Merge branch 'master' into 42611-removed-branch-link

* master: (1252 commits)
  Render log artifact files in GitLab
  Check disabled_services when finding a service
  Fix invalid parent path on group settings page
  Backport CE changes for: [Frontend only] Batch comments on merge requests
  Add button to insert table in markdown editor
  Update GITALY_SERVER_VERSION
  Updates Laravel.gitlab-ci.yml template
  Update operations metrics empty state
  Fix LFS uploaded images not being rendered
  Prepare admin/projects/show view to allow EE specific feature
  Add timed incremental rollout to Auto DevOps
  Update spec comment to point to correct issue
  Fix documentation for variables
  Document Security and Licence Management features permissions
  Fix time dependent jobs spec
  Use a CTE to remove the query timeout
  Backport changes from gitlab-ee!7538
  Fix CE to EE merge (backport)
  Add changelog entry
  Refactor Feature.flipper method
  ...

6 files changed, 254 insertions, 21 deletions

diff --git a/lib/gitlab/kubernetes/helm/api.rb b/lib/gitlab/kubernetes/helm/api.rb
index d65374cc23b..e21bc531444 100644
--- a/lib/gitlab/kubernetes/helm/api.rb
+++ b/lib/gitlab/kubernetes/helm/api.rb
@@ -9,7 +9,17 @@ module Gitlab
 
         def install(command)
           namespace.ensure_exists!
+
+          create_service_account(command)
+          create_cluster_role_binding(command)
           create_config_map(command)
+
+          kubeclient.create_pod(command.pod_resource)
+        end
+
+        def update(command)
+          namespace.ensure_exists!
+          update_config_map(command)
           kubeclient.create_pod(command.pod_resource)
         end
 
@@ -32,6 +42,12 @@ module Gitlab
           kubeclient.delete_pod(pod_name, namespace.name)
         end
 
+        def get_config_map(config_map_name)
+          namespace.ensure_exists!
+
+          kubeclient.get_config_map(config_map_name, namespace.name)
+        end
+
         private
 
         attr_reader :kubeclient, :namespace
@@ -41,6 +57,56 @@ module Gitlab
             kubeclient.create_config_map(config_map_resource)
           end
         end
+
+        def update_config_map(command)
+          command.config_map_resource.tap do |config_map_resource|
+            kubeclient.update_config_map(config_map_resource)
+          end
+        end
+
+        def create_service_account(command)
+          command.service_account_resource.tap do |service_account_resource|
+            break unless service_account_resource
+
+            if service_account_exists?(service_account_resource)
+              kubeclient.update_service_account(service_account_resource)
+            else
+              kubeclient.create_service_account(service_account_resource)
+            end
+          end
+        end
+
+        def create_cluster_role_binding(command)
+          command.cluster_role_binding_resource.tap do |cluster_role_binding_resource|
+            break unless cluster_role_binding_resource
+
+            if cluster_role_binding_exists?(cluster_role_binding_resource)
+              kubeclient.update_cluster_role_binding(cluster_role_binding_resource)
+            else
+              kubeclient.create_cluster_role_binding(cluster_role_binding_resource)
+            end
+          end
+        end
+
+        def service_account_exists?(resource)
+          resource_exists? do
+            kubeclient.get_service_account(resource.metadata.name, resource.metadata.namespace)
+          end
+        end
+
+        def cluster_role_binding_exists?(resource)
+          resource_exists? do
+            kubeclient.get_cluster_role_binding(resource.metadata.name)
+          end
+        end
+
+        def resource_exists?
+          yield
+        rescue ::Kubeclient::HttpError => e
+          raise e unless e.error_code == 404
+
+          false
+        end
       end
     end
   end
diff --git a/lib/gitlab/kubernetes/helm/base_command.rb b/lib/gitlab/kubernetes/helm/base_command.rb
index afcfd109de0..6752f2cff43 100644
--- a/lib/gitlab/kubernetes/helm/base_command.rb
+++ b/lib/gitlab/kubernetes/helm/base_command.rb
@@ -3,7 +3,9 @@ module Gitlab
     module Helm
       module BaseCommand
         def pod_resource
-          Gitlab::Kubernetes::Helm::Pod.new(self, namespace).generate
+          pod_service_account_name = rbac? ? service_account_name : nil
+
+          Gitlab::Kubernetes::Helm::Pod.new(self, namespace, service_account_name: pod_service_account_name).generate
         end
 
         def generate_script
@@ -26,6 +28,14 @@ module Gitlab
           Gitlab::Kubernetes::ConfigMap.new(name, files).generate
         end
 
