2',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'Openstack 2',
+        ],
       },
+      kind: 'CloudProfileConfig',
     },
-    spec: {
-      seedNames: [
-        'openstack-ha',
-      ],
-      kubernetes: {
-        versions: [
-          ...kubernetesVersions,
+    regions: [
+      createRegion({
+        name: 'eu-de-1',
+        zones: [
+          createZone({ name: 'eu-de-1a' }),
+          createZone({ name: 'eu-de-1b' }),
+          createZone({
+            name: 'eu-de-1d',
+            unavailableMachineTypes: [
+              openstack1MachineTypes[0].name,
+            ],
+          }),
         ],
-      },
-      machineImages: [
-        ...machineImages,
-      ],
-      machineTypes: [
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '16Gi',
-          name: 'm_c2_m16',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
-          },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '32Gi',
-          name: 'm_c4_m32',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
-          },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '64Gi',
-          name: 'm_c8_m64',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
-          },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '128Gi',
-          name: 'm_c16_m128',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
+        accessRestrictions: ['eu-access-only'],
+      }),
+      createRegion({
+        name: 'na-us-1',
+        zones: [
+          createZone({ name: 'na-us-1a' }),
+          createZone({ name: 'na-us-1b' }),
+          createZone({ name: 'na-us-1d' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'openstack-2',
+    displayName: 'Openstack 2',
+    type: 'openstack',
+    seedNames: [
+      'openstack-ha',
+    ],
+    machineTypes: openstack2MachineTypes,
+    providerConfig: {
+      apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
+      constraints: {
+        floatingPools: [
+          {
+            defaultFloatingSubnet: 'FloatingIP-intranet-*',
+            loadBalancerClasses: [
+              {
+                floatingSubnetName: 'FloatingIP-internet-*',
+                name: 'internet',
+              },
+              {
+                floatingSubnetName: 'FloatingIP-intranet-*',
+                name: 'intranet',
+                purpose: 'default',
+              },
+            ],
+            name: 'FloatingIP*',
+            region: 'eu-de-2',
           },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '32',
-          gpu: '0',
-          memory: '256Gi',
-          name: 'm_c32_m256',
-          storage: {
-            class: 'standard',
-            size: '64Gi',
-            type: 'default',
+          {
+            defaultFloatingSubnet: 'FloatingIP-intranet-*',
+            loadBalancerClasses: [
+              {
+                floatingSubnetName: 'FloatingIP-internet-*',
+                name: 'internet',
+              },
+              {
+                floatingSubnetName: 'FloatingIP-intranet-*',
+                name: 'intranet',
+                purpose: 'default',
+              },
+            ],
+            name: 'FloatingIP*',
+            region: 'na-us-2',
           },
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '32',
-          gpu: '3',
-          memory: '384Gi',
-          name: 'zg1bcm1.medium',
-          storage: {
-            class: 'standard',
-            size: '1966Gi',
-            type: 'default',
+        ],
+        loadBalancerProviders: [
+          {
+            name: 'f5',
           },
-          usable: true,
-          architecture: 'amd64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
-        constraints: {
-          floatingPools: [
-            {
-              defaultFloatingSubnet: 'FloatingIP-intranet-*',
-              loadBalancerClasses: [
-                {
-                  floatingSubnetName: 'FloatingIP-internet-*',
-                  name: 'internet',
-                },
-                {
-                  floatingSubnetName: 'FloatingIP-intranet-*',
-                  name: 'intranet',
-                  purpose: 'default',
-                },
-              ],
-              name: 'FloatingIP*',
-              region: 'eu-de-2',
-            },
-            {
-              defaultFloatingSubnet: 'FloatingIP-intranet-*',
-              loadBalancerClasses: [
-                {
-                  floatingSubnetName: 'FloatingIP-internet-*',
-                  name: 'internet',
-                },
-                {
-                  floatingSubnetName: 'FloatingIP-intranet-*',
-                  name: 'intranet',
-                  purpose: 'default',
-                },
-              ],
-              name: 'FloatingIP*',
-              region: 'na-us-2',
-            },
-          ],
-          loadBalancerProviders: [
-            {
-              name: 'f5',
-            },
-          ],
-        },
-        kind: 'CloudProfileConfig',
+        ],
       },
-      regions: [
-        {
-          name: 'eu-de-2',
-          zones: [
-            {
-              name: 'eu-de-2a',
-            },
-            {
-              name: 'eu-de-2b',
-            },
-            {
-              name: 'eu-de-2d',
-              unavailableMachineTypes: [
-                'm_c2_m16',
-              ],
-            },
-          ],
-          accessRestrictions: [{
-            name: 'eu-access-only',
-          }],
-        },
-        {
-          name: 'na-us-2',
-          zones: [
-            {
-              name: 'na-us-2a',
-            },
-            {
-              name: 'na-us-2b',
-            },
-            {
-              name: 'na-us-2d',
-            },
-          ],
-        },
-      ],
-      type: 'openstack',
+      kind: 'CloudProfileConfig',
     },
-  },
-  {
-    metadata: {
-      name: 'gcp',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'Google Cloud',
-      },
+    regions: [
+      createRegion({
+        name: 'eu-de-2',
+        zones: [
+          createZone({ name: 'eu-de-2a' }),
+          createZone({ name: 'eu-de-2b' }),
+          createZone({
+            name: 'eu-de-2d',
+            unavailableMachineTypes: [
+              openstack2MachineTypes[0].name,
+            ],
+          }),
+        ],
+        accessRestrictions: ['eu-access-only'],
+      }),
+      createRegion({
+        name: 'na-us-2',
+        zones: [
+          createZone({ name: 'na-us-2a' }),
+          createZone({ name: 'na-us-2b' }),
+          createZone({ name: 'na-us-2d' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'gcp',
+    displayName: 'Google Cloud',
+    type: 'gcp',
+    seedNames: [
+      'gcp-ha',
+    ],
+    machineTypes: gcpMachineTypes,
+    providerConfig: {
+      apiVersion: 'gcp.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
     },
-    spec: {
-      seedNames: [
-        'gcp-ha',
-      ],
-      kubernetes: {
-        versions: [
-          ...kubernetesVersions,
+    regions: [
+      createRegion({
+        name: 'europe-west1',
+        zones: [
+          createZone({ name: 'europe-west1-b' }),
+          createZone({ name: 'europe-west1-c' }),
+          createZone({
+            name: 'europe-west1-d',
+            unavailableMachineTypes: [
+              gcpMachineTypes[0].name,
+              gcpMachineTypes[1].name,
+              gcpMachineTypes[4].name,
+              gcpMachineTypes[6].name,
+            ],
+            unavailableVolumeTypes: [
+              'pd-balanced',
+              'pd-ssd',
+            ],
+          }),
         ],
-      },
-      machineImages: [
-        ...machineImages,
-      ],
-      machineTypes: [
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '7Gi',
-          name: 'n1-standard-2',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '15Gi',
-          name: 'n1-standard-4',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '30Gi',
-          name: 'n1-standard-8',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '60Gi',
-          name: 'n1-standard-16',
-          usable: true,
-          architecture: 'amd64',
-        },
-        {
-          cpu: '2',
-          gpu: '0',
-          memory: '8Gi',
-          name: 't2a-standard-2',
-          usable: true,
-          architecture: 'arm64',
-        },
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '16Gi',
-          name: 't2a-standard-4',
-          usable: true,
-          architecture: 'arm64',
-        },
-        {
-          cpu: '8',
-          gpu: '0',
-          memory: '32Gi',
-          name: 't2a-standard-8',
-          usable: true,
-          architecture: 'arm64',
-        },
-        {
-          cpu: '16',
-          gpu: '0',
-          memory: '64Gi',
-          name: 't2a-standard-16',
-          usable: true,
-          architecture: 'arm64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'gcp.provider.extensions.gardener.cloud/v1alpha1',
-        kind: 'CloudProfileConfig',
-      },
-      regions: [
-        {
-          name: 'europe-west1',
-          zones: [
-            {
-              name: 'europe-west1-b',
-            },
-            {
-              name: 'europe-west1-c',
-            },
-            {
-              name: 'europe-west1-d',
-              unavailableMachineTypes: [
-                'n1-standard-2',
-                'n1-standard-4',
-                't2a-standard-2',
-                't2a-standard-8',
-              ],
-              unavailableVolumeTypes: [
-                'pd-balanced',
-                'pd-ssd',
-              ],
-            },
-          ],
-        },
-        {
-          name: 'us-east1',
-          zones: [
-            {
-              name: 'us-east1-b',
-            },
-            {
-              name: 'us-east1-c',
-            },
-            {
-              name: 'us-east1-d',
-            },
-          ],
-        },
-      ],
-      type: 'gcp',
-      volumeTypes: [
+      }),
+      createRegion({
+        name: 'us-east1',
+        zones: [
+          createZone({ name: 'us-east1-b' }),
+          createZone({ name: 'us-east1-c' }),
+          createZone({ name: 'us-east1-d' }),
+        ],
+      }),
+    ],
+    volumeTypes: [
+      createVolumeType({ name: 'pd-balanced', class: 'premium', minSize: '20Gi' }),
+      createVolumeType({ name: 'pd-standard', class: 'standard', minSize: '20Gi' }),
+      createVolumeType({ name: 'pd-ssd', class: 'premium', minSize: '20Gi' }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'hcloud',
+    displayName: 'Hetzner Cloud',
+    type: 'hcloud',
+    seedNames: [
+      'hcloud-ha',
+    ],
+    machineTypes: hcloudMachineTypes,
+    providerConfig: {
+      apiVersion: 'hcloud.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
+    },
+    regions: [
+      createRegion({
+        name: 'fsn1',
+        zones: [
+          createZone({ name: 'fsn1-dc14' }),
+          createZone({ name: 'fsn1-dc8' }),
+        ],
+      }),
+      createRegion({
+        name: 'hel1',
+        zones: [
+          createZone({ name: 'hel1-dc2' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'metal',
+    displayName: 'Metal',
+    type: 'metal',
+    seedNames: [
+      'metal-ha',
+    ],
+    machineTypes: metalMachineTypes,
+    providerConfig: {
+      apiVersion: 'metal.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
+    },
+    regions: [
+      createRegion({
+        name: 'eu01',
+        zones: [
+          createZone({ name: 'eu01-a' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'onmetal',
+    displayName: 'OnMetal',
+    type: 'onmetal',
+    seedNames: [
+      'onmetal-ha',
+    ],
+    machineTypes: onmetalMachineTypes,
+    providerConfig: {
+      apiVersion: 'onmetal.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
+    },
+    regions: [
+      createRegion({
+        name: 'on01',
+        zones: [
+          createZone({ name: 'on01-a' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'local',
+    displayName: 'Local',
+    type: 'local',
+    machineTypes: localMachineTypes,
+    providerConfig: {
+      apiVersion: 'local.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
+    },
+    regions: [
+      createRegion({
+        name: 'local',
+        zones: [
+          createZone({ name: 'local-a' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'stackit',
+    displayName: 'stackit',
+    type: 'stackit',
+    seedNames: [
+      'stackit-ha',
+    ],
+    machineTypes: stackitMachineTypes,
+    providerConfig: {
+      apiVersion: 'stackit.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
+    },
+    regions: [
+      createRegion({
+        name: 'eu01',
+        zones: [
+          createZone({ name: 'eu01-1' }),
+          createZone({ name: 'eu01-2' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'vsphere',
+    displayName: 'vSphere',
+    type: 'vsphere',
+    seedNames: [
+      'vsphere-ha',
+    ],
+    machineTypes: vsphereMachineTypes,
+    providerConfig: {
+      apiVersion: 'vsphere.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
+    },
+    regions: [
+      createRegion({
+        name: 'region1',
+        zones: [
+          createZone({ name: 'zone1' }),
+          createZone({ name: 'zone2' }),
+        ],
+      }),
+    ],
+  }),
+  createCloudProfile({
+    metadataName: 'ironcore',
+    displayName: 'IronCore',
+    type: 'ironcore',
+    seedNames: [
+      'ironcore-ha',
+    ],
+    kubernetes: {
+      versions: [
         {
-          class: 'premium',
-          name: 'pd-balanced',
-          usable: true,
-          minSize: '20Gi',
+          version: '1.28.4',
         },
         {
-          class: 'standard',
-          name: 'pd-standard',
-          usable: true,
-          minSize: '20Gi',
+          version: '1.27.8',
         },
         {
-          class: 'premium',
-          name: 'pd-ssd',
-          usable: true,
-          minSize: '20Gi',
+          version: '1.26.11',
         },
       ],
     },
-  },
-  {
-    metadata: {
-      name: 'ironcore',
-      annotations: {
-        'garden.sapcloud.io/displayName': 'IronCore',
-      },
-    },
-    spec: {
-      seedNames: [
-        'gcp-ha',
-      ],
-      kubernetes: {
+    machineImagesProfile: [
+      {
+        name: 'gardenlinux',
         versions: [
           {
-            version: '1.28.4',
-          },
-          {
-            version: '1.27.8',
-          },
-          {
-            version: '1.26.11',
+            version: '1312.2.0',
+            cri: [
+              {
+                name: 'containerd',
+              },
+              {
+                name: 'docker',
+              },
+            ],
+            architectures: [
+              'amd64',
+            ],
           },
         ],
+        updateStrategy: 'major',
       },
-      machineImages: [
-        {
-          name: 'gardenlinux',
-          versions: [
-            {
-              version: '1312.2.0',
-              cri: [
-                {
-                  name: 'containerd',
-                },
-                {
-                  name: 'docker',
-                },
-              ],
-              architectures: [
-                'amd64',
-              ],
-            },
-          ],
-          updateStrategy: 'major',
-        },
-      ],
-      machineTypes: [
-        {
-          cpu: '4',
-          gpu: '0',
-          memory: '8Gi',
-          name: 'x3-xlarge',
-          usable: true,
-          architecture: 'amd64',
-        },
-      ],
-      providerConfig: {
-        apiVersion: 'ironcore.provider.extensions.gardener.cloud/v1alpha1',
-        kind: 'CloudProfileConfig',
-      },
-      regions: [
-        {
-          name: 'de-fra',
-          zones: [
-            {
-              name: 'fra3',
-            },
-          ],
-        },
-      ],
-      type: 'ironcore',
-      volumeTypes: [
-        {
-          class: 'standard',
-          name: 'general-purpose',
-          usable: true,
-        },
-        {
-          class: 'premium',
-          name: 'io-optimized',
-          usable: true,
-        },
-      ],
+    ],
+    machineTypes: [
+      createMachineType({ name: 'x3-xlarge', cpu: '4', memory: '8Gi' }),
+    ],
+    providerConfig: {
+      apiVersion: 'ironcore.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'CloudProfileConfig',
     },
-  },
+    regions: [
+      createRegion({
+        name: 'de-fra',
+        zones: [
+          createZone({ name: 'fra3' }),
+        ],
+      }),
+    ],
+    volumeTypes: [
+      createVolumeType({ name: 'general-purpose', class: 'standard' }),
+      createVolumeType({ name: 'io-optimized', class: 'premium' }),
+    ],
+  }),
 ]
diff --git a/frontend/__tests__/components/GGenericInputFields.spec.js b/frontend/__tests__/components/GGenericInputFields.spec.js
new file mode 100644
index 0000000000..889a35eb68
--- /dev/null
+++ b/frontend/__tests__/components/GGenericInputFields.spec.js
@@ -0,0 +1,388 @@
+//
+// SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import { nextTick } from 'vue'
+import {
+  mount,
+  shallowMount,
+} from '@vue/test-utils'
+
+import GGenericInputField from '@/components/GGenericInputField'
+import GGenericInputFields from '@/components/GGenericInputFields'
+
+import { useLogger } from '@/composables/useLogger'
+
+const { createVuetifyPlugin } = global.fixtures.helper
+
+describe('GGenericInputFields', () => {
+  function lastEmittedValue (wrapper) {
+    const emitted = wrapper.emitted('update:modelValue')
+    return emitted[emitted.length - 1][0]
+  }
+
+  it('initializes field data with configured empty defaults', async () => {
+    const wrapper = shallowMount(GGenericInputFields, {
+      props: {
+        fields: [
+          {
+            key: 'TSIGSecretAlgorithm',
+            label: 'TSIG Secret Algorithm',
+            type: 'select',
+            defaultValue: '',
+          },
+        ],
+        modelValue: {},
+      },
+      global: {
+        stubs: {
+          GGenericInputField: true,
+        },
+      },
+    })
+
+    await nextTick()
+
+    expect(lastEmittedValue(wrapper)).toEqual({
+      TSIGSecretAlgorithm: '',
+    })
+  })
+
+  it('keeps existing field data over configured defaults without redundant emit', async () => {
+    const wrapper = shallowMount(GGenericInputFields, {
+      props: {
+        fields: [
+          {
+            key: 'TSIGSecretAlgorithm',
+            label: 'TSIG Secret Algorithm',
+            type: 'select',
+            defaultValue: 'hmac-sha256',
+          },
+        ],
+        modelValue: {
+          TSIGSecretAlgorithm: 'hmac-sha512',
+        },
+      },
+      global: {
+        stubs: {
+          GGenericInputField: true,
+        },
+      },
+    })
+
+    await nextTick()
+
+    expect(wrapper.findComponent(GGenericInputField).props('modelValue')).toBe('hmac-sha512')
+    expect(wrapper.emitted('update:modelValue')).toBeUndefined()
+  })
+
+  it('loads existing field data after initially applying configured defaults', async () => {
+    const wrapper = shallowMount(GGenericInputFields, {
+      props: {
+        fields: [
+          {
+            key: 'AZURE_CLOUD',
+            label: 'Azure Cloud',
+            type: 'select',
+            defaultValue: '',
+          },
+          {
+            key: 'CLIENT_ID',
+            label: 'Client ID',
+            type: 'text',
+          },
+        ],
+        modelValue: {},
+      },
+      global: {
+        stubs: {
+          GGenericInputField: true,
+        },
+      },
+    })
+
+    await nextTick()
+    await wrapper.setProps({
+      modelValue: {
+        AZURE_CLOUD: 'AzureChina',
+        CLIENT_ID: 'client-id',
+      },
+    })
+    await nextTick()
+
+    const fields = wrapper.findAllComponents(GGenericInputField)
+    expect(fields[0].props('modelValue')).toBe('AzureChina')
+    expect(fields[1].props('modelValue')).toBe('client-id')
+    expect(lastEmittedValue(wrapper)).toEqual({
+      AZURE_CLOUD: '',
+    })
+  })
+
+  it('shows the configured empty default as the selected item', async () => {
+    const wrapper = mount(GGenericInputFields, {
+      props: {
+        fields: [
+          {
+            key: 'AZURE_CLOUD',
+            label: 'Azure Cloud',
+            type: 'select',
+            defaultValue: '',
+            values: [
+              {
+                title: 'Provider default (Azure Public)',
+                value: '',
+              },
+              {
+                title: 'AzureChina',
+                value: 'AzureChina',
+              },
+            ],
+          },
+        ],
+        modelValue: {},
+      },
+      global: {
+        plugins: [
+          createVuetifyPlugin(),
+        ],
+      },
+    })
+
+    await nextTick()
+
+    expect(wrapper.findComponent({ name: 'VSelect' }).props('modelValue')).toBe('')
+    expect(wrapper.text()).toContain('Provider default (Azure Public)')
+  })
+
+  it('does not emit when initialized with empty field data and no defaults', async () => {
+    const wrapper = shallowMount(GGenericInputFields, {
+      props: {
+        fields: [
+          {
+            key: 'accessKeyID',
+            label: 'Access Key ID',
+            type: 'text',
+          },
+        ],
+        modelValue: {},
+      },
+      global: {
+        stubs: {
+          GGenericInputField: true,
+        },
+      },
+    })
+
+    await nextTick()
+
+    expect(wrapper.emitted('update:modelValue')).toBeUndefined()
+  })
+})
+
+describe('GGenericInputField', () => {
+  let warnSpy
+  const originalFileReader = globalThis.FileReader
+
+  const TextareaStub = {
+    name: 'VTextarea',
+    props: {
+      modelValue: {
+        type: [String, Object, Number, Boolean],
+      },
+      errorMessages: {
+        type: Array,
+        default: () => [],
+      },
+    },
+    emits: [
+      'update:modelValue',
+      'blur',
+      'click:append',
+    ],
+    template: `
+      <textarea
+        :value="modelValue"
+        @input="$emit('update:modelValue', $event.target.value)"
+        @blur="$emit('blur')"
+      />
+    `,
+  }
+
+  beforeEach(() => {
+    warnSpy = vi.spyOn(useLogger(), 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    warnSpy.mockRestore()
+    vi.stubGlobal('FileReader', originalFileReader)
+  })
+
+  function createDropEvent (files) {
+    const event = new Event('drop', {
+      bubbles: true,
+      cancelable: true,
+    })
+    Object.defineProperty(event, 'dataTransfer', {
+      value: { files },
+    })
+    return event
+  }
+
+  function mountStructuredInputField (props = {}) {
+    return shallowMount(GGenericInputField, {
+      props: {
+        modelValue: '',
+        field: {
+          key: 'secret',
+          label: 'Secret',
+          type: 'json-secret',
+          validators: {},
+        },
+        ...props,
+      },
+      global: {
+        stubs: {
+          VTextarea: TextareaStub,
+        },
+      },
+    })
+  }
+
+  it('warns for unsupported validator types', async () => {
+    shallowMount(GGenericInputField, {
+      props: {
+        modelValue: '',
+        field: {
+          key: 'foo',
+          label: 'Foo',
+          type: 'text',
+          validators: {
+            unsupported: {
+              type: 'doesNotExist',
+            },
+          },
+        },
+      },
+      global: {
+        stubs: {
+          VTextField: true,
+        },
+      },
+    })
+
+    await nextTick()
+
+    expect(warnSpy).toHaveBeenCalledWith('Ignoring unsupported validator type \'doesNotExist\' for field \'foo\'')
+  })
+
+  it('does not mutate validator configuration when deriving default messages', async () => {
+    const field = {
+      key: 'secret',
+      label: 'Secret',
+      type: 'json-secret',
+      validators: {
+        validObject: {
+          type: 'isValidObject',
+        },
+        projectID: {
+          type: 'hasObjectProp',
+          key: 'project_id',
+          pattern: /^[a-z][a-z0-9-]+$/,
+        },
+        accountType: {
+          type: 'hasObjectProp',
+          key: 'type',
+          value: 'service_account',
+        },
+      },
+    }
+
+    mountStructuredInputField({ field })
+    await nextTick()
+
+    expect(field.validators.validObject).not.toHaveProperty('message')
+    expect(field.validators.projectID).not.toHaveProperty('message')
+    expect(field.validators.accountType).not.toHaveProperty('message')
+  })
+
+  it('imports a JSON file dropped by extension when the MIME type is missing', async () => {
+    vi.stubGlobal('FileReader', class {
+      readAsText () {
+        this.onload({
+          target: {
+            result: '{"foo":"bar"}',
+          },
+        })
+      }
+    })
+    const wrapper = mountStructuredInputField()
+
+    await nextTick()
+    wrapper.find('textarea').element.dispatchEvent(createDropEvent([{
+      name: 'secret.json',
+      type: '',
+    }]))
+
+    expect(wrapper.emitted('update:modelValue')).toEqual([
+      [{ foo: 'bar' }],
+    ])
+  })
+
+  it('shows the rejection reason for unsupported dropped files', async () => {
+    const wrapper = mountStructuredInputField()
+
+    await nextTick()
+    wrapper.find('textarea').element.dispatchEvent(createDropEvent([{
+      name: 'secret.txt',
+      type: 'text/plain',
+    }]))
+    await nextTick()
+
+    expect(wrapper.findComponent(TextareaStub).props('errorMessages')).toEqual([
+      'File "secret.txt" was rejected. Expected a JSON file (.json), but received text/plain.',
+    ])
+  })
+
+  it('shows the drop rejection reason before validation errors', async () => {
+    const wrapper = mountStructuredInputField({
+      field: {
+        key: 'secret',
+        label: 'Secret',
+        type: 'json-secret',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    })
+
+    await nextTick()
+    wrapper.find('textarea').element.dispatchEvent(createDropEvent([{
+      name: 'secret.txt',
+      type: 'text/plain',
+    }]))
+    await nextTick()
+
+    const errorMessages = wrapper.findComponent(TextareaStub).props('errorMessages')
+    expect(errorMessages[0]).toBe('File "secret.txt" was rejected. Expected a JSON file (.json), but received text/plain.')
+    expect(errorMessages).toContain('Value is required')
+  })
+
+  it('clears the drop rejection reason after the field is edited', async () => {
+    const wrapper = mountStructuredInputField()
+
+    await nextTick()
+    wrapper.find('textarea').element.dispatchEvent(createDropEvent([{
+      name: 'secret.txt',
+      type: 'text/plain',
+    }]))
+    await nextTick()
+
+    await wrapper.find('textarea').setValue('{"foo":"bar"}')
+
+    expect(wrapper.findComponent(TextareaStub).props('errorMessages')).toEqual([])
+  })
+})
diff --git a/frontend/__tests__/composables/__snapshots__/credential.helper.spec.js.snap b/frontend/__tests__/composables/__snapshots__/credential.helper.spec.js.snap
index 6baf07644a..7bd80b9c91 100644
--- a/frontend/__tests__/composables/__snapshots__/credential.helper.spec.js.snap
+++ b/frontend/__tests__/composables/__snapshots__/credential.helper.spec.js.snap
@@ -88,7 +88,7 @@ exports[`secretDetails > matches snapshots for all known provider types (includi
       "label": "API Key",
     },
   ],
-  "onMetal": undefined,
+  "onmetal": undefined,
   "openstack": [
     {
       "label": "Domain Name",
diff --git a/frontend/__tests__/composables/__snapshots__/useShootContext.spec.js.snap b/frontend/__tests__/composables/__snapshots__/useShootContext.spec.js.snap
index 143f5c3758..f5288d9ddd 100644
--- a/frontend/__tests__/composables/__snapshots__/useShootContext.spec.js.snap
+++ b/frontend/__tests__/composables/__snapshots__/useShootContext.spec.js.snap
@@ -622,6 +622,78 @@ exports[`composables > useShootContext > should create a default "gcp" shoot man
 }
 `;
 
+exports[`composables > useShootContext > should create a default "hcloud" shoot manifest 1`] = `
+{
+  "apiVersion": "core.gardener.cloud/v1beta1",
+  "kind": "Shoot",
+  "metadata": {
+    "name": "m6kgstc1b0",
+    "namespace": "garden-test",
+  },
+  "spec": {
+    "cloudProfile": {
+      "kind": "CloudProfile",
+      "name": "hcloud",
+    },
+    "kubernetes": {
+      "version": "1.28.6",
+    },
+    "maintenance": {
+      "autoUpdate": {
+        "kubernetesVersion": true,
+        "machineImageVersion": true,
+      },
+      "timeWindow": {
+        "begin": "220000+0100",
+        "end": "230000+0100",
+      },
+    },
+    "networking": {
+      "nodes": "10.180.0.0/16",
+      "type": "calico",
+    },
+    "provider": {
+      "controlPlaneConfig": {
+        "apiVersion": "hcloud.provider.extensions.gardener.cloud/v1alpha1",
+        "kind": "ControlPlaneConfig",
+        "zone": "fsn1-dc14",
+      },
+      "infrastructureConfig": {
+        "apiVersion": "hcloud.provider.extensions.gardener.cloud/v1alpha1",
+        "kind": "InfrastructureConfig",
+        "networks": {
+          "workers": "10.180.0.0/16",
+        },
+      },
+      "type": "hcloud",
+      "workers": [
+        {
+          "cri": {
+            "name": "containerd",
+          },
+          "machine": {
+            "architecture": "amd64",
+            "image": {
+              "name": "gardenlinux",
+              "version": "1312.3.0",
+            },
+            "type": "cpx11",
+          },
+          "maxSurge": 1,
+          "maximum": 2,
+          "minimum": 1,
+          "name": "worker-m6kgs",
+          "zones": [
+            "fsn1-dc14",
+          ],
+        },
+      ],
+    },
+    "region": "fsn1",
+  },
+}
+`;
+
 exports[`composables > useShootContext > should create a default "ironcore" shoot manifest 1`] = `
 {
   "apiVersion": "core.gardener.cloud/v1beta1",
@@ -696,6 +768,212 @@ exports[`composables > useShootContext > should create a default "ironcore" shoo
 }
 `;
 
