Extend clusters_controller for group type clusters

- Add pages javascripts to intialize clusters for group pages

- Move specs asserting gcp specific validations from controller into
UpdateService spec

- Also teach Clusters::ApplicationController about groups

19 files changed, 913 insertions, 97 deletions

diff --git a/app/assets/javascripts/pages/groups/clusters/destroy/index.js b/app/assets/javascripts/pages/groups/clusters/destroy/index.js
new file mode 100644
index 00000000000..8001d2dd1da
--- /dev/null
+++ b/app/assets/javascripts/pages/groups/clusters/destroy/index.js
@@ -0,0 +1,5 @@
+import ClustersBundle from '~/clusters/clusters_bundle';
+
+document.addEventListener('DOMContentLoaded', () => {
+  new ClustersBundle(); // eslint-disable-line no-new
+});
diff --git a/app/assets/javascripts/pages/groups/clusters/index/index.js b/app/assets/javascripts/pages/groups/clusters/index/index.js
new file mode 100644
index 00000000000..e4b8baede58
--- /dev/null
+++ b/app/assets/javascripts/pages/groups/clusters/index/index.js
@@ -0,0 +1,5 @@
+import ClustersIndex from '~/clusters/clusters_index';
+
+document.addEventListener('DOMContentLoaded', () => {
+  new ClustersIndex(); // eslint-disable-line no-new
+});
diff --git a/app/assets/javascripts/pages/groups/clusters/show/index.js b/app/assets/javascripts/pages/groups/clusters/show/index.js
new file mode 100644
index 00000000000..8001d2dd1da
--- /dev/null
+++ b/app/assets/javascripts/pages/groups/clusters/show/index.js
@@ -0,0 +1,5 @@
+import ClustersBundle from '~/clusters/clusters_bundle';
+
+document.addEventListener('DOMContentLoaded', () => {
+  new ClustersBundle(); // eslint-disable-line no-new
+});
diff --git a/app/assets/javascripts/pages/groups/clusters/update/index.js b/app/assets/javascripts/pages/groups/clusters/update/index.js
new file mode 100644
index 00000000000..8001d2dd1da
--- /dev/null
+++ b/app/assets/javascripts/pages/groups/clusters/update/index.js
@@ -0,0 +1,5 @@
+import ClustersBundle from '~/clusters/clusters_bundle';
+
+document.addEventListener('DOMContentLoaded', () => {
+  new ClustersBundle(); // eslint-disable-line no-new
+});
diff --git a/app/assets/javascripts/pages/groups/index.js b/app/assets/javascripts/pages/groups/index.js
new file mode 100644
index 00000000000..bf80d8b8193
--- /dev/null
+++ b/app/assets/javascripts/pages/groups/index.js
@@ -0,0 +1,16 @@
+import initDismissableCallout from '~/dismissable_callout';
+import initGkeDropdowns from '~/projects/gke_cluster_dropdowns';
+
+document.addEventListener('DOMContentLoaded', () => {
+  const { page } = document.body.dataset;
+  const newClusterViews = [
+    'groups:clusters:new',
+    'groups:clusters:create_gcp',
+    'groups:clusters:create_user',
+  ];
+
+  if (newClusterViews.indexOf(page) > -1) {
+    initDismissableCallout('.gcp-signup-offer');
+    initGkeDropdowns();
+  }
+});
diff --git a/app/controllers/groups/clusters/applications_controller.rb b/app/controllers/groups/clusters/applications_controller.rb
new file mode 100644
index 00000000000..8dd8a01cf40
--- /dev/null
+++ b/app/controllers/groups/clusters/applications_controller.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class Groups::Clusters::ApplicationsController < Clusters::ApplicationsController
+  include ControllerWithCrossProjectAccessCheck
+
+  prepend_before_action :group
+  requires_cross_project_access
+
+  private
+
+  def clusterable
+    @clusterable ||= ClusterablePresenter.fabricate(group, current_user: current_user)
+  end
+
+  def group
+    @group ||= find_routable!(Group, params[:group_id] || params[:id])
+  end
+end
diff --git a/app/controllers/groups/clusters_controller.rb b/app/controllers/groups/clusters_controller.rb
new file mode 100644
index 00000000000..92602fd8096
--- /dev/null
+++ b/app/controllers/groups/clusters_controller.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class Groups::ClustersController < Clusters::ClustersController
+  include ControllerWithCrossProjectAccessCheck
+
+  prepend_before_action :group
+  requires_cross_project_access
+
+  layout 'group'
+
+  private
+
+  def clusterable
+    @clusterable ||= ClusterablePresenter.fabricate(group, current_user: current_user)
+  end
+
+  def group
+    @group ||= find_routable!(Group, params[:group_id] || params[:id])
+  end
+end
diff --git a/app/helpers/clusters_helper.rb b/app/helpers/clusters_helper.rb
index 916dcb1a308..df97b1ca53b 100644
--- a/app/helpers/clusters_helper.rb
+++ b/app/helpers/clusters_helper.rb
@@ -6,6 +6,14 @@ module ClustersHelper
     false
   end
 