+        def service_account_resource
+          nil
+        end
+
+        def cluster_role_binding_resource
+          nil
+        end
+
         def file_names
           files.keys
         end
@@ -34,6 +44,10 @@ module Gitlab
           raise "Not implemented"
         end
 
+        def rbac?
+          raise "Not implemented"
+        end
+
         def files
           raise "Not implemented"
         end
@@ -47,6 +61,10 @@ module Gitlab
         def namespace
           Gitlab::Kubernetes::Helm::NAMESPACE
         end
+
+        def service_account_name
+          Gitlab::Kubernetes::Helm::SERVICE_ACCOUNT
+        end
       end
     end
   end
diff --git a/lib/gitlab/kubernetes/helm/init_command.rb b/lib/gitlab/kubernetes/helm/init_command.rb
index a4546509515..c7046a9ea75 100644
--- a/lib/gitlab/kubernetes/helm/init_command.rb
+++ b/lib/gitlab/kubernetes/helm/init_command.rb
@@ -6,9 +6,10 @@ module Gitlab
 
         attr_reader :name, :files
 
-        def initialize(name:, files:)
+        def initialize(name:, files:, rbac:)
           @name = name
           @files = files
+          @rbac = rbac
         end
 
         def generate_script
@@ -17,15 +18,62 @@ module Gitlab
           ].join("\n")
         end
 
+        def rbac?
+          @rbac
+        end
+
+        def service_account_resource
+          return unless rbac?
+
+          Gitlab::Kubernetes::ServiceAccount.new(service_account_name, namespace).generate
+        end
+
+        def cluster_role_binding_resource
+          return unless rbac?
+
+          subjects = [{ kind: 'ServiceAccount', name: service_account_name, namespace: namespace }]
+
+          Gitlab::Kubernetes::ClusterRoleBinding.new(
+            cluster_role_binding_name,
+            cluster_role_name,
+            subjects
+          ).generate
+        end
+
         private
 
         def init_helm_command
-          tls_flags = "--tiller-tls" \
-            " --tiller-tls-verify --tls-ca-cert #{files_dir}/ca.pem" \
-            " --tiller-tls-cert #{files_dir}/cert.pem" \
-            " --tiller-tls-key #{files_dir}/key.pem"
+          command = %w[helm init] + init_command_flags
+
+          command.shelljoin + " >/dev/null\n"
+        end
+
+        def init_command_flags
+          tls_flags + optional_service_account_flag
+        end
+
+        def tls_flags
+          [
+            '--tiller-tls',
+            '--tiller-tls-verify',
+            '--tls-ca-cert', "#{files_dir}/ca.pem",
+            '--tiller-tls-cert', "#{files_dir}/cert.pem",
+            '--tiller-tls-key', "#{files_dir}/key.pem"
+          ]
+        end
+
+        def optional_service_account_flag
+          return [] unless rbac?
+
+          ['--service-account', service_account_name]
+        end
+
+        def cluster_role_binding_name
+          Gitlab::Kubernetes::Helm::CLUSTER_ROLE_BINDING
+        end
 
-          "helm init #{tls_flags} >/dev/null"
+        def cluster_role_name
+          Gitlab::Kubernetes::Helm::CLUSTER_ROLE
         end
       end
     end
diff --git a/lib/gitlab/kubernetes/helm/install_command.rb b/lib/gitlab/kubernetes/helm/install_command.rb
index 9672f80687e..1be7924d6ac 100644
--- a/lib/gitlab/kubernetes/helm/install_command.rb
+++ b/lib/gitlab/kubernetes/helm/install_command.rb
@@ -6,10 +6,11 @@ module Gitlab
 
         attr_reader :name, :files, :chart, :version, :repository
 
-        def initialize(name:, chart:, files:, version: nil, repository: nil)
+        def initialize(name:, chart:, files:, rbac:, version: nil, repository: nil)
           @name = name
           @chart = chart
           @version = version
+          @rbac = rbac
           @files = files
           @repository = repository
         end
@@ -22,6 +23,10 @@ module Gitlab
           ].compact.join("\n")
         end
 
+        def rbac?
+          @rbac
+        end
+
         private
 
         def init_command
@@ -29,28 +34,51 @@ module Gitlab
         end
 
         def repository_command
-          "helm repo add #{name} #{repository}" if repository
+          ['helm', 'repo', 'add', name, repository].shelljoin if repository
         end
 
         def script_command
-          init_flags = "--name #{name}#{optional_tls_flags}#{optional_version_flag}" \
-            " --namespace #{Gitlab::Kubernetes::Helm::NAMESPACE}" \
-            " -f /data/helm/#{name}/config/values.yaml"
+          command = ['helm', 'install', chart] + install_command_flags
+
+          command.shelljoin + " >/dev/null\n"
+        end
+
+        def install_command_flags
+          name_flag      = ['--name', name]
+          namespace_flag = ['--namespace', Gitlab::Kubernetes::Helm::NAMESPACE]
+          value_flag     = ['-f', "/data/helm/#{name}/config/values.yaml"]
 
