Incorporates Kubernetes Namespace into Cluster's flow

What does this MR do?

Incorporates Clusters::KubernetesNamespace into clusters flow:

• Create the namespace/service account in GCP Kubernetes, when creating a cluster
• Create the namespace/service account in GCP Kubernetes, when adding a cluster
• Create the namespace/service account in GCP Kubernetes, when modifying namespace
• Replace KUBE_TOKEN and KUBECONFIG (passed to CI) with new credentials

What are the relevant issue numbers?

https://gitlab.com/gitlab-org/gitlab-ce/issues/51716

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• [-] Documentation created/updated
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• [-] Conforms to the database guides

Manual QA

ABAC Cluster

• Add a Cluster
• Check namespace/service account were created on kubernetes side
• Install applications
• Run AutoDevOps pipeline

RBAC Cluster

Creating cluster

• Create Cluster
• Check namespace/service account were created on kubernetes side
• Install applications
• Run AutoDevOps pipeline

Auto DevOps for ABAC

• Switch to master branch
• Create a cluster ABAC
• Switch to this branch, restart GDK
• Run Auto DevOps pipeline

Auto DevOps for RBAC

• Switch to master branch
• Create a cluster
• Switch to this branch, restart GDK
• Run Auto DevOps pipeline

app/models/clusters/platforms/kubernetes.rb

@@ -6,10 +6,13 @@ class Kubernetes < ActiveRecord::Base
       include Gitlab::Kubernetes
       include ReactiveCaching
       include EnumWithNil
+      include AfterCommitQueue
 
       self.table_name = 'cluster_platforms_kubernetes'
       self.reactive_cache_key = ->(kubernetes) { [kubernetes.class.model_name.singular, kubernetes.id] }
 
+      RESERVED_NAMESPACES = %w(gitlab-managed-apps).freeze
+
       belongs_to :cluster, inverse_of: :platform_kubernetes, class_name: 'Clusters::Cluster'
 
       attr_encrypted :password,
@@ -37,8 +40,10 @@ class Kubernetes < ActiveRecord::Base
       validates :token, presence: true
 
       validate :prevent_modification, on: :update
+      validate :prevent_reserved_namespaces
 
       after_save :clear_reactive_cache!
+      after_update :update_kubernetes_namespace
 
       alias_attribute :ca_pem, :ca_cert
 
@@ -47,6 +52,7 @@ class Kubernetes < ActiveRecord::Base
       delegate :managed?, to: :cluster, allow_nil: true
 
       delegate :cluster_project, to: :project, allow_nil: true
+      delegate :kubernetes_namespace, to: :cluster_project, allow_nil: true
 
       alias_method :active?, :enabled?
 
@@ -57,12 +63,6 @@ class Kubernetes < ActiveRecord::Base
       }
 
       def actual_namespace
-        cluster_project&.namespace || fallback_actual_namespace
-      end
-
-      # DEPRECATED
-      # To remove after migration of data to cluster_projects
-      def fallback_actual_namespace
         if namespace.present?
           namespace
         else
@@ -123,8 +123,12 @@ def kubeconfig
           ca_pem: ca_pem)
       end
 
-      # DEPRECATED
       def default_namespace
+        cluster_project&.kubernetes_namespace&.namespace.presence || fallback_default_namespace
+      end
+
+      # DEPRECATED
+      def fallback_default_namespace
         return unless project
 
         slug = "#{project.path}-#{project.id}".downcase
@@ -196,6 +200,22 @@ def prevent_modification
 
         true
       end
+
+      def prevent_reserved_namespaces
+        return if namespace.blank?
+
+        if RESERVED_NAMESPACES.include?(namespace)
+          errors.add(:namespace, 'Cannot used a GitLab reserved namespace')
+        end 
+      end
+
+      def update_kubernetes_namespace
+        return unless namespace_changed?
+
+        run_after_commit do
+          ClusterPlatformConfigureWorker.perform_async(cluster.id)
+        end
+      end
     end
   end
 end