+  def clusterable
+    @project || @group
+  end
+
+  def can_create_cluster?
+    can?(current_user, :create_cluster, clusterable)
+  end
+
   def render_gcp_signup_offer
     return if Gitlab::CurrentSettings.current_application_settings.hide_third_party_offers?
     return unless show_gcp_signup_offer?
diff --git a/app/presenters/clusters/cluster_presenter.rb b/app/presenters/clusters/cluster_presenter.rb
index 78d632eb77c..7e6eccb648c 100644
--- a/app/presenters/clusters/cluster_presenter.rb
+++ b/app/presenters/clusters/cluster_presenter.rb
@@ -15,6 +15,8 @@ module Clusters
     def show_path
       if cluster.project_type?
         project_cluster_path(project, cluster)
+      elsif cluster.group_type?
+        group_cluster_path(group, cluster)
       else
         raise NotImplementedError
       end
diff --git a/app/presenters/group_clusterable_presenter.rb b/app/presenters/group_clusterable_presenter.rb
new file mode 100644
index 00000000000..22d3ba9db35
--- /dev/null
+++ b/app/presenters/group_clusterable_presenter.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class GroupClusterablePresenter < ClusterablePresenter
+  def cluster_status_cluster_path(cluster, params = {})
+    cluster_status_group_cluster_path(clusterable, cluster, params)
+  end
+
+  def install_applications_cluster_path(cluster, application)
+    install_applications_group_cluster_path(clusterable, cluster, application)
+  end
+
+  def cluster_path(cluster, params = {})
+    group_cluster_path(clusterable, cluster, params)
+  end
+end
diff --git a/app/services/clusters/create_service.rb b/app/services/clusters/create_service.rb
index 270db4a52fd..1d45df329c0 100644
--- a/app/services/clusters/create_service.rb
+++ b/app/services/clusters/create_service.rb
@@ -36,6 +36,8 @@ module Clusters
       case clusterable
       when ::Project
         { cluster_type: :project_type, projects: [clusterable] }
+      when ::Group
+        { cluster_type: :group_type, groups: [clusterable] }
       end
     end
 
diff --git a/changelogs/unreleased/34758-group-cluster-controller.yml b/changelogs/unreleased/34758-group-cluster-controller.yml
new file mode 100644
index 00000000000..88c4c872714
--- /dev/null
+++ b/changelogs/unreleased/34758-group-cluster-controller.yml
@@ -0,0 +1,5 @@
+---
+title: Add ability to create group level clusters and install gitlab managed applications
+merge_request: 22450
+author:
+type: added
diff --git a/config/routes/group.rb b/config/routes/group.rb
index 2328b50b760..a0aeebe4b91 100644
--- a/config/routes/group.rb
+++ b/config/routes/group.rb
@@ -53,6 +53,8 @@ constraints(::Constraints::GroupUrlConstrainer.new) do
 
     resource :avatar, only: [:destroy]
 
