bee: opt-in bee-runner

[darkobas2]

What

This adds opt-in support for running bee through bee-runner (https://github.com/ethersphere/swarm-oci-registry). With beeRunner.enabled: false, the default, the rendered chart does not change.

When enabled, the bee container uses the ghcr.io/ethersphere/bee-runner image. It runs bee-runner <options> -- start --config=.bee.yaml. The runner gets the latest release of its channel, checks the signature and sha256, and execs it. The chart has to set the command directly. beeCommand sets command:, which replaces the image's entrypoint. So changing image.repository alone would skip the runner.

Values

• beeRunner.channel: stable, rc or dev.
• beeRunner.registries: registry base URLs, tried in order. Empty means the public defaults for the channel. These are: the gateway with the channel's ENS name (stable and rc only), the gateway with the channel's feed manifest, then https://registry.ethswarm.org.
• beeRunner.healthyAfter, maxCrashStarts: crash rollback.
• beeRunner.timeout, registryTimeout: time for one start, and time per registry.
• beeRunner.updateRestart: adds --update-restart, so bee exits in its rollout slot for a new release. This needs a bee with that option (feat: report newer signed releases and opt-in restart under bee-runner bee#5631). An older bee refuses the unknown flag.
• beeRunner.extraArgs: any other runner flag.

The runner cache is /home/bee/.bee/bin, on the data volume. It is not configurable on purpose. The record of what a node may not downgrade from lives there, and it must stay with the data.

Testing

• helm lint passes.
• helm template with the defaults renders the same manifests as master (apart from the randomly generated password).
• Rendered with beeRunner.enabled=true for stable and dev, and with updateRestart=true.

Chart version 0.17.4 -> 0.17.5.