Run Auto DevOps jobs when KUBECONFIG is present

ee/spec/lib/gitlab/ci/templates/Jobs/browser_performance_testing_gitlab_ci_yaml_spec.rb

@@ -19,12 +19,13 @@ RSpec.describe 'Jobs/Browser-Performance-Testing.gitlab-ci.yml' do
   end
 
   describe 'the created pipeline' do
-    let_it_be(:project) do
+    let_it_be(:project_with_ci_kubernetes_active) do
       create(:project, :repository, variables: [
         build(:ci_variable, key: 'CI_KUBERNETES_ACTIVE', value: 'true')
       ])
     end
 
+    let(:project) { project_with_ci_kubernetes_active }
     let(:user) { project.owner }
     let(:default_branch) { 'master' }
     let(:pipeline_ref) { default_branch }
@@ -46,6 +47,18 @@ RSpec.describe 'Jobs/Browser-Performance-Testing.gitlab-ci.yml' do
       expect(pipeline.errors).to be_empty
     end
 
+    context 'when variable is KUBECONFIG and not CI_KUBERNETES_ACTIVE' do
+      let_it_be(:project_with_kubeconfig) do
+        create(:project, :repository, variables: [
+          build(:ci_variable, key: 'KUBECONFIG', value: 'true')
+        ])
+      end
+
+      it 'is present' do
+        expect(build_names).to include('browser_performance')
+      end
+    end
+
     shared_examples_for 'browser_performance job on tag or branch' do
       it 'by default' do
         expect(build_names).to include('browser_performance')

ee/spec/lib/gitlab/ci/templates/Jobs/dast_default_branch_gitlab_ci_yaml_spec.rb

@@ -22,12 +22,13 @@ RSpec.describe 'Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml' do
   end
 
   describe 'the created pipeline' do
-    let_it_be_with_refind(:project) do
+    let_it_be_with_refind(:project_with_ci_kubernetes_active) do
       create(:project, :repository, variables: [
         build(:ci_variable, key: 'CI_KUBERNETES_ACTIVE', value: 'true')
       ])
     end
 
+    let(:project) { project_with_ci_kubernetes_active }
     let(:user) { project.owner }
     let(:default_branch) { 'master' }
     let(:pipeline_ref) { default_branch }
@@ -61,12 +62,9 @@ RSpec.describe 'Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml' do
       end
 
       context 'default branch' do
-        it 'includes the DAST environment jobs by default' do
+        it 'includes the DAST environment jobs by default', :aggregate_failures do
           expect(build_names).to include('dast_environment_deploy')
           expect(build_names).to include('stop_dast_environment')
-        end
-
-        it 'always runs the cleanup job' do
           expect(pipeline.builds.find_by(name: 'stop_dast_environment').when).to eq('always')
         end
 
@@ -76,6 +74,20 @@ RSpec.describe 'Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml' do
           expect(build_names).not_to include('dast_environment_deploy')
           expect(build_names).not_to include('stop_dast_environment')
         end
+
+        context 'when KUBECONFIG and not CI_KUBERNETES_ACTIVE' do
+          let(:project) do
+            create(:project, :repository, variables: [
+              build(:ci_variable, key: 'KUBECONFIG', value: 'true')
+            ])
+          end
+
+          it 'includes the DAST environment jobs', :aggregate_failures do
+            expect(build_names).to include('dast_environment_deploy')
+            expect(build_names).to include('stop_dast_environment')
+            expect(pipeline.builds.find_by(name: 'stop_dast_environment').when).to eq('always')
+          end
+        end
       end
 
       context 'on another branch' do

ee/spec/lib/gitlab/ci/templates/dast_gitlab_ci_yaml_spec.rb

@@ -54,34 +54,17 @@ RSpec.describe 'DAST.gitlab-ci.yml' do
 
       context 'when project has Ultimate license' do
         let(:license) { build(:license, plan: License::ULTIMATE_PLAN) }
-        let(:cluster) { create(:cluster, :project, :provided_by_gcp, projects: [project]) }
 
         before do
           allow(License).to receive(:current).and_return(license)
         end
 
