Merge remote-tracking branch 'upstream/master' into ce-to-ee-2018-11-23

# Conflicts:
#	doc/README.md

[ci skip]

app/assets/javascripts/clusters/clusters_bundle.js

@@ -26,6 +26,7 @@ export default class Clusters {
       statusPath,
       installHelmPath,
       installIngressPath,
+      installCertManagerPath,
       installRunnerPath,
       installJupyterPath,
       installKnativePath,
@@ -48,6 +49,7 @@ export default class Clusters {
       endpoint: statusPath,
       installHelmEndpoint: installHelmPath,
       installIngressEndpoint: installIngressPath,
+      installCertManagerEndpoint: installCertManagerPath,
       installRunnerEndpoint: installRunnerPath,
       installPrometheusEndpoint: installPrometheusPath,
       installJupyterEndpoint: installJupyterPath,

app/assets/javascripts/clusters/components/applications.vue

@@ -7,6 +7,7 @@ import helmLogo from 'images/cluster_app_logos/helm.png';
 import jeagerLogo from 'images/cluster_app_logos/jeager.png';
 import jupyterhubLogo from 'images/cluster_app_logos/jupyterhub.png';
 import kubernetesLogo from 'images/cluster_app_logos/kubernetes.png';
+import certManagerLogo from 'images/cluster_app_logos/cert_manager.png';
 import knativeLogo from 'images/cluster_app_logos/knative.png';
 import meltanoLogo from 'images/cluster_app_logos/meltano.png';
 import prometheusLogo from 'images/cluster_app_logos/prometheus.png';
@@ -59,6 +60,7 @@ export default {
     jeagerLogo,
     jupyterhubLogo,
     kubernetesLogo,
+    certManagerLogo,
     knativeLogo,
     meltanoLogo,
     prometheusLogo,
@@ -124,6 +126,23 @@ export default {
           </p>
         `;
     },
+    certManagerDescription() {
+      return sprintf(
+        _.escape(
+          s__(
+            `ClusterIntegration|cert-manager is a native Kubernetes certificate management controller that helps with issuing certificates.
+            Installing cert-manager on your cluster will issue a certificate by %{letsEncrypt} and ensure that certificates
+            are valid and up to date.`,
+          ),
+        ),
+        {
+          letsEncrypt: `<a href="https://letsencrypt.org/"
+              target="_blank" rel="noopener noreferrer">
+              ${_.escape(s__("ClusterIntegration|Let's Encrypt"))}</a>`,
+        },
+        false,
+      );
+    },
     prometheusDescription() {
       return sprintf(
         _.escape(
@@ -265,6 +284,24 @@ export default {
           <div v-html="ingressDescription"></div>
         </div>
       </application-row>
+      <application-row
+        id="cert_manager"
+        :logo-url="certManagerLogo"
+        :title="applications.cert_manager.title"
+        :status="applications.cert_manager.status"
+        :status-reason="applications.cert_manager.statusReason"
+        :request-status="applications.cert_manager.requestStatus"
+        :request-reason="applications.cert_manager.requestReason"
+        :disabled="!helmInstalled"
+        class="hide-bottom-border rounded-bottom"
+        title-link="https://cert-manager.readthedocs.io/en/latest/#"
+      >
+        <div 
+          slot="description"
+          v-html="certManagerDescription"
+        >
+        </div>
+      </application-row>
       <application-row
         v-if="isProjectCluster"
         id="prometheus"

app/assets/javascripts/clusters/services/clusters_service.js

@@ -6,6 +6,7 @@ export default class ClusterService {
     this.appInstallEndpointMap = {
       helm: this.options.installHelmEndpoint,
       ingress: this.options.installIngressEndpoint,
+      cert_manager: this.options.installCertManagerEndpoint,
       runner: this.options.installRunnerEndpoint,
       prometheus: this.options.installPrometheusEndpoint,
       jupyter: this.options.installJupyterEndpoint,

app/assets/javascripts/clusters/stores/clusters_store.js

@@ -24,6 +24,13 @@ export default class ClusterStore {
           requestReason: null,
           externalIp: null,
         },
+        cert_manager: {
+          title: s__('ClusterIntegration|Cert-Manager'),
+          status: null,
+          statusReason: null,
+          requestStatus: null,
+          requestReason: null,
+        },
         runner: {
           title: s__('ClusterIntegration|GitLab Runner'),
           status: null,

app/controllers/profiles/keys_controller.rb

@@ -40,7 +40,8 @@ class Profiles::KeysController < Profiles::ApplicationController
       begin
         user = UserFinder.new(params[:username]).find_by_username
         if user.present?
-          render text: user.all_ssh_keys.join("\n"), content_type: "text/plain"
+          headers['Content-Disposition'] = 'attachment'
+          render text: user.all_ssh_keys.join("\n"), content_type: 'text/plain'
         else
           return render_404
         end

app/finders/issuable_finder.rb

@@ -210,7 +210,14 @@ class IssuableFinder
   end
 
   def filter_by_no_label?
-    labels? && params[:label_name].include?(Label::None.title)
+    downcased = label_names.map(&:downcase)
+
+    # Label::NONE is deprecated and should be removed in 12.0
+    downcased.include?(FILTER_NONE) || downcased.include?(Label::NONE)
+  end
+
+  def filter_by_any_label?
+    label_names.map(&:downcase).include?(FILTER_ANY)
   end
 
   def labels
@@ -465,6 +472,8 @@ class IssuableFinder
     items =
       if filter_by_no_label?
         items.without_label
+      elsif filter_by_any_label?
+        items.any_label
       else
         items.with_label(label_names, params[:sort])
       end

app/models/clusters/applications/cert_manager.rb

+# frozen_string_literal: true
+
+module Clusters
+  module Applications
+    class CertManager < ActiveRecord::Base
+      VERSION = 'v0.5.0'.freeze
+
+      self.table_name = 'clusters_applications_cert_managers'
+
+      include ::Clusters::Concerns::ApplicationCore
+      include ::Clusters::Concerns::ApplicationStatus
+      include ::Clusters::Concerns::ApplicationVersion
+      include ::Clusters::Concerns::ApplicationData
+
+      default_value_for :version, VERSION
+
+      validates :email, presence: true
+
+      def chart
+        'stable/cert-manager'
+      end
+
+      def install_command
+        Gitlab::Kubernetes::Helm::InstallCommand.new(
+          name: 'certmanager',
+          version: VERSION,
+          rbac: cluster.platform_kubernetes_rbac?,
+          chart: chart,
+          files: files.merge(cluster_issuer_file),
+          postinstall: post_install_script
+        )
+      end
+
+      private
+
+      def post_install_script
+        ["/usr/bin/kubectl create -f /data/helm/certmanager/config/cluster_issuer.yaml"]
+      end
+
+      def cluster_issuer_file
+        {
+          'cluster_issuer.yaml': cluster_issuer_yaml_content
+        }
+      end
+
+      def cluster_issuer_yaml_content
+        YAML.dump(cluster_issuer_content.deep_merge(cluster_issue_overlay))
+      end
+
+      def cluster_issuer_content
+        YAML.safe_load(File.read(cluster_issuer_file_path))
+      end
+
+      def cluster_issue_overlay
+        { "spec" => { "acme" => { "email" => self.email } } }
+      end
+
+      def cluster_issuer_file_path
+        Rails.root.join('vendor', 'cert_manager', 'cluster_issuer.yaml')
+      end
+    end
+  end
+end

