Fix PREVENT_METADATA_ACCESS is not effact

[iQQBot]

Description

rename THEIA_PREVENT_METADATA_ACCESS to GITPOD_PREVENT_METADATA_ACCESS
and fix is not effect in coredev
also fix workspace nodeAffinity in core-dev maybe it can improve stable for core-dev

Related Issue(s)

Relate https://github.com/gitpod-io/ops/pull/1246/files

How to test

1. start workspace
2. you will get shutdown immediately
3. and you can find metadata access is possible log in GCP

Release Notes

NONE

Documentation

[codecov]

Codecov Report

Merging #8336 (81c22a7) into main (f41c652) will decrease coverage by 21.83%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##             main    #8336       +/-   ##
===========================================
- Coverage   33.00%   11.17%   -21.84%     
===========================================
  Files          33       18       -15     
  Lines        4735      993     -3742     
===========================================
- Hits         1563      111     -1452     
+ Misses       3054      880     -2174     
+ Partials      118        2      -116     

Flag	Coverage Δ
components-gitpod-cli-app	11.17% <ø> (ø)
components-local-app-app-darwin-amd64	?
components-local-app-app-darwin-arm64	?
components-local-app-app-linux-amd64	?
components-local-app-app-linux-arm64	?
components-local-app-app-windows-386	?
components-local-app-app-windows-arm64	?
components-ws-manager-app	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
components/ws-manager/pkg/manager/manager.go
components/ws-manager/pkg/manager/status.go
...-manager/pkg/manager/internal/workpool/workpool.go
components/ws-manager/pkg/manager/monitor.go
components/local-app/pkg/auth/auth.go
components/local-app/pkg/auth/pkce.go
components/ws-manager/pkg/manager/metrics.go
...s/ws-manager/pkg/manager/internal/grpcpool/pool.go
components/ws-manager/pkg/manager/probe.go
components/ws-manager/pkg/manager/create.go
... and 5 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f41c652...81c22a7. Read the comment docs.

[akosyakov]

@iQQBot I'm trying to test, but workspaces don't get shutdown

[akosyakov]

I cannot find GITPOD_PREVENT_METADATA_ACCESS on workspace container in GCP either. Maybe I'm looking at wrong place though.

[kylos101]

Hey @iQQBot , this definitely works as advertised, I cannot start workspaces in core-dev in this namespace. How did you make them fail? I assume you altered workspace-default networkpolicy. Was there anything else you changed or restarted? I ask because I want to test both ways.

[iQQBot]

GITPOD_PREVENT_METADATA_ACCESS env variable control this behavior, if this env variable is set true, supervisor will try to access gcp endpoint, if it can access,supervisor will close itself

This PR change all workspace's default env variable, set GITPOD_PREVENT_METADATA_ACCESS to true

And this is is base on "fix" before, you can see commit history

[akosyakov]

lgtm, works as advertised now