[usage] Configure ingress for Stripe webhook

[andrew-farries]

Description

Configures ingress between proxy and the public API server to allow external access to the Stripe webhook (added in #11806).

• Add a new backend section to the payment-ingress section in the proxy Caddyfile and
• Update a networkpolicy to allow proxy to reach the public-api-server.

Related Issue(s)

Part of #10937

How to test

• Hit the webhook handler using its external URL:

brew install httpie
http POST https://payment.af-ingressf994192aa3.preview.gitpod-dev.com/stripe/invoices/webhook type=foo

Expected output:

HTTP/1.1 200 OK
Content-Length: 15
Content-Type: text/plain; charset=utf-8
Date: Thu, 04 Aug 2022 08:05:21 GMT
X-Gitpod-Region: local.

event type: foo

Release Notes

NONE

Documentation

Werft options:

• /werft with-preview

[werft-gitpod-dev-com]

started the job as gitpod-build-af-ingress-for-stripe-webhook.10 because the annotations in the pull request description changed
(with .werft/ from main)

[easyCZ]

LGTM

/hold
for Q about generated file

[easyCZ]

Is this related to your change?

[andrew-farries]

Nope. The file was regenerated with make generateRenderTests following the README.

I don't know what accounts for the changes in the file besides the change to the proxy config. Maybe the file was not updated by a previous PR?

[easyCZ]

I guess Self-Hosted is on the review and can clarify. Perhaps we're missing a CI check that would fail if the output.golden doesn't match anymore.

[mrsimonemms]

The changes look good and happy to approve. We've just had a change merged which updated the render golden files so probably worth rebasing (again) as it's likely to fail when merged to main.

Remove the hold at will

/hold

[andrew-farries]

Rebased and tests pass so

/unhold