[public-api] Ensure no objects are rendered by installer without experimental config

[easyCZ]

Description

Ensures that all config related to public-api is only rendered when the experimental config is specified. Currently, only the deployment resource is conditionally rendered but the ServiceAccount and RoleBinding still get rendered.

Before

---
# v1/ServiceAccount public-api-server
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
creationTimestamp: null
labels:
  app: gitpod
  component: public-api-server
name: public-api-server
namespace: default
---
# rbac.authorization.k8s.io/v1/RoleBinding public-api-server
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: null
labels:
  app: gitpod
  component: public-api-server
name: public-api-server
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: default-ns-psp:restricted-root-user
subjects:
- kind: ServiceAccount
name: public-api-server
---

With this change, this config above is not rendered.

Related Issue(s)

Part of #9229

How to test

1. cd install/installer
2. Generate config with go run main.go init > installer.yaml
3. Edit the config and set domain anything non-empty
4. Fetch versions docker run -it --rm "eu.gcr.io/gitpod-core-dev/build/versions:main.2872" cat versions.yaml > versions.yaml
5. Extend the config from step 2. to add

experimental:
  webapp:
    publicApi:
      enabled: true

6. Run

export LOG_LEVEL=debug
go run main.go render --config "./installer.yaml" --use-experimental-config --debug-version-file versions.yaml

7. Search the file for public-api and see no occurences

Release Notes

NONE

Documentation

NONE

/hold

[easyCZ]

This check has been effectively hoisted higher to the Objects function (the main entry point for rendering anything for public-api). This ensures that future objects are also protected with the same config.

[andrew-farries]

Running the steps to test, I hit:

rendering using experimental config
{
  "valid": false,
  "fatal": [
    "Field 'Config.Domain' is required"
  ]
}
configuration is invalid
exit status 1

after step 5.

Where is the eu.gcr.io/gitpod-core-dev/build/versions image documented? I haven't come across that before.

[easyCZ]

Ah, I've forgotten a step. Set the domain to anything non-empty.

The image instructions used to be in the old installer readme, and I got them from Simon over Slack. Will raise a PR to add it to a readme.

[andrew-farries]

With this config:

...
experimental:
  webapp:
    publicApi:
      enabled: true

I see resources (deployments etc) relating to the public API; setting enabled to false doesn't change that.

[easyCZ]

Right. Enabled is poorly named, it's more-less so that there is something. For now, we don't parametrize the public API config. To not render it, the epxerimental.webapp.publicApi must not be set at all.

I'll raise a follow-up PR to parametrize it, but the existence of the config should in itself indicate it's enabled, so we shouldn't need an extra property down the line.

[easyCZ]

/unhold

Thanks for the review!