-        context 'by default' do
-          before do
-            allow(cluster).to receive(:active?).and_return(true)
-          end
-
-          it 'includes job' do
-            expect(build_names).to match_array(%w[dast])
-          end
-        end
-
-        context 'when cluster is not active' do
-          context 'by default' do
-            it 'includes dast job' do
-              expect(build_names).to match_array(%w[dast])
-            end
-          end
+        it 'includes job' do
+          expect(build_names).to match_array(%w[dast])
         end
 
         context 'when DAST_DISABLED=1' do
           before do
-            allow(cluster).to receive(:active?).and_return(true)
-
             create(:ci_variable, project: project, key: 'DAST_DISABLED', value: '1')
           end
 
@@ -92,8 +75,6 @@ RSpec.describe 'DAST.gitlab-ci.yml' do
 
         context 'when DAST_DISABLED_FOR_DEFAULT_BRANCH=1' do
           before do
-            allow(cluster).to receive(:active?).and_return(true)
-
             create(:ci_variable, project: project, key: 'DAST_DISABLED_FOR_DEFAULT_BRANCH', value: '1')
           end
 
@@ -118,8 +99,6 @@ RSpec.describe 'DAST.gitlab-ci.yml' do
 
         context 'when REVIEW_DISABLED=true' do
           before do
-            allow(cluster).to receive(:active?).and_return(true)
-
             create(:ci_variable, project: project, key: 'REVIEW_DISABLED', value: 'true')
           end
 

ee/spec/lib/gitlab/ci/templates/dast_latest_gitlab_ci_yaml_spec.rb

@@ -63,13 +63,11 @@ RSpec.describe 'DAST.latest.gitlab-ci.yml' do
       end
 
       context 'when project has cluster' do
-        let(:cluster) { create(:cluster, :project, :provided_by_gcp, projects: [project]) }
+        before do
+          create(:cluster, :project, :provided_by_gcp, projects: [project])
+        end
 
         context 'by default' do
-          before do
-            allow(cluster).to receive(:active?).and_return(true)
-          end
-
           include_examples 'includes no jobs'
         end
 
@@ -78,7 +76,6 @@ RSpec.describe 'DAST.latest.gitlab-ci.yml' do
 
           before do
             allow(License).to receive(:current).and_return(license)
-            allow(cluster).to receive(:active?).and_return(true)
           end
 
           context 'when no specification provided' do
@@ -87,91 +84,85 @@ RSpec.describe 'DAST.latest.gitlab-ci.yml' do
         end
       end
 
-      context 'when cluster is not active' do
-        context 'by default' do
-          include_examples 'includes no jobs'
+      context 'by default' do
+        include_examples 'includes no jobs'
+      end
+
+      context 'when DAST_WEBSITE is present' do
+        before do
+          create(:ci_variable, project: project, key: 'DAST_WEBSITE', value: 'http://example.com')
         end
 
-        context 'when DAST_WEBSITE is present' do
-          before do
-            create(:ci_variable, project: project, key: 'DAST_WEBSITE', value: 'http://example.com')
-          end
+        include_examples 'includes dast job'
+      end
 
-          include_examples 'includes dast job'
+      context 'when DAST_API_SPECIFICATION is present' do
+        before do
+          create(:ci_variable, project: project, key: 'DAST_API_SPECIFICATION', value: 'http://my.api/api-specification.yml')
         end
 
-        context 'when DAST_API_SPECIFICATION is present' do
-          before do
-            create(:ci_variable, project: project, key: 'DAST_API_SPECIFICATION', value: 'http://my.api/api-specification.yml')
-          end
+        include_examples 'includes dast job'
+      end
 
-          include_examples 'includes dast job'
-        end
+      context 'when project has Ultimate license' do
+        let(:license) { build(:license, plan: License::ULTIMATE_PLAN) }
 
