[installer] Ensure objects in secrets namespace are only created with mk2 option

Author: Furisto

install/installer/pkg/components/ws-daemon/role.go

@@ -6,13 +6,25 @@ package wsdaemon
 
 import (
 	"github.com/gitpod-io/gitpod/installer/pkg/common"
+	"github.com/gitpod-io/gitpod/installer/pkg/config/v1/experimental"
 
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
 func role(ctx *common.RenderContext) ([]runtime.Object, error) {
+	var useMk2 bool
+	_ = ctx.WithExperimental(func(ucfg *experimental.Config) error {
+		if ucfg.Workspace != nil {
+			useMk2 = ucfg.Workspace.UseWsmanagerMk2
+		}
+		return nil
+	})
+	if !useMk2 {
+		return nil, nil
+	}
+
 	return []runtime.Object{
 		&rbacv1.Role{
 			TypeMeta: common.TypeMetaRole,

install/installer/pkg/components/ws-daemon/rolebinding.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 
 	"github.com/gitpod-io/gitpod/installer/pkg/common"
+	"github.com/gitpod-io/gitpod/installer/pkg/config/v1/experimental"
 
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -17,7 +18,7 @@ import (
 func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
 	labels := common.DefaultLabels(Component)
 
-	return []runtime.Object{
+	bindings := []runtime.Object{
 		&rbacv1.ClusterRoleBinding{
 			TypeMeta: common.TypeMetaClusterRoleBinding,
 			ObjectMeta: metav1.ObjectMeta{
@@ -54,25 +55,33 @@ func rolebinding(ctx *common.RenderContext) ([]runtime.Object, error) {
 				Namespace: ctx.Namespace,
 			}},
 		},
+	}
 
-		&rbacv1.RoleBinding{
-			TypeMeta: common.TypeMetaRoleBinding,
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      Component,
-				Namespace: common.WorkspaceSecretsNamespace,
-			},
-			RoleRef: rbacv1.RoleRef{
-				APIGroup: "rbac.authorization.k8s.io",
-				Kind:     "Role",
-				Name:     Component,
-			},
-			Subjects: []rbacv1.Subject{
-				{
-					Kind:      "ServiceAccount",
+	_ = ctx.WithExperimental(func(ucfg *experimental.Config) error {
+		if ucfg.Workspace != nil && ucfg.Workspace.UseWsmanagerMk2 {
+			bindings = append(bindings, &rbacv1.RoleBinding{
+				TypeMeta: common.TypeMetaRoleBinding,
+				ObjectMeta: metav1.ObjectMeta{
 					Name:      Component,
-					Namespace: ctx.Namespace,
+					Namespace: common.WorkspaceSecretsNamespace,
 				},
-			},
-		},
-	}, nil
+				RoleRef: rbacv1.RoleRef{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Role",
+					Name:     Component,
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						Kind:      "ServiceAccount",
+						Name:      Component,
+						Namespace: ctx.Namespace,
+					},
+				},
+			})
+		}
+
+		return nil
+	})
+
+	return bindings, nil
 }