+    concerns :clusterable
+
     resources :group_members, only: [:index, :create, :update, :destroy], concerns: :access_requestable do
       post :resend_invite, on: :member
       delete :leave, on: :collection
diff --git a/spec/controllers/groups/clusters/applications_controller_spec.rb b/spec/controllers/groups/clusters/applications_controller_spec.rb
new file mode 100644
index 00000000000..68a798542b6
--- /dev/null
+++ b/spec/controllers/groups/clusters/applications_controller_spec.rb
@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Groups::Clusters::ApplicationsController do
+  include AccessMatchersForController
+
+  def current_application
+    Clusters::Cluster::APPLICATIONS[application]
+  end
+
+  describe 'POST create' do
+    let(:cluster) { create(:cluster, :group, :provided_by_gcp) }
+    let(:group) { cluster.group }
+    let(:application) { 'helm' }
+    let(:params) { { application: application, id: cluster.id } }
+
+    describe 'functionality' do
+      let(:user) { create(:user) }
+
+      before do
+        group.add_maintainer(user)
+        sign_in(user)
+      end
+
+      it 'schedule an application installation' do
+        expect(ClusterInstallAppWorker).to receive(:perform_async).with(application, anything).once
+
+        expect { go }.to change { current_application.count }
+        expect(response).to have_http_status(:no_content)
+        expect(cluster.application_helm).to be_scheduled
+      end
+
+      context 'when cluster do not exists' do
+        before do
+          cluster.destroy!
+        end
+
+        it 'return 404' do
+          expect { go }.not_to change { current_application.count }
+          expect(response).to have_http_status(:not_found)
+        end
+      end
+
+      context 'when application is unknown' do
+        let(:application) { 'unkwnown-app' }
+
+        it 'return 404' do
+          go
+
+          expect(response).to have_http_status(:not_found)
+        end
+      end
+
+      context 'when application is already installing' do
+        before do
+          create(:clusters_applications_helm, :installing, cluster: cluster)
+        end
+
+        it 'returns 400' do
+          go
+
+          expect(response).to have_http_status(:bad_request)
+        end
+      end
+    end
+
+    describe 'security' do
+      before do
+        allow(ClusterInstallAppWorker).to receive(:perform_async)
+      end
+
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+
+    def go
+      post :create, params.merge(group_id: group)
+    end
+  end
+end
diff --git a/spec/controllers/groups/clusters_controller_spec.rb b/spec/controllers/groups/clusters_controller_spec.rb
new file mode 100644
index 00000000000..05dc30c8fdf
--- /dev/null
+++ b/spec/controllers/groups/clusters_controller_spec.rb
@@ -0,0 +1,556 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Groups::ClustersController do
+  include AccessMatchersForController
+  include GoogleApi::CloudPlatformHelpers
+
+  set(:group) { create(:group) }
+
+  let(:user) { create(:user) }
+
+  before do
+    group.add_maintainer(user)
+    sign_in(user)
+  end
+
+  describe 'GET index' do
+    def go(params = {})
+      get :index, params.reverse_merge(group_id: group)
+    end
+
+    describe 'functionality' do
+      context 'when group has one or more clusters' do
+        let(:group) { create(:group) }
+        let!(:enabled_cluster) { create(:cluster, :provided_by_gcp, cluster_type: :group_type, groups: [group]) }
+        let!(:disabled_cluster) { create(:cluster, :disabled, :provided_by_gcp, :production_environment, cluster_type: :group_type, groups: [group]) }
+        it 'lists available clusters' do
+          go
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to render_template(:index)
+          expect(assigns(:clusters)).to match_array([enabled_cluster, disabled_cluster])
+        end
+
+        context 'when page is specified' do
+          let(:last_page) { group.clusters.page.total_pages }
+
+          before do
+            allow(Clusters::Cluster).to receive(:paginates_per).and_return(1)
+            create_list(:cluster, 2, :provided_by_gcp, :production_environment, cluster_type: :group_type, groups: [group])
+          end
+
+          it 'redirects to the page' do
+            go(page: last_page)
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(assigns(:clusters).current_page).to eq(last_page)
+          end
+        end
+      end
+
+      context 'when group does not have a cluster' do
+        let(:group) { create(:group) }
+
+        it 'returns an empty state page' do
+          go
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to render_template(:index, partial: :empty_state)
+          expect(assigns(:clusters)).to eq([])
+        end
+      end
+    end
+
+    describe 'security' do
+      let(:cluster) { create(:cluster, :provided_by_gcp, cluster_type: :group_type, groups: [group]) }
+
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'GET new' do
+    def go
+      get :new, group_id: group
+    end
+
+    describe 'functionality for new cluster' do
+      context 'when omniauth has been configured' do
+        let(:key) { 'secret-key' }
+        let(:session_key_for_redirect_uri) do
+          GoogleApi::CloudPlatform::Client.session_key_for_redirect_uri(key)
+        end
+
+        before do
+          allow(SecureRandom).to receive(:hex).and_return(key)
+        end
+
+        it 'has authorize_url' do
+          go
+
+          expect(assigns(:authorize_url)).to include(key)
+          expect(session[session_key_for_redirect_uri]).to eq(new_group_cluster_path(group))
+        end
+      end
+
+      context 'when omniauth has not configured' do
+        before do
+          stub_omniauth_setting(providers: [])
+        end
+
+        it 'does not have authorize_url' do
+          go
+
+          expect(assigns(:authorize_url)).to be_nil
+        end
+      end
+
+      context 'when access token is valid' do
+        before do
+          stub_google_api_validate_token
+        end
+
+        it 'has new object' do
+          go
+
+          expect(assigns(:gcp_cluster)).to be_an_instance_of(Clusters::Cluster)
+        end