-        context 'when project has Ultimate license' do
-          let(:license) { build(:license, plan: License::ULTIMATE_PLAN) }
+        before do
+          allow(License).to receive(:current).and_return(license)
+        end
 
+        context 'when project has cluster' do
           before do
-            allow(License).to receive(:current).and_return(license)
+            create(:cluster, :project, :provided_by_gcp, projects: [project])
           end
 
-          context 'when project has cluster' do
-            let(:cluster) { create(:cluster, :project, :provided_by_gcp, projects: [project]) }
+          context 'when DAST_DISABLED=1' do
+            before do
+              create(:ci_variable, project: project, key: 'DAST_DISABLED', value: '1')
+            end
 
-            context 'when DAST_DISABLED=1' do
-              before do
-                allow(cluster).to receive(:active?).and_return(true)
+            include_examples 'includes no jobs'
+          end
 
-                create(:ci_variable, project: project, key: 'DAST_DISABLED', value: '1')
-              end
+          context 'when DAST_DISABLED_FOR_DEFAULT_BRANCH=1' do
+            before do
+              create(:ci_variable, project: project, key: 'DAST_DISABLED_FOR_DEFAULT_BRANCH', value: '1')
+            end
 
+            context 'when on default branch' do
               include_examples 'includes no jobs'
             end
 
-            context 'when DAST_DISABLED_FOR_DEFAULT_BRANCH=1' do
-              before do
-                allow(cluster).to receive(:active?).and_return(true)
+            context 'when on feature branch' do
+              let(:pipeline_branch) { 'patch-1' }
 
-                create(:ci_variable, project: project, key: 'DAST_DISABLED_FOR_DEFAULT_BRANCH', value: '1')
+              before do
+                project.repository.create_branch(pipeline_branch, default_branch)
               end
 
-              context 'when on default branch' do
-                include_examples 'includes no jobs'
+              it 'includes dast job' do
+                expect(build_names).to match_array(%w[dast])
               end
+            end
+          end
 
-              context 'when on feature branch' do
-                let(:pipeline_branch) { 'patch-1' }
-
-                before do
-                  project.repository.create_branch(pipeline_branch, default_branch)
-                end
-
-                it 'includes dast job' do
-                  expect(build_names).to match_array(%w[dast])
-                end
-              end
+          context 'when REVIEW_DISABLED=true' do
+            before do
+              create(:ci_variable, project: project, key: 'REVIEW_DISABLED', value: 'true')
             end
 
-            context 'when REVIEW_DISABLED=true' do
-              before do
-                allow(cluster).to receive(:active?).and_return(true)
+            context 'when on default branch' do
+              include_examples 'includes dast job'
+            end
 
-                create(:ci_variable, project: project, key: 'REVIEW_DISABLED', value: 'true')
-              end
+            context 'when on feature branch' do
+              let(:pipeline_branch) { 'patch-1' }
 
-              context 'when on default branch' do
-                include_examples 'includes dast job'
+              before do
+                project.repository.create_branch(pipeline_branch, default_branch)
               end
 
-              context 'when on feature branch' do
-                let(:pipeline_branch) { 'patch-1' }
-
-                before do
-                  project.repository.create_branch(pipeline_branch, default_branch)
-                end
-
-                include_examples 'includes no jobs'
-              end
+              include_examples 'includes no jobs'
             end
           end
         end

lib/gitlab/ci/templates/Jobs/Browser-Performance-Testing.gitlab-ci.yml

@@ -70,7 +70,7 @@ browser_performance:
     reports:
       browser_performance: browser-performance.json
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$BROWSER_PERFORMANCE_DISABLED'
       when: never

lib/gitlab/ci/templates/Jobs/Browser-Performance-Testing.latest.gitlab-ci.yml

@@ -70,7 +70,7 @@ browser_performance:
     reports:
       browser_performance: browser-performance.json
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$BROWSER_PERFORMANCE_DISABLED'
       when: never

