Enable connection limiting for free tier

[Furisto]

Description

This instructs ws-manager to limit the rate of network connections for non paying customers. Note that this currently only audits (i.e. it records packets that would have been dropped but does not actually drop them). We will use this to refine the limits.

Related Issue(s)

Fixes #13041

How to test

• User on free tier

  • Make yourself admin in the preview environment
  • Ensure that you are on the free open source plan
  • Start a workspace
  • The workspace should have the gitpod.io/netConnLimitPerMinute annotation
  • The other parts of this have already been covered by other PRs. If you want to be sure, check the logs of ws-daemon (it should contain will limit network connections. You can also ssh into the node and then enter the network namespace of the pod with nsenter -t pid -n. nft list ruleset should show you a bunch of rules in that namespace.

• Paying customer

  • Ensure that you are on the professional open source plan
  • Start a workspace
  • The workspace should not have the gitpod.io/netConnLimitPerMinute annotation
  • The other parts should be missing as well

Release Notes

None

Werft options:

• /werft with-preview

[Furisto]

/werft run with-payment

👍 started the job as gitpod-build-fo-netlimit-annotation.7
(with .werft/ from main)

[Furisto]

/werft run with-payment

👍 started the job as gitpod-build-fo-netlimit-annotation.9
(with .werft/ from main)

[Furisto]

@geropl PTAL

[geropl]

Sorry for the additional turn-around, but: I think It make sense to also sent teams. We already fetch it below (line 878) so we can just pull it up. 👍

[geropl]

Tested and works as advertised ✔️

/hold because I think it's worth addressing this comment, but leave it up to you to decide.

[Furisto]

/unhold