+      end
+
+      context 'when access token is expired' do
+        before do
+          stub_google_api_expired_token
+        end
+
+        it { expect(@valid_gcp_token).to be_falsey }
+      end
+
+      context 'when access token is not stored in session' do
+        it { expect(@valid_gcp_token).to be_falsey }
+      end
+    end
+
+    describe 'functionality for existing cluster' do
+      it 'has new object' do
+        go
+
+        expect(assigns(:user_cluster)).to be_an_instance_of(Clusters::Cluster)
+      end
+    end
+
+    describe 'security' do
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'POST create for new cluster' do
+    let(:legacy_abac_param) { 'true' }
+    let(:params) do
+      {
+        cluster: {
+          name: 'new-cluster',
+          provider_gcp_attributes: {
+            gcp_project_id: 'gcp-project-12345',
+            legacy_abac: legacy_abac_param
+          }
+        }
+      }
+    end
+
+    def go
+      post :create_gcp, params.merge(group_id: group)
+    end
+
+    describe 'functionality' do
+      context 'when access token is valid' do
+        before do
+          stub_google_api_validate_token
+        end
+
+        it 'creates a new cluster' do
+          expect(ClusterProvisionWorker).to receive(:perform_async)
+          expect { go }.to change { Clusters::Cluster.count }
+            .and change { Clusters::Providers::Gcp.count }
+          expect(response).to redirect_to(group_cluster_path(group, group.clusters.first))
+          expect(group.clusters.first).to be_gcp
+          expect(group.clusters.first).to be_kubernetes
+          expect(group.clusters.first.provider_gcp).to be_legacy_abac
+        end
+
+        context 'when legacy_abac param is false' do
+          let(:legacy_abac_param) { 'false' }
+
+          it 'creates a new cluster with legacy_abac_disabled' do
+            expect(ClusterProvisionWorker).to receive(:perform_async)
+            expect { go }.to change { Clusters::Cluster.count }
+              .and change { Clusters::Providers::Gcp.count }
+            expect(group.clusters.first.provider_gcp).not_to be_legacy_abac
+          end
+        end
+      end
+
+      context 'when access token is expired' do
+        before do
+          stub_google_api_expired_token
+        end
+
+        it { expect(@valid_gcp_token).to be_falsey }
+      end
+
+      context 'when access token is not stored in session' do
+        it { expect(@valid_gcp_token).to be_falsey }
+      end
+    end
+
+    describe 'security' do
+      before do
+        allow_any_instance_of(described_class)
+          .to receive(:token_in_session).and_return('token')
+        allow_any_instance_of(described_class)
+          .to receive(:expires_at_in_session).and_return(1.hour.since.to_i.to_s)
+        allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+          .to receive(:projects_zones_clusters_create) do
+          OpenStruct.new(
+            self_link: 'projects/gcp-project-12345/zones/us-central1-a/operations/ope-123',
+            status: 'RUNNING'
+          )
+        end
+
+        allow(WaitForClusterCreationWorker).to receive(:perform_in).and_return(nil)
+      end
+
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'POST create for existing cluster' do
+    let(:params) do
+      {
+        cluster: {
+          name: 'new-cluster',
+          platform_kubernetes_attributes: {
+            api_url: 'http://my-url',
+            token: 'test',
+            namespace: 'aaa'
+          }
+        }
+      }
+    end
+
+    def go
+      post :create_user, params.merge(group_id: group)
+    end
+
+    describe 'functionality' do
+      context 'when creates a cluster' do
+        it 'creates a new cluster' do
+          expect(ClusterProvisionWorker).to receive(:perform_async)
+
+          expect { go }.to change { Clusters::Cluster.count }
+            .and change { Clusters::Platforms::Kubernetes.count }
+
+          expect(response).to redirect_to(group_cluster_path(group, group.clusters.first))
+
+          expect(group.clusters.first).to be_user
+          expect(group.clusters.first).to be_kubernetes
+        end
+      end
+
+      context 'when creates a RBAC-enabled cluster' do
+        let(:params) do
+          {
+            cluster: {
+              name: 'new-cluster',
+              platform_kubernetes_attributes: {
+                api_url: 'http://my-url',
+                token: 'test',
+                namespace: 'aaa',
+                authorization_type: 'rbac'
+              }
+            }
+          }
+        end
+
+        it 'creates a new cluster' do
+          expect(ClusterProvisionWorker).to receive(:perform_async)
+
+          expect { go }.to change { Clusters::Cluster.count }
+            .and change { Clusters::Platforms::Kubernetes.count }
+
+          expect(response).to redirect_to(group_cluster_path(group, group.clusters.first))
+
+          expect(group.clusters.first).to be_user
+          expect(group.clusters.first).to be_kubernetes
+          expect(group.clusters.first).to be_platform_kubernetes_rbac
+        end
+      end
+    end
+
+    describe 'security' do
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'GET cluster_status' do
+    let(:cluster) { create(:cluster, :providing_by_gcp, cluster_type: :group_type, groups: [group]) }
+
+    def go
+      get :cluster_status,
+        group_id: group.to_param,
+        id: cluster,
+        format: :json
+    end
+
+    describe 'functionality' do
+      it "responds with matching schema" do
+        go
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response).to match_response_schema('cluster_status')
+      end
+
+      it 'invokes schedule_status_update on each application' do
+        expect_any_instance_of(Clusters::Applications::Ingress).to receive(:schedule_status_update)
+
+        go
+      end
+    end
+
+    describe 'security' do
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'GET show' do
+    let(:cluster) { create(:cluster, :provided_by_gcp, cluster_type: :group_type, groups: [group]) }
+
+    def go
+      get :show,
+        group_id: group,
+        id: cluster
+    end
+