lib/gitlab/ci/templates/Jobs/CF-Provision.gitlab-ci.yml

@@ -9,6 +9,6 @@ cloud_formation:
   rules:
     - if: '($AUTO_DEVOPS_PLATFORM_TARGET != "EC2") || ($AUTO_DEVOPS_PLATFORM_TARGET != "ECS")'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'

lib/gitlab/ci/templates/Jobs/DAST-Default-Branch-Deploy.gitlab-ci.yml

@@ -29,7 +29,7 @@ dast_environment_deploy:
     - if: $DAST_WEBSITE  # we don't need to create a review app if a URL is already given
       when: never
     - if: $CI_COMMIT_BRANCH &&
-          $CI_KUBERNETES_ACTIVE &&
+          ($CI_KUBERNETES_ACTIVE || $KUBECONFIG) &&
           $GITLAB_FEATURES =~ /\bdast\b/
 
 stop_dast_environment:
@@ -52,6 +52,6 @@ stop_dast_environment:
     - if: $DAST_WEBSITE  # we don't need to create a review app if a URL is already given
       when: never
     - if: $CI_COMMIT_BRANCH &&
-          $CI_KUBERNETES_ACTIVE &&
+          ($CI_KUBERNETES_ACTIVE || $KUBECONFIG) &&
           $GITLAB_FEATURES =~ /\bdast\b/
       when: always

lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml

@@ -24,7 +24,7 @@ review:
     paths: [environment_url.txt, tiller.log]
     when: always
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: never
@@ -45,7 +45,7 @@ stop_review:
     action: stop
   allow_failure: true
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: never
@@ -74,7 +74,7 @@ staging:
     name: staging
     url: http://$CI_PROJECT_PATH_SLUG-staging.$KUBE_INGRESS_BASE_DOMAIN
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -101,7 +101,7 @@ canary:
   rules:
     - if: '$CI_DEPLOY_FREEZE != null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -132,7 +132,7 @@ production:
   rules:
     - if: '$CI_DEPLOY_FREEZE != null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$STAGING_ENABLED'
       when: never
@@ -150,7 +150,7 @@ production_manual:
   rules:
     - if: '$CI_DEPLOY_FREEZE != null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$INCREMENTAL_ROLLOUT_ENABLED'
       when: never
@@ -188,7 +188,7 @@ production_manual:
   rules:
     - if: '$CI_DEPLOY_FREEZE != null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$INCREMENTAL_ROLLOUT_MODE == "timed"'
       when: never
@@ -203,7 +203,7 @@ production_manual:
   rules:
     - if: '$CI_DEPLOY_FREEZE != null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$INCREMENTAL_ROLLOUT_MODE == "manual"'
       when: never

lib/gitlab/ci/templates/Jobs/Deploy.latest.gitlab-ci.yml

@@ -21,7 +21,7 @@ review:
     paths: [environment_url.txt, tiller.log]
     when: always
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: never
@@ -42,7 +42,7 @@ stop_review:
     action: stop
   allow_failure: true
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: never
@@ -71,7 +71,7 @@ staging:
     name: staging
     url: http://$CI_PROJECT_PATH_SLUG-staging.$KUBE_INGRESS_BASE_DOMAIN
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -96,7 +96,7 @@ canary:
     name: production
     url: http://$CI_PROJECT_PATH_SLUG.$KUBE_INGRESS_BASE_DOMAIN
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -125,7 +125,7 @@ canary:
 production:
   <<: *production_template
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$STAGING_ENABLED'
       when: never
@@ -141,7 +141,7 @@ production_manual:
   <<: *production_template
   allow_failure: false
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$INCREMENTAL_ROLLOUT_ENABLED'
       when: never
@@ -177,7 +177,7 @@ production_manual:
   resource_group: production
   allow_failure: true
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$INCREMENTAL_ROLLOUT_MODE == "timed"'
       when: never
@@ -190,7 +190,7 @@ production_manual:
 .timed_rollout_template: &timed_rollout_template
   <<: *rollout_template
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$INCREMENTAL_ROLLOUT_MODE == "manual"'
       when: never

