[registry-facade] Support zero-downtime updates

[csweichel]

This PR adds live socket handover support to registry-facade. Through this method we can update registry-facade without any downtime. The process is described in #2512.

To make the handover work, we have to run registry-facade in the hostNetwork. Otherwise we'd attempt to re-use a socket in a network namespace that no longer exists. Hence, by default handover support is disabled.

How to test

TODO(cw)

Open Questions

• Kubernetes just merged support for surge rollouts in daemonSets yet (KEP, PR). It will take a while until that becomes generally available. Until then we need some other convenient way to facilitate the handover, e.g. a separate daemonSet that can be deployed prior to the update. How would that look like? Would that be its own chart?

• /werft https

• /werft registry-facade-handover

[geropl]

/werft run

👍 started the job as gitpod-build-cw-regfac-handover.30

[geropl]

Sorry, had trouble to test. I did:

• kubectl exec -it ws-daemon-dmlls -- sh
• nsenter -t 1 -p -m (-m to be able to access the hostPath socket at /var/lib/gitpod/registry-facade-staging-cw-regfac-handover)
• after time digging found the correct registry-facade's PID
• but /proc/469480/exe handover /var/lib/gitpod/registry-facade-staging-cw-regfac-handover returns:

Error: dial unix /var/lib/gitpod/registry-facade-staging-cw-regfac-handover/rf-handover-1610115113.sock: connect: connection refused

[geropl]

Nice, works! 🎉

Deployment and actual applications follows in separate PR.