+    describe 'functionality' do
+      it "renders view" do
+        go
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(assigns(:cluster)).to eq(cluster)
+      end
+    end
+
+    describe 'security' do
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'PUT update' do
+    def go(format: :html)
+      put :update, params.merge(
+        group_id: group.to_param,
+        id: cluster,
+        format: format
+      )
+    end
+
+    let(:cluster) { create(:cluster, :provided_by_user, cluster_type: :group_type, groups: [group]) }
+
+    let(:params) do
+      {
+        cluster: {
+          enabled: false,
+          name: 'my-new-cluster-name',
+          platform_kubernetes_attributes: {
+            namespace: 'my-namespace'
+          }
+        }
+      }
+    end
+
+    it "updates and redirects back to show page" do
+      go
+
+      cluster.reload
+      expect(response).to redirect_to(group_cluster_path(group, cluster))
+      expect(flash[:notice]).to eq('Kubernetes cluster was successfully updated.')
+      expect(cluster.enabled).to be_falsey
+      expect(cluster.name).to eq('my-new-cluster-name')
+      expect(cluster.platform_kubernetes.namespace).to eq('my-namespace')
+    end
+
+    context 'when format is json' do
+      context 'when changing parameters' do
+        context 'when valid parameters are used' do
+          let(:params) do
+            {
+              cluster: {
+                enabled: false,
+                name: 'my-new-cluster-name',
+                platform_kubernetes_attributes: {
+                  namespace: 'my-namespace'
+                }
+              }
+            }
+          end
+
+          it "updates and redirects back to show page" do
+            go(format: :json)
+
+            cluster.reload
+            expect(response).to have_http_status(:no_content)
+            expect(cluster.enabled).to be_falsey
+            expect(cluster.name).to eq('my-new-cluster-name')
+            expect(cluster.platform_kubernetes.namespace).to eq('my-namespace')
+          end
+        end
+
+        context 'when invalid parameters are used' do
+          let(:params) do
+            {
+              cluster: {
+                enabled: false,
+                platform_kubernetes_attributes: {
+                  namespace: 'my invalid namespace #@'
+                }
+              }
+            }
+          end
+
+          it "rejects changes" do
+            go(format: :json)
+
+            expect(response).to have_http_status(:bad_request)
+          end
+        end
+      end
+    end
+
+    describe 'security' do
+      set(:cluster) { create(:cluster, :provided_by_gcp, cluster_type: :group_type, groups: [group]) }
+
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  describe 'DELETE destroy' do
+    let!(:cluster) { create(:cluster, :provided_by_gcp, :production_environment, cluster_type: :group_type, groups: [group]) }
+
+    def go
+      delete :destroy,
+        group_id: group,
+        id: cluster
+    end
+
+    describe 'functionality' do
+      context 'when cluster is provided by GCP' do
+        context 'when cluster is created' do
+          it "destroys and redirects back to clusters list" do
+            expect { go }
+              .to change { Clusters::Cluster.count }.by(-1)
+              .and change { Clusters::Platforms::Kubernetes.count }.by(-1)
+              .and change { Clusters::Providers::Gcp.count }.by(-1)
+
+            expect(response).to redirect_to(group_clusters_path(group))
+            expect(flash[:notice]).to eq('Kubernetes cluster integration was successfully removed.')
+          end
+        end
+
+        context 'when cluster is being created' do
+          let!(:cluster) { create(:cluster, :providing_by_gcp, :production_environment, cluster_type: :group_type, groups: [group]) }
+
+          it "destroys and redirects back to clusters list" do
+            expect { go }
+              .to change { Clusters::Cluster.count }.by(-1)
+              .and change { Clusters::Providers::Gcp.count }.by(-1)
+
+            expect(response).to redirect_to(group_clusters_path(group))
+            expect(flash[:notice]).to eq('Kubernetes cluster integration was successfully removed.')
+          end
+        end
+      end
+
+      context 'when cluster is provided by user' do
+        let!(:cluster) { create(:cluster, :provided_by_user, :production_environment, cluster_type: :group_type, groups: [group]) }
+
+        it "destroys and redirects back to clusters list" do
+          expect { go }
+            .to change { Clusters::Cluster.count }.by(-1)
+            .and change { Clusters::Platforms::Kubernetes.count }.by(-1)
+            .and change { Clusters::Providers::Gcp.count }.by(0)
+
+          expect(response).to redirect_to(group_clusters_path(group))
+          expect(flash[:notice]).to eq('Kubernetes cluster integration was successfully removed.')
+        end
+      end
+    end
+
+    describe 'security' do
+      set(:cluster) { create(:cluster, :provided_by_gcp, :production_environment, cluster_type: :group_type, groups: [group]) }
+
+      it { expect { go }.to be_allowed_for(:admin) }
+      it { expect { go }.to be_allowed_for(:owner).of(group) }
+      it { expect { go }.to be_allowed_for(:maintainer).of(group) }
+      it { expect { go }.to be_denied_for(:developer).of(group) }
+      it { expect { go }.to be_denied_for(:reporter).of(group) }
+      it { expect { go }.to be_denied_for(:guest).of(group) }
+      it { expect { go }.to be_denied_for(:user) }
+      it { expect { go }.to be_denied_for(:external) }
+    end
+  end
+
+  context 'no group_id param' do
+    it 'does not respond to any action without group_id param' do
+      expect { get :index }.to raise_error(ActionController::UrlGenerationError)
+    end
+  end
+end
diff --git a/spec/controllers/projects/clusters_controller_spec.rb b/spec/controllers/projects/clusters_controller_spec.rb
index 04aece26590..e7bb4035e55 100644
--- a/spec/controllers/projects/clusters_controller_spec.rb
+++ b/spec/controllers/projects/clusters_controller_spec.rb
@@ -396,20 +396,6 @@ describe Projects::ClustersController do
   end
 
