Refactor preview environment and image build methods

[iQQBot]

Description

This PR introduces significant refactoring to improve the security and efficiency of our deployment and build processes across the Gitpod infrastructure.

Key Changes

1. Preview Environment Create and Destroy:

   • Transitioned from using service account keys stored as environment variables to utilizing OpenID Connect (OIDC) for authentication. This update applies to operations on gitpod.io, our internal dogfood environment, and GitHub Actions.

2. Kubernetes Cluster and Secret Management:

   • Eliminated dependency on the core-dev Kubernetes cluster by adopting Google Secret Manager for handling secrets more securely and efficiently.

3. Build Process Refactoring:

   • Modified the build processes for the gitpod-web-extension and the xterm web IDE. These are now built directly within the Gitpod repository rather than their respective repositories. Corresponding commit ids in the WORKSPACE.yaml need updating to reflect these changes.

4. Service Account Key Management:

   • Removed the long-term service account keys for fluent-bit and gcr sa, transitioning to VM service accounts that generate short-term tokens. This enhances security by reducing the attack surface associated with long-term credentials.

5. Artifact Storage Location:

   • Updated the repo for image build. Builds from non-main branches will now be stored in eu.gcr.io/gitpod-dev-artifact/build/, while artifacts from the main branch continue to reside in the same location.

These changes are aimed at hardening our supply chain by reducing dependencies and improving security across our development operations.

Related Issue(s)

Fixes ENG-1963
Fixes ENG-2079

Part of ENG-1950
Part of ENG-2037

How to test

1. This PR uses the new flow to create the preview environment, it should succeed.
2. Use this branch to manually execute the modified workflows; they should also succeed.

Documentation

Preview status

Gitpod was successfully deployed to your preview environment.

• 🏷️ Name - pd-test-new-preview
• 🔗 URL - pd-test-new-preview.preview.gitpod-dev.com/workspaces.
• 📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
• 📦 Version - pd-test-new-preview-gha.24645
• 🗒️ Logs - GCP Logs Explorer

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• /werft preemptible
  Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
• with-integration-tests=ssh
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[github-actions]

⚠️ Hey reviewer! BE CAREFUL ⚠️
Review the code before opening in your Gitpod. .gitpod.yml was changed and it might be harmful.

[mustard-mh]

Tested with preview env that it will build extension gitpod-code (using a older version 0.0.6)

  codeWebExtensionCommit: 736db6fb669a1e3dd3379c26e1aa932ab9c8f696
  xtermCommit: 5a2eb92bec3dda821201f2681f531d1134173e6c

gitpod /workspace/gitpod (hw/pd-preview-test) $ kubectl get cm/ide-config -o yaml | yq r - 'data."config.json"' | jq .ideOptions.options.xterm
{
  "orderKey": "120",
  "title": "Terminal",
  "type": "browser",
  "logo": "https://ide.hw-pd-preview-test.preview.gitpod-dev.com/image/ide-logo/terminal.svg",
  "label": "Insiders",
  "image": "eu.gcr.io/gitpod-dev-artifact/build/ide/xterm-web:commit-8be0e227334e38515d781d63735f041022a953dc",
  "latestImage": "eu.gcr.io/gitpod-dev-artifact/build/ide/xterm-web:commit-8be0e227334e38515d781d63735f041022a953dc",
  "resolveImageDigest": true
}
gitpod /workspace/gitpod (hw/pd-preview-test) $ kubectl get cm/ide-config -o yaml | yq r - 'data."config.json"' | jq .ideOptions.options.code
{
  "orderKey": "010",
  "title": "VS Code",
  "type": "browser",
  "logo": "https://ide.hw-pd-preview-test.preview.gitpod-dev.com/image/ide-logo/vscode.svg",
  "label": "Browser",
  "image": "eu.gcr.io/gitpod-core-dev/build/ide/code:commit-7721fe825201d4d8d53975f81de0b063d94383cc",
  "latestImage": "eu.gcr.io/gitpod-dev-artifact/build/ide/code:commit-4c49bee58855362f807b3d6b0933e2848ec7f302",
  "imageLayers": [
    "eu.gcr.io/gitpod-dev-artifact/build/ide/gitpod-code-web:commit-8be0e227334e38515d781d63735f041022a953dc",
    "eu.gcr.io/gitpod-dev-artifact/build/ide/code-codehelper:commit-4c49bee58855362f807b3d6b0933e2848ec7f302"
  ],
  "latestImageLayers": [
    "eu.gcr.io/gitpod-dev-artifact/build/ide/gitpod-code-web:commit-8be0e227334e38515d781d63735f041022a953dc",
    "eu.gcr.io/gitpod-dev-artifact/build/ide/code-codehelper:commit-4c49bee58855362f807b3d6b0933e2848ec7f302"
  ],
  "versions": [
    {
      "version": "1.88.0",
      "image": "eu.gcr.io/gitpod-core-dev/build/ide/code:commit-7721fe825201d4d8d53975f81de0b063d94383cc",
      "imageLayers": [
        "eu.gcr.io/gitpod-dev-artifact/build/ide/gitpod-code-web:commit-8be0e227334e38515d781d63735f041022a953dc",
        "eu.gcr.io/gitpod-dev-artifact/build/ide/code-codehelper:commit-4c49bee58855362f807b3d6b0933e2848ec7f302"
      ]
    },
    ......
  ]
}
gitpod /workspace/gitpod (hw/pd-preview-test) $ git log
commit 8be0e227334e38515d781d63735f041022a953dc (HEAD -> hw/pd-preview-test, origin/hw/pd-preview-test)
Author: Huiwen Huang <[email protected]>
Date:   Fri Apr 26 17:52:11 2024 +0000

    Build gitpod-code and xterm

[mustard-mh]

Test telemetry is working. I'm using leeway run dev:preview by the way

[iQQBot]

/unhold

[mustard-mh]

🚀

[iQQBot]

/unhold

[kylos101]

@iQQBot I had to add this back, so that we can use UBP in preview environments. Ref: #19692 .