app/models/clusters/cluster.rb

@@ -10,6 +10,7 @@ module Clusters
     APPLICATIONS = {
       Applications::Helm.application_name => Applications::Helm,
       Applications::Ingress.application_name => Applications::Ingress,
+      Applications::CertManager.application_name => Applications::CertManager,
       Applications::Prometheus.application_name => Applications::Prometheus,
       Applications::Runner.application_name => Applications::Runner,
       Applications::Jupyter.application_name => Applications::Jupyter,
@@ -33,6 +34,7 @@ module Clusters
 
     has_one :application_helm, class_name: 'Clusters::Applications::Helm'
     has_one :application_ingress, class_name: 'Clusters::Applications::Ingress'
+    has_one :application_cert_manager, class_name: 'Clusters::Applications::CertManager'
     has_one :application_prometheus, class_name: 'Clusters::Applications::Prometheus'
     has_one :application_runner, class_name: 'Clusters::Applications::Runner'
     has_one :application_jupyter, class_name: 'Clusters::Applications::Jupyter'
@@ -100,6 +102,7 @@ module Clusters
       [
         application_helm || build_application_helm,
         application_ingress || build_application_ingress,
+        application_cert_manager || build_application_cert_manager,
         application_prometheus || build_application_prometheus,
         application_runner || build_application_runner,
         application_jupyter || build_application_jupyter,

app/models/concerns/issuable.rb

@@ -90,6 +90,7 @@ module Issuable
     scope :order_milestone_due_asc,  -> { left_joins_milestones.reorder('milestones.due_date IS NULL, milestones.id IS NULL, milestones.due_date ASC') }
 
     scope :without_label, -> { joins("LEFT OUTER JOIN label_links ON label_links.target_type = '#{name}' AND label_links.target_id = #{table_name}.id").where(label_links: { id: nil }) }
+    scope :any_label, -> { joins(:label_links).group(:id) }
     scope :join_project, -> { joins(:project) }
     scope :inc_notes_with_associations, -> { includes(notes: [:project, :author, :award_emoji]) }
     scope :references_project, -> { references(:project) }

app/models/label.rb

@@ -9,15 +9,10 @@ class Label < ActiveRecord::Base
   include Sortable
   include FromUnion
 
-  # Represents a "No Label" state used for filtering Issues and Merge
-  # Requests that have no label assigned.
-  LabelStruct = Struct.new(:title, :name)
-  None = LabelStruct.new('No Label', 'No Label')
-  Any = LabelStruct.new('Any Label', '')
-
   cache_markdown_field :description, pipeline: :single_line
 
-  DEFAULT_COLOR = '#428BCA'.freeze
+  DEFAULT_COLOR = '#428BCA'
+  NONE = 'no label'
 
   default_value_for :color, DEFAULT_COLOR
 

app/services/clusters/applications/create_service.rb

@@ -19,6 +19,10 @@ module Clusters
             application.hostname = params[:hostname]
           end
 
+          if application.has_attribute?(:email)
+            application.email = current_user.email
+          end
+
           if application.respond_to?(:oauth_application)
             application.oauth_application = create_oauth_application(application, request)
           end
@@ -42,7 +46,8 @@ module Clusters
       def builders
         {
           "helm" => -> (cluster) { cluster.application_helm || cluster.build_application_helm },
-          "ingress" => -> (cluster) { cluster.application_ingress || cluster.build_application_ingress }
+          "ingress" => -> (cluster) { cluster.application_ingress || cluster.build_application_ingress },
+          "cert_manager" => -> (cluster) { cluster.application_cert_manager || cluster.build_application_cert_manager }
         }.tap do |hash|
           hash.merge!(project_builders) if cluster.project_type?
         end

app/views/clusters/clusters/show.html.haml

@@ -10,6 +10,7 @@
 .edit-cluster-form.js-edit-cluster-form{ data: { status_path: status_path,
   install_helm_path: clusterable.install_applications_cluster_path(@cluster, :helm),
   install_ingress_path: clusterable.install_applications_cluster_path(@cluster, :ingress),
+  install_cert_manager_path: clusterable.install_applications_cluster_path(@cluster, :cert_manager),
   install_prometheus_path: clusterable.install_applications_cluster_path(@cluster, :prometheus),
   install_runner_path: clusterable.install_applications_cluster_path(@cluster, :runner),
   install_jupyter_path: clusterable.install_applications_cluster_path(@cluster, :jupyter),

changelogs/unreleased/52371-filter-by-none-any-for-labels-in-issues-mrs-api.yml

+---
+title: Filter by None/Any for labels in issues/mrs API
+merge_request: 22622
+author: Jacopo Beschi @jacopo-beschi
+type: added

changelogs/unreleased/52371-removes-patially-matching-no-label-and-makes-it-case-insensitive.yml

+---
+title: removes partially matching of No Label filter and makes it case-insensitive
+merge_request: 22622
+author: Jacopo Beschi @jacopo-beschi
+type: changed

changelogs/unreleased/certmanager-temp.yml

+---
+title: "#40635: Adds support for cert-manager"
+merge_request: 23036
+author: Amit Rathi
+type: added

changelogs/unreleased/fj-force-content-disposition.yml

+---
+title: Force content disposition attachment to several endpoints
+merge_request: 23223
+author:
+type: other

db/migrate/20181101191341_create_clusters_applications_cert_manager.rb

+# frozen_string_literal: true
+
+class CreateClustersApplicationsCertManager < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    create_table :clusters_applications_cert_managers do |t|
+      t.references :cluster, null: false, index: false, foreign_key: { on_delete: :cascade }
+      t.integer :status, null: false
+      t.string :version, null: false
+      t.string :email, null: false
+      t.timestamps_with_timezone null: false
+      t.text :status_reason
+      t.index :cluster_id, unique: true
+    end
+  end
+end

db/schema.rb

@@ -756,6 +756,17 @@ ActiveRecord::Schema.define(version: 20181112103239) do
     t.index ["user_id"], name: "index_clusters_on_user_id", using: :btree
   end
 
+  create_table "clusters_applications_cert_managers", force: :cascade do |t|
+    t.integer "cluster_id", null: false
+    t.integer "status", null: false
+    t.string "version", null: false
+    t.string "email", null: false
+    t.datetime_with_timezone "created_at", null: false
+    t.datetime_with_timezone "updated_at", null: false
+    t.text "status_reason"
+    t.index ["cluster_id"], name: "index_clusters_applications_cert_managers_on_cluster_id", unique: true, using: :btree
+  end
+
   create_table "clusters_applications_helm", force: :cascade do |t|
     t.integer "cluster_id", null: false
     t.datetime "created_at", null: false
@@ -3125,6 +3136,7 @@ ActiveRecord::Schema.define(version: 20181112103239) do
   add_foreign_key "cluster_projects", "projects", on_delete: :cascade
   add_foreign_key "cluster_providers_gcp", "clusters", on_delete: :cascade
   add_foreign_key "clusters", "users", on_delete: :nullify
+  add_foreign_key "clusters_applications_cert_managers", "clusters", on_delete: :cascade
   add_foreign_key "clusters_applications_helm", "clusters", on_delete: :cascade
   add_foreign_key "clusters_applications_ingress", "clusters", on_delete: :cascade
   add_foreign_key "clusters_applications_jupyter", "clusters", on_delete: :cascade

doc/administration/monitoring/prometheus/index.md

@@ -156,6 +156,20 @@ Sample Prometheus queries:
 - **Data transmitted:** `rate(node_network_transmit_bytes_total{device!="lo"}[5m])`
 - **Data received:** `rate(node_network_receive_bytes_total{device!="lo"}[5m])`
 