   describe 'PUT update' do
-    let(:cluster) { create(:cluster, :provided_by_gcp, projects: [project]) }
-
-    let(:params) do
-      {
-        cluster: {
-          enabled: false,
-          name: 'my-new-cluster-name',
-          platform_kubernetes_attributes: {
-            namespace: 'my-namespace'
-          }
-        }
-      }
-    end
-
     def go(format: :html)
       put :update, params.merge(namespace_id: project.namespace.to_param,
                                 project_id: project.to_param,
@@ -423,105 +409,73 @@ describe Projects::ClustersController do
       stub_kubeclient_get_namespace('https://kubernetes.example.com', namespace: 'my-namespace')
     end
 
-    context 'when cluster is provided by GCP' do
-      it "updates and redirects back to show page" do
-        go
-
-        cluster.reload
-        expect(response).to redirect_to(project_cluster_path(project, cluster))
-        expect(flash[:notice]).to eq('Kubernetes cluster was successfully updated.')
-        expect(cluster.enabled).to be_falsey
-      end
-
-      it "does not change cluster name" do
-        go
-
-        cluster.reload
-        expect(cluster.name).to eq('test-cluster')
-      end
-
-      context 'when cluster is being created' do
-        let(:cluster) { create(:cluster, :providing_by_gcp, projects: [project]) }
+    let(:cluster) { create(:cluster, :provided_by_user, projects: [project]) }
 