+exports[`composables > useShootContext > should create a default "local" shoot manifest 1`] = `
+{
+  "apiVersion": "core.gardener.cloud/v1beta1",
+  "kind": "Shoot",
+  "metadata": {
+    "name": "m6kgstc1b0",
+    "namespace": "garden-test",
+  },
+  "spec": {
+    "cloudProfile": {
+      "kind": "CloudProfile",
+      "name": "local",
+    },
+    "kubernetes": {
+      "version": "1.28.6",
+    },
+    "maintenance": {
+      "autoUpdate": {
+        "kubernetesVersion": true,
+        "machineImageVersion": true,
+      },
+      "timeWindow": {
+        "begin": "220000+0100",
+        "end": "230000+0100",
+      },
+    },
+    "networking": {
+      "nodes": "10.180.0.0/16",
+      "type": "calico",
+    },
+    "provider": {
+      "type": "local",
+      "workers": [
+        {
+          "cri": {
+            "name": "containerd",
+          },
+          "machine": {
+            "architecture": "amd64",
+            "image": {
+              "name": "gardenlinux",
+              "version": "1312.3.0",
+            },
+            "type": "local-dev-small",
+          },
+          "maxSurge": 1,
+          "maximum": 2,
+          "minimum": 1,
+          "name": "worker-m6kgs",
+        },
+      ],
+    },
+    "region": "local",
+  },
+}
+`;
+
+exports[`composables > useShootContext > should create a default "metal" shoot manifest 1`] = `
+{
+  "apiVersion": "core.gardener.cloud/v1beta1",
+  "kind": "Shoot",
+  "metadata": {
+    "name": "m6kgstc1b0",
+    "namespace": "garden-test",
+  },
+  "spec": {
+    "cloudProfile": {
+      "kind": "CloudProfile",
+      "name": "metal",
+    },
+    "kubernetes": {
+      "kubeControllerManager": {
+        "nodeCIDRMaskSize": 23,
+      },
+      "kubelet": {
+        "maxPods": 510,
+      },
+      "version": "1.28.6",
+    },
+    "maintenance": {
+      "autoUpdate": {
+        "kubernetesVersion": true,
+        "machineImageVersion": true,
+      },
+      "timeWindow": {
+        "begin": "220000+0100",
+        "end": "230000+0100",
+      },
+    },
+    "networking": {
+      "pods": "10.244.128.0/18",
+      "providerConfig": {
+        "apiVersion": "calico.networking.extensions.gardener.cloud/v1alpha1",
+        "backend": "vxlan",
+        "ipv4": {
+          "autoDetectionMethod": "interface=lo",
+          "mode": "Always",
+          "pool": "vxlan",
+        },
+        "kind": "NetworkConfig",
+        "typha": {
+          "enabled": true,
+        },
+      },
+      "services": "10.244.192.0/18",
+      "type": "calico",
+    },
+    "provider": {
+      "controlPlaneConfig": {
+        "apiVersion": "metal.provider.extensions.gardener.cloud/v1alpha1",
+        "kind": "ControlPlaneConfig",
+      },
+      "infrastructureConfig": {
+        "apiVersion": "metal.provider.extensions.gardener.cloud/v1alpha1",
+        "firewall": {
+          "size": "c1-metal-small",
+        },
+        "kind": "InfrastructureConfig",
+        "partitionID": "eu01-a",
+      },
+      "type": "metal",
+      "workers": [
+        {
+          "cri": {
+            "name": "containerd",
+          },
+          "machine": {
+            "architecture": "amd64",
+            "image": {
+              "name": "gardenlinux",
+              "version": "1312.3.0",
+            },
+            "type": "c1-metal-small",
+          },
+          "maxSurge": 1,
+          "maximum": 2,
+          "minimum": 1,
+          "name": "worker-m6kgs",
+        },
+      ],
+    },
+    "region": "eu01",
+  },
+}
+`;
+
+exports[`composables > useShootContext > should create a default "onmetal" shoot manifest 1`] = `
+{
+  "apiVersion": "core.gardener.cloud/v1beta1",
+  "kind": "Shoot",
+  "metadata": {
+    "name": "m6kgstc1b0",
+    "namespace": "garden-test",
+  },
+  "spec": {
+    "cloudProfile": {
+      "kind": "CloudProfile",
+      "name": "onmetal",
+    },
+    "kubernetes": {
+      "version": "1.28.6",
+    },
+    "maintenance": {
+      "autoUpdate": {
+        "kubernetesVersion": true,
+        "machineImageVersion": true,
+      },
+      "timeWindow": {
+        "begin": "220000+0100",
+        "end": "230000+0100",
+      },
+    },
+    "networking": {
+      "nodes": "10.180.0.0/16",
+      "type": "calico",
+    },
+    "provider": {
+      "type": "onmetal",
+      "workers": [
+        {
+          "cri": {
+            "name": "containerd",
+          },
+          "machine": {
+            "architecture": "amd64",
+            "image": {
+              "name": "gardenlinux",
+              "version": "1312.3.0",
+            },
+            "type": "c1-onmetal-small",
+          },
+          "maxSurge": 1,
+          "maximum": 2,
+          "minimum": 1,
+          "name": "worker-m6kgs",
+          "zones": [
+            "on01-a",
+          ],
+        },
+      ],
+    },
+    "region": "on01",
+  },
+}
+`;
+
 exports[`composables > useShootContext > should create a default "openstack" shoot manifest 1`] = `
 {
   "apiVersion": "core.gardener.cloud/v1beta1",
@@ -778,3 +1056,138 @@ exports[`composables > useShootContext > should create a default "openstack" sho
   },
 }
 `;
+
+exports[`composables > useShootContext > should create a default "stackit" shoot manifest 1`] = `
+{
+  "apiVersion": "core.gardener.cloud/v1beta1",
+  "kind": "Shoot",
+  "metadata": {
+    "name": "m6kgstc1b0",
+    "namespace": "garden-test",
+  },
+  "spec": {
+    "cloudProfile": {
+      "kind": "CloudProfile",
+      "name": "stackit",
+    },
+    "kubernetes": {
+      "version": "1.28.6",
+    },
+    "maintenance": {
+      "autoUpdate": {
+        "kubernetesVersion": true,
+        "machineImageVersion": true,
+      },
+      "timeWindow": {
+        "begin": "220000+0100",
+        "end": "230000+0100",
+      },
+    },
+    "networking": {
+      "nodes": "10.180.0.0/16",
+      "type": "calico",
+    },
+    "provider": {
+      "controlPlaneConfig": {
+        "apiVersion": "stackit.provider.extensions.gardener.cloud/v1alpha1",
+        "kind": "ControlPlaneConfig",
+      },
+      "infrastructureConfig": {
+        "apiVersion": "stackit.provider.extensions.gardener.cloud/v1alpha1",
+        "kind": "InfrastructureConfig",
+        "networks": {
+          "workers": "10.180.0.0/16",
+        },
+      },
+      "type": "stackit",
+      "workers": [
+        {
+          "cri": {
+            "name": "containerd",
+          },
+          "machine": {
+            "architecture": "amd64",
+            "image": {
+              "name": "gardenlinux",
+              "version": "1312.3.0",
+            },
+            "type": "stackit-machine-1",
+          },
+          "maxSurge": 1,
+          "maximum": 2,
+          "minimum": 1,
+          "name": "worker-m6kgs",
+          "zones": [
+            "eu01-1",
+          ],
+        },
+      ],
+    },
+    "region": "eu01",
+  },
+}
+`;
+
+exports[`composables > useShootContext > should create a default "vsphere" shoot manifest 1`] = `
+{
+  "apiVersion": "core.gardener.cloud/v1beta1",
+  "kind": "Shoot",
+  "metadata": {
+    "name": "m6kgstc1b0",
+    "namespace": "garden-test",
+  },
+  "spec": {
+    "cloudProfile": {
+      "kind": "CloudProfile",
+      "name": "vsphere",
+    },
+    "kubernetes": {
+      "version": "1.28.6",
+    },
+    "maintenance": {
+      "autoUpdate": {
+        "kubernetesVersion": true,
+        "machineImageVersion": true,
+      },
+      "timeWindow": {
+        "begin": "220000+0100",
+        "end": "230000+0100",
+      },
+    },
+    "networking": {
+      "nodes": "10.180.0.0/16",
+      "type": "calico",
+    },
+    "provider": {
+      "controlPlaneConfig": {
+        "apiVersion": "vsphere.provider.extensions.gardener.cloud/v1alpha1",
+        "kind": "ControlPlaneConfig",
+      },
+      "type": "vsphere",
+      "workers": [
+        {
+          "cri": {
+            "name": "containerd",
+          },
+          "machine": {
+            "architecture": "amd64",
+            "image": {
+              "name": "gardenlinux",
+              "version": "1312.3.0",
+            },
+            "type": "vsphere-machine-1",
+          },
+          "maxSurge": 1,
+          "maximum": 2,
+          "minimum": 1,
+          "name": "worker-m6kgs",
+          "zones": [
+            "zone1",
+          ],
+        },
+      ],
+    },
+    "region": "region1",
+  },
+}
+`;
diff --git a/frontend/__tests__/composables/credential.helper.spec.js b/frontend/__tests__/composables/credential.helper.spec.js
index fc7291fd97..c8f7428e1c 100644
--- a/frontend/__tests__/composables/credential.helper.spec.js
+++ b/frontend/__tests__/composables/credential.helper.spec.js
@@ -57,6 +57,14 @@ describe('secretDetails', () => {
     ...dnsProviders,
   ]
 
+  function providerConfig (name) {
+    return providerConfigs.find(config => config.name === name)
+  }
+
+  function secretField (providerName, fieldKey) {
+    return providerConfig(providerName).secret.fields.find(field => field.key === fieldKey)
+  }
+
   it('matches snapshots for all known provider types (including unhandled types)', () => {
     const secret = {
       data: createSecretData(),
@@ -213,4 +221,64 @@ describe('secretDetails', () => {
       },
     ])
   })
+
+  it('preserves migrated provider field validators and defaults', () => {
+    expect(secretField('aws', 'accessKeyID').validators).toMatchObject({
+      required: { type: 'required' },
+      minLength: { type: 'minLength', length: 16 },
+      maxLength: { type: 'maxLength', length: 128 },
+      alphaNumUnderscore: { type: 'alphaNumUnderscore' },
+    })
+    expect(secretField('aws', 'secretAccessKey').validators).toMatchObject({
+      required: { type: 'required' },
+      minLength: { type: 'minLength', length: 40 },
+      base64: { type: 'base64' },
+    })
+
+    expect(secretField('alicloud', 'accessKeyID').validators).toMatchObject({
+      required: { type: 'required' },
+      minLength: { type: 'minLength', length: 16 },
+      maxLength: { type: 'maxLength', length: 128 },
+    })
+    expect(secretField('alicloud', 'accessKeySecret').validators).toMatchObject({
+      required: { type: 'required' },
+      minLength: { type: 'minLength', length: 30 },
+    })
+
+    expect(secretField('azure', 'clientID').validators.guid).toEqual({ type: 'guid' })
+    expect(secretField('azure', 'tenantID').validators.guid).toEqual({ type: 'guid' })
+    expect(secretField('azure', 'subscriptionID').validators.guid).toEqual({ type: 'guid' })
+
+    expect(secretField('rfc2136', 'TSIGSecretAlgorithm')).toMatchObject({
+      defaultValue: '',
+      omitWhenEmpty: true,
+      values: expect.arrayContaining([
+        expect.objectContaining({
+          value: '',
+        }),
+      ]),
+    })
+    expect(secretField('rfc2136', 'TSIGSecretAlgorithm').validators).toBeUndefined()
+
+    expect(secretField('aws-route53', 'AWS_REGION')).toMatchObject({
+      omitWhenEmpty: true,
+    })
+    expect(secretField('azure-dns', 'AZURE_CLOUD')).toMatchObject({
+      defaultValue: '',
+      omitWhenEmpty: true,
+      values: expect.arrayContaining([
+        expect.objectContaining({
+          value: '',
+        }),
+      ]),
+    })
+  })
+
+  it('limits GCP project IDs to the documented length', () => {
+    const projectIDValidator = secretField('gcp', 'serviceaccount.json').validators.projectID
+
+    expect(projectIDValidator.pattern.test('abcde1')).toBe(true)
+    expect(projectIDValidator.pattern.test(`a${'b'.repeat(29)}`)).toBe(true)
+    expect(projectIDValidator.pattern.test(`a${'b'.repeat(30)}`)).toBe(false)
+  })
 })
diff --git a/frontend/__tests__/composables/useSecretContext.spec.js b/frontend/__tests__/composables/useSecretContext.spec.js
index 84d7293295..d9c1538436 100644
--- a/frontend/__tests__/composables/useSecretContext.spec.js
+++ b/frontend/__tests__/composables/useSecretContext.spec.js
@@ -17,7 +17,10 @@ import { useAuthzStore } from '@/store/authz'
 
 import { createSecretContextComposable } from '@/composables/credential/useSecretContext'
 
-import { encodeBase64 } from '@/utils'
+import {
+  decodeBase64,
+  encodeBase64,
+} from '@/utils'
 
 describe('composables', () => {
   describe('useSecretContext', () => {
@@ -128,6 +131,137 @@ describe('composables', () => {
       })
     })
 
+    it('should preserve decoded values as strings in secretStringData', () => {
+      secretContext.setSecretManifest({
+        metadata: {
+          name: 'my-secret',
+          namespace: testNamespace,
+        },
+        data: {
+          zero: encodeBase64('0'),
+          bool: encodeBase64('false'),
+          nullValue: encodeBase64('null'),
+          empty: encodeBase64(''),
+          object: encodeBase64('{"enabled":true}'),
+          array: encodeBase64('[1,2,3]'),
+        },
+      })
+
+      expect(secretContext.secretStringData).toEqual({
+        zero: '0',
+        bool: 'false',
+        nullValue: 'null',
+        empty: '',
+        object: '{"enabled":true}',
+        array: '[1,2,3]',
+      })
+    })
+
+    it('should parse only configured structured fields', () => {
+      secretContext.setSecretManifest({
+        metadata: {
+          name: 'my-secret',
+          namespace: testNamespace,
+        },
+        data: {
+          plainJson: encodeBase64('{"enabled":true}'),
+          serviceAccount: encodeBase64('{"project_id":"example","type":"service_account"}'),
+          yamlConfig: encodeBase64('enabled: true\n'),
+          invalidJson: encodeBase64('{"broken":'),
+        },
+      })
+
+      const fields = [
+        { key: 'plainJson', type: 'text' },
+        { key: 'serviceAccount', type: 'json-secret' },
+        { key: 'yamlConfig', type: 'yaml-secret' },
+        { key: 'invalidJson', type: 'json-secret' },
+      ]
+
+      expect(secretContext.secretStringDataForFields(fields)).toEqual({
+        plainJson: '{"enabled":true}',
+        serviceAccount: {
+          project_id: 'example',
+          type: 'service_account',
+        },
+        yamlConfig: {
+          enabled: true,
+        },
+        invalidJson: '{"broken":',
+      })
+    })
+
+    it('should encode structured fields according to their configured type', () => {
+      secretContext.createSecretManifest()
+
+      const fields = [
+        { key: 'plainJson', type: 'text' },
+        { key: 'serviceAccount', type: 'json-secret' },
+        { key: 'yamlConfig', type: 'yaml-secret' },
+      ]
+
+      secretContext.setSecretStringDataForFields(fields, {
+        plainJson: '{"enabled":true}',
+        serviceAccount: {
+          project_id: 'example',
+          type: 'service_account',
+        },
+        yamlConfig: {
+          enabled: true,
+        },
+      })
+
+      expect(decodeBase64(secretContext.secretData.plainJson)).toBe('{"enabled":true}')
+      expect(decodeBase64(secretContext.secretData.serviceAccount)).toBe('{"project_id":"example","type":"service_account"}')
+      expect(decodeBase64(secretContext.secretData.yamlConfig)).toBe('enabled: true\n')
+    })
+
+    it('should omit empty configured fields while preserving other empty values', () => {
+      secretContext.createSecretManifest()
+
+      const fields = [
+        { key: 'AWS_REGION', type: 'text', omitWhenEmpty: true },
+        { key: 'AZURE_CLOUD', type: 'select', omitWhenEmpty: true },
+        { key: 'TSIGSecretAlgorithm', type: 'select', omitWhenEmpty: true },
+        { key: 'emptyValue', type: 'text' },
+      ]
+
+      secretContext.setSecretStringDataForFields(fields, {
+        AWS_REGION: '',
+        AZURE_CLOUD: '',
+        TSIGSecretAlgorithm: '',
+        emptyValue: '',
+      })
+
+      expect(secretContext.secretData).toEqual({
+        AWS_REGION: undefined,
+        AZURE_CLOUD: undefined,
+        TSIGSecretAlgorithm: undefined,
+        emptyValue: encodeBase64(''),
+      })
+      expect(secretContext.secretManifest.data).toEqual({
+        emptyValue: encodeBase64(''),
+      })
+    })
+
+    it('should preserve falsy values when encoding secretStringData', () => {
+      secretContext.createSecretManifest()
+
+      secretContext.secretStringData = {
+        zero: 0,
+        bool: false,
+        empty: '',
+        nullValue: null,
+      }
+
+      expect(secretContext.secretData).toEqual({
+        zero: encodeBase64('0'),
+        bool: encodeBase64('false'),
+        empty: encodeBase64(''),
+        nullValue: undefined,
+      })
+    })
+
     describe('dnsSecretProviderType', () => {
       it('should get and set dns provider type correctly', () => {
         secretContext.setSecretManifest({
diff --git a/frontend/__tests__/composables/useShootContext.spec.js b/frontend/__tests__/composables/useShootContext.spec.js
index c13af31e24..0bd49efecf 100644
--- a/frontend/__tests__/composables/useShootContext.spec.js
+++ b/frontend/__tests__/composables/useShootContext.spec.js
@@ -19,10 +19,13 @@ import { useAuthzStore } from '@/store/authz'
 
 import { createShootContextComposable } from '@/composables/useShootContext'
 
+import infraProviders from '@/data/vendors/infra'
+
 import cloneDeep from 'lodash/cloneDeep'
 
 describe('composables', () => {
   let shootContextStore
+  const infraProviderTypes = infraProviders.map(({ name }) => name)
 
   const systemTime = new Date('2024-03-15T14:00:00+01:00')
 
@@ -71,9 +74,11 @@ describe('composables', () => {
   }
 
   describe('useShootContext', () => {
-    it('should create a default "aws" shoot manifest', async () => {
-      expect(createShootManifest('aws')).toMatchSnapshot()
-    })
+    for (const providerType of infraProviderTypes) {
+      it(`should create a default "${providerType}" shoot manifest`, () => {
+        expect(createShootManifest(providerType)).toMatchSnapshot()
+      })
+    }
 
     it('should omit spec.addons if no addon is enabled', () => {
       createShootManifest('aws')
@@ -125,26 +130,6 @@ describe('composables', () => {
       })
     })
 
-    it('should create a default "azure" shoot manifest', async () => {
-      expect(createShootManifest('azure')).toMatchSnapshot()
-    })
-
-    it('should create a default "alicloud" shoot manifest', async () => {
-      expect(createShootManifest('alicloud')).toMatchSnapshot()
-    })
-
-    it('should create a default "gcp" shoot manifest', async () => {
-      expect(createShootManifest('gcp')).toMatchSnapshot()
-    })
-
-    it('should create a default "openstack" shoot manifest', async () => {
-      expect(createShootManifest('openstack')).toMatchSnapshot()
-    })
-
-    it('should create a default "ironcore" shoot manifest', async () => {
-      expect(createShootManifest('ironcore')).toMatchSnapshot()
-    })
-
     it('should change the infrastructure kind', async () => {
       shootContextStore.createShootManifest()
       shootContextStore.providerType = 'gcp'
diff --git a/frontend/__tests__/composables/useShootDns.spec.js b/frontend/__tests__/composables/useShootDns.spec.js
index bfa427211b..684c85d4bf 100644
--- a/frontend/__tests__/composables/useShootDns.spec.js
+++ b/frontend/__tests__/composables/useShootDns.spec.js
@@ -38,18 +38,41 @@ describe('composables', () => {
 
     it('should return dns credentials as a plain array for a dns provider type', () => {
       const credentialStore = useCredentialStore()
-      const gardenerExtensionStore = useGardenerExtensionStore()
-      const cloudProfileStore = useCloudProfileStore()
 
       const credentialsForProviderType = getCloudProviderEntityList('aws-route53', {
         credentialStore,
-        gardenerExtensionStore,
-        cloudProfileStore,
+        vendorType: 'dns',
       })
 
       expect(Array.isArray(credentialsForProviderType)).toBe(true)
       expect(credentialsForProviderType).toEqual(credentialStore.dnsCredentialList.filter(credential => credential.metadata?.labels?.['dashboard.gardener.cloud/dnsProviderType'] === 'aws-route53'))
     })
+
+    it('should select the entity list by vendor type when provider names overlap', () => {
+      const infrastructureBinding = {
+        provider: { type: 'shared-provider' },
+      }
+      const dnsCredential = {
+        metadata: {
+          labels: {
+            'dashboard.gardener.cloud/dnsProviderType': 'shared-provider',
+          },
+        },
+      }
+      const credentialStore = {
+        infrastructureBindingList: [infrastructureBinding],
+        dnsCredentialList: [dnsCredential],
+      }
+
+      expect(getCloudProviderEntityList('shared-provider', {
+        credentialStore,
+        vendorType: 'infra',
+      })).toEqual([infrastructureBinding])
+      expect(getCloudProviderEntityList('shared-provider', {
+        credentialStore,
+        vendorType: 'dns',
+      })).toEqual([dnsCredential])
+    })
   })
 
   describe('useShootDns', () => {
diff --git a/frontend/__tests__/composables/useStructuredTextField.spec.js b/frontend/__tests__/composables/useStructuredTextField.spec.js
new file mode 100644
index 0000000000..605399fbf7
--- /dev/null
+++ b/frontend/__tests__/composables/useStructuredTextField.spec.js
@@ -0,0 +1,41 @@
+//
+// SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import { computed } from 'vue'
+
+import { useStructuredTextField } from '@/composables/useStructuredTextField'
+
+describe('composables', () => {
+  describe('useStructuredTextField', () => {
+    it('should keep raw strings when initialized from invalid structured data', () => {
+      const {
+        rawText,
+        setRawTextWithValue,
+        parseRawTextToObject,
+      } = useStructuredTextField(computed(() => 'json-secret'))
+
+      setRawTextWithValue('{"broken":')
+
+      expect(rawText.value).toBe('{"broken":')
+      expect(parseRawTextToObject()).toBeUndefined()
+    })
+
+    it('should parse valid YAML objects and reject non-object YAML values', () => {
+      const {
+        rawText,
+        parseRawTextToObject,
+      } = useStructuredTextField(computed(() => 'yaml-secret'))
+
+      rawText.value = 'enabled: true\n'
+      expect(parseRawTextToObject()).toEqual({
+        enabled: true,
+      })
+
+      rawText.value = '- item\n'
+      expect(parseRawTextToObject()).toBeUndefined()
+    })
+  })
+})
diff --git a/frontend/__tests__/stores/__snapshots__/credential.spec.js.snap b/frontend/__tests__/stores/__snapshots__/credential.spec.js.snap
index db1b0aa401..d817075198 100644
--- a/frontend/__tests__/stores/__snapshots__/credential.spec.js.snap
+++ b/frontend/__tests__/stores/__snapshots__/credential.spec.js.snap
@@ -23,6 +23,12 @@ exports[`stores > credential > should return infrastructureBindingList 1`] = `
   "gcp",
   "openstack",
   "alicloud",
+  "metal",
+  "vsphere",
+  "hcloud",
+  "onmetal",
   "ironcore",
+  "stackit",
+  "local",
 ]
 `;
diff --git a/frontend/__tests__/utils/createShoot.spec.js b/frontend/__tests__/utils/createShoot.spec.js
index c119088304..a222896837 100644
--- a/frontend/__tests__/utils/createShoot.spec.js
+++ b/frontend/__tests__/utils/createShoot.spec.js
@@ -8,7 +8,14 @@ import {
   splitCIDR,
   getZonesNetworkConfiguration,
   findFreeNetworks,
+  getKubernetesTemplate,
+  getWorkerProviderConfig,
 } from '@/utils/shoot'
+import infraProviders from '@/data/vendors/infra'
+
+function infraVendor (name) {
+  return infraProviders.find(vendor => vendor.name === name)
+}
 
 describe('utils', () => {
   describe('createShoot', () => {
@@ -79,7 +86,7 @@ describe('utils', () => {
         ]
         const workerCIDR = '10.251.0.0/16'
 
-        const freeNetworks = findFreeNetworks(existingZonesNetworkConfiguration, workerCIDR, 'aws', 4)
+        const freeNetworks = findFreeNetworks(existingZonesNetworkConfiguration, workerCIDR, 4, infraVendor('aws'))
         expect(freeNetworks).toBeInstanceOf(Array)
         expect(freeNetworks).toHaveLength(2)
       })
@@ -113,7 +120,7 @@ describe('utils', () => {
         ]
         const workerCIDR = '10.251.0.0/16'
 
-        const freeNetworks = findFreeNetworks(existingZonesNetworkConfiguration, workerCIDR, 'aws', 4)
+        const freeNetworks = findFreeNetworks(existingZonesNetworkConfiguration, workerCIDR, 4, infraVendor('aws'))
         expect(freeNetworks).toBeInstanceOf(Array)
         expect(freeNetworks).toHaveLength(0)
       })
@@ -129,7 +136,7 @@ describe('utils', () => {
         ]
         const workerCIDR = '10.251.0.0/16'
 
-        const freeNetworks = findFreeNetworks(existingZonesNetworkConfiguration, workerCIDR, 'aws', 4)
+        const freeNetworks = findFreeNetworks(existingZonesNetworkConfiguration, workerCIDR, 4, infraVendor('aws'))
         expect(freeNetworks).toBeInstanceOf(Array)
         expect(freeNetworks).toHaveLength(0)
       })
@@ -137,7 +144,7 @@ describe('utils', () => {
       it('should return networks for all zones if existingZonesNetworkConfiguration is undefined', () => {
         const workerCIDR = '10.251.0.0/16'
 
-        const freeNetworks = findFreeNetworks(undefined, workerCIDR, 'aws', 4)
+        const freeNetworks = findFreeNetworks(undefined, workerCIDR, 4, infraVendor('aws'))
         expect(freeNetworks).toBeInstanceOf(Array)
         expect(freeNetworks).toHaveLength(4)
       })
@@ -185,23 +192,23 @@ describe('utils', () => {
       ]
 
       it('should return undefined for infrastructures that do not require network config for zones (new cluster)', () => {
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(undefined, workers, 'azure', 3, undefined, nodeCIDR)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(undefined, workers, 3, undefined, nodeCIDR, infraVendor('azure'))
         expect(zonesNetworkConfiguration).toBeUndefined()
       })
 
       it('should return undefined for infrastructures that do not require network config for zones (existing cluster)', () => {
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(undefined, workers, 'azure', 3, nodeCIDR, undefined)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(undefined, workers, 3, nodeCIDR, undefined, infraVendor('azure'))
         expect(zonesNetworkConfiguration).toBeUndefined()
       })
 
       it('should return initial network config', () => {
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(undefined, workers, 'aws', 3, undefined, nodeCIDR)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(undefined, workers, 3, undefined, nodeCIDR, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeInstanceOf(Array)
         expect(zonesNetworkConfiguration).toHaveLength(2)
       })
 
       it('should keep network config if zones are the same', () => {
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workers, 'aws', 3, undefined, nodeCIDR)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workers, 3, undefined, nodeCIDR, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeInstanceOf(Array)
         expect(zonesNetworkConfiguration).toHaveLength(2)
         expect(zonesNetworkConfiguration).toEqual(customZonesNetworkConfiguration)
@@ -225,7 +232,7 @@ describe('utils', () => {
           },
         ]
 
