As we don't use any instance attributes and we don't seem to have any
commonalities between the cluster and the project variant.

Add specs too for deploying a group cluster for EE

Tidy specs for readability

This reflects how we now create or update

The two pieces of code are identical so use a private method

Subgroups are not supported in mySQL. I changed Namespace#root_ancestor
to return from self_and_ancestors as a bugfix.

```
  184   # Returns all the ancestors of the current namespaces
  185   def ancestors
  186     return self.class.none unless parent_id
  187
  188     Gitlab::GroupHierarchy
  189       .new(self.class.where(id: parent_id))
  190       .base_and_ancestors
  191   end
```

So it seems like on mySQL we accidentally returned the parent group :

```
ancestors = self.class.where(id: parent_id)
ancestors.reorder(nil).find_by(parent_id: nil)
```

Project#root_namespace is used only by shared_runners_limit_namespace
and all the tests for shared_runner_minutes_on_root_namespace are only
enabled on `:nested_groups`

`when :shared_runner_minutes_on_root_namespace is enabled', :nested_groups`

We very clearly state in https://docs.gitlab.com/ee/user/group/subgroups/ that `
Nested groups are only supported when you use PostgreSQL`, so I think I
will fix forward and add `:nested_groups` to the two failing feature
specs.

This also means we need to apply the `current_scope` otherwise this
method will return all clusters associated with the groups regardless of
any scopes applied to this method

With this MR, group clusters is now functional, so default to enabled.

Have a single setting on the root ancestor group to enabled or disable
group clusters feature as a whole

- Rename ordered_group_clusters_for_project ->
ancestor_clusters_for_clusterable
- Improve name of order option. It makes much more sense to have `hierarchy_order: :asc`
and `hierarchy_order: :desc`
- Allow ancestor_clusters_for_clusterable for group
- Re-use code already present in Project

AFAIK the only relevant place is Projects::CreateService, this gets
called when user creates a new project, forks a new project and does
those things via the api.

Also create k8s namespace for new group hierarchy
when transferring project between groups

Uses new Refresh service to create k8s namespaces

- Ensure we use Cluster#cluster_project

If a project has multiple clusters (EE), using Project#cluster_project
is not guaranteed to return the cluster_project for this cluster. So
switch to using Cluster#cluster_project - at this stage a cluster can
only have 1 cluster_project.

Also, remove rescue so that sidekiq can retry

For project level, it's the project directly associated. For group
level, it's the projects under that group.

This returns a union of the project level clusters and group level
clusters associated with this project.

kubernetes_namespaces is not needed for project import/export as it
tracks internal state of kubernetes integration

Look for matching clusters starting from the closest ancestor, then go
up the ancestor tree.

Then use Ruby to get clusters for each group in order. Not that
efficient, considering we will doing up to `NUMBER_OF_ANCESTORS_ALLOWED`
number of queries, but it's a finite number

Explicitly order query by depth

This allows us to control ordering explicitly and also to reverse the
order which is useful to allow us to be consistent with
Clusters::Cluster.on_environment (EE) which does reverse ordering.

Puts querying group clusters behind Feature Flag. Just in case we have
issues with performance, we can easily disable this

If the service fails mid-point, then we should be able to re-run this
service. So, detect presence of any previously created Kubernetes
resource and update or create accordingly.

Fix specs accordingly. In the case of finalize_creation_service_spec.rb,
I decided to stub out the async worker rather than maintaining
individual stubs for various kubeclient calls for that worker.

We remove configure_project_service_account and replace
ClusterPlatformConfigureWorker as they perform exactly the same piece of
work. This also makes GKE cluster creation to be the same as Adding
existing cluster - they both now use another worker to execute
CreateOrUpdateNamespaceService.

Currently, if a job does not have only/except policies, the policy is considered as an unspecified state, and therefore the job is executed regardless of how it's executed and which branch/tags are targetted.
Ideally, this should be specified as only: ['branches', 'tags'], as it indicates that unspecified policy jobs are meant to run on any git references.

It appears that for some jobs
(https://gitlab.com/gitlab-org/gitlab-ce/-/jobs/129705025 for example)
we process a range of commits far greater than necessary, which can lead
to commits getting reverted that were merged a long time ago.

[ci skip]

EE: set kubeconfig nil when token nil

See merge request gitlab-org/gitlab-ee!8655

CE upstream - 2018-12-04 15:22 UTC

See merge request gitlab-org/gitlab-ee!8699

Update elasticsearch system check to check for new supported versions

Closes #8652

See merge request gitlab-org/gitlab-ee!8683

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/53600

Encrypt runners tokens / EE

See merge request gitlab-org/gitlab-ee!8638

Add file and line numbers to vulnerabilities issues

Closes #8157

See merge request gitlab-org/gitlab-ee!8578

Users can unlink Group SAML from accounts page

Closes #5016

See merge request gitlab-org/gitlab-ee!8682

EE: Automatically merge CE master into EE master

See merge request gitlab-org/gitlab-ee!8657

# Conflicts:
#	spec/models/ci/pipeline_spec.rb

[ci skip]

CE upstream - 2018-12-04 12:21 UTC

See merge request gitlab-org/gitlab-ee!8693

CE port of Add new service to create the web ide terminal

See merge request gitlab-org/gitlab-ce!23514

Add new service to create the web ide terminal

See merge request gitlab-org/gitlab-ee!8549