app/gerrit/kube: implement

This change impelements the k8s machinery for Gerrit.

This might look somewhat complex at first, but the gist of it is:

 - k8s mounts etc, git, cache, db, index as RW PVs
 - k8s mounts a configmap containing gerrit.conf into an external
   directory
 - k8s mounts a secret containing secure.conf into an external directory
 - on startup, gerrit's entrypoint will copy over {gerrit,secure}.conf
   and start a small updater script that copies over gerrit.conf if
   there's any change. This should, in theory, make gerrit reload its
   config.

This is already running on production. You're probably looking at this
change through the instance deployed by itself :)

Change-Id: Ida9dff721c17cf4da7fb6ccbb54d2c4024672572
diff --git a/WORKSPACE b/WORKSPACE
index d2d7cf6..96648b6 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -60,6 +60,7 @@
 # Docker base images
 
 load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
+
 container_pull(
     name = "prodimage-bionic",
     registry = "index.docker.io",
@@ -68,6 +69,14 @@
     digest = "sha256:b36667c98cf8f68d4b7f1fb8e01f742c2ed26b5f0c965a788e98dfe589a4b3e4",
 )
 
+container_pull(
+    name = "gerrit-3.0.0",
+    registry = "index.docker.io",
+    repository = "gerritcodereview/gerrit",
+    tag = "3.0.0-ubuntu18",
+    digest = "sha256:f107729011d8b81611e35a0ad452f21a424c1820664e9f95d135ad411e87b9bb",
+)
+
 # HTTP stuff from the Internet
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 http_file(