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workers, 'aws', 3, undefined, newNodeCIDR)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workers, 3, undefined, newNodeCIDR, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeInstanceOf(Array)
         expect(zonesNetworkConfiguration).toHaveLength(2)
         expect(zonesNetworkConfiguration).toEqual(newCustomZonesNetworkConfiguration)
@@ -245,7 +252,7 @@ describe('utils', () => {
             ],
           },
         ]
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workersWithDifferentZones, 'aws', 3, undefined, nodeCIDR)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workersWithDifferentZones, 3, undefined, nodeCIDR, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeInstanceOf(Array)
         expect(zonesNetworkConfiguration).toHaveLength(2)
         expect(zonesNetworkConfiguration).not.toEqual(customZonesNetworkConfiguration)
@@ -260,7 +267,7 @@ describe('utils', () => {
           },
         ]
 
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, oneZoneWorkers, 'aws', 3, nodeCIDR, undefined)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, oneZoneWorkers, 3, nodeCIDR, undefined, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeInstanceOf(Array)
         expect(zonesNetworkConfiguration).toHaveLength(2)
         expect(zonesNetworkConfiguration).toEqual(customZonesNetworkConfiguration)
@@ -298,7 +305,7 @@ describe('utils', () => {
           },
         ]
 
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(existingZonesNetworkConfiguration, workersWithDifferentZones, 'aws', 3, nodeCIDR, undefined)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(existingZonesNetworkConfiguration, workersWithDifferentZones, 3, nodeCIDR, undefined, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeInstanceOf(Array)
         expect(zonesNetworkConfiguration).toHaveLength(3)
         expect(zonesNetworkConfiguration).toEqual(newZonesNetworkConfiguration)
@@ -320,9 +327,39 @@ describe('utils', () => {
           },
         ]
 
-        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workersWithDifferentZones, 'aws', 3, nodeCIDR, undefined)
+        const zonesNetworkConfiguration = getZonesNetworkConfiguration(customZonesNetworkConfiguration, workersWithDifferentZones, 3, nodeCIDR, undefined, infraVendor('aws'))
         expect(zonesNetworkConfiguration).toBeUndefined()
       })
     })
+
+    describe('vendor config templates', () => {
+      it('should return cloned kubernetes templates and worker provider configs', () => {
+        const shootVendor = {
+          shoot: {
+            templates: {
+              kubernetes: {
+                kubelet: {
+                  maxPods: 100,
+                },
+              },
+            },
+            workerProviderConfig: {
+              volume: {
+                iops: 100,
+              },
+            },
+          },
+        }
+
+        const kubernetesTemplate = getKubernetesTemplate(shootVendor)
+        const workerProviderConfig = getWorkerProviderConfig(shootVendor)
+
+        kubernetesTemplate.kubelet.maxPods = 200
+        workerProviderConfig.volume.iops = 200
+
+        expect(shootVendor.shoot.templates.kubernetes.kubelet.maxPods).toBe(100)
+        expect(shootVendor.shoot.workerProviderConfig.volume.iops).toBe(100)
+      })
+    })
   })
 })
diff --git a/frontend/__tests__/utils/index.spec.js b/frontend/__tests__/utils/index.spec.js
index a8f9a58324..35602611a0 100644
--- a/frontend/__tests__/utils/index.spec.js
+++ b/frontend/__tests__/utils/index.spec.js
@@ -20,12 +20,176 @@ import {
   isEmail,
   convertToGi,
   convertToGibibyte,
+  handleTextFieldDrop,
 } from '@/utils'
 
 import pick from 'lodash/pick'
 import find from 'lodash/find'
 
 describe('utils', () => {
+  describe('#handleTextFieldDrop', () => {
+    const originalFileReader = globalThis.FileReader
+
+    afterEach(() => {
+      vi.stubGlobal('FileReader', originalFileReader)
+    })
+
+    function createTextField () {
+      const element = document.createElement('div')
+      document.body.appendChild(element)
+      return { $el: element }
+    }
+
+    function createDropEvent (files) {
+      const event = new Event('drop', {
+        bubbles: true,
+        cancelable: true,
+      })
+      Object.defineProperty(event, 'dataTransfer', {
+        value: { files },
+      })
+      return event
+    }
+
+    it('accepts files by configured extension if the MIME type is missing', () => {
+      vi.stubGlobal('FileReader', class {
+        readAsText () {
+          this.onload({
+            target: {
+              result: '{"foo":"bar"}',
+            },
+          })
+        }
+      })
+
+      const onDrop = vi.fn()
+      const onReject = vi.fn()
+      const textField = createTextField()
+      const dispose = handleTextFieldDrop(textField, /json/, onDrop, {
+        acceptedFileDescription: 'a JSON file (.json)',
+        acceptedFileExtensions: ['.json'],
+        onReject,
+      })
+
+      textField.$el.dispatchEvent(createDropEvent([{
+        name: 'secret.json',
+        type: '',
+      }]))
+
+      expect(onDrop).toHaveBeenCalledWith('{"foo":"bar"}')
+      expect(onReject).not.toHaveBeenCalled()
+
+      dispose()
+      textField.$el.remove()
+    })
+
+    it('rejects drops without files', () => {
+      const onDrop = vi.fn()
+      const onReject = vi.fn()
+      const textField = createTextField()
+      const dispose = handleTextFieldDrop(textField, /json/, onDrop, {
+        acceptedFileDescription: 'a JSON file (.json)',
+        onReject,
+      })
+
+      textField.$el.dispatchEvent(createDropEvent([]))
+
+      expect(onDrop).not.toHaveBeenCalled()
+      expect(onReject).toHaveBeenCalledWith({
+        code: 'missing-file',
+        file: undefined,
+        message: 'Drop a JSON file (.json) to import its contents.',
+      })
+
+      dispose()
+      textField.$el.remove()
+    })
+
+    it('rejects multiple files', () => {
+      const onDrop = vi.fn()
+      const onReject = vi.fn()
+      const textField = createTextField()
+      const dispose = handleTextFieldDrop(textField, /json/, onDrop, {
+        acceptedFileDescription: 'a JSON file (.json)',
+        onReject,
+      })
+
+      textField.$el.dispatchEvent(createDropEvent([
+        { name: 'one.json', type: 'application/json' },
+        { name: 'two.json', type: 'application/json' },
+      ]))
+
+      expect(onDrop).not.toHaveBeenCalled()
+      expect(onReject).toHaveBeenCalledWith({
+        code: 'too-many-files',
+        file: undefined,
+        message: 'Drop only one file at a time. Expected a JSON file (.json).',
+      })
+
+      dispose()
+      textField.$el.remove()
+    })
+
+    it('rejects unsupported file types', () => {
+      const onDrop = vi.fn()
+      const onReject = vi.fn()
+      const textField = createTextField()
+      const file = {
+        name: 'secret.txt',
+        type: 'text/plain',
+      }
+      const dispose = handleTextFieldDrop(textField, /json/, onDrop, {
+        acceptedFileDescription: 'a JSON file (.json)',
+        acceptedFileExtensions: ['.json'],
+        onReject,
+      })
+
+      textField.$el.dispatchEvent(createDropEvent([file]))
+
+      expect(onDrop).not.toHaveBeenCalled()
+      expect(onReject).toHaveBeenCalledWith({
+        code: 'unsupported-file-type',
+        file,
+        message: 'File "secret.txt" was rejected. Expected a JSON file (.json), but received text/plain.',
+      })
+
+      dispose()
+      textField.$el.remove()
+    })
+
+    it('reports file read errors', () => {
+      vi.stubGlobal('FileReader', class {
+        readAsText () {
+          this.onerror()
+        }
+      })
+
+      const onDrop = vi.fn()
+      const onReject = vi.fn()
+      const textField = createTextField()
+      const file = {
+        name: 'secret.json',
+        type: 'application/json',
+      }
+      const dispose = handleTextFieldDrop(textField, /json/, onDrop, {
+        acceptedFileDescription: 'a JSON file (.json)',
+        onReject,
+      })
+
+      textField.$el.dispatchEvent(createDropEvent([file]))
+
+      expect(onDrop).not.toHaveBeenCalled()
+      expect(onReject).toHaveBeenCalledWith({
+        code: 'read-error',
+        file,
+        message: 'Could not read file "secret.json".',
+      })
+
+      dispose()
+      textField.$el.remove()
+    })
+  })
+
   describe('authorization', () => {
     describe('#canI', () => {
       let rulesReview
diff --git a/frontend/__tests__/utils/inputFieldTypes.spec.js b/frontend/__tests__/utils/inputFieldTypes.spec.js
new file mode 100644
index 0000000000..8ffb241368
--- /dev/null
+++ b/frontend/__tests__/utils/inputFieldTypes.spec.js
@@ -0,0 +1,52 @@
+//
+// SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import {
+  isJsonFieldType,
+  isSecretFieldType,
+  isStructuredFieldType,
+  isStructuredSecretFieldType,
+  isYamlFieldType,
+  structuredFieldTypes,
+} from '@/utils/inputFieldTypes'
+
+describe('utils', () => {
+  describe('inputFieldTypes', () => {
+    it('should classify structured field types', () => {
+      expect(structuredFieldTypes).toEqual(new Set([
+        'json',
+        'json-secret',
+        'yaml',
+        'yaml-secret',
+      ]))
+
+      expect(isStructuredFieldType('json')).toBe(true)
+      expect(isStructuredFieldType('json-secret')).toBe(true)
+      expect(isStructuredFieldType('yaml')).toBe(true)
+      expect(isStructuredFieldType('yaml-secret')).toBe(true)
+      expect(isStructuredFieldType('text')).toBe(false)
+    })
+
+    it('should classify json, yaml and secret-like field types', () => {
+      expect(isJsonFieldType('json')).toBe(true)
+      expect(isJsonFieldType('json-secret')).toBe(true)
+      expect(isJsonFieldType('yaml')).toBe(false)
+
+      expect(isYamlFieldType('yaml')).toBe(true)
+      expect(isYamlFieldType('yaml-secret')).toBe(true)
+      expect(isYamlFieldType('json')).toBe(false)
+
+      expect(isStructuredSecretFieldType('json-secret')).toBe(true)
+      expect(isStructuredSecretFieldType('yaml-secret')).toBe(true)
+      expect(isStructuredSecretFieldType('password')).toBe(false)
+
+      expect(isSecretFieldType('password')).toBe(true)
+      expect(isSecretFieldType('json-secret')).toBe(true)
+      expect(isSecretFieldType('yaml-secret')).toBe(true)
+      expect(isSecretFieldType('json')).toBe(false)
+    })
+  })
+})
diff --git a/frontend/src/components/Credentials/GSecretDialog.vue b/frontend/src/components/Credentials/GSecretDialog.vue
index 32e0e97318..eada220004 100644
--- a/frontend/src/components/Credentials/GSecretDialog.vue
+++ b/frontend/src/components/Credentials/GSecretDialog.vue
@@ -31,26 +31,28 @@ SPDX-License-Identifier: Apache-2.0
             ref="secretDetails"
             class="d-flex flex-column flex-grow-1"
           >
-            <div>
-              <template v-if="isCreateMode">
-                <v-text-field
-                  ref="name"
-                  v-model.trim="name"
-                  color="primary"
-                  label="Secret Name"
-                  :error-messages="getErrorMessages(v$.name)"
-                  variant="underlined"
-                  @update:model-value="v$.name.$touch()"
-                  @blur="v$.name.$touch()"
-                />
-              </template>
-              <template v-else>
-                <div class="text-title-large pb-4">
-                  {{ resourceName }} ({{ resourceKind }})
-                </div>
-              </template>
-            </div>
-            <slot name="secret-slot" />
+            <form @submit.prevent="submit">
+              <div>
+                <template v-if="isCreateMode">
+                  <v-text-field
+                    ref="name"
+                    v-model.trim="name"
+                    color="primary"
+                    label="Secret Name"
+                    :error-messages="getErrorMessages(v$.name)"
+                    variant="underlined"
+                    @update:model-value="v$.name.$touch()"
+                    @blur="v$.name.$touch()"
+                  />
+                </template>
+                <template v-else>
+                  <div class="text-title-large pb-4">
+                    {{ resourceName }} ({{ resourceKind }})
+                  </div>
+                </template>
+              </div>
+              <slot name="secret-slot" />
+            </form>
             <g-message
               v-model:message="errorMessage"
               v-model:detailed-message="detailedErrorMessage"
@@ -138,7 +140,6 @@ SPDX-License-Identifier: Apache-2.0
 import {
   mapActions,
   mapState,
-  storeToRefs,
 } from 'pinia'
 import { useVuelidate } from '@vuelidate/core'
 import {
@@ -151,7 +152,6 @@ import {
 } from 'vue'
 
 import { useCredentialStore } from '@/store/credential'
-import { useGardenerExtensionStore } from '@/store/gardenerExtension'
 import { useShootStore } from '@/store/shoot'
 import { useConfigStore } from '@/store/config'
 
@@ -166,6 +166,7 @@ import { useCloudProviderBinding } from '@/composables/credential/useCloudProvid
 import { useDnsProviderCredential } from '@/composables/credential/useDnsProviderCredential'
 
 import {
+  withMessage,
   messageFromErrors,
   withFieldName,
   unique,
@@ -221,11 +222,8 @@ export default {
     'update:modelValue',
   ],
   setup (props) {
-    const { credential, binding, providerType } = toRefs(props)
-    const gardenerExtensionStore = useGardenerExtensionStore()
-    const { dnsProviderTypes } = storeToRefs(gardenerExtensionStore)
-
-    const isDnsProvider = computed(() => dnsProviderTypes.value.includes(providerType.value))
+    const { credential, binding, vendorType } = toRefs(props)
+    const isDnsProvider = computed(() => vendorType.value === 'dns')
 
     let credentialComposable = {}
 
@@ -248,7 +246,7 @@ export default {
     let bindingContext = {}
     if (!isDnsProvider.value) {
       const { isSecretBinding } = credentialComposable
-      if (isSecretBinding) {
+      if (isSecretBinding?.value) {
         // Legacy SecretBinding for existing SecrertBindings
         bindingContext = useSecretBindingContext()
       } else {
@@ -314,14 +312,13 @@ export default {
       maxLength: maxLength(128),
       lowerCaseAlphaNumHyphen,
       noStartEndHyphen,
-      unique: unique('credentialNames'),
+      unique: withMessage('Secret name must be unique', unique('credentialNames')),
     }
     rules.name = withFieldName('Secret Name', nameRules)
 
