Create AirGapped preview in Werft

[mrsimonemms]

Build an automation in Werft that allows for creation of an airgapped Gitpod infrastructure. When deploying to this, the expectation is that the installer will upload all KOTS/Gitpod images to the container registry and pull from there.

There should be both a Werft command (eg, /werft run airgapped-preview) and a checkbox added to all PRs. This will also add an additional preview box under the PR

Requirements

• Container registry
• Database
• Object storage
• Kubernetes cluster
• Cloud DNS zone
• TLS cert configured via LetEncrypt
• Firewall
  • deny outgoing network traffic to the public internet
  • allow connection to the registry, database, storage
  • No additional limitations on incoming network traffic when compared to the preview environment*
• GitLab - either:
  • Create a self-hosted GitLab instance on the network
  • allow connection to the pre-existing Gitpod GitLab instance

As a working example, the Azure instance in https://github.com/MrSimonEmms/gitpod-self-hosted-infrastructure. Feel free to use as an example of what I've been doing when testing in Azure.

---

* Why do we not limit incoming network traffic?

This is a pragmatic decision. Ultimately, the engineer will need to connect to the Gitpod instance hosted on the cluster at some point. If this were a truly airgapped instance, there would be the requirement to connect via a network/VPN. There is a cost in development, maintenance and documentation to this - ultimately, a new Gitpodder will find it tricky to connect to and it doesn't do much to remove developer friction.

Ultimately, the actual test is that the cluster is isolated from pulling things from the public internet. The incoming connection is no different whether it comes from the public internet or via a specific network.

As of 2022-09-16, there have been no documented cases where this approach has not met any of our customers' requirements for an airgapped installation. This pragmatic decision may be revisited in future

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.