WIP: fake rejection

TODO:
 - find out if it really works by looking at logs (seems to fast atm)
- also, fix the broken "ns-psp:unprivileged" references

components/ws-manager-mk2/controllers/workspace_controller.go

@@ -7,6 +7,7 @@ package controllers
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -290,6 +291,23 @@ func (r *WorkspaceReconciler) actOnStatus(ctx context.Context, workspace *worksp
 	}
 	pod := &workspacePods.Items[0]
 
+	marker := slices.ContainsFunc(workspace.Spec.UserEnvVars, func(e corev1.EnvVar) bool {
+		return e.Name == "GITPOD_WORKSPACE_CONTEXT_URL" && strings.Contains(e.Value, "geropl")
+	})
+	if workspace.Status.PodRecreated == 0 && marker && (workspace.Status.Phase == workspacev1.WorkspacePhasePending || workspace.Status.Phase == workspacev1.WorkspacePhaseCreating) {
+		patch := client.MergeFrom(pod.DeepCopy())
+		pod.Status.Phase = corev1.PodFailed
+		pod.Status.Reason = "NodeAffinity"
+		pod.Status.Message = "Pod was rejected"
+
+		log.WithValues("ws", workspace.Name).Info("REJECTING POD FOR TESTING")
+		err = r.Client.Status().Patch(ctx, pod, patch)
+		if err != nil {
+			log.WithValues("ws", workspace.Name).Error(err, "REJECTING POD FOR TESTING: error while patching workspace pod")
+		}
+		return ctrl.Result{Requeue: true, RequeueAfter: 5 * time.Second}, nil
+	}
+
 	switch {
 	// if there is a pod, and it's failed, delete it
 	case workspace.IsConditionTrue(workspacev1.WorkspaceConditionFailed) && !isPodBeingDeleted(pod):