+## Prometheus as a Grafana data source
+
+Grafana allows you to import Prometheus performance metrics as a data source
+and render the metrics as graphs and dashboards which is helpful with visualisation.
+
+To add a Prometheus dashboard for a single server GitLab setup:
+
+1. Create a new data source in Grafana.
+1. Name your data source i.e GitLab.
+1. Select `Prometheus` in the type drop down.
+1. Add your Prometheus listen address as the URL and set access to `Browser`.
+1. Set the HTTP method to `GET`.
+1. Save & Test your configuration to verify that it works.
+
 ## GitLab metrics
 
 > Introduced in GitLab 9.3.

doc/api/issues.md

@@ -36,7 +36,7 @@ GET /issues?my_reaction_emoji=star
 | Attribute           | Type             | Required   | Description                                                                                                                                         |
 | ------------------- | ---------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `state`             | string           | no         | Return all issues or just those that are `opened` or `closed`                                                                                       |
-| `labels`            | string           | no         | Comma-separated list of label names, issues must have all labels to be returned. `No+Label` lists all issues with no labels                         |
+| `labels`            | string           | no         | Comma-separated list of label names, issues must have all labels to be returned. `None` lists all issues with no labels. `Any` lists all issues with at least one label. `No+Label` (Deprecated) lists all issues with no labels. Predefined names are case-insensitive. |
 | `milestone`         | string           | no         | The milestone title. `None` lists all issues with no milestone. `Any` lists all issues that have an assigned milestone.                             |
 | `scope`             | string           | no         | Return issues for the given scope: `created_by_me`, `assigned_to_me` or `all`. Defaults to `created_by_me`<br> For versions before 11.0, use the now deprecated `created-by-me` or `assigned-to-me` scopes instead.<br> _([Introduced][ce-13004] in GitLab 9.5. [Changed to snake_case][ce-18935] in GitLab 11.0)_ |
 | `author_id`         | integer          | no         | Return issues created by the given user `id`. Combine with `scope=all` or `scope=assigned_to_me`. _([Introduced][ce-13004] in GitLab 9.5)_          |
@@ -151,7 +151,7 @@ GET /groups/:id/issues?my_reaction_emoji=star
 | ------------------- | ---------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------- |
 | `id`                | integer/string   | yes        | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) owned by the authenticated user                 |
 | `state`             | string           | no         | Return all issues or just those that are `opened` or `closed`                                                                 |
-| `labels`            | string           | no         | Comma-separated list of label names, issues must have all labels to be returned. `No+Label` lists all issues with no labels   |
+| `labels`            | string           | no         | Comma-separated list of label names, issues must have all labels to be returned. `None` lists all issues with no labels. `Any` lists all issues with at least one label. `No+Label` (Deprecated) lists all issues with no labels. Predefined names are case-insensitive. |
 | `iids[]`            | Array[integer]   | no         | Return only the issues having the given `iid`                                                                                 |
 | `milestone`         | string           | no         | The milestone title. `None` lists all issues with no milestone. `Any` lists all issues that have an assigned milestone.       |
 | `scope`             | string           | no         | Return issues for the given scope: `created_by_me`, `assigned_to_me` or `all`.<br> For versions before 11.0, use the now deprecated `created-by-me` or `assigned-to-me` scopes instead.<br> _([Introduced][ce-13004] in GitLab 9.5. [Changed to snake_case][ce-18935] in GitLab 11.0)_ |
@@ -268,7 +268,7 @@ GET /projects/:id/issues?my_reaction_emoji=star
 | `id`                | integer/string   | yes        | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user               |
 | `iids[]`            | Array[integer]   | no         | Return only the milestone having the given `iid`                                                                              |
 | `state`             | string           | no         | Return all issues or just those that are `opened` or `closed`                                                                 |
-| `labels`            | string           | no         | Comma-separated list of label names, issues must have all labels to be returned. `No+Label` lists all issues with no labels   |
+| `labels`            | string           | no         | Comma-separated list of label names, issues must have all labels to be returned. `None` lists all issues with no labels. `Any` lists all issues with at least one label. `No+Label` (Deprecated) lists all issues with no labels. Predefined names are case-insensitive. |
 | `milestone`         | string           | no         | The milestone title. `None` lists all issues with no milestone. `Any` lists all issues that have an assigned milestone.       |
 | `scope`             | string           | no         | Return issues for the given scope: `created_by_me`, `assigned_to_me` or `all`.<br> For versions before 11.0, use the now deprecated `created-by-me` or `assigned-to-me` scopes instead.<br> _([Introduced][ce-13004] in GitLab 9.5. [Changed to snake_case][ce-18935] in GitLab 11.0)_ |
 | `author_id`         | integer          | no         | Return issues created by the given user `id` _([Introduced][ce-13004] in GitLab 9.5)_                                         |

doc/api/merge_requests.md

@@ -35,7 +35,7 @@ Parameters:
 | `sort`              | string   | no       | Return requests sorted in `asc` or `desc` order. Default is `desc`                                                     |
 | `milestone`         | string   | no       | Return merge requests for a specific milestone. `None` returns merge requests with no milestone. `Any` returns merge requests that have an assigned milestone. |
 | `view`              | string   | no       | If `simple`, returns the `iid`, URL, title, description, and basic state of merge request                              |
-| `labels`            | string   | no       | Return merge requests matching a comma separated list of labels                                                        |
+| `labels`            | string   | no       | Return merge requests matching a comma separated list of labels. `None` lists all merge requests with no labels. `Any` lists all merge requests with at least one label. `No+Label` (Deprecated) lists all merge requests with no labels. Predefined names are case-insensitive. |
 | `created_after`     | datetime | no       | Return merge requests created on or after the given time                                                               |
 | `created_before`    | datetime | no       | Return merge requests created on or before the given time                                                              |
 | `updated_after`     | datetime | no       | Return merge requests updated on or after the given time                                                               |
@@ -171,7 +171,7 @@ Parameters:
 | `sort`              | string         | no       | Return requests sorted in `asc` or `desc` order. Default is `desc`                                                             |
 | `milestone`         | string         | no       | Return merge requests for a specific milestone. `None` returns merge requests with no milestone. `Any` returns merge requests that have an assigned milestone. |
 | `view`              | string         | no       | If `simple`, returns the `iid`, URL, title, description, and basic state of merge request                                      |
-| `labels`            | string         | no       | Return merge requests matching a comma separated list of labels                                                                |
+| `labels`            | string         | no       | Return merge requests matching a comma separated list of labels. `None` lists all merge requests with no labels. `Any` lists all merge requests with at least one label. `No+Label` (Deprecated) lists all merge requests with no labels. Predefined names are case-insensitive. |
 | `created_after`     | datetime       | no       | Return merge requests created on or after the given time                                                                       |
 | `created_before`    | datetime       | no       | Return merge requests created on or before the given time                                                                      |
 | `updated_after`     | datetime       | no       | Return merge requests updated on or after the given time                                                                       |
@@ -296,7 +296,7 @@ Parameters:
 | `sort`              | string         | no       | Return merge requests sorted in `asc` or `desc` order. Default is `desc`                                                       |
 | `milestone`         | string         | no       | Return merge requests for a specific milestone. `None` returns merge requests with no milestone. `Any` returns merge requests that have an assigned milestone. |
 | `view`              | string         | no       | If `simple`, returns the `iid`, URL, title, description, and basic state of merge request                                      |
-| `labels`            | string         | no       | Return merge requests matching a comma separated list of labels                                                                |
+| `labels`            | string         | no       | Return merge requests matching a comma separated list of labels. `None` lists all merge requests with no labels. `Any` lists all merge requests with at least one label. `No+Label` (Deprecated) lists all merge requests with no labels. Predefined names are case-insensitive. |
 | `created_after`     | datetime       | no       | Return merge requests created on or after the given time                                                                       |
 | `created_before`    | datetime       | no       | Return merge requests created on or before the given time                                                                      |
 | `updated_after`     | datetime       | no       | Return merge requests updated on or after the given time                                                                       |

