[blobserve] watch and reload dockerAuth config when using ECR

[kylos101]

Is your feature request related to a problem? Please describe

When running in AWS using ECR, the cluster's image pull secret will be updated periodically by the refresh-credential component. Eventually, this means the dockerAuth config for blobserve will grow stale.

Describe the behaviour you'd like

blobserve should watch the pull secret for changes and update its configmap, similar to registry-facade and image-builder-mk3.

additionally, the new refresh-credential component should be deployed in application clusters as part of IDE installation types, not just workspace types.

Additional context

Here is an example for workspace, and image builder.

We depend on an image pull secret being defined at install time

gitpod/install/installer/pkg/components/image-builder-mk3/deployment.go

Line 30 in 0b4662b

secretName = ctx.Config.ContainerRegistry.External.Certificate.Name

Rotated on a schedule at runtime

gitpod/install/installer/pkg/components/refresh-credential/constants.go

Line 10 in 0b4662b

CronSchedule = "* */6 * * *"

And then components which need a working dockerAuth value update their config at runtime:

gitpod/components/image-builder-mk3/pkg/auth/auth.go

Line 42 in 0b4662b

res.loadFromFile(fn)

[kylos101]

@laushinka @akosyakov @loujaybee for 👀 and @jenting because IDE team may questions.

[kylos101]

We discussed today that the Scout Team will take of supporting external services, removing from IDE team inbox @akosyakov @laushinka @loujaybee .

[jenting]

additionally, the new refresh-credential component should be deployed in application clusters as part of IDE installation types, not just workspace types.

If the image builder moved to the workspace cluster, should the refresh-credential still need to be deployed into the application cluster?