[helm] registry-facade, ws-daemon: Add postStart and preStop lifecycle hooks akin to installer

Also, fix cluster-level bindings and roles

Author: geropl

chart/templates/registry-facade-clusterrole.yaml

@@ -17,4 +17,11 @@ rules:
     verbs: ["use"]
     resourceNames:
     - {{ .Release.Namespace }}-ns-registry-facade
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs:
+    - get
+    - list
+    - update
+    - patch
 {{- end -}}

chart/templates/registry-facade-daemonset.yaml

@@ -53,6 +53,10 @@ spec:
 {{ include "gitpod.container.tracingEnv" $this | indent 8 }}
         - name: GRPC_GO_RETRY
           value: "on"
+        - name: NODENAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
         volumeMounts:
         - name: cache
           mountPath: "/mnt/cache"
@@ -71,6 +75,19 @@ spec:
         - name: https-certificates
           mountPath: "/mnt/certificates"
         {{- end }}
+        lifecycle:
+          postStart:
+            exec:
+              command:
+              - /bin/bash
+              - -c
+              - kubectl label --overwrite nodes ${NODENAME} gitpod.io/registry-facade_ready_ns_${KUBE_NAMESPACE}=true
+          preStop:
+            exec:
+              command:
+              - /bin/bash
+              - -c
+              - kubectl label nodes ${NODENAME} gitpod.io/registry-facade_ready_ns_${KUBE_NAMESPACE}-
 {{ include "gitpod.kube-rbac-proxy" $this | indent 6 }}
       volumes:
       - name: cache

chart/templates/registry-facade-rolebinding.yaml

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Gitpod GmbH. All rights reserved.
 # Licensed under the MIT License. See License-MIT.txt in the project root for license information.
 
-kind: RoleBinding
+kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: registry-facade
+  name: {{ .Release.Namespace }}-ns-registry-facade
   labels:
     app: {{ template "gitpod.fullname" . }}
     component: registry-facade
@@ -13,6 +13,7 @@ metadata:
 subjects:
 - kind: ServiceAccount
   name: registry-facade
+  namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
   name: {{ .Release.Namespace }}-ns-registry-facade

chart/templates/ws-daemon-daemonset.yaml

@@ -288,6 +288,19 @@ spec:
             path: "/"
           initialDelaySeconds: 5
           periodSeconds: 10
+        lifecycle:
+          postStart:
+            exec:
+              command:
+              - /bin/bash
+              - -c
+              - kubectl label --overwrite nodes ${NODENAME} gitpod.io/ws-daemon_ready_ns_${KUBE_NAMESPACE}=true
+          preStop:
+            exec:
+              command:
+              - /bin/bash
+              - -c
+              - kubectl label nodes ${NODENAME} gitpod.io/ws-daemon_ready_ns_${KUBE_NAMESPACE}-
         livenessProbe:
           httpGet:
             port: 9999

chart/templates/ws-daemon-rolebinding.yaml

@@ -1,10 +1,10 @@
 # Copyright (c) 2020 Gitpod GmbH. All rights reserved.
 # Licensed under the MIT License. See License-MIT.txt in the project root for license information.
 
-kind: RoleBinding
+kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: ws-daemon-rb
+  name: {{ .Release.Namespace }}-ns-ws-daemon-rb
   labels:
     app: {{ template "gitpod.fullname" . }}
     component: ws-daemon
@@ -13,6 +13,7 @@ metadata:
 subjects:
 - kind: ServiceAccount
   name: ws-daemon
+  namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
   name: {{ .Release.Namespace }}-ns-ws-daemon