doc/api/projects.md

@@ -673,7 +673,7 @@ POST /projects
 | `shared_runners_enabled` | boolean | no | Enable shared runners for this project |
 | `visibility` | string | no | See [project visibility level](#project-visibility-level) |
 | `import_url` | string | no | URL to import repository from |
-| `public_jobs` | boolean | no | If `true`, jobs can be viewed by non-project-members |
+| `public_builds` | boolean | no | If `true`, jobs can be viewed by non-project-members |
 | `only_allow_merge_if_pipeline_succeeds` | boolean | no | Set whether merge requests can only be merged with successful jobs |
 | `only_allow_merge_if_all_discussions_are_resolved` | boolean | no | Set whether merge requests can only be merged when all the discussions are resolved |
 | `merge_method` | string | no | Set the merge method used |
@@ -718,7 +718,7 @@ POST /projects/user/:user_id
 | `shared_runners_enabled` | boolean | no | Enable shared runners for this project |
 | `visibility` | string | no | See [project visibility level](#project-visibility-level) |
 | `import_url` | string | no | URL to import repository from |
-| `public_jobs` | boolean | no | If `true`, jobs can be viewed by non-project-members |
+| `public_builds` | boolean | no | If `true`, jobs can be viewed by non-project-members |
 | `only_allow_merge_if_pipeline_succeeds` | boolean | no | Set whether merge requests can only be merged with successful jobs |
 | `only_allow_merge_if_all_discussions_are_resolved` | boolean | no | Set whether merge requests can only be merged when all the discussions are resolved |
 | `merge_method` | string | no | Set the merge method used |
@@ -763,7 +763,7 @@ PUT /projects/:id
 | `shared_runners_enabled` | boolean | no | Enable shared runners for this project |
 | `visibility` | string | no | See [project visibility level](#project-visibility-level) |
 | `import_url` | string | no | URL to import repository from |
-| `public_jobs` | boolean | no | If `true`, jobs can be viewed by non-project-members |
+| `public_builds` | boolean | no | If `true`, jobs can be viewed by non-project-members |
 | `only_allow_merge_if_pipeline_succeeds` | boolean | no | Set whether merge requests can only be merged with successful jobs |
 | `only_allow_merge_if_all_discussions_are_resolved` | boolean | no | Set whether merge requests can only be merged when all the discussions are resolved |
 | `merge_method` | string | no | Set the merge method used |

doc/development/i18n/proofreader.md

@@ -5,7 +5,14 @@ are very appreciative of the work done by translators and proofreaders!
 
 ## Proofreaders
 
+- Albanian
+  - Proofreaders needed.
+- Arabic
+  - Proofreaders needed.
 - Bulgarian
+  - Lyubomir Vasilev - [Crowdin](https://crowdin.com/profile/lyubomirv)
+- Catalan
+  - Proofreaders needed.
 - Chinese Simplified
   - Huang Tao - [GitLab](https://gitlab.com/htve), [Crowdin](https://crowdin.com/profile/htve)
 - Chinese Traditional
@@ -14,13 +21,31 @@ are very appreciative of the work done by translators and proofreaders!
   - Yi-Jyun Pan - [GitLab](https://gitlab.com/pan93412), [Crowdin](https://crowdin.com/profile/pan93412)
 - Chinese Traditional, Hong Kong
   - Huang Tao - [GitLab](https://gitlab.com/htve), [Crowdin](https://crowdin.com/profile/htve)
+- Czech
+  - Proofreaders needed.
+- Danish
+  - Proofreaders needed.
 - Dutch
   - Emily Hendle - [GitLab](https://gitlab.com/pundachan), [Crowdin](https://crowdin.com/profile/pandachan)
 - Esperanto
+- Lyubomir Vasilev - [Crowdin](https://crowdin.com/profile/lyubomirv)
+- Estonian
+  - Proofreaders needed.
+- Filipino
+  - Proofreaders needed.
 - French
   - Davy Defaud - [GitLab](https://gitlab.com/DevDef), [Crowdin](https://crowdin.com/profile/DevDef)
+- Galician
+  - Antón Méixome - [Crowdin](https://crowdin.com/profile/meixome)
+  - Pedro Garcia - [GitLab](https://gitlab.com/pedgarrod), [Crowdin](https://crowdin.com/profile/breaking_pitt)
 - German
   - Michael Hahnle - [GitLab](https://gitlab.com/mhah), [Crowdin](https://crowdin.com/profile/mhah)
+- Greek
+  - Proofreaders needed.
+- Hebrew
+  - Proofreaders needed.
+- Hungarian
+  - Proofreaders needed.
 - Indonesian
   - Ahmad Naufal Mukhtar - [GitLab](https://gitlab.com/anaufalm), [Crowdin](https://crowdin.com/profile/anaufalm)
 - Italian
@@ -32,19 +57,38 @@ are very appreciative of the work done by translators and proofreaders!
   - Chang-Ho Cha - [GitLab](https://gitlab.com/changho-cha), [Crowdin](https://crowdin.com/profile/zzazang)
   - Huang Tao - [GitLab](https://gitlab.com/htve), [Crowdin](https://crowdin.com/profile/htve)
   - Ji Hun Oh - [GitLab](https://gitlab.com/Baw-Appie), [Crowdin](https://crowdin.com/profile/BawAppie)
+- Mongolian
+  - Proofreaders needed.
+- Norwegian Bokmal
+  - Proofreaders needed.
 - Polish
   - Filip Mech - [GitLab](https://gitlab.com/mehenz), [Crowdin](https://crowdin.com/profile/mehenz)
+- Portuguese
+  - Proofreaders needed.
 - Portuguese, Brazilian
   - Paulo George Gomes Bezerra - [GitLab](https://gitlab.com/paulobezerra), [Crowdin](https://crowdin.com/profile/paulogomes.rep)
   - André Gama - [GitLab](https://gitlab.com/andregamma), [Crowdin](https://crowdin.com/profile/ToeOficial)
+- Romanian
+  - Proofreaders needed.
 - Russian
   - Nikita Grylov - [GitLab](https://gitlab.com/nixel2007), [Crowdin](https://crowdin.com/profile/nixel2007)
   - Alexy Lustin - [GitLab](https://gitlab.com/allustin), [Crowdin](https://crowdin.com/profile/lustin)
+  - NickVolynkin - [Crowdin](https://crowdin.com/profile/NickVolynkin)
+- Serbian (Cyrillic)
+  - Proofreaders needed.
+- Serbian (Latin)
+  - Proofreaders needed.
+- Slovak
+  - Proofreaders needed.
 - Spanish
   - Pedro Garcia - [GitLab](https://gitlab.com/pedgarrod), [Crowdin](https://crowdin.com/profile/breaking_pitt)
+- Turkish
+  - Proofreaders needed.
 - Ukrainian
   - Volodymyr Sobotovych - [GitLab](https://gitlab.com/wheleph), [Crowdin](https://crowdin.com/profile/wheleph)
   - Andrew Vityuk - [GitLab](https://gitlab.com/3_1_3_u), [Crowdin](https://crowdin.com/profile/andruwa13)
+- Welsh
+  - Proofreaders needed.
 
