From 69d28d313c2a65ead87229841a50bfc130e8c952 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Fri, 30 Apr 2021 15:09:50 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../runner_instructions_modal.vue             |  41 ++-
 app/finders/deploy_tokens/tokens_finder.rb    |  43 +++
 app/helpers/projects_helper.rb                |  42 ---
 app/helpers/sidebars_helper.rb                |   3 +-
 .../nav/sidebar/_project_menus.html.haml      |  95 ------
 .../nav/sidebar/_tracing_link.html.haml       |   7 -
 ...06-remove-ff-search-track-unique-users.yml |   5 +
 ...433-add-filtering-to-deploy-tokens-api.yml |   5 +
 ...n-modal-should-support-smaller-screens.yml |   6 +
 .../development/search_track_unique_users.yml |   8 -
 ...alize_conversion_of_events_id_to_bigint.rb |   2 +-
 ..._push_event_payloads_event_id_to_bigint.rb |   2 +-
 ..._conversion_of_ci_build_needs_to_bigint.rb |   2 +-
 ...onversion_of_ci_job_artifacts_to_bigint.rb |   2 +-
 ...urces_pipelines_source_job_id_to_bigint.rb |   2 +-
 doc/api/deploy_tokens.md                      |  84 +++--
 doc/development/code_review.md                |   2 +-
 .../configuration/index.md                    |   3 +
 .../secret_detection/index.md                 |  44 +++
 .../merge_requests/approvals/img/approve.png  | Bin 6655 -> 0 bytes
 .../approvals/img/approve_additionally.png    | Bin 7803 -> 0 bytes
 .../approvals/img/remove_approval.png         | Bin 7533 -> 0 bytes
 .../project/merge_requests/approvals/index.md | 187 ++++++-----
 lib/api/deploy_tokens.rb                      |  31 +-
 lib/api/entities/deploy_token.rb              |   3 +-
 lib/gitlab/database/migration_helpers.rb      |  36 +-
 .../sidekiq_logging/structured_logger.rb      |   2 +
 .../known_events/common.yml                   |   3 -
 .../projects/menus/operations_menu.rb         | 217 ++++++++++++
 lib/sidebars/projects/panel.rb                |   1 +
 locale/gitlab.pot                             |   8 +-
 qa/qa/page/project/sub_menus/operations.rb    |  17 +-
 .../settings/repository_controller_spec.rb    |   2 +
 .../settings/repository_controller_spec.rb    |   2 +
 spec/features/issues/issue_sidebar_spec.rb    |   1 +
 spec/features/operations_sidebar_link_spec.rb |  91 ++---
 .../deploy_tokens/tokens_finder_spec.rb       | 135 ++++++++
 .../runner_instructions_modal_spec.js         |  40 ++-
 spec/helpers/projects_helper_spec.rb          |  37 --
 .../gitlab/database/migration_helpers_spec.rb |  24 +-
 .../projects/menus/operations_menu_spec.rb    | 205 ++++++++++++
 spec/requests/api/deploy_tokens_spec.rb       |  57 +++-
 .../nav/sidebar/_project.html.haml_spec.rb    | 316 ++++++++++++++----
 43 files changed, 1333 insertions(+), 480 deletions(-)
 create mode 100644 app/finders/deploy_tokens/tokens_finder.rb
 delete mode 100644 app/views/layouts/nav/sidebar/_tracing_link.html.haml
 create mode 100644 changelogs/unreleased/240906-remove-ff-search-track-unique-users.yml
 create mode 100644 changelogs/unreleased/292433-add-filtering-to-deploy-tokens-api.yml
 create mode 100644 changelogs/unreleased/327124-runner-installation-modal-should-support-smaller-screens.yml
 delete mode 100644 config/feature_flags/development/search_track_unique_users.yml
 delete mode 100644 doc/user/project/merge_requests/approvals/img/approve.png
 delete mode 100644 doc/user/project/merge_requests/approvals/img/approve_additionally.png
 delete mode 100644 doc/user/project/merge_requests/approvals/img/remove_approval.png
 create mode 100644 lib/sidebars/projects/menus/operations_menu.rb
 create mode 100644 spec/finders/deploy_tokens/tokens_finder_spec.rb
 create mode 100644 spec/lib/sidebars/projects/menus/operations_menu_spec.rb

