Merge remote-tracking branch 'upstream/master' into ce-to-ee-2018-12-04

# Conflicts:
#	lib/gitlab/checks/base_checker.rb
#	lib/gitlab/checks/change_access.rb
#	lib/gitlab/checks/diff_check.rb

[ci skip]

app/models/clusters/platforms/kubernetes.rb

@@ -85,7 +85,7 @@ module Clusters
 
           if kubernetes_namespace = cluster.kubernetes_namespaces.has_service_account_token.find_by(project: project)
             variables.concat(kubernetes_namespace.predefined_variables)
-          else
+          elsif cluster.project_type?
             # From 11.5, every Clusters::Project should have at least one
             # Clusters::KubernetesNamespace, so once migration has been completed,
             # this 'else' branch will be removed. For more information, please see

changelogs/unreleased/legacy_fallback_for_project_clusters_only.yml

+---
+title: Fallback to admin KUBE_TOKEN for project clusters only
+merge_request: 23527
+author:
+type: other

lib/gitlab/checks/base_checker.rb

@@ -3,7 +3,10 @@
 module Gitlab
   module Checks
     class BaseChecker
+<<<<<<< HEAD
       prepend EE::Gitlab::Checks::BaseChecker
+=======
+>>>>>>> upstream/master
       include Gitlab::Utils::StrongMemoize
 
       attr_reader :change_access

lib/gitlab/checks/change_access.rb

@@ -3,12 +3,19 @@
 module Gitlab
   module Checks
     class ChangeAccess
+<<<<<<< HEAD
       prepend EE::Gitlab::Checks::ChangeAccess
 
       ATTRIBUTES = %i[user_access project skip_authorization
                       skip_lfs_integrity_check protocol oldrev newrev ref
                       branch_name tag_name logger commits].freeze
 
+=======
+      ATTRIBUTES = %i[user_access project skip_authorization
+                      skip_lfs_integrity_check protocol oldrev newrev ref
+                      branch_name tag_name logger commits].freeze
+
+>>>>>>> upstream/master
       attr_reader(*ATTRIBUTES)
 
       def initialize(

lib/gitlab/checks/diff_check.rb

@@ -4,7 +4,10 @@ module Gitlab
   module Checks
     class DiffCheck < BaseChecker
       include Gitlab::Utils::StrongMemoize
+<<<<<<< HEAD
       prepend EE::Gitlab::Checks::DiffCheck
+=======
+>>>>>>> upstream/master
 
       LOG_MESSAGES = {
         validate_file_paths: "Validating diffs' file paths...",

spec/factories/clusters/kubernetes_namespaces.rb

@@ -5,10 +5,12 @@ FactoryBot.define do
     association :cluster, :project, :provided_by_gcp
 
     after(:build) do |kubernetes_namespace|
-      cluster_project = kubernetes_namespace.cluster.cluster_project
+      if kubernetes_namespace.cluster.project_type?
+        cluster_project = kubernetes_namespace.cluster.cluster_project
 
-      kubernetes_namespace.project = cluster_project.project
-      kubernetes_namespace.cluster_project = cluster_project
+        kubernetes_namespace.project = cluster_project.project
+        kubernetes_namespace.cluster_project = cluster_project
+      end
     end
 
     trait :with_token do

spec/models/clusters/platforms/kubernetes_spec.rb

@@ -273,6 +273,36 @@ describe Clusters::Platforms::Kubernetes, :use_clean_rails_memory_store_caching
         )
       end
     end
+
+    context 'group level cluster' do
+      let!(:cluster) { create(:cluster, :group, platform_kubernetes: kubernetes) }
+
+      let(:project) { create(:project, group: cluster.group) }
+
+      subject { kubernetes.predefined_variables(project: project) }
+
+      context 'no kubernetes namespace for the project' do
+        it_behaves_like 'setting variables'
+
+        it 'does not return KUBE_TOKEN' do
+          expect(subject).not_to include(
+            { key: 'KUBE_TOKEN', value: kubernetes.token, public: false }
+          )
+        end
+      end
+
+      context 'kubernetes namespace exists for the project' do
+        let!(:kubernetes_namespace) { create(:cluster_kubernetes_namespace, :with_token, cluster: cluster, project: project) }
+
+        it_behaves_like 'setting variables'
+
+        it 'sets KUBE_TOKEN' do
+          expect(subject).to include(
+            { key: 'KUBE_TOKEN', value: kubernetes_namespace.service_account_token, public: false }
+          )
+        end
+      end
+    end
   end
 
   describe '#terminals' do