 ## Become a proofreader
 

doc/raketasks/backup_restore.md

@@ -92,11 +92,12 @@ If you are running GitLab within a Docker container, you can run the backup from
 docker exec -t <container name> gitlab-rake gitlab:backup:create
 ```
 
-If you are using the gitlab-omnibus helm chart on a Kubernetes cluster, you can
-run the backup task on the gitlab application pod using kubectl:
+If you are using the [GitLab helm chart](https://gitlab.com/charts/gitlab) on a
+Kubernetes cluster, you can run the backup task using `backup-utility` script on
+the gitlab task runner pod via `kubectl`. Refer to [backing up a GitLab installation](https://gitlab.com/charts/gitlab/blob/master/doc/backup-restore/backup.md#backing-up-a-gitlab-installation) for more details:
 
 ```sh
-kubectl exec -it <gitlab-gitlab pod> gitlab-rake gitlab:backup:create
+kubectl exec -it <gitlab task-runner pod> backup-utility
 ```
 
 Example output:
@@ -665,7 +666,7 @@ Restart GitLab:
 sudo service gitlab restart
 ```
 
-### Restore for Omnibus installations
+### Restore for Omnibus GitLab installations
 
 This procedure assumes that:
 
@@ -714,10 +715,10 @@ If there is a GitLab version mismatch between your backup tar file and the insta
 version of GitLab, the restore command will abort with an error. Install the
 [correct GitLab version](https://packages.gitlab.com/gitlab/) and try again.
 
-### Restore for Docker image and gitlab-omnibus helm chart
+### Restore for Docker image and GitLab helm chart installations
 
-For GitLab installations using docker image or the gitlab-omnibus helm chart on
-a Kubernetes cluster, restore task expects the restore directories to be empty.
+For GitLab installations using the Docker image or the GitLab helm chart on
+a Kubernetes cluster, the restore task expects the restore directories to be empty.
 However, with docker and Kubernetes volume mounts, some system level directories
 may be created at the volume roots, like `lost+found` directory found in Linux
 operating systems. These directories are usually owned by `root`, which can
@@ -728,19 +729,14 @@ directories are empty.
 For both these installation types, the backup tarball has to be available in the
 backup location (default location is `/var/opt/gitlab/backups`).
 
-For docker installations, the restore task can be run from host using the
-command
+For docker installations, the restore task can be run from host:
 