diff --git a/app/assets/javascripts/vue_shared/components/runner_instructions/runner_instructions_modal.vue b/app/assets/javascripts/vue_shared/components/runner_instructions/runner_instructions_modal.vue
index 795b4f58ac5..1f70644eb2c 100644
--- a/app/assets/javascripts/vue_shared/components/runner_instructions/runner_instructions_modal.vue
+++ b/app/assets/javascripts/vue_shared/components/runner_instructions/runner_instructions_modal.vue
@@ -9,7 +9,9 @@ import {
   GlIcon,
   GlLoadingIcon,
   GlSkeletonLoader,
+  GlResizeObserverDirective,
 } from '@gitlab/ui';
+import { GlBreakpointInstance as bp } from '@gitlab/ui/dist/utils';
 import { isEmpty } from 'lodash';
 import { __, s__ } from '~/locale';
 import ModalCopyButton from '~/vue_shared/components/modal_copy_button.vue';
@@ -33,6 +35,9 @@ export default {
     GlSkeletonLoader,
     ModalCopyButton,
   },
+  directives: {
+    GlResizeObserver: GlResizeObserverDirective,
+  },
   props: {
     modalId: {
       type: String,
@@ -87,6 +92,7 @@ export default {
       selectedArchitecture: null,
       showAlert: false,
       instructions: {},
+      platformsButtonGroupVertical: false,
     };
   },
   computed: {
@@ -127,6 +133,13 @@ export default {
     toggleAlert(state) {
       this.showAlert = state;
     },
+    onPlatformsButtonResize() {
+      if (bp.getBreakpointSize() === 'xs') {
+        this.platformsButtonGroupVertical = true;
+      } else {
+        this.platformsButtonGroupVertical = false;
+      }
+    },
   },
   i18n: {
     installARunner: s__('Runners|Install a runner'),
@@ -159,17 +172,23 @@ export default {
       <h5>
         {{ __('Environment') }}
       </h5>
-      <gl-button-group class="gl-mb-3">
-        <gl-button
-          v-for="platform in platforms"
-          :key="platform.name"
-          :selected="selectedPlatform && selectedPlatform.name === platform.name"
-          data-testid="platform-button"
-          @click="selectPlatform(platform)"
+      <div v-gl-resize-observer="onPlatformsButtonResize">
+        <gl-button-group
+          :vertical="platformsButtonGroupVertical"
+          :class="{ 'gl-w-full': platformsButtonGroupVertical }"
+          class="gl-mb-3"
+          data-testid="platform-buttons"
         >
-          {{ platform.humanReadableName }}
-        </gl-button>
-      </gl-button-group>
+          <gl-button
+            v-for="platform in platforms"
+            :key="platform.name"
+            :selected="selectedPlatform && selectedPlatform.name === platform.name"
+            @click="selectPlatform(platform)"
+          >
+            {{ platform.humanReadableName }}
+          </gl-button>
+        </gl-button-group>
+      </div>
     </template>
     <template v-if="hasArchitecureList">
       <template v-if="selectedPlatform">
@@ -190,7 +209,7 @@ export default {
             {{ architecture.name }}
           </gl-dropdown-item>
         </gl-dropdown>
-        <div class="gl-display-flex gl-align-items-center gl-mb-3">
+        <div class="gl-sm-display-flex gl-align-items-center gl-mb-3">
           <h5>{{ $options.i18n.downloadInstallBinary }}</h5>
           <gl-button
             class="gl-ml-auto"
diff --git a/app/finders/deploy_tokens/tokens_finder.rb b/app/finders/deploy_tokens/tokens_finder.rb
new file mode 100644
index 00000000000..98456628375
--- /dev/null
+++ b/app/finders/deploy_tokens/tokens_finder.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# Arguments:
+#   current_user: The currently logged in user.
+#   scope: A Project or Group to scope deploy tokens to (or :all for all tokens).
+#   params:
+#     active: Boolean - When true, only return active deployments.
+module DeployTokens
+  class TokensFinder
+    attr_reader :current_user, :params, :scope
+
+    def initialize(current_user, scope, params = {})
+      @current_user = current_user
+      @scope = scope
+      @params = params
+    end
+
+    def execute
+      by_active(init_collection)
+    end
+
+    private
+
+    def init_collection
+      case scope
+      when Group, Project
+        raise Gitlab::Access::AccessDeniedError unless current_user.can?(:read_deploy_token, scope)
+
+        scope.deploy_tokens
+      when :all
+        raise Gitlab::Access::AccessDeniedError unless current_user.can_read_all_resources?
+
+        DeployToken.all
+      else
+        raise ArgumentError, "Scope must be a Group, a Project, or the :all symbol."
+      end
+    end
+
+    def by_active(items)
+      params[:active] ? items.active : items
+    end
+  end
+end
diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index c6f2585953c..da8ece06bcd 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -404,14 +404,6 @@ module ProjectsHelper
       nav_tabs << :pipelines
     end
 