     return rules
   },
   computed: {
-    ...mapState(useGardenerExtensionStore, ['dnsProviderTypes']),
     ...mapState(useShootStore, ['shootList']),
     ...mapState(useCredentialStore, [
       'infrastructureBindingList',
diff --git a/frontend/src/components/Credentials/GSecretDialogAlicloud.vue b/frontend/src/components/Credentials/GSecretDialogAlicloud.vue
deleted file mode 100644
index 446ecc67e3..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogAlicloud.vue
+++ /dev/null
@@ -1,217 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-    :provider-type="providerType"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="accessKeyId"
-          color="primary"
-          label="Access Key Id"
-          :error-messages="getErrorMessages(v$.accessKeyId)"
-          hint="e.g. QNJebZ17v5Q7pYpP"
-          variant="underlined"
-          @update:model-value="v$.accessKeyId.$touch()"
-          @blur="v$.accessKeyId.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="accessKeySecret"
-          color="primary"
-          label="Access Key Secret"
-          :error-messages="getErrorMessages(v$.accessKeySecret)"
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideSecret ? 'password' : 'text'"
-          hint="e.g. WJalrXUtnFEMIK7MDENG/bPxRfiCYz"
-          variant="underlined"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @update:model-value="v$.accessKeySecret.$touch()"
-          @blur="v$.accessKeySecret.$touch()"
-        />
-      </div>
-    </template>
-    <template #help-slot>
-      <div v-if="providerType==='alicloud'">
-        <p>
-          Before you can provision and access a Kubernetes cluster on Alibaba Cloud, you need to add account credentials. To manage
-          credentials for Alibaba Cloud Resource Access Management (RAM), use the
-          <g-external-link url="https://ram.console.aliyun.com/overview">
-            RAM Console
-          </g-external-link>.
-          The Gardener needs the credentials to provision and operate the Alibaba Cloud infrastructure for your Kubernetes cluster.
-        </p>
-        <p>
-          Gardener uses encrypted system disk when creating Shoot, please enable ECS disk encryption on Alibaba Cloud Console
-          (<g-external-link url="https://www.alibabacloud.com/help/doc-detail/59643.htm">
-            official
-            documentation
-          </g-external-link>).
-        </p>
-        <p>
-          Copy the Alibaba Cloud RAM policy document below and attach it to the RAM user
-          (<g-external-link url="https://www.alibabacloud.com/help/product/28625.htm?spm=a3c0i.100866.1204872.1.79461e4eLtFABp">
-            official
-            documentation
-          </g-external-link>). Alternatively, you can assign following permissions to the RAM
-          user: AliyunECSFullAccess, AliyunSLBFullAccess, AliyunVPCFullAccess, AliyunEIPFullAccess, AliyunNATGatewayFullAccess.
-        </p>
-        <g-code-block
-          max-height="100%"
-          lang="json"
-          :content="JSON.stringify(template, undefined, 2)"
-        />
-      </div>
-      <div v-if="providerType==='alicloud-dns'">
-        <p>
-          You need to provide an access key (access key ID and secret access key) for Alibaba Cloud to allow the dns-controller-manager to authenticate to Alibaba Cloud DNS.
-        </p>
-        <p>
-          For details see
-          <g-external-link url="https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/docs/2-Client-EN.md#accesskey-client">
-            AccessKey Client
-          </g-external-link>.
-          Currently the regionId is fixed to cn-shanghai.
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import {
-  required,
-  minLength,
-  maxLength,
-} from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GCodeBlock from '@/components/GCodeBlock'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import { withFieldName } from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-    GCodeBlock,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-    providerType: {
-      type: String,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      accessKeyId,
-      accessKeySecret,
-    } = secretStringDataRefs({
-      accessKeyID: 'accessKeyId',
-      accessKeySecret: 'accessKeySecret',
-    })
-
-    return {
-      accessKeyId,
-      accessKeySecret,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideSecret: true,
-      template: {
-        Statement: [
-          {
-            Action: 'vpc:*',
-            Effect: 'Allow',
-            Resource: '*',
-          },
-          {
-            Action: 'ecs:*',
-            Effect: 'Allow',
-            Resource: '*',
-          },
-          {
-            Action: 'slb:*',
-            Effect: 'Allow',
-            Resource: '*',
-          },
-          {
-            Action: [
-              'ram:GetRole',
-              'ram:CreateRole',
-              'ram:CreateServiceLinkedRole',
-            ],
-            Effect: 'Allow',
-            Resource: '*',
-          },
-          {
-            Action: 'ros:*',
-            Effect: 'Allow',
-            Resource: '*',
-          },
-        ],
-        Version: '1',
-      },
-    }
-  },
-  validations () {
-    return {
-      accessKeyId: withFieldName('Access Key ID', {
-        required,
-        minLength: minLength(16),
-        maxLength: maxLength(128),
-      }),
-      accessKeySecret: withFieldName('Access Key Secret', {
-        required,
-        minLength: minLength(30),
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogAws.vue b/frontend/src/components/Credentials/GSecretDialogAws.vue
deleted file mode 100644
index 8820cb21d3..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogAws.vue
+++ /dev/null
@@ -1,275 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-    :provider-type="providerType"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="accessKeyId"
-          color="primary"
-          label="Access Key Id"
-          :error-messages="getErrorMessages(v$.accessKeyId)"
-          hint="e.g. AKIAIOSFODNN7EXAMPLE"
-          variant="underlined"
-          @update:model-value="v$.accessKeyId.$touch()"
-          @blur="v$.accessKeyId.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="secretAccessKey"
-          color="primary"
-          label="Secret Access Key"
-          :error-messages="getErrorMessages(v$.secretAccessKey)"
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideSecret ? 'password' : 'text'"
-          hint="e.g. wJalrXUtnFEMIK7MDENG/bPxRfiCYzEXAMPLEKEY"
-          variant="underlined"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @update:model-value="v$.secretAccessKey.$touch()"
-          @blur="v$.secretAccessKey.$touch()"
-        />
-      </div>
-      <div v-if="providerType === 'aws-route53'">
-        <v-text-field
-          v-model="awsRegion"
-          color="primary"
-          label="Region (optional)"
-          hint="Overwrite default region of Route 53 endpoint. Required for certain regions. Example value: eu-central-1"
-          variant="underlined"
-        />
-      </div>
-    </template>
-    <template #help-slot>
-      <p v-if="providerType==='aws'">
-        Before you can provision and access a Kubernetes cluster, you need to add account credentials. Gardener needs the credentials to provision and operate the AWS infrastructure for your Kubernetes cluster.
-      </p>
-      <p v-if="providerType==='aws-route53'">
-        Before you can use an external DNS provider, you need to add account credentials.
-        The user needs permissions on the hosted zone to list and change DNS records.
-      </p>
-      <p>
-        To manage
-        credentials for AWS Identity and Access Management (IAM), use the
-        <g-external-link url="https://console.aws.amazon.com/iam/home">
-          IAM Console
-        </g-external-link>.
-      </p>
-      <p>
-        Copy the AWS IAM policy document below and attach it to the IAM user
-        (<g-external-link url="http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html">
-          official
-          documentation
-        </g-external-link>).
-      </p>
-      <g-code-block
-        v-if="providerType==='aws'"
-        max-height="100%"
-        lang="json"
-        :content="JSON.stringify(templateAws, undefined, 2)"
-      />
-      <div v-if="providerType==='aws-route53'">
-        <p>In this example, the placeholder for the hosted zone is Z2XXXXXXXXXXXX</p>
-        <g-code-block
-          max-height="100%"
-          lang="json"
-          :content="JSON.stringify(templateAwsRoute53, undefined, 2)"
-        />
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import {
-  required,
-  minLength,
-  maxLength,
-} from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GCodeBlock from '@/components/GCodeBlock'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import {
-  withFieldName,
-  alphaNumUnderscore,
-  base64,
-} from '@/utils/validators'
-import { getErrorMessages } from '@/utils'
-
-export default {
-  components: {
-    GSecretDialog,
-    GCodeBlock,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-    providerType: {
-      type: String,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      accessKeyId,
-      secretAccessKey,
-      awsRegion,
-    } = secretStringDataRefs({
-      accessKeyID: 'accessKeyId',
-      secretAccessKey: 'secretAccessKey',
-      AWS_REGION: 'awsRegion',
-    })
-
-    return {
-      accessKeyId,
-      secretAccessKey,
-      awsRegion,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideSecret: true,
-      templateAws: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Effect: 'Allow',
-            Action: 'autoscaling:*',
-            Resource: '*',
-          },
-          {
-            Effect: 'Allow',
-            Action: 'ec2:*',
-            Resource: '*',
-          },
-          {
-            Effect: 'Allow',
-            Action: 'elasticloadbalancing:*',
-            Resource: '*',
-          },
-          {
-            Action: [
-              'iam:GetInstanceProfile',
-              'iam:GetPolicy',
-              'iam:GetPolicyVersion',
-              'iam:GetRole',
-              'iam:GetRolePolicy',
-              'iam:ListPolicyVersions',
-              'iam:ListRolePolicies',
-              'iam:ListAttachedRolePolicies',
-              'iam:ListInstanceProfilesForRole',
-              'iam:CreateInstanceProfile',
-              'iam:CreatePolicy',
-              'iam:CreatePolicyVersion',
-              'iam:CreateRole',
-              'iam:CreateServiceLinkedRole',
-              'iam:AddRoleToInstanceProfile',
-              'iam:AttachRolePolicy',
-              'iam:DetachRolePolicy',
-              'iam:RemoveRoleFromInstanceProfile',
-              'iam:DeletePolicy',
-              'iam:DeletePolicyVersion',
-              'iam:DeleteRole',
-              'iam:DeleteRolePolicy',
-              'iam:DeleteInstanceProfile',
-              'iam:PutRolePolicy',
-              'iam:PassRole',
-              'iam:UpdateAssumeRolePolicy',
-            ],
-            Effect: 'Allow',
-            Resource: '*',
-          },
-        ],
-      },
-      templateAwsRoute53: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Sid: 'VisualEditor0',
-            Effect: 'Allow',
-            Action: 'route53:ListResourceRecordSets',
-            Resource: 'arn:aws:route53:::hostedzone/*',
-          },
-          {
-            Sid: 'VisualEditor1',
-            Effect: 'Allow',
-            Action: 'route53:GetHostedZone',
-            Resource: 'arn:aws:route53:::hostedzone/Z2XXXXXXXXXXXX',
-          },
-          {
-            Sid: 'VisualEditor2',
-            Effect: 'Allow',
-            Action: 'route53:ListHostedZones',
-            Resource: '*',
-          },
-          {
-            Sid: 'VisualEditor3',
-            Effect: 'Allow',
-            Action: 'route53:ChangeResourceRecordSets',
-            Resource: 'arn:aws:route53:::hostedzone/Z2XXXXXXXXXXXX',
-          },
-        ],
-      },
-    }
-  },
-  validations () {
-    return {
-      accessKeyId: withFieldName('Access Key ID', {
-        required,
-        minLength: minLength(16),
-        maxLength: maxLength(128),
-        alphaNumUnderscore,
-      }),
-      secretAccessKey: withFieldName('Secret Access Key', {
-        required,
-        minLength: minLength(40),
-        base64,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogAzure.vue b/frontend/src/components/Credentials/GSecretDialogAzure.vue
deleted file mode 100644
index bb4a6d3661..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogAzure.vue
+++ /dev/null
@@ -1,218 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-    :provider-type="providerType"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="clientId"
-          color="primary"
-          label="Client Id"
-          :error-messages="getErrorMessages(v$.clientId)"
-          variant="underlined"
-          @update:model-value="v$.clientId.$touch()"
-          @blur="v$.clientId.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="clientSecret"
-          color="primary"
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideSecret ? 'password' : 'text'"
-          label="Client Secret"
-          :error-messages="getErrorMessages(v$.clientSecret)"
-          variant="underlined"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @update:model-value="v$.clientSecret.$touch()"
-          @blur="v$.clientSecret.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="tenantId"
-          color="primary"
-          label="Tenant Id"
-          :error-messages="getErrorMessages(v$.tenantId)"
-          variant="underlined"
-          @update:model-value="v$.tenantId.$touch()"
-          @blur="v$.tenantId.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="subscriptionId"
-          color="primary"
-          label="Subscription Id"
-          :error-messages="getErrorMessages(v$.subscriptionId)"
-          variant="underlined"
-          @update:model-value="v$.subscriptionId.$touch()"
-          @blur="v$.subscriptionId.$touch()"
-        />
-      </div>
-      <div v-if="isDNSSecret">
-        <v-select
-          v-model="azureCloud"
-          color="primary"
-          item-color="primary"
-          label="Azure Cloud"
-          :items="['AzurePublic', 'AzureChina', 'AzureGovernment']"
-          variant="underlined"
-        />
-      </div>
-    </template>
-    <template #help-slot>
-      <div v-if="providerType==='azure'">
-        <p>
-          Before you can provision and access a Kubernetes cluster on Azure, you need to add account/subscription credentials.
-          The Gardener needs the credentials of a service principal assigned to an account/subscription to provision
-          and operate the Azure infrastructure for your Kubernetes cluster.
-        </p>
-        <p>
-          Ensure that the service principal has the permissions defined
-          <g-external-link url="https://github.com/gardener/gardener-extension-provider-azure/blob/master/docs/usage/azure-permissions.md">
-            here
-          </g-external-link> within your subscription assigned.
-          If no fine-grained permissions are required then assign the <strong>Contributor</strong> role.
-        </p>
-        <p>
-          Read the
-          <g-external-link url="https://docs.microsoft.com/azure/active-directory/role-based-access-control-configure">
-            IAM Console help section
-          </g-external-link> on how to manage your credentials and subscriptions.
-        </p>
-      </div>
-      <div v-if="isDNSSecret">
-        <p>
-          Follow the steps as described in the Azure documentation to
-          <g-external-link url="https://docs.microsoft.com/en-us/azure/dns/dns-sdk#create-a-service-principal-account">
-            create a service principal account
-          </g-external-link>
-          and grant the service principal account 'DNS Zone Contributor' permissions to the resource group.
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-import { computed } from 'vue'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import {
-  withFieldName,
-  guid,
-} from '@/utils/validators'
-import { getErrorMessages } from '@/utils'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-    providerType: {
-      type: String,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup (props) {
-    const isDNSSecret = computed(() => {
-      return props.providerType === 'azure-dns' || props.providerType === 'azure-private-dns'
-    })
-
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      clientId,
-      clientSecret,
-      tenantId,
-      subscriptionId,
-      azureCloud,
-    } = secretStringDataRefs({
-      clientID: 'clientId',
-      clientSecret: 'clientSecret',
-      tenantID: 'tenantId',
-      subscriptionID: 'subscriptionId',
-      AZURE_CLOUD: 'azureCloud',
-    })
-
-    return {
-      clientId,
-      clientSecret,
-      tenantId,
-      subscriptionId,
-      azureCloud,
-      isDNSSecret,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideSecret: true,
-    }
-  },
-  validations () {
-    return {
-      clientId: withFieldName('Client ID', {
-        required,
-        guid,
-      }),
-      clientSecret: withFieldName('Client Secret', {
-        required,
-      }),
-      tenantId: withFieldName('Tenant ID', {
-        required,
-        guid,
-      }),
-      subscriptionId: withFieldName('Subscription ID', {
-        required,
-        guid,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogCloudflare.vue b/frontend/src/components/Credentials/GSecretDialogCloudflare.vue
deleted file mode 100644
index 7720814e4b..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogCloudflare.vue
+++ /dev/null
@@ -1,130 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="apiToken"
-          color="primary"
-          label="Cloudflare API Token"
-          :error-messages="getErrorMessages(v$.apiToken)"
-          :append-icon="hideApiToken ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideApiToken ? 'password' : 'text'"
-          variant="underlined"
-          @click:append="() => (hideApiToken = !hideApiToken)"
-          @update:model-value="v$.apiToken.$touch()"
-          @blur="v$.apiToken.$touch()"
-        />
-      </div>
-    </template>
-
-    <template #help-slot>
-      <div>
-        <p>
-          To use this provider you need to generate an API token from the Cloudflare dashboard. A detailed documentation to generate an API token is available at
-          <g-external-link url="https://support.cloudflare.com/hc/en-us/articles/200167836-Managing-API-Tokens-and-Keys" />.
-        </p>
-        <p class="font-weight-bold">
-          Note: You need to generate an API token and not an API key.
-        </p>
-        <p>
-          To generate the token make sure the token has permission of Zone:Read and DNS:Edit for all zones. Optionally you can exclude certain zones.
-        </p>
-        <p class="font-weight-bold">
-          Note: You need to Include All zones in the Zone Resources section. Setting Specific zone doesn't work. But you can still add one or more Excludes.
-        </p>
-        <p>
-          Generate the token and keep this key safe as it won't be shown again.
-        </p>
-        <pre>$ echo -n '1234567890123456789' | base64</pre>
-        <p>
-          to get the base64 encoded token. In this eg. this would be MTIzNDU2Nzg5MDEyMzQ1Njc4OQ==.
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import { withFieldName } from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const { apiToken } = secretStringDataRefs({
-      apiToken: 'apiToken',
-    })
-
-    return {
-      apiToken,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideApiToken: true,
-    }
-  },
-  validations () {
-    return {
-      apiToken: withFieldName('API Token', {
-        required,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogDDns.vue b/frontend/src/components/Credentials/GSecretDialogDDns.vue
deleted file mode 100644
index 207539844b..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogDDns.vue
+++ /dev/null
@@ -1,230 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="v$.server.$model"
-          color="primary"
-          label="<host>:<port> of the authorive DNS server"
-          :error-messages="getErrorMessages(v$.server)"
-          type="text"
-          variant="underlined"
-          @blur="v$.server.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="v$.tsigKeyName.$model"
-          color="primary"
-          label="TSIG Key Name"
-          :error-messages="getErrorMessages(v$.tsigKeyName)"
-          type="text"
-          variant="underlined"
-          @blur="v$.tsigKeyName.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="v$.tsigSecret.$model"
-          color="primary"
-          label="TSIG Secret"
-          :error-messages="getErrorMessages(v$.tsigSecret)"
-          :append-icon="tsigSecretHidden ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="tsigSecretHidden ? 'password' : 'text'"
-          variant="underlined"
-          @click:append="() => (tsigSecretHidden = !tsigSecretHidden)"
-          @blur="v$.tsigSecret.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="v$.zone.$model"
-          color="primary"
-          label="Zone"
-          :error-messages="getErrorMessages(v$.zone)"
-          type="text"
-          variant="underlined"
-          @blur="v$.zone.$touch()"
-        />
-      </div>
-      <div>
-        <v-select
-          v-model="tsigSecretAlgorithm"
-          color="primary"
-          label="TSIG Secret Algorithm"
-          :items="secretAlgorithmItems"
-          variant="underlined"
-        />
-      </div>
-    </template>
-
-    <template #help-slot>
-      <div>
-        <p>
-          This DNS provider allows you to create and manage DNS entries for authoritive DNS server supporting dynamic updates with DNS messages following
-          <g-external-link url="https://datatracker.ietf.org/doc/html/rfc2136">
-            RFC2136
-          </g-external-link>
-          (DNS Update) like knot-dns or others.
-        </p>
-        <p>
-          The configuration is depending on the DNS server product. You need permissions for <code>update</code> and <code>transfer</code> (AXFR) actions on your zones and a TSIG secret.
-        </p>
-        <p>
-          For details see
-          <g-external-link url="https://github.com/gardener/external-dns-management/tree/master/docs/rfc2136">
-            Gardener RFC2136 DNS Provider Documentation
-          </g-external-link>
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import {
-  withFieldName,
-  withMessage,
-} from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      server,
-      tsigKeyName,
-      tsigSecret,
-      zone,
-      tsigSecretAlgorithm,
-    } = secretStringDataRefs({
-      Server: 'server',
-      TSIGKeyName: 'tsigKeyName',
-      TSIGSecret: 'tsigSecret',
-      Zone: 'zone',
-      TSIGSecretAlgorithm: 'tsigSecretAlgorithm',
-    })
-
-    tsigSecretAlgorithm.value = 'hmac-sha256'
-
-    return {
-      server,
-      tsigKeyName,
-      tsigSecret,
-      zone,
-      tsigSecretAlgorithm,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      tsigSecretHidden: true,
-      secretAlgorithmItems: [
-        {
-          title: 'HMAC-SHA256 (default)',
-          value: 'hmac-sha256',
-        },
-        {
-          title: 'HMAC-SHA224',
-          value: 'hmac-sha224',
-        },
-        {
-          title: 'HMAC-SHA384',
-          value: 'hmac-sha384',
-        },
-        {
-          title: 'HMAC-SHA512',
-          value: 'hmac-sha512',
-        },
-        {
-          title: 'HMAC-SHA1',
-          value: 'hmac-sha1',
-        },
-        {
-          title: 'HMAC-MD5',
-          value: 'hmac-md5',
-        },
-      ],
-    }
-  },
-  validations () {
-    return {
-      server: withFieldName('Server', {
-        required,
-      }),
-      tsigKeyName: withFieldName('TSIG Key Name', {
-        required,
-        format: withMessage('Must end with a dot', value => {
-          return /\.$/.test(value)
-        }),
-      }),
-      tsigSecret: withFieldName('TSIG Secret', {
-        required,
-      }),
-      zone: withFieldName('Zone', {
-        required,
-        format: withMessage('Must be fully qualified', value => {
-          if (typeof value !== 'string' || value.length > 255) {
-            return false
-          }
-          return /^[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*\.$/.test(value) // eslint-disable-line security/detect-unsafe-regex
-        }),
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogGcp.vue b/frontend/src/components/Credentials/GSecretDialogGcp.vue
deleted file mode 100644
index 82cfbe7c05..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogGcp.vue
+++ /dev/null
@@ -1,264 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-    :provider-type="providerType"
-  >
-    <template #secret-slot>
-      <div>
-        <v-textarea
-          ref="serviceAccountKeyRef"
-          v-model="serviceAccountKey"
-          color="primary"
-          variant="filled"
-          label="Service Account Key"
-          :error-messages="getErrorMessages(v$.serviceAccountKey)"
-          hint="Enter or drop a service account key in JSON format"
-          persistent-hint
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :class="{ 'hide-secret': hideSecret }"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @update:model-value="v$.serviceAccountKey.$touch()"
-          @blur="v$.serviceAccountKey.$touch()"
-        />
-      </div>
-    </template>
-    <template #help-slot>
-      <div
-        v-if="providerType==='gcp'"
-        class="help-content"
-      >
-        <p>
-          A service account is a special account that can be used by services and applications running on your Google
-          Compute Engine instance to interact with other Google Cloud Platform APIs. Applications can use service
-          account credentials to authorize themselves to a set of APIs and perform actions within the permissions
-          granted to the service account and virtual machine instance.
-        </p>
-
-        <p>
-          Ensure that the service account has at least the roles below.
-        </p>
-
-        <ul>
-          <li>Service Account Admin</li>
-          <li>Service Account Token Creator</li>
-          <li>Service Account User</li>
-          <li>Compute Admin</li>
-        </ul>
-
-        <p>
-          The Service Account has to be enabled for the Google Identity and Access Management API.
-        </p>
-
-        <p>
-          Read the
-          <g-external-link url="https://cloud.google.com/compute/docs/access/service-accounts">
-            Service Account Documentation
-          </g-external-link> on how to apply for credentials
-          to service accounts.
-        </p>
-      </div>
-      <div v-if="providerType==='google-clouddns'">
-        <p>
-          You need to provide a service account and a key (serviceaccount.json) to allow the dns-controller-manager to authenticate and execute calls to Cloud DNS.
-        </p>
-        <p>
-          For details on Cloud DNS see
-          <g-external-link url="https://cloud.google.com/dns/docs/zones" />,
-          and on Service Accounts see
-          <g-external-link url="https://cloud.google.com/iam/docs/service-accounts" />
-        </p>
-        <p>
-          The service account needs permissions on the hosted zone to list and change DNS records. For details on which permissions or roles are required see <g-external-link url="https://cloud.google.com/dns/docs/access-control" />. A possible role is roles/dns.admin "DNS Administrator".
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import {
-  withFieldName,
-  withMessage,
-} from '@/utils/validators'
-import {
-  handleTextFieldDrop,
-  getErrorMessages,
-  setDelayedInputFocus,
-} from '@/utils'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-    providerType: {
-      type: String,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const { serviceAccountKey } = secretStringDataRefs({
-      'serviceaccount.json': 'serviceAccountKey',
-    })
-
-    return {
-      serviceAccountKey,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideSecret: true,
-      dropHandlerInitialized: false,
-    }
-  },
-  validations () {
-    const projectIDTestPattern = /^[a-z][a-z0-9-]{4,28}[a-z0-9]+$/
-
-    return {
-      serviceAccountKey: withFieldName('Service Account Key',
-        {
-          required,
-          validJson: withMessage('Not a valid JSON', value => {
-            try {
-              JSON.parse(value)
-              return true
-            } catch (err) {
-              return false
-            }
-          }),
-          projectID: withMessage('Must contain a valid `project_id`', value => {
-            try {
-              const key = JSON.parse(value)
-              return key.project_id && projectIDTestPattern.test(key.project_id)
-            } catch (err) {
-              return false
-            }
-          }),
-          type: withMessage('Credential `type` must be "service_account"', value => {
-            try {
-              const key = JSON.parse(value)
-              return key.type && key.type === 'service_account'
-            } catch (err) {
-              return false
-            }
-          }),
-
-        },
-      ),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  watch: {
-    value: function (value) {
-      if (value) {
-        this.reset()
-
-        // Mounted does not guarantee that all child components have also been mounted.
-        // In addition, the serviceAccountKey ref is within a slot of a v-dialog, which is by default lazily loaded.
-        // We initialize the drop handler once the dialog is shown by watching the `value`.
-        // We use $nextTick to make sure the entire view has been rendered
-        this.$nextTick(() => {
-          this.initializeDropHandlerOnce()
-        })
-      }
-    },
-  },
-  methods: {
-    reset () {
-      this.v$.$reset()
-
-      this.serviceAccountKey = ''
-
-      if (!this.isCreateMode) {
-        setDelayedInputFocus(this, 'serviceAccountKey')
-      }
-    },
-    initializeDropHandlerOnce () {
-      if (this.dropHandlerInitialized) {
-        return
-      }
-
-      this.dropHandlerInitialized = true
-      const onDrop = value => {
-        this.serviceAccountKey = value
-      }
-      handleTextFieldDrop(this.$refs.serviceAccountKeyRef, /json/, onDrop)
-    },
-    getErrorMessages,
-  },
-}
-</script>
-
-<style lang="scss" scoped>
-
-  :deep(.v-input__control textarea) {
-    font-family: monospace;
-    font-size: 14px;
-  }
-
-  .help-content {
-    ul {
-      margin-top: 20px;
-      margin-bottom: 20px;
-      list-style-type: none;
-      border-left: 4px solid #318334 !important;
-      margin-left: 20px;
-      padding-left: 24px;
-      li {
-        font-weight: 300;
-        font-size: 16px;
-      }
-    }
-  }
-
-  .hide-secret {
-    :deep(.v-input__control textarea) {
-      -webkit-text-security: disc;
-    }
-  }
-
-</style>
diff --git a/frontend/src/components/Credentials/GSecretDialogGeneric.vue b/frontend/src/components/Credentials/GSecretDialogGeneric.vue
index 8d5104aa57..a2f2426b49 100644
--- a/frontend/src/components/Credentials/GSecretDialogGeneric.vue
+++ b/frontend/src/components/Credentials/GSecretDialogGeneric.vue
@@ -9,31 +9,43 @@ SPDX-License-Identifier: Apache-2.0
     v-model="visible"
     :secret-validations="v$"
     :binding="binding"
+    :credential="credential"
     :provider-type="providerType"
     :vendor-type="vendorType"
   >
     <template #secret-slot>
-      <div>
-        <v-textarea
-          v-model="data"
-          color="primary"
-          variant="filled"
-          label="Secret Data"
-          :error-messages="getErrorMessages(v$.data)"
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :class="{ 'hide-secret': hideSecret }"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @blur="v$.data.$touch()"
-        />
-      </div>
+      <g-generic-input-fields
+        v-if="providerFields"
+        v-model="secretStringDataForProviderFields"
+        :fields="providerFields"
+      />
+      <GGenericInputField
+        v-else
+        v-model="secretStringData"
+        :field="defaultInputField"
+      />
     </template>
     <template #help-slot>
-      <div class="help-content">
+      <!-- eslint-disable vue/no-v-html -->
+      <template v-if="helpHtml">
+        <div
+          class="markdown"
+          v-html="helpHtml"
+        />
+        <g-code-block
+          v-if="helpJSONTemplate"
+          class="mt-3"
+          max-height="100%"
+          lang="json"
+          :content="helpJSONTemplate"
+        />
+      </template>
+      <div v-else>
         <p>
           This is a generic secret dialog.
         </p>
         <p>
-          Please enter data required for {{ vendorName }}.
+          Please enter data required for <code>{{ vendorName }}</code>.
         </p>
       </div>
     </template>
@@ -43,29 +55,24 @@ SPDX-License-Identifier: Apache-2.0
 <script>
 import { mapActions } from 'pinia'
 import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-import {
-  dump as yamlDump,
-  load as yamlLoad,
-} from 'js-yaml'
 
 import { useConfigStore } from '@/store/config'
 
 import GSecretDialog from '@/components/Credentials/GSecretDialog'
+import GGenericInputFields from '@/components/GGenericInputFields'
+import GGenericInputField from '@/components/GGenericInputField'
+import GCodeBlock from '@/components/GCodeBlock'
 
 import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
 
-import {
-  withFieldName,
-  withMessage,
-} from '@/utils/validators'
-import { getErrorMessages } from '@/utils'
-
-import isObject from 'lodash/isObject'
+import { transformHtml } from '@/utils'
 
 export default {
   components: {
     GSecretDialog,
+    GGenericInputFields,
+    GGenericInputField,
+    GCodeBlock,
   },
   props: {
     modelValue: {
@@ -75,6 +82,9 @@ export default {
     binding: {
       type: Object,
     },
+    credential: {
+      type: Object,
+    },
     providerType: {
       type: String,
     },
@@ -87,28 +97,19 @@ export default {
     'update:modelValue',
   ],
   setup () {
-    const { secretStringData } = useProvideSecretContext()
+    const {
+      secretStringData,
+      secretStringDataForFields,
+      setSecretStringDataForFields,
+    } = useProvideSecretContext()
 
     return {
-      stringData: secretStringData,
+      secretStringData,
+      secretStringDataForFields,
+      setSecretStringDataForFields,
       v$: useVuelidate(),
     }
   },
-  data () {
-    return {
-      hideSecret: true,
-      internalYaml: '',
-      touched: false,
-    }
-  },
-  validations () {
-    return {
-      data: withFieldName('Secret Data', {
-        required,
-        isYAML: withMessage('You need to enter secret data as YAML key - value pairs', () => Object.keys(this.stringData).length > 0),
-      }),
-    }
-  },
   computed: {
     visible: {
       get () {
@@ -118,31 +119,40 @@ export default {
         this.$emit('update:modelValue', modelValue)
       },
     },
-    data: {
+    providerFields () {
+      if (!this.vendorSecretConfiguration?.fields) {
+        return undefined
+      }
+      return this.vendorSecretConfiguration?.fields
+    },
+    secretStringDataForProviderFields: {
       get () {
-        return this.internalYaml
+        return this.secretStringDataForFields(this.providerFields)
       },
       set (value) {
-        this.internalYaml = value
-        this.touched = true
-        this.stringData = {}
-
-        try {
-          this.stringData = yamlLoad(value)
-        } catch (err) {
-        /* ignore errors */
-        } finally {
-          if (!isObject(this.stringData)) {
-            this.stringData = {}
-          }
-        }
+        this.setSecretStringDataForFields(this.providerFields, value)
       },
     },
-    valid () {
-      return !this.v$.$invalid
+    defaultInputField () {
+      return {
+        label: 'Secret Data',
+        hint: 'Provide secret data as YAML key-value pairs',
+        type: 'yaml-secret',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          isYAML: {
+            type: 'isValidObject',
+          },
+        },
+      }
+    },
+    helpHtml () {
+      return transformHtml(this.vendorSecretConfiguration?.help)
     },
-    isCreateMode () {
-      return !this.secret
+    helpJSONTemplate () {
+      return JSON.stringify(this.vendorSecretConfiguration?.helpJSONTemplate, undefined, 2)
     },
     vendorName () {
       return this.vendorDisplayName({
@@ -150,52 +160,25 @@ export default {
         name: this.providerType,
       })
     },
-  },
-  watch: {
-    stringData (value) {
-      if (!this.touched) {
-        if (value && Object.keys(value).length > 0) {
-          this.internalYaml = yamlDump(value)
-        } else {
-          this.internalYaml = ''
-        }
-      }
+    vendorSecretConfiguration () {
+      return this.vendorDetails({
+        type: this.vendorType,
+        name: this.providerType,
+      })?.secret
     },
   },
   methods: {
-    getErrorMessages,
-    ...mapActions(useConfigStore, ['vendorDisplayName']),
-
+    ...mapActions(useConfigStore, ['vendorDetails', 'vendorDisplayName']),
   },
 }
 </script>
 
 <style lang="scss" scoped>
 
-  :deep(.v-input__control textarea) {
-    font-family: monospace;
-    font-size: 14px;
-  }
-
-  .help-content {
-    ul {
-      margin-top: 20px;
-      margin-bottom: 20px;
-      list-style-type: none;
-      border-left: 4px solid #318334 !important;
-      margin-left: 20px;
-      padding-left: 24px;
-      li {
-        font-weight: 300;
-        font-size: 16px;
-      }
-    }
-  }
-
-  .hide-secret {
-    :deep(.v-input__control textarea) {
-      -webkit-text-security: disc;
-    }
+.markdown {
+  :deep(p) {
+    margin: 0px;
   }
+}
 
 </style>
diff --git a/frontend/src/components/Credentials/GSecretDialogHCloud.vue b/frontend/src/components/Credentials/GSecretDialogHCloud.vue
deleted file mode 100644
index 6f9eeef25b..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogHCloud.vue
+++ /dev/null
@@ -1,119 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="hcloudToken"
-          color="primary"
-          label="Hetzner Cloud Token"
-          :error-messages="getErrorMessages(v$.hcloudToken)"
-          variant="underlined"
-          @update:model-value="v$.hcloudToken.$touch()"
-          @blur="v$.hcloudToken.$touch()"
-        />
-      </div>
-    </template>
-
-    <template #help-slot>
-      <div>
-        <p>
-          Before you can provision and access a Kubernetes cluster on Hetzner Cloud, you need to add a Hetzner Cloud token.
-          The Gardener needs these credentials to provision and operate Hetzner Cloud infrastructure for your Kubernetes cluster.
-        </p>
-        <p>
-          Please read the
-          <g-external-link
-            url="https://www.hetzner.com/cloud"
-          >
-            Hetzner Cloud Documentation
-          </g-external-link>.
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink.vue'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { withFieldName } from '@/utils/validators'
-import { getErrorMessages } from '@/utils'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const { hcloudToken } = secretStringDataRefs({
-      hcloudToken: 'hcloudToken',
-    })
-
-    return {
-      hcloudToken,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideHcloudToken: true,
-    }
-  },
-  validations () {
-    return {
-      hcloudToken: withFieldName('Cloud Token', {
-        required,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogInfoblox.vue b/frontend/src/components/Credentials/GSecretDialogInfoblox.vue
deleted file mode 100644
index 260f9f1516..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogInfoblox.vue
+++ /dev/null
@@ -1,129 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="infobloxUsername"
-          color="primary"
-          label="Infoblox Username"
-          :error-messages="getErrorMessages(v$.infobloxUsername)"
-          variant="underlined"
-          @update:model-value="v$.infobloxUsername.$touch()"
-          @blur="v$.infobloxUsername.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="infobloxPassword"
-          color="primary"
-          label="Infoblox Password"
-          :error-messages="getErrorMessages(v$.infobloxPassword)"
-          :append-icon="hideInfobloxPassword ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideInfobloxPassword ? 'password' : 'text'"
-          variant="underlined"
-          @click:append="() => (hideInfobloxPassword = !hideInfobloxPassword)"
-          @update:model-value="v$.infobloxPassword.$touch()"
-          @blur="v$.infobloxPassword.$touch()"
-        />
-      </div>
-    </template>
-
-    <template #help-slot>
-      <div>
-        <p>Before you can use Infoblox DNS provider, you need to add account credentials.</p>
-        <p>Please enter account information for a technical user.</p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { withFieldName } from '@/utils/validators'
-import { getErrorMessages } from '@/utils'
-
-export default {
-  components: {
-    GSecretDialog,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      infobloxUsername,
-      infobloxPassword,
-    } = secretStringDataRefs({
-      USERNAME: 'infobloxUsername',
-      PASSWORD: 'infobloxPassword',
-    })
-
-    return {
-      infobloxUsername,
-      infobloxPassword,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideInfobloxPassword: true,
-    }
-  },
-  validations () {
-    return {
-      infobloxUsername: withFieldName('Username', {
-        required,
-      }),
-      infobloxPassword: withFieldName('Password', {
-        required,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogMetal.vue b/frontend/src/components/Credentials/GSecretDialogMetal.vue
deleted file mode 100644
index f16180f575..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogMetal.vue
+++ /dev/null
@@ -1,134 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="apiUrl"
-          color="primary"
-          label="API URL"
-          :error-messages="getErrorMessages(v$.apiUrl)"
-          variant="underlined"
-          @update:model-value="v$.apiUrl.$touch()"
-          @blur="v$.apiUrl.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="apiHmac"
-          color="primary"
-          label="API HMAC"
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideSecret ? 'password' : 'text'"
-          :error-messages="getErrorMessages(v$.apiHmac)"
-          variant="underlined"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @update:model-value="v$.apiHmac.$touch()"
-          @blur="v$.apiHmac.$touch()"
-        />
-      </div>
-    </template>
-    <template #help-slot>
-      <div>
-        <p>
-          Before you can provision and access a Kubernetes cluster on Metal Stack, you need to provide HMAC credentials and the endpoint of your Metal API.
-          The Gardener needs the credentials to provision and operate the Metal Stack infrastructure for your Kubernetes cluster.
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import {
-  required,
-  url,
-} from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import { withFieldName } from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      apiHmac,
-      apiUrl,
-    } = secretStringDataRefs({
-      metalAPIHMac: 'apiHmac',
-      metalAPIURL: 'apiUrl',
-    })
-
-    return {
-      apiHmac,
-      apiUrl,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideSecret: true,
-    }
-  },
-  validations () {
-    return {
-      apiHmac: withFieldName('API HMAC', {
-        required,
-      }),
-      apiUrl: withFieldName('API URL', {
-        required,
-        url,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogNetlify.vue b/frontend/src/components/Credentials/GSecretDialogNetlify.vue
deleted file mode 100644
index cbae1d4d0f..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogNetlify.vue
+++ /dev/null
@@ -1,121 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="apiToken"
-          color="primary"
-          label="Netlify API Token"
-          :error-messages="getErrorMessages(v$.apiToken)"
-          :append-icon="hideApiToken ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideApiToken ? 'password' : 'text'"
-          variant="underlined"
-          @click:append="() => (hideApiToken = !hideApiToken)"
-          @update:model-value="v$.apiToken.$touch()"
-          @blur="v$.apiToken.$touch()"
-        />
-      </div>
-    </template>
-
-    <template #help-slot>
-      <div>
-        <p>
-          You need to provide an access token for Netlify to allow the dns-controller-manager to authenticate with the Netlify DNS API.
-        </p>
-        <p>
-          Then, base64 encode the token. For example, if the generated token in 1234567890123456, use
-        </p>
-        <pre>$ echo -n '1234567890123456789' | base64</pre>
-        <p>
-          For details, see
-          <g-external-link url="https://docs.netlify.com/cli/get-started/#obtain-a-token-in-the-netlify-ui" />
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import { withFieldName } from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const { apiToken } = secretStringDataRefs({
-      apiToken: 'apiToken',
-    })
-
-    return {
-      apiToken,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideApiToken: true,
-    }
-  },
-  validations () {
-    return {
-      apiToken: withFieldName('API Token', {
-        required,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogOpenstack.vue b/frontend/src/components/Credentials/GSecretDialogOpenstack.vue
index aad8c6ee4c..acb7d5641a 100644
--- a/frontend/src/components/Credentials/GSecretDialogOpenstack.vue
+++ b/frontend/src/components/Credentials/GSecretDialogOpenstack.vue
@@ -10,128 +10,64 @@ SPDX-License-Identifier: Apache-2.0
     :secret-validations="v$"
     :binding="binding"
     :provider-type="providerType"
+    :vendor-type="vendorType"
   >
     <template #secret-slot>
-      <div v-if="providerType==='openstack-designate'">
-        <v-text-field
-          v-model="authURL"
-          color="primary"
-          label="Auth URL"
-          :error-messages="getErrorMessages(v$.authURL)"
-          variant="underlined"
-          @update:model-value="v$.authURL.$touch()"
-          @blur="v$.authURL.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="domainName"
-          color="primary"
-          label="Domain Name"
-          :error-messages="getErrorMessages(v$.domainName)"
-          variant="underlined"
-          @update:model-value="v$.domainName.$touch()"
-          @blur="v$.domainName.$touch()"
+      <GGenericInputField
+        v-if="providerType==='openstack-designate'"
+        v-model="authURL"
+        :field="fields['authURL']"
+      />
+      <GGenericInputField
+        v-model="domainName"
+        :field="fields['domainName']"
+      />
+      <GGenericInputField
+        v-model="tenantName"
+        :field="fields['tenantName']"
+      />
+      <v-radio-group
+        v-model="authenticationMethod"
+        row
+      >
+        <template #label>
+          <span class="text-body-large">Authentication Method:</span>
+        </template>
+        <v-radio
+          label="Technical User"
+          value="USER"
         />
-      </div>
-      <div>
-        <v-text-field
-          v-model="tenantName"
-          color="primary"
-          label="Project / Tenant Name"
-          :error-messages="getErrorMessages(v$.tenantName)"
-          variant="underlined"
-          @update:model-value="v$.tenantName.$touch()"
-          @blur="v$.tenantName.$touch()"
+        <v-radio
+          label="Application Credentials"
+          value="APPLICATION_CREDENTIALS"
         />
-      </div>
-      <div>
-        <v-radio-group
-          v-model="authenticationMethod"
-          row
-        >
-          <template #label>
-            <span class="text-body-large">Authentication Method:</span>
-          </template>
-          <v-radio
-            label="Technical User"
-            value="USER"
+      </v-radio-group>
+      <v-container class="py-0">
+        <template v-if="authenticationMethod === 'USER'">
+          <GGenericInputField
+            v-model="username"
+            :field="fields['username']"
+            :input-props="{ 'v-messages-color': { color: 'warning' } }"
           />
-          <v-radio
-            label="Application Credentials"
-            value="APPLICATION_CREDENTIALS"
+          <GGenericInputField
+            v-model="password"
+            :field="fields['password']"
+            :input-props="{ 'v-messages-color': {color: 'warning' } }"
           />
-        </v-radio-group>
-      </div>
-      <v-container class="py-0">
-        <template v-if="authenticationMethod === 'APPLICATION_CREDENTIALS'">
-          <div>
-            <v-text-field
-              v-model="applicationCredentialID"
-              color="primary"
-              label="ID"
-              :error-messages="getErrorMessages(v$.applicationCredentialID)"
-              variant="underlined"
-              @update:model-value="v$.applicationCredentialID.$touch()"
-              @blur="v$.applicationCredentialID.$touch()"
-            />
-          </div>
-          <div>
-            <v-text-field
-              v-model="applicationCredentialName"
-              color="primary"
-              label="Name"
-              :error-messages="getErrorMessages(v$.applicationCredentialName)"
-              variant="underlined"
-              @update:model-value="v$.applicationCredentialName.$touch()"
-              @blur="v$.applicationCredentialName.$touch()"
-            />
-          </div>
-          <div>
-            <v-text-field
-              v-model="applicationCredentialSecret"
-              color="primary"
-              label="Password"
-              :error-messages="getErrorMessages(v$.applicationCredentialSecret)"
-              :append-icon="hideApplicationCredentialSecret ? 'mdi-eye' : 'mdi-eye-off'"
-              :type="hideApplicationCredentialSecret ? 'password' : 'text'"
-              variant="underlined"
-              @click:append="() => (hideApplicationCredentialSecret = !hideApplicationCredentialSecret)"
-              @update:model-value="v$.applicationCredentialSecret.$touch()"
-              @blur="v$.applicationCredentialSecret.$touch()"
-            />
-          </div>
         </template>
         <template v-else>
-          <div>
-            <v-text-field
-              v-model="username"
-              v-messages-color="{ color: 'primary' }"
-              color="primary"
-              label="Technical User"
-              :error-messages="getErrorMessages(v$.username)"
-              hint="Do not use personalized login credentials. Instead, use credentials of a technical user"
-              variant="underlined"
-              @update:model-value="v$.username.$touch()"
-              @blur="v$.username.$touch()"
-            />
-          </div>
-          <div>
-            <v-text-field
-              v-model="password"
-              v-messages-color="{ color: 'warning' }"
-              color="primary"
-              label="Password"
-              :error-messages="getErrorMessages(v$.password)"
-              :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-              :type="hideSecret ? 'password' : 'text'"
-              hint="Do not use personalized login credentials. Instead, use credentials of a technical user"
-              variant="underlined"
-              @click:append="() => (hideSecret = !hideSecret)"
-              @update:model-value="v$.password.$touch()"
-              @blur="v$.password.$touch()"
-            />
-          </div>
+          <GGenericInputField
+            v-model="applicationCredentialID"
+            :field="fields['applicationCredentialID']"
+          />
+          <GGenericInputField
+            v-model="applicationCredentialName"
+            :field="fields['applicationCredentialName']"
+          />
+          <GGenericInputField
+            v-model="applicationCredentialSecret"
+            :field="fields['applicationCredentialSecret']"
+          />
         </template>
       </v-container>
     </template>
@@ -161,30 +97,25 @@ SPDX-License-Identifier: Apache-2.0
 </template>
 
