[installer] Add slow-server to network policy ingress rules

[andrew-farries]

Description

As part of #9198, a deployment called slow-server was added, identical to server but with a higher latency connection to the database.

This PR adds the slow-server component to the image-builder-mk3 and usage component network policy ingress rules, so that ingress to those two components works for slow-server just as it does for the server component.

This means that workspace startup works correctly for workspaces started by slow-server.

Related Issue(s)

Fixes #15027

How to test

1. Log into the preview environment.
2. Update the configcat targeting rule for the slow_database (non-production) feature flag for your user id.
3. Wait for 3 minutes for configcat to pull the new config or until /api/feature-flags/slow-database starts setting X-Gitpod-Slow-Database: true in the response headers.
4. Start a workspace.

The workspace start should be slower than usual, but should complete successfully.

Release Notes

NONE

Documentation

Werft options:

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-slow-database
• /werft with-large-vm
• /werft with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh

[werft-gitpod-dev-com]

started the job as gitpod-build-af-slow-workspace-starts.15 because the annotations in the pull request description changed
(with .werft/ from main)

[Pothulapati]

LGTM and sounds valid!

Just FYI, there seem to be more NetworkPolicy rules that are present with component: server to allow communication with components like proxy, etc. Might be a good idea to add now (or alter when we see the need).

[andrew-farries]

Thanks for the review @Pothulapati. server also appears as a pod selector in these other network policies:

• proxy-deny-all-allow-explicit:

  gitpod/install/installer/cmd/testdata/render/kind-webapp/output.golden

  Lines 99 to 105 in 5c7f28f

  	- from:
  	- namespaceSelector:
  	matchLabels:
  	chart: monitoring
  	podSelector:
  	matchLabels:
  	component: server

• open-vsx-proxy:

  gitpod/install/installer/cmd/testdata/render/customization/output.golden

  Lines 218 to 224 in 5c7f28f

  	- from:
  	- namespaceSelector:
  	matchLabels:
  	chart: monitoring
  	podSelector:
  	matchLabels:
  	component: server

• workspace-default:

  gitpod/install/installer/cmd/testdata/render/customization/output.golden

  Lines 424 to 431 in 5c7f28f

  	- from:
  	- namespaceSelector:
  	matchLabels:
  	chart: monitoring
  	podSelector:
  	matchLabels:
  	app: gitpod
  	component: server

Looking at the network policy docs, each of the above policies allows ingress from a pod called server in a namespace with a chart=monitoring label. ie not from a server pod in any other namespace. This is confusing as there doesn't appear to even be a namespace with that label in preview or live environments.

Is it possible that the policies are incorrect and we made the mistake described in the docs, ie that those parts of the policies should in fact read:

        - namespaceSelector:
            matchLabels:
              chart: monitoring
        - podSelector:
            matchLabels:
              app: gitpod
              component: server

To allow ingress from anywhere in a chart=monitoring namespace and from server? Given that Gitpod functions with the policies as they are, I think maybe these policies are redundant.

Do you have any idea what the intention is with these policies?

[andrew-farries]

/unhold because the changes here are sufficient to start workspaces through slow-server.