-    if can_view_operations_tab?(current_user, project)
-      nav_tabs << :operations
-    end
-
-    if can_view_product_analytics?(current_user, project)
-      nav_tabs << :product_analytics
-    end
-
     tab_ability_map.each do |tab, ability|
       if can?(current_user, ability, project)
         nav_tabs << tab
@@ -470,32 +462,6 @@ module ProjectsHelper
     }
   end
 
-  def view_operations_tab_ability
-    [
-      :metrics_dashboard,
-      :read_alert_management_alert,
-      :read_environment,
-      :read_issue,
-      :read_sentry_issue,
-      :read_cluster,
-      :read_feature_flag,
-      :read_terraform_state
-    ]
-  end
-
-  def can_view_operations_tab?(current_user, project)
-    return false unless project.feature_available?(:operations, current_user)
-
-    view_operations_tab_ability.any? do |ability|
-      can?(current_user, ability, project)
-    end
-  end
-
-  def can_view_product_analytics?(current_user, project)
-    Feature.enabled?(:product_analytics, project) &&
-      can?(current_user, :read_product_analytics, project)
-  end
-
   def search_tab_ability_map
     @search_tab_ability_map ||= tab_ability_map.merge(
       blobs:          :download_code,
@@ -563,14 +529,6 @@ module ProjectsHelper
     end
   end
 