-        it "rejects changes" do
-          go
-
-          expect(response).to have_gitlab_http_status(:ok)
-          expect(response).to render_template(:show)
-          expect(cluster.enabled).to be_truthy
-        end
-      end
-    end
-
-    context 'when cluster is provided by user' do
-      let(:cluster) { create(:cluster, :provided_by_user, projects: [project]) }
-
-      let(:params) do
-        {
-          cluster: {
-            enabled: false,
-            name: 'my-new-cluster-name',
-            platform_kubernetes_attributes: {
-              namespace: 'my-namespace'
-            }
+    let(:params) do
+      {
+        cluster: {
+          enabled: false,
+          name: 'my-new-cluster-name',
+          platform_kubernetes_attributes: {
+            namespace: 'my-namespace'
           }
         }
-      end
+      }
+    end
 
-      it "updates and redirects back to show page" do
-        go
+    it "updates and redirects back to show page" do
+      go
 
-        cluster.reload
-        expect(response).to redirect_to(project_cluster_path(project, cluster))
-        expect(flash[:notice]).to eq('Kubernetes cluster was successfully updated.')
-        expect(cluster.enabled).to be_falsey
-        expect(cluster.name).to eq('my-new-cluster-name')
-        expect(cluster.platform_kubernetes.namespace).to eq('my-namespace')
-      end
+      cluster.reload
+      expect(response).to redirect_to(project_cluster_path(project, cluster))
+      expect(flash[:notice]).to eq('Kubernetes cluster was successfully updated.')
+      expect(cluster.enabled).to be_falsey
+      expect(cluster.name).to eq('my-new-cluster-name')
+      expect(cluster.platform_kubernetes.namespace).to eq('my-namespace')
+    end
 
-      context 'when format is json' do
-        context 'when changing parameters' do
-          context 'when valid parameters are used' do
-            let(:params) do
-              {
-                cluster: {
-                  enabled: false,
-                  name: 'my-new-cluster-name',
-                  platform_kubernetes_attributes: {
-                    namespace: 'my-namespace'
-                  }
+    context 'when format is json' do
+      context 'when changing parameters' do
+        context 'when valid parameters are used' do
+          let(:params) do
+            {
+              cluster: {
+                enabled: false,
+                name: 'my-new-cluster-name',
+                platform_kubernetes_attributes: {
+                  namespace: 'my-namespace'
                 }
               }
-            end
+            }
+          end
 
-            it "updates and redirects back to show page" do
-              go(format: :json)
+          it "updates and redirects back to show page" do
+            go(format: :json)
 
-              cluster.reload
-              expect(response).to have_http_status(:no_content)
-              expect(cluster.enabled).to be_falsey
-              expect(cluster.name).to eq('my-new-cluster-name')
-              expect(cluster.platform_kubernetes.namespace).to eq('my-namespace')
-            end
+            cluster.reload
+            expect(response).to have_http_status(:no_content)
+            expect(cluster.enabled).to be_falsey
+            expect(cluster.name).to eq('my-new-cluster-name')
+            expect(cluster.platform_kubernetes.namespace).to eq('my-namespace')
           end
+        end
 
-          context 'when invalid parameters are used' do
-            let(:params) do
-              {
-                cluster: {
-                  enabled: false,
-                  platform_kubernetes_attributes: {
-                    namespace: 'my invalid namespace #@'
-                  }
+        context 'when invalid parameters are used' do
+          let(:params) do
+            {
+              cluster: {
+                enabled: false,
+                platform_kubernetes_attributes: {
+                  namespace: 'my invalid namespace #@'
                 }
               }
-            end
+            }
+          end
 
-            it "rejects changes" do
-              go(format: :json)
+          it "rejects changes" do
+            go(format: :json)
 