 <script>
+import { mapActions } from 'pinia'
 import { useVuelidate } from '@vuelidate/core'
-import {
-  required,
-  requiredIf,
-} from '@vuelidate/validators'
+
+import { useConfigStore } from '@/store/config'
 
 import GSecretDialog from '@/components/Credentials/GSecretDialog'
 import GExternalLink from '@/components/GExternalLink'
 
 import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
 
-import {
-  withMessage,
-  withFieldName,
-} from '@/utils/validators'
-import {
-  getErrorMessages,
-  setDelayedInputFocus,
-} from '@/utils'
+import { getErrorMessages } from '@/utils'
+
+import GGenericInputField from '../GGenericInputField.vue'
 
 export default {
   components: {
     GSecretDialog,
     GExternalLink,
+    GGenericInputField,
   },
   props: {
     modelValue: {
@@ -197,6 +128,10 @@ export default {
     providerType: {
       type: String,
     },
+    vendorType: {
+      type: String,
+      required: true,
+    },
   },
   emits: [
     'update:modelValue',
@@ -240,66 +175,25 @@ export default {
     return {
       hideSecret: true,
       hideApplicationCredentialSecret: true,
-      authenticationMethod: 'USER',
+      authenticationMethodInternal: 'USER',
     }
   },
-  validations () {
-    const requiredUserMessage = 'Required for technical user authentication'
-    const requiredApplicationCredentialsMessage = 'Required for application credentials authentication'
-
-    const rules = {}
-
-    rules.domainName = withFieldName('Domain Name', {
-      required,
-    })
-
-    rules.tenantName = withFieldName('Project / Tenant Name', {
-      required,
-    })
-
-    const usernameRules = {
-      required: withMessage(requiredUserMessage,
-        requiredIf(() => this.authenticationMethod === 'USER'),
-      ),
-    }
-    rules.username = withFieldName('Technical User', usernameRules)
-
-    const passwordRules = {
-      required: withMessage(requiredUserMessage,
-        requiredIf(() => this.authenticationMethod === 'USER'),
-      ),
-    }
-    rules.password = withFieldName('Password', passwordRules)
-
-    const authURLRules = {
-      required: requiredIf(() => this.providerType === 'openstack-designate'),
-    }
-    rules.authURL = withFieldName('Auth URL', authURLRules)
-
-    const applicationCredentialIDRules = {
-      required: withMessage(requiredApplicationCredentialsMessage,
-        requiredIf(() => this.authenticationMethod === 'APPLICATION_CREDENTIALS'),
-      ),
-    }
-    rules.applicationCredentialID = withFieldName('Application Credentials ID', applicationCredentialIDRules)
-
-    const applicationCredentialNameRules = {
-      required: withMessage(requiredApplicationCredentialsMessage,
-        requiredIf(() => this.authenticationMethod === 'APPLICATION_CREDENTIALS'),
-      ),
-    }
-    rules.applicationCredentialName = withFieldName('Application Credentials Name', applicationCredentialNameRules)
-
-    const applicationCredentialSecretRules = {
-      required: withMessage(requiredApplicationCredentialsMessage,
-        requiredIf(() => this.authenticationMethod === 'APPLICATION_CREDENTIALS'),
-      ),
-    }
-    rules.applicationCredentialSecret = withFieldName('Application Credentials Secret', applicationCredentialSecretRules)
-
-    return rules
-  },
   computed: {
+    authenticationMethod: {
+      get () {
+        return this.authenticationMethodInternal
+      },
+      set (value) {
+        this.authenticationMethodInternal = value
+        this.username = undefined
+        this.password = undefined
+        this.applicationCredentialID = undefined
+        this.applicationCredentialName = undefined
+        this.applicationCredentialSecret = undefined
+
+        this.v$.$reset()
+      },
+    },
     visible: {
       get () {
         return this.modelValue
@@ -308,6 +202,15 @@ export default {
         this.$emit('update:modelValue', modelValue)
       },
     },
+    fields () {
+      return Object.fromEntries(this.providerFields.map(field => [field.key, field]))
+    },
+    providerFields () {
+      return this.vendorDetails({
+        type: this.vendorType,
+        name: this.providerType,
+      })?.secret?.fields ?? []
+    },
     valid () {
       return !this.v$.$invalid
     },
@@ -316,36 +219,14 @@ export default {
     },
   },
   watch: {
-    authenticationMethod () {
-      this.username = undefined
-      this.password = undefined
-      this.applicationCredentialID = undefined
-      this.applicationCredentialName = undefined
-      this.applicationCredentialSecret = undefined
-      this.v$.$reset()
+    applicationCredentialID (value) {
+      if (value) {
+        this.authenticationMethodInternal = 'APPLICATION_CREDENTIALS'
+      }
     },
   },
   methods: {
-    reset () {
-      this.v$.$reset()
-
-      this.domainName = ''
-      this.tenantName = ''
-      this.username = ''
-      this.password = ''
-      this.authURL = ''
-      this.applicationCredentialID = ''
-      this.applicationCredentialName = ''
-      this.applicationCredentialSecret = ''
-
-      if (!this.isCreateMode) {
-        if (this.secret.data) {
-          this.domainName = this.secret.data.domainName
-          this.tenantName = this.secret.data.tenantName
-        }
-        setDelayedInputFocus(this, 'domainName')
-      }
-    },
+    ...mapActions(useConfigStore, ['vendorDetails']),
     getErrorMessages,
   },
 }
diff --git a/frontend/src/components/Credentials/GSecretDialogPowerdns.vue b/frontend/src/components/Credentials/GSecretDialogPowerdns.vue
deleted file mode 100644
index ea0621b148..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogPowerdns.vue
+++ /dev/null
@@ -1,134 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="server"
-          color="primary"
-          label="Server"
-          :error-messages="getErrorMessages(v$.server)"
-          variant="underlined"
-          @update:model-value="v$.server.$touch()"
-          @blur="v$.server.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="apiKey"
-          color="primary"
-          label="API Key"
-          :append-icon="hideSecret ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideSecret ? 'password' : 'text'"
-          :error-messages="getErrorMessages(v$.apiKey)"
-          variant="underlined"
-          @click:append="() => (hideSecret = !hideSecret)"
-          @update:model-value="v$.apiKey.$touch()"
-          @blur="v$.apiKey.$touch()"
-        />
-      </div>
-    </template>
-    <template #help-slot>
-      <div>
-        <p>
-          To use this provider you need to configure the PowerDNS API with an API key. A detailed documentation to generate an API key is available at
-          <g-external-link url="https://doc.powerdns.com/authoritative/http-api/index.html#enabling-the-api" />
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import {
-  required,
-  url,
-} from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import { withFieldName } from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      server,
-      apiKey,
-    } = secretStringDataRefs({
-      server: 'server',
-      apiKey: 'apiKey',
-    })
-
-    return {
-      server,
-      apiKey,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideSecret: true,
-    }
-  },
-  validations () {
-    return {
-      apiKey: withFieldName('API Key', {
-        required,
-      }),
-      server: withFieldName('Server', {
-        required,
-        url,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogVSphere.vue b/frontend/src/components/Credentials/GSecretDialogVSphere.vue
deleted file mode 100644
index f9f804bf4e..0000000000
--- a/frontend/src/components/Credentials/GSecretDialogVSphere.vue
+++ /dev/null
@@ -1,184 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Gardener contributors
-
-SPDX-License-Identifier: Apache-2.0
- -->
-
-<template>
-  <g-secret-dialog
-    v-model="visible"
-    :secret-validations="v$"
-    :binding="binding"
-  >
-    <template #secret-slot>
-      <div>
-        <v-text-field
-          v-model="vsphereUsername"
-          color="primary"
-          label="vSphere Username"
-          :error-messages="getErrorMessages(v$.vsphereUsername)"
-          variant="underlined"
-          @update:model-value="v$.vsphereUsername.$touch()"
-          @blur="v$.vsphereUsername.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="vspherePassword"
-          color="primary"
-          label="vSphere Password"
-          :error-messages="getErrorMessages(v$.vspherePassword)"
-          :append-icon="hideVspherePassword ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideVspherePassword ? 'password' : 'text'"
-          variant="underlined"
-          @click:append="() => (hideVspherePassword = !hideVspherePassword)"
-          @update:model-value="v$.vspherePassword.$touch()"
-          @blur="v$.vspherePassword.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="nsxtUsername"
-          color="primary"
-          label="NSX-T Username"
-          :error-messages="getErrorMessages(v$.nsxtUsername)"
-          variant="underlined"
-          @update:model-value="v$.nsxtUsername.$touch()"
-          @blur="v$.nsxtUsername.$touch()"
-        />
-      </div>
-      <div>
-        <v-text-field
-          v-model="nsxtPassword"
-          color="primary"
-          label="NSX-T Password"
-          :error-messages="getErrorMessages(v$.nsxtPassword)"
-          :append-icon="hideNsxtPassword ? 'mdi-eye' : 'mdi-eye-off'"
-          :type="hideNsxtPassword ? 'password' : 'text'"
-          variant="underlined"
-          @click:append="() => (hideNsxtPassword = !hideNsxtPassword)"
-          @update:model-value="v$.nsxtPassword.$touch()"
-          @blur="v$.nsxtPassword.$touch()"
-        />
-      </div>
-    </template>
-
-    <template #help-slot>
-      <div>
-        <p>
-          Before you can provision and access a Kubernetes cluster on VMware vSphere, you need to add vSphere and NSX-T account credentials.
-          The Gardener needs these credentials to provision and operate the VMware vSphere infrastructure for your Kubernetes cluster.
-        </p>
-        <p>
-          Ensure that these accounts have privileges to <strong>create, modify and delete VMs and Networking resources</strong>.
-        </p>
-        <p>
-          Please read the
-          <g-external-link url="https://docs.vmware.com/de/VMware-vSphere/index.html">
-            VMware vSphere Documentation
-          </g-external-link>
-          and the
-          <g-external-link url="https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html">
-            VMware NSX-T Data Center Documentation
-          </g-external-link>.
-        </p>
-      </div>
-    </template>
-  </g-secret-dialog>
-</template>
-
-<script>
-import { useVuelidate } from '@vuelidate/core'
-import { required } from '@vuelidate/validators'
-
-import GSecretDialog from '@/components/Credentials/GSecretDialog'
-import GExternalLink from '@/components/GExternalLink.vue'
-
-import { useProvideSecretContext } from '@/composables/credential/useSecretContext'
-
-import { getErrorMessages } from '@/utils'
-import { withFieldName } from '@/utils/validators'
-
-export default {
-  components: {
-    GSecretDialog,
-    GExternalLink,
-  },
-  props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-    },
-    binding: {
-      type: Object,
-    },
-  },
-  emits: [
-    'update:modelValue',
-  ],
-  setup () {
-    const { secretStringDataRefs } = useProvideSecretContext()
-
-    const {
-      vsphereUsername,
-      vspherePassword,
-      nsxtUsername,
-      nsxtPassword,
-    } = secretStringDataRefs({
-      vSphereUsername: 'vsphereUsername',
-      vSpherePassword: 'vspherePassword',
-      NSXTUsername: 'nsxtUsername',
-      NSXTPassword: 'nsxtPassword',
-    })
-
-    return {
-      vsphereUsername,
-      vspherePassword,
-      nsxtUsername,
-      nsxtPassword,
-      v$: useVuelidate(),
-    }
-  },
-  data () {
-    return {
-      hideVspherePassword: true,
-      hideNsxtPassword: true,
-    }
-  },
-  validations () {
-    return {
-      vsphereUsername: withFieldName('vSphere Username', {
-        required,
-      }),
-      vspherePassword: withFieldName('vSphere Password', {
-        required,
-      }),
-      nsxtUsername: withFieldName('NSX-T Username', {
-        required,
-      }),
-      nsxtPassword: withFieldName('NSX-T Password', {
-        required,
-      }),
-    }
-  },
-  computed: {
-    visible: {
-      get () {
-        return this.modelValue
-      },
-      set (modelValue) {
-        this.$emit('update:modelValue', modelValue)
-      },
-    },
-    valid () {
-      return !this.v$.$invalid
-    },
-    isCreateMode () {
-      return !this.secret
-    },
-  },
-  methods: {
-    getErrorMessages,
-  },
-}
-</script>
diff --git a/frontend/src/components/Credentials/GSecretDialogWrapper.vue b/frontend/src/components/Credentials/GSecretDialogWrapper.vue
index 51467050f0..b4ace3797b 100644
--- a/frontend/src/components/Credentials/GSecretDialogWrapper.vue
+++ b/frontend/src/components/Credentials/GSecretDialogWrapper.vue
@@ -16,19 +16,7 @@ SPDX-License-Identifier: Apache-2.0
 <script>
 import { defineAsyncComponent } from 'vue'
 
-const GcpDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogGcp'))
-const AwsDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogAws'))
-const AzureDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogAzure'))
 const OpenstackDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogOpenstack'))
-const AlicloudDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogAlicloud'))
-const MetalDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogMetal'))
-const VsphereDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogVSphere'))
-const CloudflareDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogCloudflare'))
-const InfobloxDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogInfoblox'))
-const NetlifyDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogNetlify'))
-const DDnsDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogDDns'))
-const HcloudDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogHCloud'))
-const PowerdnsDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogPowerdns'))
 const GenericDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogGeneric'))
 const DeleteDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogDelete'))
 const MigrationDialog = defineAsyncComponent(() => import('@/components/Credentials/GSecretDialogMigration'))
@@ -47,29 +35,9 @@ export default {
   computed: {
     resolvedComponent () {
       switch (this.visibleDialog) {
-        // Infra Secret Dialogs
-        case 'aws': return AwsDialog
-        case 'azure': return AzureDialog
-        case 'gcp': return GcpDialog
+        // Custom Dialogs for specific provider types
         case 'openstack': return OpenstackDialog
-        case 'alicloud': return AlicloudDialog
-        case 'metal': return MetalDialog
-        case 'vsphere': return VsphereDialog
-        case 'hcloud': return HcloudDialog
-
-        // DNS Secret Dialogs
-        case 'aws-route53': return AwsDialog
-        case 'azure-dns': return AzureDialog
-        case 'azure-private-dns': return AzureDialog
-        case 'google-clouddns': return GcpDialog
         case 'openstack-designate': return OpenstackDialog
-        case 'alicloud-dns': return AlicloudDialog
-        case 'cloudflare-dns': return CloudflareDialog
-        case 'infoblox-dns': return InfobloxDialog
-        case 'netlify-dns': return NetlifyDialog
-        case 'rfc2136': return DDnsDialog
-        case 'cloudflare': return CloudflareDialog
-        case 'powerdns': return PowerdnsDialog
 
         // Generic Dialogs
         case 'delete': return DeleteDialog
diff --git a/frontend/src/components/Credentials/GSelectCredential.vue b/frontend/src/components/Credentials/GSelectCredential.vue
index a5122523d8..45e78ec4a1 100644
--- a/frontend/src/components/Credentials/GSelectCredential.vue
+++ b/frontend/src/components/Credentials/GSelectCredential.vue
@@ -64,7 +64,7 @@ SPDX-License-Identifier: Apache-2.0
     </v-select>
     <g-secret-dialog-wrapper
       :visible-dialog="visibleSecretDialog"
-      :visible-dialog-vendor-type="isDnsProvider ? 'dns' : 'infra'"
+      :visible-dialog-vendor-type="vendorType"
       @dialog-closed="onSecretDialogClosed"
     />
   </div>
@@ -77,12 +77,9 @@ import {
 } from 'vue'
 import { useVuelidate } from '@vuelidate/core'
 import { required } from '@vuelidate/validators'
-import { storeToRefs } from 'pinia'
 
 import { useProjectStore } from '@/store/project'
 import { useCredentialStore } from '@/store/credential'
-import { useGardenerExtensionStore } from '@/store/gardenerExtension'
-import { useCloudProfileStore } from '@/store/cloudProfile'
 
 import GSecretDialogWrapper from '@/components/Credentials/GSecretDialogWrapper'
 import GCredentialName from '@/components/Credentials/GCredentialName'
@@ -122,6 +119,11 @@ export default {
     providerType: {
       type: String,
     },
+    vendorType: {
+      type: String,
+      required: true,
+      validator: value => ['infra', 'dns'].includes(value),
+    },
     registerVuelidateAs: {
       type: String,
     },
@@ -145,20 +147,18 @@ export default {
       costObject,
     } = useProjectCostObject(projectItem)
     const credentialStore = useCredentialStore()
-    const gardenerExtensionStore = useGardenerExtensionStore()
-    const cloudProfileStore = useCloudProfileStore()
 
     const v$ = useVuelidate({
       $registerAs: props.registerVuelidateAs,
     })
 
     const providerType = toRef(props, 'providerType')
+    const vendorType = toRef(props, 'vendorType')
     const credential = toRef(props, 'modelValue')
 
-    const cloudProviderEntityList = useCloudProviderEntityList(providerType, { credentialStore, gardenerExtensionStore, cloudProfileStore })
+    const cloudProviderEntityList = useCloudProviderEntityList(providerType, { credentialStore, vendorType })
 