-  def sidebar_operations_link_path(project = @project)
-    if can?(current_user, :read_environment, project)
-      metrics_project_environments_path(project)
-    else
-      project_feature_flags_path(project)
-    end
-  end
-
   def project_last_activity(project)
     if project.last_activity_at
       time_ago_with_tooltip(project.last_activity_at, placement: 'bottom', html_class: 'last_activity_time_ago')
diff --git a/app/helpers/sidebars_helper.rb b/app/helpers/sidebars_helper.rb
index 3e66b757dca..ddf5461715f 100644
--- a/app/helpers/sidebars_helper.rb
+++ b/app/helpers/sidebars_helper.rb
@@ -41,7 +41,8 @@ module SidebarsHelper
       learn_gitlab_experiment_enabled: learn_gitlab_experiment_enabled?(project),
       current_ref: current_ref,
       jira_issues_integration: project_jira_issues_integration?,
-      can_view_pipeline_editor: can_view_pipeline_editor?(project)
+      can_view_pipeline_editor: can_view_pipeline_editor?(project),
+      show_cluster_hint: show_gke_cluster_integration_callout?(project)
     }
   end
 end
diff --git a/app/views/layouts/nav/sidebar/_project_menus.html.haml b/app/views/layouts/nav/sidebar/_project_menus.html.haml
index 4497dedba60..8d838617b64 100644
--- a/app/views/layouts/nav/sidebar/_project_menus.html.haml
+++ b/app/views/layouts/nav/sidebar/_project_menus.html.haml
@@ -1,98 +1,3 @@
-- if project_nav_tab? :operations
-  = nav_link(controller: sidebar_operations_paths) do
-    = link_to sidebar_operations_link_path, class: 'shortcuts-operations', data: { qa_selector: 'operations_link' } do
-      .nav-icon-container
-        = sprite_icon('cloud-gear')
-      %span.nav-item-name
-        = _('Operations')
-
-    %ul.sidebar-sub-level-items
-      = nav_link(controller: sidebar_operations_paths, html_options: { class: "fly-out-top-item" } ) do
-        = link_to sidebar_operations_link_path do
-          %strong.fly-out-top-item-name
-            =  _('Operations')
-      %li.divider.fly-out-top-item
-
-      - if project_nav_tab? :metrics_dashboards
-        = nav_link(controller: :metrics_dashboard, action: [:show]) do
-          = link_to project_metrics_dashboard_path(@project), title: _('Metrics'), class: 'shortcuts-metrics', data: { qa_selector: 'operations_metrics_link' } do
-            %span
-              = _('Metrics')
-
-      - if project_nav_tab?(:environments) && can?(current_user, :read_pod_logs, @project)
-        = nav_link(controller: :logs, action: [:index]) do
-          = link_to project_logs_path(@project), title: _('Logs') do
-            %span
-              = _('Logs')
-
-      - if project_nav_tab? :environments
-        = render "layouts/nav/sidebar/tracing_link"
-
-      - if project_nav_tab?(:error_tracking)
-        = nav_link(controller: :error_tracking) do
-          = link_to project_error_tracking_index_path(@project), title: _('Error Tracking') do
-            %span
-              = _('Error Tracking')
-
-      - if project_nav_tab?(:alert_management)
-        = nav_link(controller: :alert_management) do
-          = link_to project_alert_management_index_path(@project), title: _('Alerts') do
-            %span
-              = _('Alerts')
-
-      - if project_nav_tab?(:incidents)
-        = nav_link(controller: :incidents) do
-          = link_to project_incidents_path(@project), title: _('Incidents'), data: { qa_selector: 'operations_incidents_link' } do
-            %span
-              = _('Incidents')
-
-      = render_if_exists 'projects/sidebar/oncall_schedules'
-
-      - if project_nav_tab? :serverless
-        = nav_link(controller: :functions) do
-          = link_to project_serverless_functions_path(@project), title: _('Serverless') do
-            %span
-              = _('Serverless')
-
-      - if project_nav_tab? :terraform
-        = nav_link(controller: :terraform) do
-          = link_to project_terraform_index_path(@project), title: _('Terraform') do
-            %span
-              = _('Terraform')
-
-      - if project_nav_tab? :clusters
-        - show_cluster_hint = show_gke_cluster_integration_callout?(@project)
-        = nav_link(controller: [:cluster_agents, :clusters]) do
-          = link_to project_clusters_path(@project), title: _('Kubernetes'), class: 'shortcuts-kubernetes' do
-            %span
-              = _('Kubernetes')
-            - if show_cluster_hint
-              .js-feature-highlight{ disabled: true,
-                data: { trigger: 'manual',
-                  container: 'body',
-                  placement: 'right',
-                  highlight: UserCalloutsHelper::GKE_CLUSTER_INTEGRATION,
-                  highlight_priority: UserCallout.feature_names[:GKE_CLUSTER_INTEGRATION],
-                  dismiss_endpoint: user_callouts_path,
-                  auto_devops_help_path: help_page_path('topics/autodevops/index.md') } }
-      - if project_nav_tab? :environments
-        = nav_link(controller: :environments, action: [:index, :folder, :show, :new, :edit, :create, :update, :stop, :terminal]) do
-          = link_to project_environments_path(@project), title: _('Environments'), class: 'shortcuts-environments qa-operations-environments-link' do
-            %span
-              = _('Environments')
-
-      - if project_nav_tab? :feature_flags
-        = nav_link(controller: :feature_flags) do
-          = link_to project_feature_flags_path(@project), title: _('Feature Flags'), class: 'shortcuts-feature-flags' do
-            %span
-              = _('Feature Flags')
-
-      - if project_nav_tab?(:product_analytics)
-        = nav_link(controller: :product_analytics) do
-          = link_to project_product_analytics_path(@project), title: _('Product Analytics') do
-            %span
-              = _('Product Analytics')
-
 = render_if_exists 'layouts/nav/sidebar/project_packages_link'
 