lib/gitlab/ci/templates/Jobs/Deploy/EC2.gitlab-ci.yml

@@ -16,7 +16,7 @@ review_ec2:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "EC2"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$REVIEW_DISABLED'
       when: never
@@ -32,7 +32,7 @@ production_ec2:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "EC2"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never

lib/gitlab/ci/templates/Jobs/Deploy/ECS.gitlab-ci.yml

@@ -42,7 +42,7 @@ review_ecs:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "ECS"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$REVIEW_DISABLED'
       when: never
@@ -58,7 +58,7 @@ stop_review_ecs:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "ECS"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$REVIEW_DISABLED'
       when: never
@@ -77,7 +77,7 @@ review_fargate:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "FARGATE"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$REVIEW_DISABLED'
       when: never
@@ -93,7 +93,7 @@ stop_review_fargate:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "FARGATE"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$REVIEW_DISABLED'
       when: never
@@ -107,7 +107,7 @@ production_ecs:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "ECS"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -118,7 +118,7 @@ production_fargate:
   rules:
     - if: '$AUTO_DEVOPS_PLATFORM_TARGET != "FARGATE"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE'
+    - if: '$CI_KUBERNETES_ACTIVE || $KUBECONFIG'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never

lib/gitlab/ci/templates/Jobs/Helm-2to3.gitlab-ci.yml

@@ -72,7 +72,7 @@
   rules:
     - if: '$MIGRATE_HELM_2TO3 != "true"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: never
@@ -89,7 +89,7 @@ review:helm-2to3:cleanup:
   rules:
     - if: '$MIGRATE_HELM_2TO3 != "true" && $CLEANUP_HELM_2TO3 == null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: never
@@ -104,7 +104,7 @@ review:helm-2to3:cleanup:
   rules:
     - if: '$MIGRATE_HELM_2TO3 != "true"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -119,7 +119,7 @@ staging:helm-2to3:cleanup:
   rules:
     - if: '$MIGRATE_HELM_2TO3 != "true" && $CLEANUP_HELM_2TO3 == null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
@@ -132,7 +132,7 @@ staging:helm-2to3:cleanup:
   rules:
     - if: '$MIGRATE_HELM_2TO3 != "true"'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: manual
@@ -145,7 +145,7 @@ production:helm-2to3:cleanup:
   rules:
     - if: '$MIGRATE_HELM_2TO3 != "true" && $CLEANUP_HELM_2TO3 == null'
       when: never
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
       when: manual

lib/gitlab/ci/templates/Jobs/Load-Performance-Testing.gitlab-ci.yml

@@ -23,7 +23,7 @@ load_performance:
     reports:
       load_performance: load-performance.json
   rules:
-    - if: '$CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == ""'
+    - if: '($CI_KUBERNETES_ACTIVE == null || $CI_KUBERNETES_ACTIVE == "") && ($KUBECONFIG == null || $KUBECONFIG == "")'
       when: never
     - if: '$LOAD_PERFORMANCE_DISABLED'
       when: never

lib/gitlab/ci/templates/Security/DAST.gitlab-ci.yml

@@ -51,7 +51,7 @@ dast:
           $REVIEW_DISABLED
       when: never
     - if: $CI_COMMIT_BRANCH &&
-          $CI_KUBERNETES_ACTIVE &&
+          ($CI_KUBERNETES_ACTIVE || $KUBECONFIG) &&
           $GITLAB_FEATURES =~ /\bdast\b/
     - if: $CI_COMMIT_BRANCH &&
           $GITLAB_FEATURES =~ /\bdast\b/