-    const { dnsProviderTypes } = storeToRefs(gardenerExtensionStore)
-    const isDnsProvider = computed(() => dnsProviderTypes.value.includes(providerType.value))
+    const isDnsProvider = computed(() => vendorType.value === 'dns')
     let composable
     if (isDnsProvider.value) {
       composable = useDnsProviderCredential(credential)
diff --git a/frontend/src/components/Credentials/GShootCredentialConfiguration.vue b/frontend/src/components/Credentials/GShootCredentialConfiguration.vue
index ba9d393b6c..89148520f1 100644
--- a/frontend/src/components/Credentials/GShootCredentialConfiguration.vue
+++ b/frontend/src/components/Credentials/GShootCredentialConfiguration.vue
@@ -18,6 +18,7 @@ SPDX-License-Identifier: Apache-2.0
         <g-select-credential
           v-model="infrastructureBinding"
           :provider-type="shootProviderType"
+          vendor-type="infra"
           :filter-fn="credentialFilterFn"
         />
         <template v-if="migrationMode">
diff --git a/frontend/src/components/GGenericInputField.vue b/frontend/src/components/GGenericInputField.vue
new file mode 100644
index 0000000000..734f864965
--- /dev/null
+++ b/frontend/src/components/GGenericInputField.vue
@@ -0,0 +1,391 @@
+<!--
+SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<template>
+  <v-text-field
+    v-if="isTextLike"
+    ref="fieldRef"
+    v-model="v$.localValue.$model"
+    color="primary"
+    :label="field.label"
+    :hint="field.hint"
+    :type="computedTextFieldType"
+    :autocomplete="inputAutocomplete"
+    :append-icon="appendIcon"
+    :error-messages="inputErrorMessages"
+    variant="underlined"
+    v-bind="inputProps"
+    @click:append="onClickAppend"
+    @blur="v$.localValue.$touch()"
+  />
+
+  <v-select
+    v-else-if="isSelectLike"
+    ref="fieldRef"
+    v-model="v$.localValue.$model"
+    color="primary"
+    item-color="primary"
+    :label="field.label"
+    :items="items"
+    :hint="field.hint"
+    :multiple="field.type === 'select-multiple'"
+    :error-messages="inputErrorMessages"
+    variant="underlined"
+    v-bind="inputProps"
+    @blur="v$.localValue.$touch()"
+  />
+
+  <v-textarea
+    v-else-if="isStructuredLike"
+    ref="fieldRef"
+    v-model="v$.localValue.$model"
+    color="primary"
+    :label="field.label"
+    :hint="field.hint"
+    :error-messages="inputErrorMessages"
+    :autocomplete="inputAutocomplete"
+    :append-icon="appendIcon"
+    :class="{ 'hide-secret': hideSecret }"
+    variant="filled"
+    v-bind="inputProps"
+    @click:append="onClickAppend"
+    @blur="v$.localValue.$touch()"
+  />
+</template>
+
+<script setup>
+import {
+  computed,
+  ref,
+  watch,
+  onMounted,
+  onUnmounted,
+  useTemplateRef,
+} from 'vue'
+import {
+  required,
+  maxLength,
+  minLength,
+  url,
+} from '@vuelidate/validators'
+import { useVuelidate } from '@vuelidate/core'
+
+import { useStructuredTextField } from '@/composables/useStructuredTextField'
+import { useLogger } from '@/composables/useLogger'
+
+import {
+  withFieldName,
+  withMessage,
+  guid,
+  alphaNumUnderscore,
+  base64,
+} from '@/utils/validators'
+import {
+  getErrorMessages,
+  handleTextFieldDrop,
+} from '@/utils'
+import {
+  isJsonFieldType,
+  isSecretFieldType,
+  isStructuredFieldType,
+  isStructuredSecretFieldType,
+  isYamlFieldType,
+} from '@/utils/inputFieldTypes'
+
+import get from 'lodash/get'
+import forEach from 'lodash/forEach'
+import set from 'lodash/set'
+import isEmpty from 'lodash/isEmpty'
+
+const props = defineProps({
+  field: {
+    type: Object,
+    required: true,
+  },
+  modelValue: {
+    type: [String, Object, Number, Boolean],
+  },
+  inputProps: {
+    type: Object,
+    default: undefined,
+  },
+  cloudProfileRef: {
+    type: Object,
+  },
+})
+
+const emit = defineEmits([
+  'update:modelValue',
+  'touch',
+])
+
+const fieldRef = useTemplateRef('fieldRef')
+const logger = useLogger()
+const dropErrorMessage = ref()
+
+const fieldType = computed(() => props.field.type)
+
+const isYAML = computed(() => isYamlFieldType(fieldType.value))
+const isJSON = computed(() => isJsonFieldType(fieldType.value))
+const isStructuredPassword = computed(() => isStructuredSecretFieldType(fieldType.value))
+
+const isTextLike = computed(() => fieldType.value === 'text' || fieldType.value === 'password')
+const isSelectLike = computed(() => fieldType.value === 'select' || fieldType.value === 'select-multiple')
+const isStructuredLike = computed(() => isStructuredFieldType(fieldType.value))
+
+const inputAutocomplete = computed(() => {
+  if (props.field.autocomplete) {
+    return props.field.autocomplete
+  }
+
+  if (isSecretFieldType(fieldType.value)) {
+    return 'off'
+  }
+
+  return undefined
+})
+
+// ----- password eye handling -----
+const showPassword = ref(false)
+
+const appendIcon = computed(() => {
+  if (!isSecretFieldType(fieldType.value)) {
+    return undefined
+  }
+  return showPassword.value ? 'mdi-eye' : 'mdi-eye-off'
+})
+
+const computedTextFieldType = computed(() => {
+  if (fieldType.value !== 'password') {
+    return 'text'
+  }
+  return showPassword.value ? 'text' : 'password'
+})
+
+const hideSecret = computed(() => {
+  return isStructuredPassword.value && !showPassword.value
+})
+
+function onClickAppend () {
+  if (isSecretFieldType(fieldType.value)) {
+    showPassword.value = !showPassword.value
+  }
+}
+
+// ----- normal fields (text/select) -----
+const localValue = computed({
+  get: () => {
+    if (isStructuredLike.value) {
+      return structuredRawText.value
+    }
+    return props.modelValue
+  },
+  set: value => {
+    dropErrorMessage.value = undefined
+    if (isStructuredLike.value) {
+      structuredRawText.value = value
+      v$.value.localValue.$touch()
+      return
+    }
+    emit('update:modelValue', value)
+  },
+})
+
+// ----- structured fields (yaml/json) -----
+let touched = false
+
+const {
+  rawText,
+  setRawTextWithValue,
+  parseRawTextToObject,
+} = useStructuredTextField(computed(() => props.field.type))
+
+const structuredRawText = computed({
+  get: () => rawText.value,
+  set: value => {
+    touched = true
+    rawText.value = value
+
+    const parsed = parseRawTextToObject()
+    emit('update:modelValue', parsed === undefined ? value : parsed)
+  },
+})
+
+// keep raw string in sync when parent updates parsed object (e.g. initial load / reset)
+watch(
+  () => props.modelValue,
+  value => {
+    if (isStructuredLike.value && !touched) {
+      setRawTextWithValue(value)
+    }
+  },
+  { immediate: true },
+)
+
+// ----- validation (yaml/json) -----
+const rules = computed(() => {
+  const compiledValidators = {}
+  forEach(props.field.validators, (validator, validatorName) => {
+    let message = validator.message
+
+    switch (validator.type) {
+      case 'required':
+        set(compiledValidators, [validatorName], required)
+        break
+      case 'regex':
+        set(compiledValidators, [validatorName], value => !value || new RegExp(validator.pattern).test(value)) // eslint-disable-line security/detect-non-literal-regexp
+        break
+      case 'guid':
+        set(compiledValidators, [validatorName], guid)
+        break
+      case 'alphaNumUnderscore':
+        set(compiledValidators, [validatorName], alphaNumUnderscore)
+        break
+      case 'base64':
+        set(compiledValidators, [validatorName], base64)
+        break
+      case 'url':
+        set(compiledValidators, [validatorName], url)
+        break
+      case 'maxLength':
+        set(compiledValidators, [validatorName], maxLength(validator.length))
+        break
+      case 'minLength':
+        set(compiledValidators, [validatorName], minLength(validator.length))
+        break
+      // structured content validators
+      case 'isValidObject':
+        set(compiledValidators, [validatorName], value => {
+          if (isEmpty(value)) {
+            return true // empty is valid (unless required validator is also present)
+          }
+          // Check if modelValue is a non-empty object (successful parse)
+          return typeof props.modelValue === 'object' && props.modelValue !== null && Object.keys(props.modelValue).length > 0
+        })
+        if (!message) {
+          if (isYAML.value) {
+            message = 'You need to enter secret data as YAML key-value pairs'
+          } else if (isJSON.value) {
+            message = 'You need to enter secret data as valid JSON object'
+          }
+        }
+        break
+      case 'hasObjectProp':
+        set(compiledValidators, [validatorName], () => {
+          const objVal = get(props.modelValue, [validator.key])
+          if (!objVal) {
+            return false
+          }
+          if (validator.value) {
+            return objVal === validator.value
+          }
+          if (validator.pattern) {
+            return validator.pattern.test(objVal)
+          }
+          return true
+        })
+        if (!message) {
+          if (validator.value) {
+            message = `Must contain a valid ${validator.key} property with value "${validator.value}"`
+          } else if (validator.pattern) {
+            message = `Must contain a valid ${validator.key} property matching pattern ${validator.pattern}`
+          }
+        }
+        break
+      default:
+        logger.warn(`Ignoring unsupported validator type '${validator.type}' for field '${props.field.key}'`)
+        break
+    }
+    const compiledValidator = get(compiledValidators, [validatorName])
+    if (message && compiledValidator) {
+      set(compiledValidators, [validatorName], withMessage(message, compiledValidator))
+    }
+  })
+  return {
+    localValue: withFieldName(props.field.label, compiledValidators),
+  }
+})
+
+const v$ = useVuelidate(rules, { localValue })
+
+const inputErrorMessages = computed(() => {
+  return [
+    ...(dropErrorMessage.value ? [dropErrorMessage.value] : []),
+    ...getErrorMessages(v$.value.localValue),
+  ]
+})
+
+const items = computed(() => {
+  const field = props.field
+  let items
+  if (Array.isArray(field.values)) {
+    items = field.values
+  }
+  return items
+})
+
+// ----- handle file drop -----
+const dropFileValidation = computed(() => {
+  if (isYAML.value) {
+    return {
+      acceptedFileDescription: 'a YAML file (.yaml or .yml)',
+      acceptedFileExtensions: ['.yaml', '.yml'],
+      pattern: /yaml|yml/,
+    }
+  }
+
+  if (isJSON.value) {
+    return {
+      acceptedFileDescription: 'a JSON file (.json)',
+      acceptedFileExtensions: ['.json'],
+      pattern: /json/,
+    }
+  }
+
+  return {
+    acceptedFileDescription: 'a text file',
+    acceptedFileExtensions: [],
+    pattern: /.*/,
+  }
+})
+
+let disposeTextFieldDrop
+
+onMounted(() => {
+  if (isStructuredLike.value) {
+    const {
+      acceptedFileDescription,
+      acceptedFileExtensions,
+      pattern,
+    } = dropFileValidation.value
+    disposeTextFieldDrop = handleTextFieldDrop(fieldRef.value, pattern, value => {
+      localValue.value = value
+    }, {
+      acceptedFileDescription,
+      acceptedFileExtensions,
+      onReject: ({ message }) => {
+        dropErrorMessage.value = message
+        v$.value.localValue.$touch()
+      },
+    })
+  }
+})
+
+onUnmounted(() => {
+  disposeTextFieldDrop?.()
+})
+
+</script>
+
+<style lang="scss" scoped>
+
+  .hide-secret {
+    :deep(.v-input__control textarea) {
+      -webkit-text-security: disc;
+    }
+  }
+
+</style>
diff --git a/frontend/src/components/GGenericInputFields.vue b/frontend/src/components/GGenericInputFields.vue
new file mode 100644
index 0000000000..12cd71c5df
--- /dev/null
+++ b/frontend/src/components/GGenericInputFields.vue
@@ -0,0 +1,95 @@
+<!--
+SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<template>
+  <component
+    :is="wrapper"
+    v-for="field in fields"
+    :key="field.key"
+    v-bind="wrapperProps"
+  >
+    <GGenericInputField
+      v-model="fieldData[field.key]"
+      :field="field"
+      :cloud-profile-ref="cloudProfileRef"
+      :input-props="inputProps"
+    />
+  </component>
+</template>
+<script setup>
+
+import {
+  watch,
+  ref,
+} from 'vue'
+
+import GGenericInputField from '@/components/GGenericInputField'
+
+import isEqual from 'lodash/isEqual'
+import fromPairs from 'lodash/fromPairs'
+
+const props = defineProps({
+  fields: {
+    type: Array,
+  },
+  modelValue: {
+    type: Object,
+    required: true,
+  },
+  wrapper: {
+    type: String,
+    default: 'div',
+  },
+  wrapperProps: {
+    type: Object,
+  },
+  inputProps: {
+    type: Object,
+  },
+  cloudProfileRef: {
+    type: String,
+  },
+})
+
+const emit = defineEmits([
+  'update:modelValue',
+])
+
+const fieldData = ref({})
+
+function defaultFieldData (fields = []) {
+  return fromPairs(
+    fields
+      .filter(field => Object.prototype.hasOwnProperty.call(field, 'defaultValue'))
+      .map(field => [field.key, field.defaultValue]),
+  )
+}
+
+function initialFieldData (fields, value) {
+  return {
+    ...defaultFieldData(fields),
+    ...(value ?? {}),
+  }
+}
+
+watch(() => fieldData.value, value => {
+  if (!isEqual(value, props.modelValue)) {
+    emit('update:modelValue', value)
+  }
+}, {
+  deep: true,
+})
+
+watch([() => props.fields, () => props.modelValue], ([fields, value]) => {
+  const valueWithDefaults = initialFieldData(fields, value)
+  if (!isEqual(fieldData.value, valueWithDefaults)) {
+    fieldData.value = valueWithDefaults
+  }
+}, {
+  immediate: true,
+})
+
+</script>
diff --git a/frontend/src/components/NewShoot/GNewShootInfrastructureDetails.vue b/frontend/src/components/NewShoot/GNewShootInfrastructureDetails.vue
index a58c521159..783c56fecf 100644
--- a/frontend/src/components/NewShoot/GNewShootInfrastructureDetails.vue
+++ b/frontend/src/components/NewShoot/GNewShootInfrastructureDetails.vue
@@ -22,6 +22,7 @@ SPDX-License-Identifier: Apache-2.0
         <g-select-credential
           v-model="infrastructureBinding"
           :provider-type="providerType"
+          vendor-type="infra"
         />
       </v-col>
       <v-col cols="3">
diff --git a/frontend/src/components/ShootDns/GDnsProviderRow.vue b/frontend/src/components/ShootDns/GDnsProviderRow.vue
index e00a376c11..7d60672084 100644
--- a/frontend/src/components/ShootDns/GDnsProviderRow.vue
+++ b/frontend/src/components/ShootDns/GDnsProviderRow.vue
@@ -42,6 +42,7 @@ SPDX-License-Identifier: Apache-2.0
         <g-select-credential
           v-model="dnsProviderCredential"
           :provider-type="dnsProviderType"
+          vendor-type="dns"
           :filter-fn="credentialFilter"
           register-vuelidate-as="dnsProviderCredential"
         />
@@ -101,7 +102,6 @@ import { useVuelidate } from '@vuelidate/core'
 
 import { useGardenerExtensionStore } from '@/store/gardenerExtension'
 import { useCredentialStore } from '@/store/credential'
-import { useCloudProfileStore } from '@/store/cloudProfile'
 
 import GSelectCredential from '@/components/Credentials/GSelectCredential'
 import GVendorIcon from '@/components/GVendorIcon'
@@ -140,11 +140,9 @@ export default {
     } = useShootContext()
 
     const credentialStore = useCredentialStore()
-    const gardenerExtensionStore = useGardenerExtensionStore()
-    const cloudProfileStore = useCloudProfileStore()
 
     const dnsProviderType = toRef(props.dnsProvider, 'type')
-    const dnsCloudProviderCredentials = useCloudProviderEntityList(dnsProviderType, { credentialStore, gardenerExtensionStore, cloudProfileStore })
+    const dnsCloudProviderCredentials = useCloudProviderEntityList(dnsProviderType, { credentialStore, vendorType: 'dns' })
 
     return {
       v$: useVuelidate(),
diff --git a/frontend/src/components/ShootDns/GManageDns.vue b/frontend/src/components/ShootDns/GManageDns.vue
index 6c905f44b4..35f1275b35 100644
--- a/frontend/src/components/ShootDns/GManageDns.vue
+++ b/frontend/src/components/ShootDns/GManageDns.vue
@@ -73,6 +73,7 @@ SPDX-License-Identifier: Apache-2.0
           <g-select-credential
             v-model="primaryDnsProviderCredential"
             :provider-type="dnsPrimaryProviderType"
+            vendor-type="dns"
             register-vuelidate-as="dnsProviderCredential"
             label="Primary DNS Provider Credential"
           />
@@ -162,7 +163,6 @@ import {
 
 import { useGardenerExtensionStore } from '@/store/gardenerExtension'
 import { useCredentialStore } from '@/store/credential'
-import { useCloudProfileStore } from '@/store/cloudProfile'
 
 import GSelectCredential from '@/components/Credentials/GSelectCredential'
 import GDnsProviderRow from '@/components/ShootDns/GDnsProviderRow'
@@ -202,8 +202,6 @@ export default {
     } = useShootContext()
 
     const credentialStore = useCredentialStore()
-    const gardenerExtensionStore = useGardenerExtensionStore()
-    const cloudProfileStore = useCloudProfileStore()
 
     const customDomainEnabled = ref(
       isNewCluster.value
@@ -211,7 +209,7 @@ export default {
         : !!dnsPrimaryProviderType.value,
     )
 
-    const availableCredentialsForPrimaryDnsProvider = useCloudProviderEntityList(dnsPrimaryProviderType, { credentialStore, gardenerExtensionStore, cloudProfileStore })
+    const availableCredentialsForPrimaryDnsProvider = useCloudProviderEntityList(dnsPrimaryProviderType, { credentialStore, vendorType: 'dns' })
 
     return {
       v$: useVuelidate(),
diff --git a/frontend/src/components/ShootWorkers/GVolumeType.vue b/frontend/src/components/ShootWorkers/GVolumeType.vue
index fd6797ead4..08f1b9b0f1 100644
--- a/frontend/src/components/ShootWorkers/GVolumeType.vue
+++ b/frontend/src/components/ShootWorkers/GVolumeType.vue
@@ -31,13 +31,13 @@ SPDX-License-Identifier: Apache-2.0
       </template>
     </v-select>
     <v-text-field
-      v-if="isAWS && worker.volume.type !== 'gp2'"
+      v-if="showIops"
       v-model.number="workerIops"
       class="ml-1"
       color="primary"
       :error-messages="getErrorMessages(v$.workerIops)"
       type="number"
-      min="100"
+      :min="minIops"
       label="IOPS"
       variant="underlined"
       @update:model-value="onInputIops"
@@ -56,6 +56,7 @@ import {
 import { useVuelidate } from '@vuelidate/core'
 
 import { useCloudProfileStore } from '@/store/cloudProfile'
+import { useConfigStore } from '@/store/config'
 
 import { getErrorMessages } from '@/utils'
 import { getWorkerProviderConfig } from '@/utils/shoot'
@@ -107,9 +108,9 @@ export default {
       },
       workerIops: withFieldName(() => `${this.fieldName} IOPS`, {
         required: requiredIf(() => {
-          return this.isAWS && (this.worker.volume.type === 'io1' || this.worker.volume.type === 'io2')
+          return this.isIopsRequired
         }),
-        minValue: minValue(100),
+        minValue: minValue(this.minIops),
       }),
     }
   },
@@ -133,9 +134,38 @@ export default {
       }
       return ''
     },
-    isAWS () {
+    providerType () {
       const cloudProfile = this.cloudProfileByRef(this.cloudProfileRef)
-      return get(cloudProfile, ['spec', 'type']) === 'aws'
+      return get(cloudProfile, ['spec', 'type'])
+    },
+    providerVendor () {
+      if (!this.providerType) {
+        return undefined
+      }
+      return this.vendorDetails({
+        type: 'infra',
+        name: this.providerType,
+      })
+    },
+    iopsConfig () {
+      return get(this.providerVendor, ['shoot', 'workerVolume', 'iops'])
+    },
+    showIops () {
+      if (!this.iopsConfig) {
+        return false
+      }
+      const hiddenForVolumeTypes = get(this.iopsConfig, ['hiddenForVolumeTypes'], [])
+      return !hiddenForVolumeTypes.includes(this.worker.volume.type)
+    },
+    minIops () {
+      return get(this.iopsConfig, ['min'], 100)
+    },
+    isIopsRequired () {
+      if (!this.showIops) {
+        return false
+      }
+      const requiredForVolumeTypes = get(this.iopsConfig, ['requiredForVolumeTypes'], [])
+      return requiredForVolumeTypes.includes(this.worker.volume.type)
     },
   },
   watch: {
@@ -151,6 +181,9 @@ export default {
     ...mapActions(useCloudProfileStore, [
       'cloudProfileByRef',
     ]),
+    ...mapActions(useConfigStore, [
+      'vendorDetails',
+    ]),
     onInputVolumeType () {
       this.v$.worker.volume.type.$touch()
       this.$emit('updateVolumeType')
@@ -159,7 +192,7 @@ export default {
       const iopsValue = parseInt(value)
       if (value && iopsValue > 0) {
         if (!this.worker.providerConfig) {
-          this.worker.providerConfig = getWorkerProviderConfig('aws')
+          this.worker.providerConfig = getWorkerProviderConfig(this.providerVendor) ?? {}
         }
         set(this.worker.providerConfig, ['volume', 'iops'], iopsValue)
       } else {
diff --git a/frontend/src/composables/credential/helper.js b/frontend/src/composables/credential/helper.js
index dd65f4bef7..62fcd985bb 100644
--- a/frontend/src/composables/credential/helper.js
+++ b/frontend/src/composables/credential/helper.js
@@ -4,8 +4,6 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
-import { storeToRefs } from 'pinia'
-
 import {
   decodeBase64,
   isTruthyValue,
@@ -180,18 +178,14 @@ export function isDNSCredential ({ credential, dnsProviderTypes }) {
 
 export function getCloudProviderEntityList (providerType, {
   credentialStore,
-  gardenerExtensionStore,
-  cloudProfileStore,
+  vendorType,
 }) {
-  const { dnsProviderTypes } = storeToRefs(gardenerExtensionStore)
-  const { sortedInfraProviderTypeList } = storeToRefs(cloudProfileStore)
-
-  if (sortedInfraProviderTypeList.value.includes(providerType)) {
+  if (vendorType === 'infra') {
     return filter(credentialStore.infrastructureBindingList, binding => {
       return bindingProviderType(binding) === providerType
     })
   }
-  if (dnsProviderTypes.value.includes(providerType)) {
+  if (vendorType === 'dns') {
     return filter(credentialStore.dnsCredentialList, credential => {
       return credentialProviderType(credential) === providerType
     })
diff --git a/frontend/src/composables/credential/useCloudProviderEntityList.js b/frontend/src/composables/credential/useCloudProviderEntityList.js
index 91464f37d1..ba66614cac 100644
--- a/frontend/src/composables/credential/useCloudProviderEntityList.js
+++ b/frontend/src/composables/credential/useCloudProviderEntityList.js
@@ -7,11 +7,10 @@
 import {
   computed,
   isRef,
+  unref,
 } from 'vue'
 
 import { useCredentialStore } from '@/store/credential'
-import { useGardenerExtensionStore } from '@/store/gardenerExtension'
-import { useCloudProfileStore } from '@/store/cloudProfile'
 
 import { getCloudProviderEntityList } from './helper'
 
@@ -22,15 +21,13 @@ export const useCloudProviderEntityList = (providerType, options = {}) => {
 
   const {
     credentialStore = useCredentialStore(),
-    gardenerExtensionStore = useGardenerExtensionStore(),
-    cloudProfileStore = useCloudProfileStore(),
+    vendorType,
   } = options
 
   return computed(() => {
     return getCloudProviderEntityList(providerType.value, {
       credentialStore,
-      gardenerExtensionStore,
-      cloudProfileStore,
+      vendorType: unref(vendorType),
     })
   })
 }
diff --git a/frontend/src/composables/credential/useSecretContext.js b/frontend/src/composables/credential/useSecretContext.js
index 8e988852c4..a269d3e9b0 100644
--- a/frontend/src/composables/credential/useSecretContext.js
+++ b/frontend/src/composables/credential/useSecretContext.js
@@ -13,6 +13,10 @@ import {
   inject,
   provide,
 } from 'vue'
+import {
+  dump as yamlDump,
+  load as yamlLoad,
+} from 'js-yaml'
 
 import { useAuthzStore } from '@/store/authz'
 
@@ -24,6 +28,10 @@ import {
   decodeBase64,
   encodeBase64,
 } from '@/utils'
+import {
+  isStructuredFieldType,
+  isYamlFieldType,
+} from '@/utils/inputFieldTypes'
 
 import cloneDeep from 'lodash/cloneDeep'
 import get from 'lodash/get'
@@ -31,6 +39,44 @@ import isEqual from 'lodash/isEqual'
 import set from 'lodash/set'
 import mapValues from 'lodash/mapValues'
 
+function fieldByKey (fields = []) {
+  return Object.fromEntries(
+    fields.map(field => [field.key, field]),
+  )
+}
+
+function parseSecretStringDataValueForField (value, field) {
+  if (!isStructuredFieldType(field?.type) || typeof value !== 'string' || !value) {
+    return value
+  }
+
+  try {
+    const parsed = isYamlFieldType(field.type)
+      ? yamlLoad(value)
+      : JSON.parse(value)
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return parsed
+    }
+  } catch (err) {
+    // Keep the raw string so the structured input can show and validate it.
+  }
+
+  return value
+}
+
+function encodeSecretStringDataValueForField (value, field) {
+  if (value == null || (value === '' && field?.omitWhenEmpty)) {
+    return undefined
+  }
+  if (typeof value === 'string') {
+    return encodeBase64(value)
+  }
+  if (isYamlFieldType(field?.type)) {
+    return encodeBase64(yamlDump(value))
+  }
+  return encodeBase64(JSON.stringify(value))
+}
+
 export function createSecretContextComposable (options = {}) {
   const {
     authzStore = useAuthzStore(),
@@ -110,18 +156,37 @@ export function createSecretContextComposable (options = {}) {
   const secretStringData = computed({
     get () {
       return mapValues(secretData.value, v => {
-        return v ? decodeBase64(v) : undefined
+        if (v == null) {
+          return undefined
+        }
+        return decodeBase64(v)
       })
     },
     set (value) {
       secretData.value = value && typeof value === 'object'
         ? mapValues(value, v => {
-          return v ? encodeBase64(v) : undefined
+          return encodeSecretStringDataValueForField(v)
         })
         : undefined
     },
   })
 
+  function secretStringDataForFields (fields) {
+    const fieldsByKey = fieldByKey(fields)
+    return mapValues(secretStringData.value, (value, key) => {
+      return parseSecretStringDataValueForField(value, get(fieldsByKey, [key]))
+    })
+  }
+
+  function setSecretStringDataForFields (fields, value) {
+    const fieldsByKey = fieldByKey(fields)
+    secretData.value = value && typeof value === 'object'
+      ? mapValues(value, (v, key) => {
+        return encodeSecretStringDataValueForField(v, get(fieldsByKey, [key]))
+      })
+      : undefined
+  }
+
   /**
    * Creates a set of refs for string-based secret data fields. Each key in
    * `keyMapping` maps a key in the `.data` object to a variable name. The
@@ -170,6 +235,8 @@ export function createSecretContextComposable (options = {}) {
     secretNamespace,
     secretData,
     secretStringData,
+    secretStringDataForFields,
+    setSecretStringDataForFields,
     secretStringDataRefs,
     dnsSecretProviderType,
   }
diff --git a/frontend/src/composables/useShootContext.js b/frontend/src/composables/useShootContext.js
index 46b3e5a2bb..a4ceb0b574 100644
--- a/frontend/src/composables/useShootContext.js
+++ b/frontend/src/composables/useShootContext.js
@@ -379,12 +379,22 @@ export function createShootContextComposable (options = {}) {
     },
   })
 
+  const providerVendor = computed(() => {
+    if (!providerType.value) {
+      return undefined
+    }
+    return configStore.vendorDetails({
+      type: 'infra',
+      name: providerType.value,
+    })
+  })
+
   function applySpecTemplate (cloudProfileRef) {
     const {
       kubernetes,
       networking,
       provider,
-    } = getSpecTemplate(providerType.value, defaultNodesCIDR.value)
+    } = getSpecTemplate(providerType.value, defaultNodesCIDR.value, providerVendor.value)
     set(manifest.value, ['spec', 'provider', 'infrastructureConfig'], provider.infrastructureConfig)
     set(manifest.value, ['spec', 'provider', 'controlPlaneConfig'], provider.controlPlaneConfig)
     set(manifest.value, ['spec', 'networking'], networking)
@@ -396,14 +406,14 @@ export function createShootContextComposable (options = {}) {
       const value = get(manifest.value, ['spec', 'provider', 'controlPlaneConfig', 'zone'])
       return getControlPlaneZone(
         providerWorkers.value,
-        providerType.value,
+        providerVendor.value,
         value,
       )
     },
     set (value) {
       value = getControlPlaneZone(
         providerWorkers.value,
-        providerType.value,
+        providerVendor.value,
         value,
       )
       if (value) {
@@ -608,9 +618,9 @@ export function createShootContextComposable (options = {}) {
       return getZonesNetworkConfiguration(
         value,
         providerWorkers.value,
-        providerType.value,
         size(allZones.value),
         ...args,
+        providerVendor.value,
       )
     },
     set (value) {
@@ -631,16 +641,12 @@ export function createShootContextComposable (options = {}) {
   })
 
   const isZonedCluster = computed(() => {
-    switch (providerType.value) {
-      case 'azure':
-        if (isNewCluster.value) {
-          return true // new clusters are always created as zoned clusters by the dashboard
-        }
+    switch (providerVendor.value?.shoot?.zones?.mode) {
+      case 'infrastructure-config-zoned':
         return get(manifest.value, ['spec', 'provider', 'infrastructureConfig', 'zoned'], false)
-      case 'metal':
-        return false // metal clusters do not support zones for worker groups
-      case 'local':
-        return false // local development provider does not support zones
+      case 'never':
+        return false
+      case 'always':
       default:
         return true
     }
@@ -671,8 +677,8 @@ export function createShootContextComposable (options = {}) {
     return findFreeNetworks(
       providerInfrastructureConfigNetworksZones.value,
       networkingNodes.value ?? defaultNodesCIDR.value,
-      providerType.value,
       size(allZones.value),
+      providerVendor.value,
     )
   })
 
diff --git a/frontend/src/composables/useShootDns.js b/frontend/src/composables/useShootDns.js
index dab524867f..49ff367a33 100644
--- a/frontend/src/composables/useShootDns.js
+++ b/frontend/src/composables/useShootDns.js
@@ -8,7 +8,6 @@ import { computed } from 'vue'
 
 import { useGardenerExtensionStore } from '@/store/gardenerExtension'
 import { useCredentialStore } from '@/store/credential'
-import { useCloudProfileStore } from '@/store/cloudProfile'
 
 import { useShootResources } from '@/composables/useShootResources'
 import { useShootExtensions } from '@/composables/useShootExtensions'
@@ -53,7 +52,6 @@ export const useShootDns = (manifest, options) => {
   const {
     gardenerExtensionStore = useGardenerExtensionStore(),
     credentialStore = useCredentialStore(),
-    cloudProfileStore = useCloudProfileStore(),
   } = options
 
   /* resources */
@@ -205,8 +203,7 @@ export const useShootDns = (manifest, options) => {
   function getDefaultCredential (providerType) {
     const credentials = getCloudProviderEntityList(providerType, {
       credentialStore,
-      gardenerExtensionStore,
-      cloudProfileStore,
+      vendorType: 'dns',
     })
 
     const usedResourceRefs = map(resources.value, 'resourceRef')
@@ -245,7 +242,7 @@ export const useShootDns = (manifest, options) => {
   }
 
   function resolveResourceRef (type, credentialsRef) {
-    const credentialsForProviderType = getCloudProviderEntityList(type, { credentialStore, gardenerExtensionStore, cloudProfileStore })
+    const credentialsForProviderType = getCloudProviderEntityList(type, { credentialStore, vendorType: 'dns' })
     const credential = find(credentialsForProviderType, credential => {
       return dnsCredentialResourceNamePart({
         kind: credential?.kind,
diff --git a/frontend/src/composables/useShootHelper.js b/frontend/src/composables/useShootHelper.js
index c0be3dcf30..05258cd4e7 100644
--- a/frontend/src/composables/useShootHelper.js
+++ b/frontend/src/composables/useShootHelper.js
@@ -178,7 +178,7 @@ export function createShootHelperComposable (shootItem, options = {}) {
 
   const { defaultNodesCIDR } = useDefaultNodesCIDR(cloudProfile)
 