-          "helm install #{chart} #{init_flags} >/dev/null\n"
+          name_flag +
+            optional_tls_flags +
+            optional_version_flag +
+            optional_rbac_create_flag +
+            namespace_flag +
+            value_flag
+        end
+
+        def optional_rbac_create_flag
+          return [] unless rbac?
+
+          # jupyterhub helm chart is using rbac.enabled
+          #   https://github.com/jupyterhub/zero-to-jupyterhub-k8s/tree/master/jupyterhub
+          %w[--set rbac.create=true,rbac.enabled=true]
         end
 
         def optional_version_flag
-          " --version #{version}" if version
+          return [] unless version
+
+          ['--version', version]
         end
 
         def optional_tls_flags
-          return unless files.key?(:'ca.pem')
+          return [] unless files.key?(:'ca.pem')
 
-          " --tls" \
-            " --tls-ca-cert #{files_dir}/ca.pem" \
-            " --tls-cert #{files_dir}/cert.pem" \
-            " --tls-key #{files_dir}/key.pem"
+          [
+            '--tls',
+            '--tls-ca-cert', "#{files_dir}/ca.pem",
+            '--tls-cert', "#{files_dir}/cert.pem",
+            '--tls-key', "#{files_dir}/key.pem"
+          ]
         end
       end
     end
diff --git a/lib/gitlab/kubernetes/helm/pod.rb b/lib/gitlab/kubernetes/helm/pod.rb
index 6e5d3388405..95192b11c0d 100644
--- a/lib/gitlab/kubernetes/helm/pod.rb
+++ b/lib/gitlab/kubernetes/helm/pod.rb
@@ -2,9 +2,10 @@ module Gitlab
   module Kubernetes
     module Helm
       class Pod
-        def initialize(command, namespace_name)
+        def initialize(command, namespace_name, service_account_name: nil)
           @command = command
           @namespace_name = namespace_name
+          @service_account_name = service_account_name
         end
 
         def generate
@@ -12,13 +13,14 @@ module Gitlab
 
           spec[:volumes] = volumes_specification
           spec[:containers][0][:volumeMounts] = volume_mounts_specification
+          spec[:serviceAccountName] = service_account_name if service_account_name
 
           ::Kubeclient::Resource.new(metadata: metadata, spec: spec)
         end
 
         private
 
-        attr_reader :command, :namespace_name, :kubeclient, :config_map
+        attr_reader :command, :namespace_name, :service_account_name
 
         def container_specification
           {
diff --git a/lib/gitlab/kubernetes/helm/upgrade_command.rb b/lib/gitlab/kubernetes/helm/upgrade_command.rb
new file mode 100644
index 00000000000..74188046739
--- /dev/null
+++ b/lib/gitlab/kubernetes/helm/upgrade_command.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Kubernetes
+    module Helm
+      class UpgradeCommand
+        include BaseCommand
+
+        attr_reader :name, :chart, :version, :repository, :files
+
+        def initialize(name, chart:, files:, rbac:, version: nil, repository: nil)
+          @name = name
+          @chart = chart
+          @rbac = rbac
+          @version = version
+          @files = files
+          @repository = repository
+        end
+
+        def generate_script
+          super + [
+            init_command,
+            repository_command,
+            script_command
+          ].compact.join("\n")
+        end
+
+        def rbac?
+          @rbac
+        end
+
+        def pod_name
+          "upgrade-#{name}"
+        end
+
+        private
+
+        def init_command
+          'helm init --client-only >/dev/null'
+        end
+
+        def repository_command
+          "helm repo add #{name} #{repository}" if repository
+        end
+
+        def script_command
+          upgrade_flags = "#{optional_version_flag}#{optional_tls_flags}" \
+            " --reset-values" \
+            " --install" \
+            " --namespace #{::Gitlab::Kubernetes::Helm::NAMESPACE}" \
+            " -f /data/helm/#{name}/config/values.yaml"
+
+          "helm upgrade #{name} #{chart}#{upgrade_flags} >/dev/null\n"
+        end
+
+        def optional_version_flag
+          " --version #{version}" if version
+        end
+
+        def optional_tls_flags
+          return unless files.key?(:'ca.pem')
+
+          " --tls" \
+            " --tls-ca-cert #{files_dir}/ca.pem" \
+            " --tls-cert #{files_dir}/cert.pem" \
+            " --tls-key #{files_dir}/key.pem"
+        end
+      end
+    end
+  end
+end