Incorporates Kubernetes Namespace into Cluster's flow

What does this MR do?

Incorporates Clusters::KubernetesNamespace into clusters flow:

• Create the namespace/service account in GCP Kubernetes, when creating a cluster
• Create the namespace/service account in GCP Kubernetes, when adding a cluster
• Create the namespace/service account in GCP Kubernetes, when modifying namespace
• Replace KUBE_TOKEN and KUBECONFIG (passed to CI) with new credentials

What are the relevant issue numbers?

https://gitlab.com/gitlab-org/gitlab-ce/issues/51716

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• [-] Documentation created/updated
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• [-] Conforms to the database guides

Manual QA

ABAC Cluster

• Add a Cluster
• Check namespace/service account were created on kubernetes side
• Install applications
• Run AutoDevOps pipeline

RBAC Cluster

Creating cluster

• Create Cluster
• Check namespace/service account were created on kubernetes side
• Install applications
• Run AutoDevOps pipeline

Auto DevOps for ABAC

• Switch to master branch
• Create a cluster ABAC
• Switch to this branch, restart GDK
• Run Auto DevOps pipeline

Auto DevOps for RBAC

• Switch to master branch
• Create a cluster
• Switch to this branch, restart GDK
• Run Auto DevOps pipeline

app/models/clusters/platforms/kubernetes.rb

@@ -7,6 +7,8 @@ class Kubernetes < ActiveRecord::Base
       include ReactiveCaching
       include EnumWithNil
 
+      RESERVED_NAMESPACES = %w(gitlab-managed-apps).freeze
+
       self.table_name = 'cluster_platforms_kubernetes'
       self.reactive_cache_key = ->(kubernetes) { [kubernetes.class.model_name.singular, kubernetes.id] }
 
@@ -32,6 +34,8 @@ class Kubernetes < ActiveRecord::Base
           message: Gitlab::Regex.kubernetes_namespace_regex_message
         }
 
+      validates :namespace, exclusion: { in: RESERVED_NAMESPACES }
+
       # We expect to be `active?` only when enabled and cluster is created (the api_url is assigned)
       validates :api_url, url: true, presence: true
       validates :token, presence: true
@@ -45,6 +49,7 @@ class Kubernetes < ActiveRecord::Base
       delegate :project, to: :cluster, allow_nil: true
       delegate :enabled?, to: :cluster, allow_nil: true
       delegate :managed?, to: :cluster, allow_nil: true
+      delegate :kubernetes_namespace, to: :cluster
 
       alias_method :active?, :enabled?
 
@@ -116,10 +121,19 @@ def kubeconfig
       end
 
       def default_namespace
+        kubernetes_namespace&.namespace.presence || fallback_default_namespace
+      end
+
+      # DEPRECATED
+      #
+      # On 11.4 Clusters::KubernetesNamespace was introduced, this model will allow to
+      # have multiple namespaces per project. This method will be removed after migration
+      # has been completed.
+      def fallback_default_namespace
         return unless project
 
         slug = "#{project.path}-#{project.id}".downcase
-        slug.gsub(/[^-a-z0-9]/, '-').gsub(/^-+/, '')
+        Gitlab::NamespaceSanitizer.sanitize(slug)
       end
 
       def build_kube_client!(api_groups: ['api'], api_version: 'v1')