-```
+```sh
 docker exec -it <name of container> gitlab-rake gitlab:backup:restore
 ```
 
-Similarly, for gitlab-omnibus helm chart, the restore task can be run on the
-gitlab application pod using kubectl
-
-```
-kubectl exec -it <gitlab-gitlab pod> gitlab-rake gitlab:backup:restore
-```
+The GitLab helm chart uses a different process, documented in
+[restoring a GitLab helm chart installation](https://gitlab.com/charts/gitlab/blob/master/doc/backup-restore/restore.md).
 
 ## Alternative backup strategies
 

doc/user/admin_area/settings/visibility_and_access_controls.md

 # Visibility and access controls
 
+## Import sources
+
+Choose from which hosting sites the users can
+[import their projects](../../project/import/index.md).
+
+![import sources](img/import_sources.png)
+
 ## Enabled Git access protocols
 
 > [Introduced][ce-4696] in GitLab 8.10.

doc/user/project/clusters/index.md

@@ -226,6 +226,7 @@ twice, which can lead to confusion during deployments.
 | ----------- | :------------: | ----------- | --------------- |
 | [Helm Tiller](https://docs.helm.sh/) | 10.2+ | Helm is a package manager for Kubernetes and is required to install all the other applications. It is installed in its own pod inside the cluster which can run the `helm` CLI in a safe environment. | n/a |
 | [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) | 10.2+ | Ingress can provide load balancing, SSL termination, and name-based virtual hosting. It acts as a web proxy for your applications and is useful if you want to use [Auto DevOps] or deploy your own web apps. | [stable/nginx-ingress](https://github.com/helm/charts/tree/master/stable/nginx-ingress) |
+| [Cert Manager](http://docs.cert-manager.io/en/latest/) | 11.6+ | Cert Manager is a native Kubernetes certificate management controller that helps with issuing certificates. Installing Cert Manager on your cluster will issue a certificate by [Let's Encrypt](https://letsencrypt.org/) and ensure that certificates are valid and up to date. The email address used by Let's Encrypt registration will be taken from the GitLab user that installed Cert Manager on the cluster. | [stable/cert-manager](https://github.com/helm/charts/tree/master/stable/cert-manager) |
 | [Prometheus](https://prometheus.io/docs/introduction/overview/) | 10.4+ | Prometheus is an open-source monitoring and alerting system useful to supervise your deployed applications. | [stable/prometheus](https://github.com/helm/charts/tree/master/stable/prometheus) |
 | [GitLab Runner](https://docs.gitlab.com/runner/) | 10.6+ | GitLab Runner is the open source project that is used to run your jobs and send the results back to GitLab. It is used in conjunction with [GitLab CI/CD](https://about.gitlab.com/features/gitlab-ci-cd/), the open-source continuous integration service included with GitLab that coordinates the jobs. When installing the GitLab Runner via the applications, it will run in **privileged mode** by default. Make sure you read the [security implications](#security-implications) before doing so. | [runner/gitlab-runner](https://gitlab.com/charts/gitlab-runner) |
 | [JupyterHub](http://jupyter.org/) | 11.0+ | [JupyterHub](https://jupyterhub.readthedocs.io/en/stable/) is a multi-user service for managing notebooks across a team. [Jupyter Notebooks](https://jupyter-notebook.readthedocs.io/en/latest/) provide a web-based interactive programming environment used for data analysis, visualization, and machine learning. We use [this](https://gitlab.com/gitlab-org/jupyterhub-user-image/blob/master/Dockerfile) custom Jupyter image that installs additional useful packages on top of the base Jupyter. You will also see ready-to-use DevOps Runbooks built with Nurtch's [Rubix library](https://github.com/amit1rrr/rubix). More information on creating executable runbooks can be found at [Nurtch Documentation](http://docs.nurtch.com/en/latest).  **Note**: Authentication will be enabled for any user of the GitLab server via OAuth2. HTTPS will be supported in a future release. | [jupyter/jupyterhub](https://jupyterhub.github.io/helm-chart/) |

doc/user/project/merge_requests/revert_changes.md

@@ -12,6 +12,12 @@ The **Revert** button will only be available for merge requests
 created since GitLab 8.5. However, you can still revert a merge request
 by reverting the merge commit from the list of Commits page.
 
+NOTE: **Note:**
+The **Revert** button will only be shown for projects that use the
+merge method "Merge Commit", which can be set under the project's
+**Settings > General > Merge request**. [Fast-forward commits](fast_forward_merge.md)
+can not be reverted via the MR view.
+
 After the Merge Request has been merged, a **Revert** button will be available
 to revert the changes introduced by that merge request.
 

lib/api/helpers.rb

@@ -533,6 +533,7 @@ module API
     def send_git_blob(repository, blob)
       env['api.format'] = :txt
       content_type 'text/plain'
+      header['Content-Disposition'] = "attachment; filename=#{blob.name.inspect}"
       header(*Gitlab::Workhorse.send_git_blob(repository, blob))
     end
 

lib/api/snippets.rb

@@ -146,6 +146,7 @@ module API
 
         env['api.format'] = :txt
         content_type 'text/plain'
+        header['Content-Disposition'] = 'attachment'
         present snippet.content
       end
       # rubocop: enable CodeReuse/ActiveRecord

lib/gitlab/kubernetes/helm/install_command.rb

@@ -64,17 +64,17 @@ module Gitlab
           name_flag +
             optional_tls_flags +
             optional_version_flag +
-            optional_rbac_create_flag +
+            rbac_create_flag +
             namespace_flag +
             value_flag
         end
 
-        def optional_rbac_create_flag
-          return [] unless rbac?
-
-          # jupyterhub helm chart is using rbac.enabled
-          #   https://github.com/jupyterhub/zero-to-jupyterhub-k8s/tree/master/jupyterhub
+        def rbac_create_flag
+          if rbac?
             %w[--set rbac.create=true,rbac.enabled=true]
+          else
+            %w[--set rbac.create=false,rbac.enabled=false]
+          end
         end
 
         def optional_version_flag

lib/gitlab/usage_data.rb

@@ -62,6 +62,7 @@ module Gitlab
             clusters_platforms_user: count(::Clusters::Cluster.user_provided.enabled),
             clusters_applications_helm: count(::Clusters::Applications::Helm.installed),
             clusters_applications_ingress: count(::Clusters::Applications::Ingress.installed),
+            clusters_applications_cert_managers: count(::Clusters::Applications::CertManager.installed),
             clusters_applications_prometheus: count(::Clusters::Applications::Prometheus.installed),
             clusters_applications_runner: count(::Clusters::Applications::Runner.installed),
             clusters_applications_knative: count(::Clusters::Applications::Knative.installed),

locale/gitlab.pot

@@ -1744,6 +1744,9 @@ msgstr ""
 msgid "ClusterIntegration|CA Certificate"
 msgstr ""
 
+msgid "ClusterIntegration|Cert-Manager"
+msgstr ""
+
 msgid "ClusterIntegration|Certificate Authority bundle (PEM format)"
 msgstr ""
 
@@ -1915,6 +1918,9 @@ msgstr ""
 msgid "ClusterIntegration|Learn more about group Kubernetes clusters"
 msgstr ""
 
+msgid "ClusterIntegration|Let's Encrypt"
+msgstr ""
+
 msgid "ClusterIntegration|Machine type"
 msgstr ""
 
@@ -2077,6 +2083,9 @@ msgstr ""
 msgid "ClusterIntegration|access to Google Kubernetes Engine"
 msgstr ""
 
+msgid "ClusterIntegration|cert-manager is a native Kubernetes certificate management controller that helps with issuing certificates. Installing cert-manager on your cluster will issue a certificate by %{letsEncrypt} and ensure that certificates are valid and up to date."
+msgstr ""
+
 msgid "ClusterIntegration|check the pricing here"
 msgstr ""
 

spec/controllers/profiles/keys_controller_spec.rb

@@ -62,8 +62,15 @@ describe Profiles::KeysController do
 
       it "responds with text/plain content type" do
         get :get_keys, username: user.username
+
         expect(response.content_type).to eq("text/plain")
       end
+
+      it "responds with attachment content disposition" do
+        get :get_keys, username: user.username
+
+        expect(response.headers['Content-Disposition']).to eq('attachment')
+      end
     end
   end
 end

spec/factories/clusters/applications/helm.rb

@@ -49,6 +49,11 @@ FactoryBot.define do
       cluster factory: %i(cluster with_installed_helm provided_by_gcp)
     end
 
+    factory :clusters_applications_cert_managers, class: Clusters::Applications::CertManager do
+      email 'admin@example.com'
+      cluster factory: %i(cluster with_installed_helm provided_by_gcp)
+    end
+
     factory :clusters_applications_prometheus, class: Clusters::Applications::Prometheus do
       cluster factory: %i(cluster with_installed_helm provided_by_gcp)
     end

spec/finders/issues_finder_spec.rb

@@ -302,19 +302,51 @@ describe IssuesFinder do
           create(:label_link, label: label2, target: issue2)
         end
 
-        it 'returns the unique issues with any of those labels' do
+        it 'returns the unique issues with all those labels' do
+          expect(issues).to contain_exactly(issue2)
+        end
+      end
+
+      context 'filtering by a label that includes any or none in the title' do