-  const infrastructureBindings = useCloudProviderEntityList(providerType, { credentialStore, gardenerExtensionStore, cloudProfileStore })
+  const infrastructureBindings = useCloudProviderEntityList(providerType, { credentialStore, vendorType: 'infra' })
 
   const kubernetesVersionIsNotLatestPatch = useKubernetesVersionIsNotLatestPatch(kubernetesVersion)
 
diff --git a/frontend/src/composables/useStructuredTextField.js b/frontend/src/composables/useStructuredTextField.js
new file mode 100644
index 0000000000..1bfb96a986
--- /dev/null
+++ b/frontend/src/composables/useStructuredTextField.js
@@ -0,0 +1,80 @@
+//
+// SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import {
+  ref,
+  computed,
+} from 'vue'
+import {
+  dump as yamlDump,
+  load as yamlLoad,
+} from 'js-yaml'
+
+import {
+  isJsonFieldType,
+  isYamlFieldType,
+} from '@/utils/inputFieldTypes'
+
+export function useStructuredTextField (typeRef) {
+  const rawText = ref('')
+
+  const isYaml = computed(() => isYamlFieldType(typeRef.value))
+  const isJson = computed(() => isJsonFieldType(typeRef.value))
+
+  function setRawTextWithValue (value) {
+    try {
+      if (!value) {
+        rawText.value = ''
+      } else if (typeof value === 'string') {
+        rawText.value = value
+      } else if (Object.keys(value).length === 0) {
+        rawText.value = ''
+      } else if (isYaml.value) {
+        rawText.value = yamlDump(value)
+      } else if (isJson.value) {
+        rawText.value = JSON.stringify(value, null, 2)
+      } else {
+        rawText.value = ''
+      }
+    } catch {
+      rawText.value = ''
+    }
+  }
+
+  /**
+   * Parses current raw.value -> parsed object.
+   * Returns undefined on parse errors or non-object results.
+   */
+  function parseRawTextToObject () {
+    let parsed
+
+    if (!rawText.value) {
+      return null
+    }
+
+    try {
+      if (isYaml.value) {
+        parsed = yamlLoad(rawText.value)
+      } else if (isJson.value) {
+        parsed = JSON.parse(rawText.value)
+      }
+    } catch {
+      parsed = undefined
+    }
+
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      parsed = undefined
+    }
+
+    return parsed
+  }
+
+  return {
+    rawText,
+    setRawTextWithValue,
+    parseRawTextToObject,
+  }
+}
diff --git a/frontend/src/data/vendors/dns/alicloud-dns.js b/frontend/src/data/vendors/dns/alicloud-dns.js
index 20c0348ef5..dbb1a68f71 100644
--- a/frontend/src/data/vendors/dns/alicloud-dns.js
+++ b/frontend/src/data/vendors/dns/alicloud-dns.js
@@ -7,5 +7,16 @@ export default {
   icon: 'alicloud-dns.png',
   secret: {
     details: alicloud.secret.details,
+    fields: alicloud.secret.fields,
+    help: `
+      <p>
+        You need to provide an access key (access key ID and secret access key) for Alibaba Cloud to allow the dns-controller-manager to authenticate to Alibaba Cloud DNS.
+      </p>
+      <p>
+        For details see
+        <a href="https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/docs/2-Client-EN.md#accesskey-client">AccessKey Client</a>.
+        Currently the regionId is fixed to cn-shanghai.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/aws-route53.js b/frontend/src/data/vendors/dns/aws-route53.js
index 45da4b20b4..10859a42aa 100644
--- a/frontend/src/data/vendors/dns/aws-route53.js
+++ b/frontend/src/data/vendors/dns/aws-route53.js
@@ -1,3 +1,5 @@
+import aws from '../infra/aws'
+
 export default {
   name: 'aws-route53',
   displayName: 'Amazon Route53',
@@ -12,5 +14,60 @@ export default {
         },
       },
     ],
+    fields: [
+      ...aws.secret.fields,
+      {
+        key: 'AWS_REGION',
+        label: 'Region (optional)',
+        hint: 'Overwrite default region of Route 53 endpoint. Required for certain regions. Example value: eu-central-1',
+        type: 'text',
+        omitWhenEmpty: true,
+      },
+    ],
+    help: `
+      <p>
+        Before you can use an external DNS provider, you need to add account credentials.
+        The user needs permissions on the hosted zone to list and change DNS records.
+      </p>
+      <p>
+        To manage
+        credentials for AWS Identity and Access Management (IAM), use the
+        <a href="https://console.aws.amazon.com/iam/home">IAM Console</a>.
+      </p>
+      <p>
+        Copy the AWS IAM policy document below and attach it to the IAM user
+        (<a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html">official documentation</a>).
+      </p>
+      <p>In this example, the placeholder for the hosted zone is Z2XXXXXXXXXXXX</p>
+      `,
+    helpJSONTemplate: {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Sid: 'VisualEditor0',
+          Effect: 'Allow',
+          Action: 'route53:ListResourceRecordSets',
+          Resource: 'arn:aws:route53:::hostedzone/*',
+        },
+        {
+          Sid: 'VisualEditor1',
+          Effect: 'Allow',
+          Action: 'route53:GetHostedZone',
+          Resource: 'arn:aws:route53:::hostedzone/Z2XXXXXXXXXXXX',
+        },
+        {
+          Sid: 'VisualEditor2',
+          Effect: 'Allow',
+          Action: 'route53:ListHostedZones',
+          Resource: '*',
+        },
+        {
+          Sid: 'VisualEditor3',
+          Effect: 'Allow',
+          Action: 'route53:ChangeResourceRecordSets',
+          Resource: 'arn:aws:route53:::hostedzone/Z2XXXXXXXXXXXX',
+        },
+      ],
+    },
   },
 }
diff --git a/frontend/src/data/vendors/dns/azure-dns.js b/frontend/src/data/vendors/dns/azure-dns.js
index 246c274049..896a66235e 100644
--- a/frontend/src/data/vendors/dns/azure-dns.js
+++ b/frontend/src/data/vendors/dns/azure-dns.js
@@ -1,3 +1,5 @@
+import azure from '../infra/azure'
+
 export default {
   name: 'azure-dns',
   displayName: 'Azure DNS',
@@ -15,5 +17,40 @@ export default {
         },
       },
     ],
+    fields: [
+      ...azure.secret.fields,
+      {
+        key: 'AZURE_CLOUD',
+        label: 'Azure Cloud',
+        type: 'select',
+        defaultValue: '',
+        omitWhenEmpty: true,
+        values: [
+          {
+            title: 'Provider default (Azure Public)',
+            value: '',
+          },
+          {
+            title: 'AzurePublic',
+            value: 'AzurePublic',
+          },
+          {
+            title: 'AzureChina',
+            value: 'AzureChina',
+          },
+          {
+            title: 'AzureGovernment',
+            value: 'AzureGovernment',
+          },
+        ],
+      },
+    ],
+    help: `
+      <p>
+        Follow the steps as described in the Azure documentation to
+        <a href="https://docs.microsoft.com/en-us/azure/dns/dns-sdk#create-a-service-principal-account">create a service principal account</a>
+        and grant the service principal account 'DNS Zone Contributor' permissions to the resource group.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/azure-private-dns.js b/frontend/src/data/vendors/dns/azure-private-dns.js
index 3768053fa6..a10b23eb2a 100644
--- a/frontend/src/data/vendors/dns/azure-private-dns.js
+++ b/frontend/src/data/vendors/dns/azure-private-dns.js
@@ -5,7 +5,5 @@ export default {
   displayName: 'Azure Private DNS',
   weight: 300,
   icon: 'azure-dns.svg',
-  secret: {
-    details: azureDns.secret.details,
-  },
+  secret: azureDns.secret,
 }
diff --git a/frontend/src/data/vendors/dns/cloudflare.js b/frontend/src/data/vendors/dns/cloudflare.js
index 8de30c151c..ed655938be 100644
--- a/frontend/src/data/vendors/dns/cloudflare.js
+++ b/frontend/src/data/vendors/dns/cloudflare.js
@@ -10,5 +10,39 @@ export default {
         hidden: true,
       },
     ],
+    fields: [
+      {
+        key: 'apiToken',
+        label: 'Cloudflare API Token',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        To use this provider you need to generate an API token from the Cloudflare dashboard. A detailed documentation to generate an API token is available at
+        <a href="https://support.cloudflare.com/hc/en-us/articles/200167836-Managing-API-Tokens-and-Keys">Managing API Tokens and Keys</a>.
+      </p>
+      <p class="font-weight-bold">
+        Note: You need to generate an API token and not an API key.
+      </p>
+      <p>
+        To generate the token make sure the token has permission of Zone:Read and DNS:Edit for all zones. Optionally you can exclude certain zones.
+      </p>
+      <p class="font-weight-bold">
+        Note: You need to Include All zones in the Zone Resources section. Setting Specific zone doesn't work. But you can still add one or more Excludes.
+      </p>
+      <p>
+        Generate the token and keep this key safe as it won't be shown again.
+      </p>
+      <pre>$ echo -n '1234567890123456789' | base64</pre>
+      <p>
+        to get the base64 encoded token. In this eg. this would be MTIzNDU2Nzg5MDEyMzQ1Njc4OQ==.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/google-clouddns.js b/frontend/src/data/vendors/dns/google-clouddns.js
index 8802f4fdc7..b4f4026741 100644
--- a/frontend/src/data/vendors/dns/google-clouddns.js
+++ b/frontend/src/data/vendors/dns/google-clouddns.js
@@ -1,3 +1,5 @@
+import gcp from '../infra/gcp'
+
 export default {
   name: 'google-clouddns',
   displayName: 'Google Cloud DNS',
@@ -14,5 +16,22 @@ export default {
         },
       },
     ],
+    fields: gcp.secret.fields,
+    help: `
+      <p>
+          You need to provide a service account and a key (serviceaccount.json) to allow the dns-controller-manager to authenticate and execute calls to Cloud DNS.
+        </p>
+        <p>
+          For details on Cloud DNS see
+          <a href="https://cloud.google.com/dns/docs/zones">Cloud DNS documentation</a>,
+          and on Service Accounts see
+          <a href="https://cloud.google.com/iam/docs/service-accounts">Service Account documentation</a>.
+        </p>
+        <p>
+          The service account needs permissions on the hosted zone to list and change DNS records. For details on which permissions or roles are required see
+          <a href="https://cloud.google.com/dns/docs/access-control">Access Control documentation</a>.
+          A possible role is roles/dns.admin "DNS Administrator".
+        </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/index.js b/frontend/src/data/vendors/dns/index.js
index 98ae6b1738..8b75f7d4bc 100644
--- a/frontend/src/data/vendors/dns/index.js
+++ b/frontend/src/data/vendors/dns/index.js
@@ -1,25 +1,25 @@
 import awsRoute53 from './aws-route53'
+import alicloudDns from './alicloud-dns'
 import azureDns from './azure-dns'
 import azurePrivateDns from './azure-private-dns'
-import googleCloudDns from './google-clouddns'
-import openstackDesignate from './openstack-designate'
-import alicloudDns from './alicloud-dns'
 import cloudflareDns from './cloudflare'
-import infobloxDns from './infoblox'
-import netlifyDns from './netlify'
-import powerdns from './powerdns'
 import rfc2136 from './rfc2136'
+import googleCloudDns from './google-clouddns'
+import infoblox from './infoblox'
+import netlify from './netlify'
+import powerdns from './powerdns'
+import openstackDesignate from './openstack-designate'
 
 export default [
   awsRoute53,
+  alicloudDns,
   azureDns,
   azurePrivateDns,
-  googleCloudDns,
-  openstackDesignate,
-  alicloudDns,
   cloudflareDns,
-  infobloxDns,
-  netlifyDns,
-  powerdns,
   rfc2136,
+  googleCloudDns,
+  infoblox,
+  netlify,
+  powerdns,
+  openstackDesignate,
 ]
diff --git a/frontend/src/data/vendors/dns/infoblox.js b/frontend/src/data/vendors/dns/infoblox.js
index 3ec19875bd..a8ce714d93 100644
--- a/frontend/src/data/vendors/dns/infoblox.js
+++ b/frontend/src/data/vendors/dns/infoblox.js
@@ -12,5 +12,31 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'USERNAME',
+        label: 'Infoblox Username',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'PASSWORD',
+        label: 'Infoblox Password',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>Before you can use Infoblox DNS provider, you need to add account credentials.</p>
+      <p>Please enter account information for a technical user.</p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/netlify.js b/frontend/src/data/vendors/dns/netlify.js
index 7dfa5e828c..a0204941ea 100644
--- a/frontend/src/data/vendors/dns/netlify.js
+++ b/frontend/src/data/vendors/dns/netlify.js
@@ -10,5 +10,30 @@ export default {
         hidden: true,
       },
     ],
+    fields: [
+      {
+        key: 'apiToken',
+        label: 'Netlify API Token',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        You need to provide an access token for Netlify to allow the dns-controller-manager to authenticate with the Netlify DNS API.
+      </p>
+      <p>
+        Then, base64 encode the token. For example, if the generated token is 1234567890123456789, use
+      </p>
+      <pre>$ echo -n '1234567890123456789' | base64</pre>
+      <p>
+        For details, see
+        <a href="https://docs.netlify.com/cli/get-started/#obtain-a-token-in-the-netlify-ui" target="_blank" rel="noopener noreferrer">Netlify Documentation</a>.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/openstack-designate.js b/frontend/src/data/vendors/dns/openstack-designate.js
index 6fa28abab9..444ce01353 100644
--- a/frontend/src/data/vendors/dns/openstack-designate.js
+++ b/frontend/src/data/vendors/dns/openstack-designate.js
@@ -1,3 +1,5 @@
+import openstack from '../infra/openstack'
+
 export default {
   name: 'openstack-designate',
   displayName: 'OpenStack Designate',
@@ -18,5 +20,6 @@ export default {
         },
       },
     ],
+    fields: openstack.secret.fields,
   },
 }
diff --git a/frontend/src/data/vendors/dns/powerdns.js b/frontend/src/data/vendors/dns/powerdns.js
index b1553ccb55..d84bac6a83 100644
--- a/frontend/src/data/vendors/dns/powerdns.js
+++ b/frontend/src/data/vendors/dns/powerdns.js
@@ -16,5 +16,36 @@ export default {
         hidden: true,
       },
     ],
+    fields: [
+      {
+        key: 'server',
+        label: 'Server',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          url: {
+            type: 'url',
+          },
+        },
+      },
+      {
+        key: 'apiKey',
+        label: 'API Key',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        To use this provider you need to configure the PowerDNS API with an API key. A detailed documentation to generate an API key is available at
+        <a href="https://doc.powerdns.com/authoritative/http-api/index.html#enabling-the-api" target="_blank" rel="noopener noreferrer">PowerDNS Documentation</a>.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/dns/rfc2136.js b/frontend/src/data/vendors/dns/rfc2136.js
index ebe587d683..a41d8ac2c8 100644
--- a/frontend/src/data/vendors/dns/rfc2136.js
+++ b/frontend/src/data/vendors/dns/rfc2136.js
@@ -33,5 +33,113 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'Server',
+        label: '<host>:<port> of the authoritative DNS server',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'TSIGKeyName',
+        label: 'TSIG Key Name',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          endsWithDot: {
+            type: 'regex',
+            pattern: '\\.$',
+            message: 'TSIG Key Name must end with a dot',
+          },
+        },
+      },
+      {
+        key: 'TSIGSecret',
+        label: 'TSIG Secret',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'Zone',
+        label: 'Zone',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          maxLength: {
+            type: 'maxLength',
+            length: 255,
+            message: 'Zone must be at most 255 characters long',
+          },
+          regex: {
+            type: 'regex',
+            pattern: '^[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)*\\.$',
+            message: 'Zone must be fully qualified',
+          },
+        },
+      },
+      {
+        key: 'TSIGSecretAlgorithm',
+        label: 'TSIG Secret Algorithm',
+        type: 'select',
+        defaultValue: '',
+        omitWhenEmpty: true,
+        values: [
+          {
+            title: 'Provider default (HMAC-SHA256)',
+            value: '',
+          },
+          {
+            title: 'HMAC-SHA256',
+            value: 'hmac-sha256',
+          },
+          {
+            title: 'HMAC-SHA224',
+            value: 'hmac-sha224',
+          },
+          {
+            title: 'HMAC-SHA384',
+            value: 'hmac-sha384',
+          },
+          {
+            title: 'HMAC-SHA512',
+            value: 'hmac-sha512',
+          },
+          {
+            title: 'HMAC-SHA1',
+            value: 'hmac-sha1',
+          },
+          {
+            title: 'HMAC-MD5',
+            value: 'hmac-md5',
+          },
+        ],
+      },
+    ],
+    help: `
+      <p>
+        This DNS provider allows you to create and manage DNS entries for authoritative DNS server supporting dynamic updates with DNS messages following
+        <a href="https://datatracker.ietf.org/doc/html/rfc2136">RFC2136</a>
+        (DNS Update) like knot-dns or others.
+      </p>
+      <p>
+        The configuration is depending on the DNS server product. You need permissions for <code>update</code> and <code>transfer</code> (AXFR) actions on your zones and a TSIG secret.
+      </p>
+      <p>
+        For details see
+        <a href="https://github.com/gardener/external-dns-management/tree/master/docs/rfc2136">Gardener RFC2136 DNS Provider Documentation</a>
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/infra/alicloud.js b/frontend/src/data/vendors/infra/alicloud.js
index 03940eac02..d164fe6475 100644
--- a/frontend/src/data/vendors/infra/alicloud.js
+++ b/frontend/src/data/vendors/infra/alicloud.js
@@ -3,6 +3,32 @@ export default {
   displayName: 'Alibaba Cloud',
   weight: 500,
   icon: 'alicloud.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'alicloud',
+        infrastructureConfig: {
+          apiVersion: 'alicloud.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            vpc: {
+              cidr: '__DEFAULT_WORKER_CIDR__',
+            },
+          },
+        },
+        controlPlaneConfig: {
+          apiVersion: 'alicloud.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+    zoneNetworking: {
+      strategy: 'split-workers',
+    },
+  },
   secret: {
     details: [
       {
@@ -12,5 +38,93 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'accessKeyID',
+        label: 'Access Key ID',
+        hint: 'e.g. QNJebZ17v5Q7pYpP',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          minLength: {
+            type: 'minLength',
+            length: 16,
+          },
+          maxLength: {
+            type: 'maxLength',
+            length: 128,
+          },
+        },
+      },
+      {
+        key: 'accessKeySecret',
+        label: 'Access Key Secret',
+        hint: 'e.g. WJalrXUtnFEMIK7MDENG/bPxRfiCYz',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          minLength: {
+            type: 'minLength',
+            length: 30,
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        Before you can provision and access a Kubernetes cluster on Alibaba Cloud, you need to add account credentials. To manage
+        credentials for Alibaba Cloud Resource Access Management (RAM), use the
+        <a href="https://ram.console.aliyun.com/overview">RAM Console</a>.
+        The Gardener needs the credentials to provision and operate the Alibaba Cloud infrastructure for your Kubernetes cluster.
+      </p>
+      <p>
+        Gardener uses encrypted system disk when creating Shoot, please enable ECS disk encryption on Alibaba Cloud Console
+        (<a href="https://www.alibabacloud.com/help/doc-detail/59643.htm">official documentation</a>).
+      </p>
+      <p>
+        Copy the Alibaba Cloud RAM policy document below and attach it to the RAM user
+        (<a href="https://www.alibabacloud.com/help/product/28625.htm?spm=a3c0i.100866.1204872.1.79461e4eLtFABp">official documentation</a>).
+        Alternatively, you can assign following permissions to the RAM
+        user: AliyunECSFullAccess, AliyunSLBFullAccess, AliyunVPCFullAccess, AliyunEIPFullAccess, AliyunNATGatewayFullAccess.
+      </p>
+    `,
+    helpJSONTemplate: {
+      Statement: [
+        {
+          Action: 'vpc:*',
+          Effect: 'Allow',
+          Resource: '*',
+        },
+        {
+          Action: 'ecs:*',
+          Effect: 'Allow',
+          Resource: '*',
+        },
+        {
+          Action: 'slb:*',
+          Effect: 'Allow',
+          Resource: '*',
+        },
+        {
+          Action: [
+            'ram:GetRole',
+            'ram:CreateRole',
+            'ram:CreateServiceLinkedRole',
+          ],
+          Effect: 'Allow',
+          Resource: '*',
+        },
+        {
+          Action: 'ros:*',
+          Effect: 'Allow',
+          Resource: '*',
+        },
+      ],
+      Version: '1',
+    },
   },
 }
diff --git a/frontend/src/data/vendors/infra/aws.js b/frontend/src/data/vendors/infra/aws.js
index d8ffd945ef..cdfc72d11a 100644
--- a/frontend/src/data/vendors/infra/aws.js
+++ b/frontend/src/data/vendors/infra/aws.js
@@ -3,6 +3,43 @@ export default {
   displayName: 'AWS',
   weight: 100,
   icon: 'aws.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'aws',
+        infrastructureConfig: {
+          apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            vpc: {
+              cidr: '__DEFAULT_WORKER_CIDR__',
+            },
+          },
+        },
+        controlPlaneConfig: {
+          apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+    zoneNetworking: {
+      strategy: 'split-workers-public-internal',
+    },
+    workerVolume: {
+      iops: {
+        min: 100,
+        hiddenForVolumeTypes: ['gp2'],
+        requiredForVolumeTypes: ['io1', 'io2'],
+      },
+    },
+    workerProviderConfig: {
+      apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
+      kind: 'WorkerConfig',
+    },
+  },
   secret: {
     details: [
       {
@@ -12,5 +49,113 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'accessKeyID',
+        label: 'Access Key ID',
+        hint: 'e.g. AKIAIOSFODNN7EXAMPLE',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          minLength: {
+            type: 'minLength',
+            length: 16,
+          },
+          maxLength: {
+            type: 'maxLength',
+            length: 128,
+          },
+          alphaNumUnderscore: {
+            type: 'alphaNumUnderscore',
+          },
+        },
+      },
+      {
+        key: 'secretAccessKey',
+        label: 'Secret Access Key',
+        hint: 'e.g. wJalrXUtnFEMIK7MDENG/bPxRfiCYzEXAMPLEKEY',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          minLength: {
+            type: 'minLength',
+            length: 40,
+          },
+          base64: {
+            type: 'base64',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        Before you can provision and access a Kubernetes cluster, you need to add account credentials. Gardener needs the credentials to provision and operate the AWS infrastructure for your Kubernetes cluster.
+      </p>
+      <p>
+        To manage
+        credentials for AWS Identity and Access Management (IAM), use the
+        <a href="https://console.aws.amazon.com/iam/home">IAM Console</a>.
+      </p>
+      <p>
+        Copy the AWS IAM policy document below and attach it to the IAM user
+        (<a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html">official documentation</a>).
+      </p>
+      `,
+    helpJSONTemplate: {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Allow',
+          Action: 'autoscaling:*',
+          Resource: '*',
+        },
+        {
+          Effect: 'Allow',
+          Action: 'ec2:*',
+          Resource: '*',
+        },
+        {
+          Effect: 'Allow',
+          Action: 'elasticloadbalancing:*',
+          Resource: '*',
+        },
+        {
+          Action: [
+            'iam:GetInstanceProfile',
+            'iam:GetPolicy',
+            'iam:GetPolicyVersion',
+            'iam:GetRole',
+            'iam:GetRolePolicy',
+            'iam:ListPolicyVersions',
+            'iam:ListRolePolicies',
+            'iam:ListAttachedRolePolicies',
+            'iam:ListInstanceProfilesForRole',
+            'iam:CreateInstanceProfile',
+            'iam:CreatePolicy',
+            'iam:CreatePolicyVersion',
+            'iam:CreateRole',
+            'iam:CreateServiceLinkedRole',
+            'iam:AddRoleToInstanceProfile',
+            'iam:AttachRolePolicy',
+            'iam:DetachRolePolicy',
+            'iam:RemoveRoleFromInstanceProfile',
+            'iam:DeletePolicy',
+            'iam:DeletePolicyVersion',
+            'iam:DeleteRole',
+            'iam:DeleteRolePolicy',
+            'iam:DeleteInstanceProfile',
+            'iam:PutRolePolicy',
+            'iam:PassRole',
+            'iam:UpdateAssumeRolePolicy',
+          ],
+          Effect: 'Allow',
+          Resource: '*',
+        },
+      ],
+    },
   },
 }
diff --git a/frontend/src/data/vendors/infra/azure.js b/frontend/src/data/vendors/infra/azure.js
index 5b6fbe1862..8259d46abb 100644
--- a/frontend/src/data/vendors/infra/azure.js
+++ b/frontend/src/data/vendors/infra/azure.js
@@ -3,6 +3,34 @@ export default {
   displayName: 'Azure',
   weight: 200,
   icon: 'azure.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'azure',
+        infrastructureConfig: {
+          apiVersion: 'azure.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            vnet: {
+              cidr: '__DEFAULT_WORKER_CIDR__',
+            },
+            workers: '__DEFAULT_WORKER_CIDR__',
+          },
+          zoned: true,
+        },
+        controlPlaneConfig: {
+          apiVersion: 'azure.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+    zones: {
+      mode: 'infrastructure-config-zoned',
+    },
+  },
   secret: {
     details: [
       {
@@ -15,5 +43,74 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'clientID',
+        label: 'Client Id',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          guid: {
+            type: 'guid',
+          },
+        },
+      },
+      {
+        key: 'clientSecret',
+        label: 'Client Secret',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'tenantID',
+        label: 'Tenant Id',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          guid: {
+            type: 'guid',
+          },
+        },
+      },
+      {
+        key: 'subscriptionID',
+        label: 'Subscription Id',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          guid: {
+            type: 'guid',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        Before you can provision and access a Kubernetes cluster on Azure, you need to add account/subscription credentials.
+        The Gardener needs the credentials of a service principal assigned to an account/subscription to provision
+        and operate the Azure infrastructure for your Kubernetes cluster.
+      </p>
+      <p>
+        Ensure that the service principal has the permissions defined
+        <a href="https://github.com/gardener/gardener-extension-provider-azure/blob/master/docs/usage/azure-permissions.md">here</a>
+        within your subscription assigned.
+        If no fine-grained permissions are required then assign the <strong>Contributor</strong> role.
+      </p>
+      <p>
+        Read the
+        <a href="https://docs.microsoft.com/azure/active-directory/role-based-access-control-configure">IAM Console help section</a>
+        on how to manage your credentials and subscriptions.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/infra/gcp.js b/frontend/src/data/vendors/infra/gcp.js
index 93faff9053..6cb5509317 100644
--- a/frontend/src/data/vendors/infra/gcp.js
+++ b/frontend/src/data/vendors/infra/gcp.js
@@ -3,6 +3,30 @@ export default {
   displayName: 'Google Cloud',
   weight: 300,
   icon: 'gcp.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'gcp',
+        infrastructureConfig: {
+          apiVersion: 'gcp.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            workers: '__DEFAULT_WORKER_CIDR__',
+          },
+        },
+        controlPlaneConfig: {
+          apiVersion: 'gcp.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+    controlPlane: {
+      zoneStrategy: 'worker-zones',
+    },
+  },
   secret: {
     details: [
       {
@@ -14,5 +38,60 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'serviceaccount.json',
+        label: 'Service Account Key',
+        hint: 'Enter or drop a service account key in JSON format',
+        type: 'json-secret',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          isJSON: {
+            type: 'isValidObject',
+          },
+          projectID: {
+            type: 'hasObjectProp',
+            key: 'project_id',
+            pattern: /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/,
+          },
+          type: {
+            type: 'hasObjectProp',
+            key: 'type',
+            value: 'service_account',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        A service account is a special account that can be used by services and applications running on your Google
+        Compute Engine instance to interact with other Google Cloud Platform APIs. Applications can use service
+        account credentials to authorize themselves to a set of APIs and perform actions within the permissions
+        granted to the service account and virtual machine instance.
+      </p>
+
+      <p>
+        Ensure that the service account has at least the roles below.
+      </p>
+
+      <ul>
+        <li>Service Account Admin</li>
+        <li>Service Account Token Creator</li>
+        <li>Service Account User</li>
+        <li>Compute Admin</li>
+      </ul>
+
+      <p>
+        The Service Account has to be enabled for the Google Identity and Access Management API.
+      </p>
+
+      <p>
+        Read the
+        <a href="https://cloud.google.com/compute/docs/access/service-accounts">Service Account Documentation</a>
+        on how to apply for credentials to service accounts.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/infra/hcloud.js b/frontend/src/data/vendors/infra/hcloud.js
index 6a8b1546fe..5cf9f9c920 100644
--- a/frontend/src/data/vendors/infra/hcloud.js
+++ b/frontend/src/data/vendors/infra/hcloud.js
@@ -3,6 +3,30 @@ export default {
   displayName: 'Hetzner Cloud',
   weight: 800,
   icon: 'hcloud.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'hcloud',
+        infrastructureConfig: {
+          apiVersion: 'hcloud.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            workers: '__DEFAULT_WORKER_CIDR__',
+          },
+        },
+        controlPlaneConfig: {
+          apiVersion: 'hcloud.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+    controlPlane: {
+      zoneStrategy: 'worker-zones',
+    },
+  },
   secret: {
     details: [
       {
@@ -10,5 +34,27 @@ export default {
         hidden: true,
       },
     ],
+    fields: [
+      {
+        key: 'hcloudToken',
+        label: 'Hetzner Cloud Token',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        Before you can provision and access a Kubernetes cluster on Hetzner Cloud, you need to add a Hetzner Cloud token.
+        The Gardener needs these credentials to provision and operate Hetzner Cloud infrastructure for your Kubernetes cluster.
+      </p>
+      <p>
+        Please read the
+        <a href="https://www.hetzner.com/cloud">Hetzner Cloud Documentation</a>.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/infra/index.js b/frontend/src/data/vendors/infra/index.js
index 39a57dc510..06ddb385be 100644
--- a/frontend/src/data/vendors/infra/index.js
+++ b/frontend/src/data/vendors/infra/index.js
@@ -1,26 +1,26 @@
 import aws from './aws'
+import alicloud from './alicloud'
 import azure from './azure'
+import hcloud from './hcloud'
 import gcp from './gcp'
-import openstack from './openstack'
-import alicloud from './alicloud'
 import metal from './metal'
-import vsphere from './vsphere'
-import hcloud from './hcloud'
 import onmetal from './onmetal'
+import openstack from './openstack'
+import vsphere from './vsphere'
 import ironcore from './ironcore'
 import stackit from './stackit'
 import local from './local'
 