lib/gitlab/ci/templates/Security/DAST.latest.gitlab-ci.yml

@@ -52,7 +52,7 @@ dast:
           $DAST_API_SPECIFICATION == null
       when: never
     - if: $CI_COMMIT_BRANCH &&
-          $CI_KUBERNETES_ACTIVE &&
+          ($CI_KUBERNETES_ACTIVE || $KUBECONFIG) &&
           $GITLAB_FEATURES =~ /\bdast\b/
     - if: $CI_COMMIT_BRANCH &&
           $DAST_WEBSITE

spec/lib/gitlab/ci/templates/Jobs/deploy_gitlab_ci_yaml_spec.rb

@@ -27,9 +27,9 @@ RSpec.describe 'Jobs/Deploy.gitlab-ci.yml' do
   end
 
   describe 'the created pipeline' do
-    let(:project) { create(:project, :repository) }
-    let(:user) { project.owner }
+    let_it_be(:project, refind: true) { create(:project, :repository) }
 
+    let(:user) { project.owner }
     let(:default_branch) { 'master' }
     let(:pipeline_ref) { default_branch }
     let(:service) { Ci::CreatePipelineService.new(project, user, ref: pipeline_ref) }
@@ -43,23 +43,23 @@ RSpec.describe 'Jobs/Deploy.gitlab-ci.yml' do
       allow(project).to receive(:default_branch).and_return(default_branch)
     end
 
-    context 'with no cluster' do
+    context 'with no cluster or agent' do
       it 'does not create any kubernetes deployment jobs' do
         expect(build_names).to eq %w(placeholder)
       end
     end
 
     context 'with only a disabled cluster' do
-      let!(:cluster) { create(:cluster, :project, :provided_by_gcp, enabled: false, projects: [project]) }
+      before do
+        create(:cluster, :project, :provided_by_gcp, enabled: false, projects: [project])
+      end
 
       it 'does not create any kubernetes deployment jobs' do
         expect(build_names).to eq %w(placeholder)
       end
     end
 
-    context 'with an active cluster' do
-      let!(:cluster) { create(:cluster, :project, :provided_by_gcp, projects: [project]) }
-
+    shared_examples_for 'pipeline with deployment jobs' do
       context 'on master' do
         it 'by default' do
           expect(build_names).to include('production')
@@ -218,5 +218,21 @@ RSpec.describe 'Jobs/Deploy.gitlab-ci.yml' do
         end
       end
     end
+
+    context 'with an agent' do
+      before do
+        create(:cluster_agent, project: project)
+      end
+
+      it_behaves_like 'pipeline with deployment jobs'
+    end
+
+    context 'with a cluster' do
+      before do
+        create(:cluster, :project, :provided_by_gcp, projects: [project])
+      end
+
+      it_behaves_like 'pipeline with deployment jobs'
+    end
   end
 end

spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb

@@ -148,9 +148,7 @@ RSpec.describe 'Auto-DevOps.gitlab-ci.yml' do
         it_behaves_like 'no Kubernetes deployment job'
       end
 
-      context 'when the project has an active cluster' do
-        let!(:cluster) { create(:cluster, :project, :provided_by_gcp, projects: [project]) }
-
+      shared_examples 'pipeline with Kubernetes jobs' do
         describe 'deployment-related builds' do
           context 'on default branch' do
             it 'does not include rollout jobs besides production' do
@@ -233,6 +231,22 @@ RSpec.describe 'Auto-DevOps.gitlab-ci.yml' do
           end
         end
       end
+
+      context 'when a cluster is attached' do
+        before do
+          create(:cluster, :project, :provided_by_gcp, projects: [project])
+        end
+
+        it_behaves_like 'pipeline with Kubernetes jobs'
+      end
+
+      context 'when project has an Agent is present' do
+        before do
+          create(:cluster_agent, project: project)
+        end
+
+        it_behaves_like 'pipeline with Kubernetes jobs'
+      end
     end
 
     describe 'buildpack detection' do