+        let(:params) { { label_name: [label.title, label2.title].join(',') } }
+        let(:label) { create(:label, title: 'any foo', project: project2) }
+        let(:label2) { create(:label, title: 'bar none', project: project2) }
+
+        it 'returns the unique issues with all those labels' do
+          create(:label_link, label: label2, target: issue2)
+
           expect(issues).to contain_exactly(issue2)
         end
       end
 
       context 'filtering by no label' do
-        let(:params) { { label_name: Label::None.title } }
+        let(:params) { { label_name: described_class::FILTER_NONE } }
 
         it 'returns issues with no labels' do
           expect(issues).to contain_exactly(issue1, issue3, issue4)
         end
       end
 
+      context 'filtering by legacy No+Label' do
+        let(:params) { { label_name: Label::NONE } }
+
+        it 'returns issues with no labels' do
+          expect(issues).to contain_exactly(issue1, issue3, issue4)
+        end
+      end
+
+      context 'filtering by any label' do
+        let(:params) { { label_name: described_class::FILTER_ANY } }
+
+        it 'returns issues that have one or more label' do
+          2.times do
+            create(:label_link, label: create(:label, project: project2), target: issue3)
+          end
+
+          expect(issues).to contain_exactly(issue2, issue3)
+        end
+      end
+
       context 'filtering by issue term' do
         let(:params) { { search: 'git' } }
 

spec/javascripts/clusters/components/applications_spec.js

@@ -20,6 +20,7 @@ describe('Applications', () => {
         applications: {
           helm: { title: 'Helm Tiller' },
           ingress: { title: 'Ingress' },
+          cert_manager: { title: 'Cert-Manager' },
           runner: { title: 'GitLab Runner' },
           prometheus: { title: 'Prometheus' },
           jupyter: { title: 'JupyterHub' },
@@ -36,6 +37,10 @@ describe('Applications', () => {
       expect(vm.$el.querySelector('.js-cluster-application-row-ingress')).toBeDefined();
     });
 
+    it('renders a row for Cert-Manager', () => {
+      expect(vm.$el.querySelector('.js-cluster-application-row-cert_manager')).toBeDefined();
+    });
+
     it('renders a row for Prometheus', () => {
       expect(vm.$el.querySelector('.js-cluster-application-row-prometheus')).toBeDefined();
     });
@@ -65,6 +70,7 @@ describe('Applications', () => {
                 externalIp: '0.0.0.0',
               },
               helm: { title: 'Helm Tiller' },
+              cert_manager: { title: 'Cert-Manager' },
               runner: { title: 'GitLab Runner' },
               prometheus: { title: 'Prometheus' },
               jupyter: { title: 'JupyterHub', hostname: '' },
@@ -89,6 +95,7 @@ describe('Applications', () => {
                 status: 'installed',
               },
               helm: { title: 'Helm Tiller' },
+              cert_manager: { title: 'Cert-Manager' },
               runner: { title: 'GitLab Runner' },
               prometheus: { title: 'Prometheus' },
               jupyter: { title: 'JupyterHub', hostname: '' },
@@ -109,6 +116,7 @@ describe('Applications', () => {
           applications: {
             helm: { title: 'Helm Tiller' },
             ingress: { title: 'Ingress' },
+            cert_manager: { title: 'Cert-Manager' },
             runner: { title: 'GitLab Runner' },
             prometheus: { title: 'Prometheus' },
             jupyter: { title: 'JupyterHub', hostname: '' },
@@ -128,6 +136,7 @@ describe('Applications', () => {
             applications: {
               helm: { title: 'Helm Tiller', status: 'installed' },
               ingress: { title: 'Ingress', status: 'installed', externalIp: '1.1.1.1' },
+              cert_manager: { title: 'Cert-Manager' },
               runner: { title: 'GitLab Runner' },
               prometheus: { title: 'Prometheus' },
               jupyter: { title: 'JupyterHub', hostname: '', status: 'installable' },
@@ -145,6 +154,7 @@ describe('Applications', () => {
             applications: {
               helm: { title: 'Helm Tiller', status: 'installed' },
               ingress: { title: 'Ingress', status: 'installed' },
+              cert_manager: { title: 'Cert-Manager' },
               runner: { title: 'GitLab Runner' },
               prometheus: { title: 'Prometheus' },
               jupyter: { title: 'JupyterHub', hostname: '', status: 'installable' },
@@ -162,6 +172,7 @@ describe('Applications', () => {
             applications: {
               helm: { title: 'Helm Tiller', status: 'installed' },
               ingress: { title: 'Ingress', status: 'installed', externalIp: '1.1.1.1' },
+              cert_manager: { title: 'Cert-Manager' },
               runner: { title: 'GitLab Runner' },
               prometheus: { title: 'Prometheus' },
               jupyter: { title: 'JupyterHub', status: 'installed', hostname: '' },
@@ -179,6 +190,7 @@ describe('Applications', () => {
             applications: {
               helm: { title: 'Helm Tiller' },
               ingress: { title: 'Ingress' },
+              cert_manager: { title: 'Cert-Manager' },
               runner: { title: 'GitLab Runner' },
               prometheus: { title: 'Prometheus' },
               jupyter: { title: 'JupyterHub', status: 'not_installable' },

spec/javascripts/clusters/services/mock_data.js

@@ -38,6 +38,11 @@ const CLUSTERS_MOCK_DATA = {
             status: APPLICATION_STATUS.INSTALLING,
             status_reason: 'Cannot connect',
           },
+          {
+            name: 'cert_manager',
+            status: APPLICATION_STATUS.ERROR,
+            status_reason: 'Cannot connect',
+          },
         ],
       },
     },
@@ -77,6 +82,11 @@ const CLUSTERS_MOCK_DATA = {
             status: APPLICATION_STATUS.INSTALLABLE,
             status_reason: 'Cannot connect',
           },
+          {
+            name: 'cert_manager',
+            status: APPLICATION_STATUS.ERROR,
+            status_reason: 'Cannot connect',
+          },
         ],
       },
     },
@@ -84,6 +94,7 @@ const CLUSTERS_MOCK_DATA = {
   POST: {
     '/gitlab-org/gitlab-shell/clusters/1/applications/helm': {},
     '/gitlab-org/gitlab-shell/clusters/1/applications/ingress': {},
+    '/gitlab-org/gitlab-shell/clusters/1/applications/cert_manager': {},
     '/gitlab-org/gitlab-shell/clusters/1/applications/runner': {},
     '/gitlab-org/gitlab-shell/clusters/1/applications/prometheus': {},
     '/gitlab-org/gitlab-shell/clusters/1/applications/jupyter': {},

spec/javascripts/clusters/stores/clusters_store_spec.js

@@ -108,6 +108,13 @@ describe('Clusters Store', () => {
             requestReason: null,
             hostname: null,
           },
+          cert_manager: {
+            title: 'Cert-Manager',
+            status: mockResponseData.applications[6].status,
+            statusReason: mockResponseData.applications[6].status_reason,
+            requestStatus: null,
+            requestReason: null,
+          },
         },
       });
     });

spec/lib/gitlab/kubernetes/helm/install_command_spec.rb

@@ -43,6 +43,7 @@ describe Gitlab::Kubernetes::Helm::InstallCommand do
         --tls-cert /data/helm/app-name/config/cert.pem
         --tls-key /data/helm/app-name/config/key.pem
         --version 1.2.3
+        --set rbac.create\\=false,rbac.enabled\\=false
         --namespace gitlab-managed-apps
         -f /data/helm/app-name/config/values.yaml
       EOS
@@ -101,6 +102,7 @@ describe Gitlab::Kubernetes::Helm::InstallCommand do
           --tls-cert /data/helm/app-name/config/cert.pem
           --tls-key /data/helm/app-name/config/key.pem
           --version 1.2.3
+          --set rbac.create\\=false,rbac.enabled\\=false
           --namespace gitlab-managed-apps
           -f /data/helm/app-name/config/values.yaml
         EOS
@@ -126,7 +128,7 @@ describe Gitlab::Kubernetes::Helm::InstallCommand do
         <<~EOS.strip
         /bin/date
         /bin/true
-        helm install chart-name --name app-name --tls --tls-ca-cert /data/helm/app-name/config/ca.pem --tls-cert /data/helm/app-name/config/cert.pem --tls-key /data/helm/app-name/config/key.pem --version 1.2.3 --namespace gitlab-managed-apps -f /data/helm/app-name/config/values.yaml
+        helm install chart-name --name app-name --tls --tls-ca-cert /data/helm/app-name/config/ca.pem --tls-cert /data/helm/app-name/config/cert.pem --tls-key /data/helm/app-name/config/key.pem --version 1.2.3 --set rbac.create\\=false,rbac.enabled\\=false --namespace gitlab-managed-apps -f /data/helm/app-name/config/values.yaml
         EOS
       end
     end
@@ -148,7 +150,7 @@ describe Gitlab::Kubernetes::Helm::InstallCommand do
 
       let(:helm_install_command) do
         <<~EOS.strip
-        helm install chart-name --name app-name --tls --tls-ca-cert /data/helm/app-name/config/ca.pem --tls-cert /data/helm/app-name/config/cert.pem --tls-key /data/helm/app-name/config/key.pem --version 1.2.3 --namespace gitlab-managed-apps -f /data/helm/app-name/config/values.yaml
+        helm install chart-name --name app-name --tls --tls-ca-cert /data/helm/app-name/config/ca.pem --tls-cert /data/helm/app-name/config/cert.pem --tls-key /data/helm/app-name/config/key.pem --version 1.2.3 --set rbac.create\\=false,rbac.enabled\\=false --namespace gitlab-managed-apps -f /data/helm/app-name/config/values.yaml