 export default [
   aws,
+  alicloud,
   azure,
+  hcloud,
   gcp,
-  openstack,
-  alicloud,
   metal,
-  vsphere,
-  hcloud,
   onmetal,
+  openstack,
+  vsphere,
   ironcore,
   stackit,
   local,
diff --git a/frontend/src/data/vendors/infra/local.js b/frontend/src/data/vendors/infra/local.js
index fdbe50477b..de417ab69b 100644
--- a/frontend/src/data/vendors/infra/local.js
+++ b/frontend/src/data/vendors/infra/local.js
@@ -2,4 +2,9 @@ export default {
   name: 'local',
   displayName: 'Local',
   weight: 10100,
+  shoot: {
+    zones: {
+      mode: 'never',
+    },
+  },
 }
diff --git a/frontend/src/data/vendors/infra/metal.js b/frontend/src/data/vendors/infra/metal.js
index 63d0161c14..fbfaf1b498 100644
--- a/frontend/src/data/vendors/infra/metal.js
+++ b/frontend/src/data/vendors/infra/metal.js
@@ -3,6 +3,50 @@ export default {
   displayName: 'metal-stack',
   weight: 600,
   icon: 'metal.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'metal',
+        infrastructureConfig: {
+          apiVersion: 'metal.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+        },
+        controlPlaneConfig: {
+          apiVersion: 'metal.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        type: 'calico',
+        pods: '10.244.128.0/18',
+        services: '10.244.192.0/18',
+        providerConfig: {
+          apiVersion: 'calico.networking.extensions.gardener.cloud/v1alpha1',
+          kind: 'NetworkConfig',
+          backend: 'vxlan',
+          ipv4: {
+            autoDetectionMethod: 'interface=lo',
+            mode: 'Always',
+            pool: 'vxlan',
+          },
+          typha: {
+            enabled: true,
+          },
+        },
+      },
+      kubernetes: {
+        kubeControllerManager: {
+          nodeCIDRMaskSize: 23,
+        },
+        kubelet: {
+          maxPods: 510,
+        },
+      },
+    },
+    zones: {
+      mode: 'never',
+    },
+  },
   secret: {
     details: [
       {
@@ -12,5 +56,36 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'metalAPIURL',
+        label: 'API URL',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+          url: {
+            type: 'url',
+          },
+        },
+      },
+      {
+        key: 'metalAPIHMac',
+        label: 'API HMAC',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        Before you can provision and access a Kubernetes cluster on Metal Stack, you need to provide HMAC credentials and the endpoint of your Metal API.
+        The Gardener needs the credentials to provision and operate the Metal Stack infrastructure for your Kubernetes cluster.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/data/vendors/infra/onmetal.js b/frontend/src/data/vendors/infra/onmetal.js
index cec462b584..71650e8f20 100644
--- a/frontend/src/data/vendors/infra/onmetal.js
+++ b/frontend/src/data/vendors/infra/onmetal.js
@@ -1,6 +1,6 @@
 export default {
-  name: 'onMetal',
+  name: 'onmetal',
   displayName: 'OnMetal',
-  weight: 900,
+  weight: 901,
   icon: 'onmetal.svg',
 }
diff --git a/frontend/src/data/vendors/infra/openstack.js b/frontend/src/data/vendors/infra/openstack.js
index fd3d2d27fd..1c0a226d3e 100644
--- a/frontend/src/data/vendors/infra/openstack.js
+++ b/frontend/src/data/vendors/infra/openstack.js
@@ -18,5 +18,110 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'authURL',
+        label: 'Auth URL',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'domainName',
+        label: 'Domain Name',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'tenantName',
+        label: 'Project / Tenant Name',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'applicationCredentialID',
+        label: 'ID',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'applicationCredentialName',
+        label: 'Name',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'applicationCredentialSecret',
+        label: 'Secret',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'username',
+        label: 'Technical User',
+        type: 'text',
+        hint: 'Do not use personalized login credentials. Instead, use credentials of a technical user',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'password',
+        label: 'Password',
+        type: 'password',
+        hint: 'Do not use personalized login credentials. Instead, use credentials of a technical user',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+  },
+  shoot: {
+    templates: {
+      provider: {
+        type: 'openstack',
+        infrastructureConfig: {
+          apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            workers: '__DEFAULT_WORKER_CIDR__',
+          },
+        },
+        controlPlaneConfig: {
+          apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
   },
 }
diff --git a/frontend/src/data/vendors/infra/stackit.js b/frontend/src/data/vendors/infra/stackit.js
index 4de0cf6be3..ed72a4a0e9 100644
--- a/frontend/src/data/vendors/infra/stackit.js
+++ b/frontend/src/data/vendors/infra/stackit.js
@@ -3,4 +3,25 @@ export default {
   displayName: 'stackit',
   weight: 1100,
   icon: 'stackit.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'stackit',
+        infrastructureConfig: {
+          apiVersion: 'stackit.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'InfrastructureConfig',
+          networks: {
+            workers: '__DEFAULT_WORKER_CIDR__',
+          },
+        },
+        controlPlaneConfig: {
+          apiVersion: 'stackit.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+  },
 }
diff --git a/frontend/src/data/vendors/infra/vsphere.js b/frontend/src/data/vendors/infra/vsphere.js
index f61dda7894..a2211fff5a 100644
--- a/frontend/src/data/vendors/infra/vsphere.js
+++ b/frontend/src/data/vendors/infra/vsphere.js
@@ -3,6 +3,20 @@ export default {
   displayName: 'vSphere',
   weight: 700,
   icon: 'vsphere.svg',
+  shoot: {
+    templates: {
+      provider: {
+        type: 'vsphere',
+        controlPlaneConfig: {
+          apiVersion: 'vsphere.provider.extensions.gardener.cloud/v1alpha1',
+          kind: 'ControlPlaneConfig',
+        },
+      },
+      networking: {
+        nodes: '__DEFAULT_WORKER_CIDR__',
+      },
+    },
+  },
   secret: {
     details: [
       {
@@ -24,5 +38,66 @@ export default {
         },
       },
     ],
+    fields: [
+      {
+        key: 'vSphereUsername',
+        label: 'vSphere Username',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'vSpherePassword',
+        label: 'vSphere Password',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'NSXTUsername',
+        label: 'NSX-T Username',
+        type: 'text',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+      {
+        key: 'NSXTPassword',
+        label: 'NSX-T Password',
+        type: 'password',
+        validators: {
+          required: {
+            type: 'required',
+          },
+        },
+      },
+    ],
+    help: `
+      <p>
+        Before you can provision and access a Kubernetes cluster on VMware vSphere, you need to add vSphere and NSX-T account credentials.
+        The Gardener needs these credentials to provision and operate the VMware vSphere infrastructure for your Kubernetes cluster.
+      </p>
+      <p>
+        Ensure that these accounts have privileges to <strong>create, modify and delete VMs and Networking resources</strong>.
+      </p>
+      <p>
+        Please read the
+        <a href="https://docs.vmware.com/de/VMware-vSphere/index.html">
+          VMware vSphere Documentation
+        </a>
+        and the
+        <a href="https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html">
+          VMware NSX-T Data Center Documentation
+        </a>.
+      </p>
+      `,
   },
 }
diff --git a/frontend/src/store/config.js b/frontend/src/store/config.js
index e362d798f7..454f361467 100644
--- a/frontend/src/store/config.js
+++ b/frontend/src/store/config.js
@@ -43,7 +43,7 @@ const wellKnownConditions = {
     name: 'Control Plane',
     shortName: 'CP',
     description: 'Indicates whether all control plane components are up and running.',
-    showLandscapeViewerOnly: true,
+    showAdminOnly: true,
     sortOrder: '1',
   },
   SystemComponentsHealthy: {
diff --git a/frontend/src/utils/index.js b/frontend/src/utils/index.js
index a006573607..c92dc71b61 100644
--- a/frontend/src/utils/index.js
+++ b/frontend/src/utils/index.js
@@ -52,27 +52,89 @@ export function emailToDisplayName (value) {
   }
 }
 
-export function handleTextFieldDrop (textField, fileTypePattern, onDrop = () => {}) {
+function fileExtension (file) {
+  const name = file?.name ?? ''
+  const extensionIndex = name.lastIndexOf('.')
+  if (extensionIndex === -1) {
+    return ''
+  }
+  return name.slice(extensionIndex).toLowerCase()
+}
+
+function normalizedFileExtensions (extensions = []) {
+  return extensions.map(extension => {
+    const normalizedExtension = extension.toLowerCase()
+    return normalizedExtension.startsWith('.') ? normalizedExtension : `.${normalizedExtension}`
+  })
+}
+
+function fileTypeDescription (file) {
+  if (file.type) {
+    return file.type
+  }
+
+  const extension = fileExtension(file)
+  return extension || 'unknown file type'
+}
+
+export function handleTextFieldDrop (textField, fileTypePattern, onDrop = () => {}, {
+  acceptedFileDescription = 'a supported file',
+  acceptedFileExtensions = [],
+  onReject = () => {},
+} = {}) {
+  const extensions = normalizedFileExtensions(acceptedFileExtensions)
+
+  function rejectDrop (code, message, file) {
+    onReject({
+      code,
+      file,
+      message,
+    })
+  }
+
+  function isAcceptedFile (file) {
+    fileTypePattern.lastIndex = 0
+    if (file.type && fileTypePattern.test(file.type)) {
+      return true
+    }
+
+    const extension = fileExtension(file)
+    return !!extension && extensions.includes(extension)
+  }
+
   function drop (event) {
     event.stopPropagation()
     event.preventDefault()
 
-    const files = event.dataTransfer.files
-    if (files.length) {
-      const file = files[0]
-      if (fileTypePattern.test(file.type)) {
-        const reader = new FileReader()
-        const onLoaded = event => {
-          try {
-            const result = JSON.parse(event.target.result)
-
-            onDrop(JSON.stringify(result, null, '  '))
-          } catch (err) { /* ignore error */ }
-        }
-        reader.onloadend = onLoaded
-        reader.readAsText(file)
-      }
+    const files = event.dataTransfer?.files ?? []
+    if (!files.length) {
+      rejectDrop('missing-file', `Drop ${acceptedFileDescription} to import its contents.`)
+      return
+    }
+
+    if (files.length > 1) {
+      rejectDrop('too-many-files', `Drop only one file at a time. Expected ${acceptedFileDescription}.`)
+      return
     }
+
+    const file = files[0]
+    if (!isAcceptedFile(file)) {
+      rejectDrop(
+        'unsupported-file-type',
+        `File "${file.name}" was rejected. Expected ${acceptedFileDescription}, but received ${fileTypeDescription(file)}.`,
+        file,
+      )
+      return
+    }
+
+    const reader = new FileReader()
+    reader.onload = event => {
+      onDrop(event.target.result)
+    }
+    reader.onerror = () => {
+      rejectDrop('read-error', `Could not read file "${file.name}".`, file)
+    }
+    reader.readAsText(file)
   }
 
   function dragOver (event) {
@@ -81,9 +143,14 @@ export function handleTextFieldDrop (textField, fileTypePattern, onDrop = () =>
     event.dataTransfer.dropEffect = 'copy'
   }
 
-  const textarea = textField.$refs['input-slot']
-  textarea.addEventListener('dragover', dragOver, false)
-  textarea.addEventListener('drop', drop, false)
+  const field = textField.$el
+  field.addEventListener('dragover', dragOver, false)
+  field.addEventListener('drop', drop, false)
+
+  return () => {
+    field.removeEventListener('dragover', dragOver, false)
+    field.removeEventListener('drop', drop, false)
+  }
 }
 
 export function getErrorMessages (property) {
@@ -507,7 +574,7 @@ export function transformHtml (html, transformToExternalLinks = true) {
   const linkElements = documentFragment.querySelectorAll('a')
   linkElements.forEach(linkElement => {
     if (transformToExternalLinks) {
-      linkElement.classList.add('text-anchor', 'text-decoration-none')
+      linkElement.classList.add('text-anchor', 'text-decoration-none', 'text-no-wrap')
       linkElement.setAttribute('target', '_blank')
       linkElement.setAttribute('rel', 'noopener')
       const linkText = linkElement.innerHTML
diff --git a/frontend/src/utils/inputFieldTypes.js b/frontend/src/utils/inputFieldTypes.js
new file mode 100644
index 0000000000..fb8ce8b38e
--- /dev/null
+++ b/frontend/src/utils/inputFieldTypes.js
@@ -0,0 +1,50 @@
+//
+// SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+export const jsonFieldTypes = new Set([
+  'json',
+  'json-secret',
+])
+
+export const yamlFieldTypes = new Set([
+  'yaml',
+  'yaml-secret',
+])
+
+export const structuredFieldTypes = new Set([
+  ...jsonFieldTypes,
+  ...yamlFieldTypes,
+])
+
+export const structuredSecretFieldTypes = new Set([
+  'json-secret',
+  'yaml-secret',
+])
+
+export const secretFieldTypes = new Set([
+  'password',
+  ...structuredSecretFieldTypes,
+])
+
+export function isJsonFieldType (type) {
+  return jsonFieldTypes.has(type)
+}
+
+export function isYamlFieldType (type) {
+  return yamlFieldTypes.has(type)
+}
+
+export function isStructuredFieldType (type) {
+  return structuredFieldTypes.has(type)
+}
+
+export function isStructuredSecretFieldType (type) {
+  return structuredSecretFieldTypes.has(type)
+}
+
+export function isSecretFieldType (type) {
+  return secretFieldTypes.has(type)
+}
diff --git a/frontend/src/utils/shoot.js b/frontend/src/utils/shoot.js
index 76a9c3d41e..e92ecaaf34 100644
--- a/frontend/src/utils/shoot.js
+++ b/frontend/src/utils/shoot.js
@@ -17,201 +17,63 @@ import filter from 'lodash/filter'
 import range from 'lodash/range'
 import isEmpty from 'lodash/isEmpty'
 import compact from 'lodash/compact'
+import cloneDeep from 'lodash/cloneDeep'
 
-export function getSpecTemplate (providerType, defaultWorkerCIDR) {
+const DEFAULT_WORKER_CIDR_PLACEHOLDER = '__DEFAULT_WORKER_CIDR__'
+
+function replacePlaceholderInTemplate (value, defaultWorkerCIDR) {
+  if (typeof value === 'string') {
+    return value === DEFAULT_WORKER_CIDR_PLACEHOLDER ? defaultWorkerCIDR : value
+  }
+  if (Array.isArray(value)) {
+    return map(value, item => replacePlaceholderInTemplate(item, defaultWorkerCIDR))
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, nestedValue]) => {
+        return [key, replacePlaceholderInTemplate(nestedValue, defaultWorkerCIDR)]
+      }),
+    )
+  }
+  return value
+}
+
+export function getSpecTemplate (providerType, defaultWorkerCIDR, shootVendor) {
   const spec = {
-    provider: getProviderTemplate(providerType, defaultWorkerCIDR),
-    networking: getNetworkingTemplate(providerType, defaultWorkerCIDR),
+    provider: getProviderTemplate(providerType, defaultWorkerCIDR, shootVendor),
+    networking: getNetworkingTemplate(providerType, defaultWorkerCIDR, shootVendor),
   }
-  const kubernetes = getKubernetesTemplate(providerType)
+  const kubernetes = getKubernetesTemplate(shootVendor)
   if (!isEmpty(kubernetes)) {
     spec.kubernetes = kubernetes
   }
   return spec
 }
 
-export function getProviderTemplate (providerType, defaultWorkerCIDR) {
-  switch (providerType) {
-    case 'aws':
-      return {
-        type: 'aws',
-        infrastructureConfig: {
-          apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            vpc: {
-              cidr: defaultWorkerCIDR,
-            },
-          },
-        },
-        controlPlaneConfig: {
-          apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'azure':
-      return {
-        type: 'azure',
-        infrastructureConfig: {
-          apiVersion: 'azure.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            vnet: {
-              cidr: defaultWorkerCIDR,
-            },
-            workers: defaultWorkerCIDR,
-          },
-          zoned: true,
-        },
-        controlPlaneConfig: {
-          apiVersion: 'azure.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'gcp':
-      return {
-        type: 'gcp',
-        infrastructureConfig: {
-          apiVersion: 'gcp.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            workers: defaultWorkerCIDR,
-          },
-        },
-        controlPlaneConfig: {
-          apiVersion: 'gcp.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'openstack':
-      return {
-        type: 'openstack',
-        infrastructureConfig: {
-          apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            workers: defaultWorkerCIDR,
-          },
-        },
-        controlPlaneConfig: {
-          apiVersion: 'openstack.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'stackit':
-      return {
-        type: 'stackit',
-        infrastructureConfig: {
-          apiVersion: 'stackit.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            workers: defaultWorkerCIDR,
-          },
-        },
-        controlPlaneConfig: {
-          apiVersion: 'stackit.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'alicloud':
-      return {
-        type: 'alicloud',
-        infrastructureConfig: {
-          apiVersion: 'alicloud.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            vpc: {
-              cidr: defaultWorkerCIDR,
-            },
-          },
-        },
-        controlPlaneConfig: {
-          apiVersion: 'alicloud.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'metal':
-      return {
-        type: 'metal',
-        infrastructureConfig: {
-          apiVersion: 'metal.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-        },
-        controlPlaneConfig: {
-          apiVersion: 'metal.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'vsphere':
-      return {
-        type: 'vsphere',
-        controlPlaneConfig: {
-          apiVersion: 'vsphere.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    case 'hcloud':
-      return {
-        type: 'hcloud',
-        infrastructureConfig: {
-          apiVersion: 'hcloud.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'InfrastructureConfig',
-          networks: {
-            workers: defaultWorkerCIDR,
-          },
-        },
-        controlPlaneConfig: {
-          apiVersion: 'hcloud.provider.extensions.gardener.cloud/v1alpha1',
-          kind: 'ControlPlaneConfig',
-        },
-      }
-    default:
-      return {
-        type: providerType,
-      }
+export function getProviderTemplate (providerType, defaultWorkerCIDR, shootVendor) {
+  const template = shootVendor?.shoot?.templates?.provider
+  if (!template) {
+    return {
+      type: providerType,
+    }
   }
+
+  return replacePlaceholderInTemplate(template, defaultWorkerCIDR)
 }
 
-export function getNetworkingTemplate (providerType, defaultWorkerCIDR) {
-  switch (providerType) {
-    case 'metal':
-      return {
-        type: 'calico',
-        pods: '10.244.128.0/18',
-        services: '10.244.192.0/18',
-        providerConfig: {
-          apiVersion: 'calico.networking.extensions.gardener.cloud/v1alpha1',
-          kind: 'NetworkConfig',
-          backend: 'vxlan',
-          ipv4: {
-            autoDetectionMethod: 'interface=lo',
-            mode: 'Always',
-            pool: 'vxlan',
-          },
-          typha: {
-            enabled: true,
-          },
-        },
-      }
-    default:
-      return {
-        nodes: defaultWorkerCIDR,
-      }
+export function getNetworkingTemplate (providerType, defaultWorkerCIDR, shootVendor) {
+  const template = shootVendor?.shoot?.templates?.networking
+  if (!template) {
+    return {
+      nodes: defaultWorkerCIDR,
+    }
   }
+
+  return replacePlaceholderInTemplate(template, defaultWorkerCIDR)
 }
 
-export function getKubernetesTemplate (providerType) {
-  switch (providerType) {
-    case 'metal':
-      return {
-        kubeControllerManager: {
-          nodeCIDRMaskSize: 23,
-        },
-        kubelet: {
-          maxPods: 510,
-        },
-      }
-  }
+export function getKubernetesTemplate (shootVendor) {
+  return cloneDeep(shootVendor?.shoot?.templates?.kubernetes)
 }
 
 export function splitCIDR (cidrToSplitStr, numberOfNetworks) {
@@ -232,12 +94,12 @@ export function splitCIDR (cidrToSplitStr, numberOfNetworks) {
   return cidrArray
 }
 
-export function getDefaultNetworkConfigurationForAllZones (numberOfZones, providerType, workerCIDR) {
-  switch (providerType) {
-    case 'aws': {
-      const zoneNetworksAws = splitCIDR(workerCIDR, numberOfZones)
+export function getDefaultNetworkConfigurationForAllZones (numberOfZones, workerCIDR, shootVendor) {
+  switch (shootVendor?.shoot?.zoneNetworking?.strategy) {
+    case 'split-workers-public-internal': {
+      const zoneNetworks = splitCIDR(workerCIDR, numberOfZones)
       return map(range(numberOfZones), index => {
-        const zoneNetwork = zoneNetworksAws[index] // eslint-disable-line security/detect-object-injection
+        const zoneNetwork = zoneNetworks[index] // eslint-disable-line security/detect-object-injection
         const bigNetWorks = splitCIDR(zoneNetwork, 2)
         const workerNetwork = bigNetWorks[0]
         const smallNetworks = splitCIDR(bigNetWorks[1], 2)
@@ -250,10 +112,10 @@ export function getDefaultNetworkConfigurationForAllZones (numberOfZones, provid
         }
       })
     }
-    case 'alicloud': {
-      const zoneNetworksAli = splitCIDR(workerCIDR, numberOfZones)
+    case 'split-workers': {
+      const zoneNetworks = splitCIDR(workerCIDR, numberOfZones)
       return map(range(numberOfZones), index => {
-        const zoneNetwork = zoneNetworksAli[index] // eslint-disable-line security/detect-object-injection
+        const zoneNetwork = zoneNetworks[index] // eslint-disable-line security/detect-object-injection
         return {
           workers: zoneNetwork,
         }
@@ -262,8 +124,8 @@ export function getDefaultNetworkConfigurationForAllZones (numberOfZones, provid
   }
 }
 
-export function getDefaultZonesNetworkConfiguration (zones, providerType, maxNumberOfZones, workerCIDR) {
-  const zoneConfigurations = getDefaultNetworkConfigurationForAllZones(maxNumberOfZones, providerType, workerCIDR)
+export function getDefaultZonesNetworkConfiguration (zones, maxNumberOfZones, workerCIDR, shootVendor) {
+  const zoneConfigurations = getDefaultNetworkConfigurationForAllZones(maxNumberOfZones, workerCIDR, shootVendor)
   if (!zoneConfigurations) {
     return undefined
   }
@@ -276,12 +138,12 @@ export function getDefaultZonesNetworkConfiguration (zones, providerType, maxNum
   })
 }
 
-export function findFreeNetworks (existingZonesNetworkConfiguration, workerCIDR, providerType, maxNumberOfZones) {
+export function findFreeNetworks (existingZonesNetworkConfiguration, workerCIDR, maxNumberOfZones, shootVendor) {
   if (!existingZonesNetworkConfiguration) {
-    return getDefaultNetworkConfigurationForAllZones(maxNumberOfZones, providerType, workerCIDR)
+    return getDefaultNetworkConfigurationForAllZones(maxNumberOfZones, workerCIDR, shootVendor)
   }
   for (let numberOfZones = maxNumberOfZones; numberOfZones >= existingZonesNetworkConfiguration.length; numberOfZones--) {
-    const newZonesNetworkConfiguration = getDefaultNetworkConfigurationForAllZones(numberOfZones, providerType, workerCIDR)
+    const newZonesNetworkConfiguration = getDefaultNetworkConfigurationForAllZones(numberOfZones, workerCIDR, shootVendor)
     const freeZoneNetworks = filter(newZonesNetworkConfiguration, networkConfiguration => {
       return !some(existingZonesNetworkConfiguration, networkConfiguration)
     })
@@ -293,15 +155,15 @@ export function findFreeNetworks (existingZonesNetworkConfiguration, workerCIDR,
   return []
 }
 
-export function getZonesNetworkConfiguration (oldZonesNetworkConfiguration, workers, providerType, maxNumberOfZones, existingShootWorkerCIDR, newShootWorkerCIDR) {
-  if (isEmpty(workers) || !providerType || !maxNumberOfZones) {
+export function getZonesNetworkConfiguration (oldZonesNetworkConfiguration, workers, maxNumberOfZones, existingShootWorkerCIDR, newShootWorkerCIDR, shootVendor) {
+  if (isEmpty(workers) || !maxNumberOfZones) {
     return
   }
 
   const usedZones = uniq(flatMap(workers, 'zones'))
 
   const workerCIDR = existingShootWorkerCIDR || newShootWorkerCIDR
-  const defaultZonesNetworkConfiguration = getDefaultZonesNetworkConfiguration(usedZones, providerType, maxNumberOfZones, workerCIDR)
+  const defaultZonesNetworkConfiguration = getDefaultZonesNetworkConfiguration(usedZones, maxNumberOfZones, workerCIDR, shootVendor)
   if (!defaultZonesNetworkConfiguration) {
     return
   }
@@ -309,7 +171,7 @@ export function getZonesNetworkConfiguration (oldZonesNetworkConfiguration, work
   const existingZonesNetworkConfiguration = filter(oldZonesNetworkConfiguration, ({ name }) => includes(usedZones, name))
 
   if (existingShootWorkerCIDR) {
-    const freeZoneNetworks = findFreeNetworks(existingZonesNetworkConfiguration, existingShootWorkerCIDR, providerType, maxNumberOfZones)
+    const freeZoneNetworks = findFreeNetworks(existingZonesNetworkConfiguration, existingShootWorkerCIDR, maxNumberOfZones, shootVendor)
     const availableNetworksLength = existingZonesNetworkConfiguration.length + freeZoneNetworks.length
     if (availableNetworksLength < usedZones.length) {
       return
@@ -341,11 +203,10 @@ export function getZonesNetworkConfiguration (oldZonesNetworkConfiguration, work
     : existingZonesNetworkConfiguration
 }
 
-export function getControlPlaneZone (workers, providerType, oldControlPlaneZone) {
+export function getControlPlaneZone (workers, shootVendor, oldControlPlaneZone) {
   const workerZones = uniq(flatMap(workers, 'zones'))
-  switch (providerType) {
-    case 'gcp':
-    case 'hcloud':
+  switch (shootVendor?.shoot?.controlPlane?.zoneStrategy) {
+    case 'worker-zones':
       if (includes(workerZones, oldControlPlaneZone)) {
         return oldControlPlaneZone
       }
@@ -355,13 +216,6 @@ export function getControlPlaneZone (workers, providerType, oldControlPlaneZone)
   }
 }
 
-export function getWorkerProviderConfig (providerType) {
-  switch (providerType) {
-    case 'aws': {
-      return {
-        apiVersion: 'aws.provider.extensions.gardener.cloud/v1alpha1',
-        kind: 'WorkerConfig',
-      }
-    }
-  }
+export function getWorkerProviderConfig (shootVendor) {
+  return cloneDeep(shootVendor?.shoot?.workerProviderConfig)
 }
diff --git a/frontend/src/views/GCredentials.vue b/frontend/src/views/GCredentials.vue
index 69d8ac15c9..b5fc0fa53d 100644
--- a/frontend/src/views/GCredentials.vue
+++ b/frontend/src/views/GCredentials.vue
@@ -378,8 +378,8 @@ export default {
   },
   data () {
     return {
-      selectedInfraBinding: {},
-      selectedDnsCredential: {},
+      selectedInfraBinding: undefined,
+      selectedDnsCredential: undefined,
       infraCredentialFilter: '',
       createInfraCredentialMenu: false,
       dnsCredentialFilter: '',