-              expect(response).to have_http_status(:bad_request)
-            end
+            expect(response).to have_http_status(:bad_request)
           end
         end
       end
diff --git a/spec/presenters/clusters/cluster_presenter_spec.rb b/spec/presenters/clusters/cluster_presenter_spec.rb
index 7af181f37d5..72c5eac3ede 100644
--- a/spec/presenters/clusters/cluster_presenter_spec.rb
+++ b/spec/presenters/clusters/cluster_presenter_spec.rb
@@ -82,5 +82,12 @@ describe Clusters::ClusterPresenter do
 
       it { is_expected.to eq(project_cluster_path(project, cluster)) }
     end
+
+    context 'group_type cluster' do
+      let(:group) { cluster.group }
+      let(:cluster) { create(:cluster, :provided_by_gcp, :group) }
+
+      it { is_expected.to eq(group_cluster_path(group, cluster)) }
+    end
   end
 end
diff --git a/spec/presenters/group_clusterable_presenter_spec.rb b/spec/presenters/group_clusterable_presenter_spec.rb
new file mode 100644
index 00000000000..205160742bf
--- /dev/null
+++ b/spec/presenters/group_clusterable_presenter_spec.rb
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe GroupClusterablePresenter do
+  include Gitlab::Routing.url_helpers
+
+  let(:presenter) { described_class.new(group) }
+  let(:cluster) { create(:cluster, :provided_by_gcp, :group) }
+  let(:group) { cluster.group }
+
+  describe '#can_create_cluster?' do
+    let(:user) { create(:user) }
+
+    subject { presenter.can_create_cluster? }
+
+    before do
+      allow(presenter).to receive(:current_user).and_return(user)
+    end
+
+    context 'when user can create' do
+      before do
+        group.add_maintainer(user)
+      end
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when user cannot create' do
+      it { is_expected.to be_falsey }
+    end
+  end
+
+  describe '#index_path' do
+    subject { presenter.index_path }
+
+    it { is_expected.to eq(group_clusters_path(group)) }
+  end
+
+  describe '#new_path' do
+    subject { presenter.new_path }
+
+    it { is_expected.to eq(new_group_cluster_path(group)) }
+  end
+
+  describe '#create_user_clusters_path' do
+    subject { presenter.create_user_clusters_path }
+
+    it { is_expected.to eq(create_user_group_clusters_path(group)) }
+  end
+
+  describe '#create_gcp_clusters_path' do
+    subject { presenter.create_gcp_clusters_path }
+
+    it { is_expected.to eq(create_gcp_group_clusters_path(group)) }
+  end
+
+  describe '#cluster_status_cluster_path' do
+    subject { presenter.cluster_status_cluster_path(cluster) }
+
+    it { is_expected.to eq(cluster_status_group_cluster_path(group, cluster)) }
+  end
+
+  describe '#install_applications_cluster_path' do
+    let(:application) { :helm }
+
+    subject { presenter.install_applications_cluster_path(cluster, application) }
+
+    it { is_expected.to eq(install_applications_group_cluster_path(group, cluster, application)) }
+  end
+
+  describe '#cluster_path' do
+    subject { presenter.cluster_path(cluster) }
+
+    it { is_expected.to eq(group_cluster_path(group, cluster)) }
+  end
+end
diff --git a/spec/services/clusters/update_service_spec.rb b/spec/services/clusters/update_service_spec.rb
index a1b20c61116..7a777260be1 100644
--- a/spec/services/clusters/update_service_spec.rb
+++ b/spec/services/clusters/update_service_spec.rb
@@ -62,5 +62,32 @@ describe Clusters::UpdateService do
         expect(cluster.errors[:"platform_kubernetes.namespace"]).to be_present
       end
     end
+
+    context 'when cluster is provided by GCP' do
+      let(:cluster) { create(:cluster, :project, :provided_by_gcp) }
+
+      let(:params) do
+        {
+          name: 'my-new-name'
+        }
+      end
+
+      it "does not change cluster name" do
+        is_expected.to eq(false)
+
+        cluster.reload
+        expect(cluster.name).to eq('test-cluster')
+      end
+
+      context 'when cluster is being created' do
+        let(:cluster) { create(:cluster, :providing_by_gcp) }
+
+        it "rejects changes" do
+          is_expected.to eq(false)
+
+          expect(cluster.errors.full_messages).to include('cannot modify during creation')
+        end
+      end
+    end
   end
 end