         /bin/date
         /bin/false
         EOS
@@ -175,6 +177,7 @@ describe Gitlab::Kubernetes::Helm::InstallCommand do
         helm install chart-name
            --name app-name
            --version 1.2.3
+           --set rbac.create\\=false,rbac.enabled\\=false
            --namespace gitlab-managed-apps
            -f /data/helm/app-name/config/values.yaml
         EOS
@@ -204,6 +207,7 @@ describe Gitlab::Kubernetes::Helm::InstallCommand do
           --tls-ca-cert /data/helm/app-name/config/ca.pem
           --tls-cert /data/helm/app-name/config/cert.pem
           --tls-key /data/helm/app-name/config/key.pem
+          --set rbac.create\\=false,rbac.enabled\\=false
           --namespace gitlab-managed-apps
           -f /data/helm/app-name/config/values.yaml
         EOS

spec/lib/gitlab/usage_data_spec.rb

@@ -20,6 +20,7 @@ describe Gitlab::UsageData do
       create(:cluster, :provided_by_user, :disabled)
       create(:clusters_applications_helm, :installed, cluster: gcp_cluster)
       create(:clusters_applications_ingress, :installed, cluster: gcp_cluster)
+      create(:clusters_applications_cert_managers, :installed, cluster: gcp_cluster)
       create(:clusters_applications_prometheus, :installed, cluster: gcp_cluster)
       create(:clusters_applications_runner, :installed, cluster: gcp_cluster)
       create(:clusters_applications_knative, :installed, cluster: gcp_cluster)
@@ -82,6 +83,7 @@ describe Gitlab::UsageData do
         clusters_platforms_user
         clusters_applications_helm
         clusters_applications_ingress
+        clusters_applications_cert_managers
         clusters_applications_prometheus
         clusters_applications_runner
         clusters_applications_knative
@@ -132,6 +134,7 @@ describe Gitlab::UsageData do
       expect(count_data[:clusters_platforms_user]).to eq(1)
       expect(count_data[:clusters_applications_helm]).to eq(1)
       expect(count_data[:clusters_applications_ingress]).to eq(1)
+      expect(count_data[:clusters_applications_cert_managers]).to eq(1)
       expect(count_data[:clusters_applications_prometheus]).to eq(1)
       expect(count_data[:clusters_applications_runner]).to eq(1)
       expect(count_data[:clusters_applications_knative]).to eq(1)

spec/models/clusters/applications/cert_manager_spec.rb

+require 'rails_helper'
+
+describe Clusters::Applications::CertManager do
+  let(:cert_manager) { create(:clusters_applications_cert_managers) }
+
+  include_examples 'cluster application core specs', :clusters_applications_cert_managers
+
+  describe '#make_installing!' do
+    before do
+      application.make_installing!
+    end
+
+    context 'application install previously errored with older version' do
+      let(:application) { create(:clusters_applications_cert_managers, :scheduled, version: 'v0.4.0') }
+
+      it 'updates the application version' do
+        expect(application.reload.version).to eq('v0.5.0')
+      end
+    end
+  end
+
+  describe '#install_command' do
+    let(:cluster_issuer_file) { { "cluster_issuer.yaml": "---\napiVersion: certmanager.k8s.io/v1alpha1\nkind: ClusterIssuer\nmetadata:\n  name: letsencrypt-prod\nspec:\n  acme:\n    server: https://acme-v02.api.letsencrypt.org/directory\n    email: admin@example.com\n    privateKeySecretRef:\n      name: letsencrypt-prod\n    http01: {}\n" } }
+    subject { cert_manager.install_command }
+
+    it { is_expected.to be_an_instance_of(Gitlab::Kubernetes::Helm::InstallCommand) }
+
+    it 'should be initialized with cert_manager arguments' do
+      expect(subject.name).to eq('certmanager')
+      expect(subject.chart).to eq('stable/cert-manager')
+      expect(subject.version).to eq('v0.5.0')
+      expect(subject).not_to be_rbac
+      expect(subject.files).to eq(cert_manager.files.merge(cluster_issuer_file))
+      expect(subject.postinstall).to eq(['/usr/bin/kubectl create -f /data/helm/certmanager/config/cluster_issuer.yaml'])
+    end
+
+    context 'for a specific user' do
+      before do
+        cert_manager.email = 'abc@xyz.com'
+        cluster_issuer_file[:'cluster_issuer.yaml'].gsub! 'admin@example.com', 'abc@xyz.com'
+      end
+
+      it 'should use his/her email to register issuer with certificate provider' do
+        expect(subject.files).to eq(cert_manager.files.merge(cluster_issuer_file))
+      end
+    end
+
+    context 'on a rbac enabled cluster' do
+      before do
+        cert_manager.cluster.platform_kubernetes.rbac!
+      end
+
+      it { is_expected.to be_rbac }
+    end
+
+    context 'application failed to install previously' do
+      let(:cert_manager) { create(:clusters_applications_cert_managers, :errored, version: '0.0.1') }
+
+      it 'should be initialized with the locked version' do
+        expect(subject.version).to eq('v0.5.0')
+      end
+    end
+  end
+
+  describe '#files' do
+    let(:application) { cert_manager }
+    let(:values) { subject[:'values.yaml'] }
+
+    subject { application.files }
+
+    it 'should include cert_manager specific keys in the values.yaml file' do
+      expect(values).to include('ingressShim')
+    end
+  end
+
+  describe 'validations' do
+    it { is_expected.to validate_presence_of(:email) }
+  end
+end

spec/models/clusters/cluster_spec.rb

@@ -311,13 +311,14 @@ describe Clusters::Cluster do
     context 'when applications are created' do
       let!(:helm) { create(:clusters_applications_helm, cluster: cluster) }
       let!(:ingress) { create(:clusters_applications_ingress, cluster: cluster) }
+      let!(:cert_manager) { create(:clusters_applications_cert_managers, cluster: cluster) }
       let!(:prometheus) { create(:clusters_applications_prometheus, cluster: cluster) }
       let!(:runner) { create(:clusters_applications_runner, cluster: cluster) }
       let!(:jupyter) { create(:clusters_applications_jupyter, cluster: cluster) }
       let!(:knative) { create(:clusters_applications_knative, cluster: cluster) }
 
       it 'returns a list of created applications' do
-        is_expected.to contain_exactly(helm, ingress, prometheus, runner, jupyter, knative)
+        is_expected.to contain_exactly(helm, ingress, cert_manager, prometheus, runner, jupyter, knative)
       end
     end
   end

spec/requests/api/files_spec.rb

@@ -178,6 +178,14 @@ describe API::Files do
         expect(response).to have_gitlab_http_status(200)
       end
 
+      it 'forces attachment content disposition' do
+        url = route(file_path) + "/raw"
+
+        get api(url, current_user), params
+
+        expect(headers['Content-Disposition']).to match(/^attachment/)
+      end
+
       context 'when mandatory params are not given' do
         it_behaves_like '400 response' do
           let(:request) { get api(route("any%2Ffile"), current_user) }

spec/requests/api/repositories_spec.rb

@@ -168,6 +168,12 @@ describe API::Repositories do
         expect(response).to have_gitlab_http_status(200)
       end
 
+      it 'forces attachment content disposition' do
+        get api(route, current_user)
+
+        expect(headers['Content-Disposition']).to match(/^attachment/)
+      end
+
       context 'when sha does not exist' do
         it_behaves_like '404 response' do
           let(:request) { get api(route.sub(sample_blob.oid, '123456'), current_user) }

spec/requests/api/snippets_spec.rb

@@ -94,6 +94,12 @@ describe API::Snippets do
       expect(response.body).to eq(snippet.content)
     end
 
+    it 'forces attachment content disposition' do
+      get api("/snippets/#{snippet.id}/raw", user)
+
+      expect(headers['Content-Disposition']).to match(/^attachment/)
+    end
+
     it 'returns 404 for invalid snippet id' do
       get api("/snippets/1234/raw", user)
 

spec/support/shared_examples/requests/api/merge_requests_list.rb

@@ -186,6 +186,23 @@ shared_examples 'merge requests list' do
       expect(json_response.length).to eq(0)
     end
 
+    it 'returns an array of merge requests with any label when filtering by any label' do
+      get api(endpoint_path, user), labels: IssuesFinder::FILTER_ANY
+
+      expect_paginated_array_response
+      expect(json_response.length).to eq(1)
+      expect(json_response.first['id']).to eq(merge_request.id)
+    end
+
+    it 'returns an array of merge requests without a label when filtering by no label' do
+      get api(endpoint_path, user), labels: IssuesFinder::FILTER_NONE
+
+      response_ids = json_response.map { |merge_request| merge_request['id'] }
+
+      expect_paginated_array_response
+      expect(response_ids).to contain_exactly(merge_request_closed.id, merge_request_merged.id, merge_request_locked.id)
+    end
+
     it 'returns an array of labeled merge requests that are merged for a milestone' do
       bug_label = create(:label, title: 'bug', color: '#FFAABB', project: project)
 

vendor/cert_manager/cluster_issuer.yaml

+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: my-email@example.com
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    http01: {}

vendor/cert_manager/values.yaml

+# These options provide fully automated TLS.
+# See https://github.com/jetstack/cert-manager/blob/master/docs/reference/ingress-shim.rst#configuration
+ingressShim:
+  defaultIssuerKind: "ClusterIssuer"
+  defaultIssuerName: "letsencrypt-prod"