[Feature]: Developer can stage and run apps in spaces created via the API

[tcdowney]

Blockers/Dependencies

No response

Background

As an App Developer
I want to be able to stage and run apps in spaces that I create via cf create-space
So that My staging and workload Pods are run separately from other spaces and that my RBAC roles apply to them

Acceptance Criteria

---

Staging Apps

GIVEN I have created an org and space with the cf CLI
WHEN I create a CFBuild in the space I just created
THEN I see it succeed

---

Running Apps

GIVEN I have created an org and space with the cf CLI
AND I have staged an App in that space / assigned the Droplet to the App
WHEN I start the App
THEN I see running Pods in the namespace corresponding with the CF space

---

Dev Notes

Right now there are three issues I've identified that are preventing this from working:

1. We should configure the new cf namespace to be the root namespace in the API shim
2. We need to configure HNC to propagate secrets
3. Propagating ServiceAccounts seems buggy and maybe not supported. It propagates the ServiceAccounts themselves, but not the token secrets that they rely on which causes them to be broken in the child namespaces.

The HNC docs say this:

Similarly, Kubernetes ServiceAccount Secrets will also by default be excluded from propagation.

[tcdowney]

Notes from the discussion during the CF on K8s SIG call:

• We should avoid relying on HNC to propagate ServiceAccounts for now. Let's have the API Shim create one when creating spaces*. Eventually let's have a controller that operates on CFOrg and CFSpace resources handle this.

* I think space creation is pretty async since we are actually creating HNC SubnamespaceAnchors. But I've seen buggy CLI behavior where the create space call returns too soon, so it might be beneficial in general to wait a bit for the namespace to get made so that we can create the ServiceAccount for kpack

[gcapizzi]

After #154 we should already be waiting for namespaces to exist before returning from the endpoint!

[tcdowney]

@gcapizzi nice, good to know :)