[installer] change blobserve node to workload_ide

[iQQBot]

Description

This PR move blobserve to workload_ide node, because traffic through ide-proxy

This PR also adjust blobserve network policy, in order to support some edge case see internal discuss

Related Issue(s)

Fixes #12366

How to test

Release Notes

NONE

Documentation

Werft options:

• /werft with-preview

[akosyakov]

@iQQBot Should I fix it somehow?
or ask @gitpod-io/engineering-self-hosted to verify?

[iQQBot]

I think we should ask @gitpod-io/engineering-self-hosted to verify, i.e. use this version to reinstall

[akosyakov]

lgtm

/hold

please merge when you are comfortable

[werft-gitpod-dev-com]

started the job as gitpod-build-pd-fix-blobserve.2 because the annotations in the pull request description changed
(with .werft/ from main)

[mrsimonemms]

I'm broadly ok with this change, but I don't know the implications of changing the network policies. My recollection from when we did this is that it was only implemented in GKE (not EKS, AKS or k3s).

It's worth running the test suites we have. You'll need to load this PR in a workspace, and then run:

werft run github -j .werft/gke-installer-tests.yaml -a skipTests=true
werft run github -j .werft/aks-installer-tests.yaml -a skipTests=true
werft run github -j .werft/k3s-installer-tests.yaml -a skipTests=true
werft run github -j .werft/eks-installer-tests.yaml -a skipTests=true

There's a possibility that these may fail due to these tests being fairly new, but this should give us an idea if this change creates any regressions.

[werft-gitpod-dev-com]

started the job as gitpod-build-pd-fix-blobserve.3 because the annotations in the pull request description changed
(with .werft/ from main)

[iQQBot]

I'm broadly ok with this change, but I don't know the implications of changing the network policies. My recollection from when we did this is that it was only implemented in GKE (not EKS, AKS or k3s).

The role of network policy is 2 parts

One is to restrict access to certain non-public services, such as ws-manager, which we don't want some pod like the workspace pod to be able to access, which may pose some security issues

The other role is to unrestrict access and prevent other network policies from acting on this pod

For blobserve, it is a public service, there is no need to restrict access to it, so in this PR, we remove all access restrictions

[corneliusludmann]

I tested the PR and it seems to fix the issue. Thank you very much @iQQBot for investigating this! 🚀

And sorry that it took so long on my end.

/unhold