Retrieve supported workspace classes from workspace cluster

[Furisto]

Description

Note: This is a stacked PR that depends on #10982

During registration of a workspace cluster the workspace classes that are supported by this cluster will be fetched from the DescribeCluster endpoint of ws-manager. They are also fetched in a configurable interval (currently 60 seconds) so that updates to the supported classes are propagated to the meta side.

I have added a feature flag, so that this change can be deployed even if the new endpoint from #10982 has not been deployed to workspace clusters yet.

Related Issue(s)

Partially fixes ##10842

How to test

• Currently the feature flag (workspace_classes_backend) is active, so with debug logs activated (gpctl debug logs ws-manager-bridge) you should see messages like reconciling workspace classes...in the log output. After disabling the flag and restarting ws-manager-bridge you should not see any messages.

• Registration of a workspace cluster can be done with gpctl clusters register --name ws-cluster1 --hint-cordoned --hint-govern --tls-path ./wsman-tls/ --url 34.77.51.162:8081 --kubeconfig ./meta-cluster. After that in the admissionConstraints column of d_b_workspace_cluster you should see an entry similar to this:

[
   {
      "type":"has-class",
      "id":"default",
      "displayName":"default"
   },
   {
      "type":"has-class",
      "id":"gitpodio-internal-xl",
      "displayName":"XL"
   }
]

You can create a workspace cluster with workspace preview. I already have created a VM which you can use for registration. Contact me for the credentials.

Release Notes

None

Werft options:

• /werft with-preview

[Furisto]

I added this in addition to findFiltered because findFiltered does not return the tls config which we need to authenticate against the ws-manager endpoint

[geropl]

Jep. We did so to reduce traffic (bc it turned out to be a perf problem). See comment below.

[Furisto]

/hold

[sagor999]

Removed myself and workspace team from reviewers, since this PR does not contain any files that we are code owners of.

[geropl]

FYI: Thomas and I had a quick sync, aligned and discussed some minor changes. @Furisto Please ping for re-review! 🙏

[Furisto]

@geropl ping

[corneliusludmann]

Changes on Team Self-Hosted owned files look good. Approving to unblock the merge after being reviewed by the other teams.

[geropl]

/werft run

👍 started the job as gitpod-build-fo-register-cluster.11
(with .werft/ from main)

[geropl]

@Furisto I'm currently reviewing. Can you provide me the tls config for wsman? 🙏

[geropl]

@Furisto I received the credentials for your new VM. After setting everything up I still see no update of the admission constraints:

1. ws cluster is configured and can connect
2. bridge has run "reconcile workspace classes"
3. feature flags are 🟢 in ConfigCat
4. still, the DB says no admission constraint:

Could it be that the ws cluster is missing the workspace classes config? 🤔

[geropl]

Turns out the admissionsConstraint is properly updated which we can verify by accessing the DB directly. ✔️

gpctl has to be taught to express workspaceClass admissionConstraints, but that's out-of-scope and worth a follow-up. 🧘

[Furisto]

/unhold