 - if project_nav_tab? :analytics
diff --git a/app/views/layouts/nav/sidebar/_tracing_link.html.haml b/app/views/layouts/nav/sidebar/_tracing_link.html.haml
deleted file mode 100644
index 7a31a20f5f0..00000000000
--- a/app/views/layouts/nav/sidebar/_tracing_link.html.haml
+++ /dev/null
@@ -1,7 +0,0 @@
-- return unless can?(current_user, :read_environment, @project)
-
-- if project_nav_tab? :settings
-  = nav_link(controller: :tracings, action: [:show]) do
-    = link_to project_tracing_path(@project), title: _('Tracing') do
-      %span
-        = _('Tracing')
diff --git a/changelogs/unreleased/240906-remove-ff-search-track-unique-users.yml b/changelogs/unreleased/240906-remove-ff-search-track-unique-users.yml
new file mode 100644
index 00000000000..ae47fe4c7ca
--- /dev/null
+++ b/changelogs/unreleased/240906-remove-ff-search-track-unique-users.yml
@@ -0,0 +1,5 @@
+---
+title: Remove search_track_unique_users feature flag
+merge_request: 60706
+author:
+type: other
diff --git a/changelogs/unreleased/292433-add-filtering-to-deploy-tokens-api.yml b/changelogs/unreleased/292433-add-filtering-to-deploy-tokens-api.yml
new file mode 100644
index 00000000000..f6eb9370461
--- /dev/null
+++ b/changelogs/unreleased/292433-add-filtering-to-deploy-tokens-api.yml
@@ -0,0 +1,5 @@
+---
+title: Add "active" filter to deploy tokens API
+merge_request: 59582
+author: Devin Christensen
+type: added
diff --git a/changelogs/unreleased/327124-runner-installation-modal-should-support-smaller-screens.yml b/changelogs/unreleased/327124-runner-installation-modal-should-support-smaller-screens.yml
new file mode 100644
index 00000000000..f0be6d6055f
--- /dev/null
+++ b/changelogs/unreleased/327124-runner-installation-modal-should-support-smaller-screens.yml
@@ -0,0 +1,6 @@
+---
+title: This change captures resizes of the runner installation instructions modal
+  to make it usable on screens.
+merge_request: 60588
+author:
+type: changed
diff --git a/config/feature_flags/development/search_track_unique_users.yml b/config/feature_flags/development/search_track_unique_users.yml
deleted file mode 100644
index 641636fd955..00000000000
--- a/config/feature_flags/development/search_track_unique_users.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: search_track_unique_users
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40134
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/240906
-milestone: '13.4'
-type: development
-group: group::global search
-default_enabled: true
diff --git a/db/migrate/20210311120153_initialize_conversion_of_events_id_to_bigint.rb b/db/migrate/20210311120153_initialize_conversion_of_events_id_to_bigint.rb
index 72536d24fe1..f5ff0816047 100644
--- a/db/migrate/20210311120153_initialize_conversion_of_events_id_to_bigint.rb
+++ b/db/migrate/20210311120153_initialize_conversion_of_events_id_to_bigint.rb
@@ -14,7 +14,7 @@ class InitializeConversionOfEventsIdToBigint < ActiveRecord::Migration[6.0]
   def down
     trigger_name = rename_trigger_name(:events, :id, :id_convert_to_bigint)
 
-    remove_rename_triggers_for_postgresql :events, trigger_name
+    remove_rename_triggers :events, trigger_name
 
     remove_column :events, :id_convert_to_bigint
   end
diff --git a/db/migrate/20210311120154_initialize_conversion_of_push_event_payloads_event_id_to_bigint.rb b/db/migrate/20210311120154_initialize_conversion_of_push_event_payloads_event_id_to_bigint.rb
index 9ce3b59e2dd..651c9ed993d 100644
--- a/db/migrate/20210311120154_initialize_conversion_of_push_event_payloads_event_id_to_bigint.rb
+++ b/db/migrate/20210311120154_initialize_conversion_of_push_event_payloads_event_id_to_bigint.rb
@@ -14,7 +14,7 @@ class InitializeConversionOfPushEventPayloadsEventIdToBigint < ActiveRecord::Mig
   def down
     trigger_name = rename_trigger_name(:push_event_payloads, :event_id, :event_id_convert_to_bigint)
 
-    remove_rename_triggers_for_postgresql :push_event_payloads, trigger_name
+    remove_rename_triggers :push_event_payloads, trigger_name
 
     remove_column :push_event_payloads, :event_id_convert_to_bigint
   end
diff --git a/db/migrate/20210415100159_initialize_conversion_of_ci_build_needs_to_bigint.rb b/db/migrate/20210415100159_initialize_conversion_of_ci_build_needs_to_bigint.rb
index 2f989879d8b..068dceda272 100644
--- a/db/migrate/20210415100159_initialize_conversion_of_ci_build_needs_to_bigint.rb
+++ b/db/migrate/20210415100159_initialize_conversion_of_ci_build_needs_to_bigint.rb
@@ -10,7 +10,7 @@ class InitializeConversionOfCiBuildNeedsToBigint < ActiveRecord::Migration[6.0]
   def down
     trigger_name = rename_trigger_name(:ci_build_needs, :build_id, :build_id_convert_to_bigint)
 
-    remove_rename_triggers_for_postgresql :ci_build_needs, trigger_name
+    remove_rename_triggers :ci_build_needs, trigger_name
 
     remove_column :ci_build_needs, :build_id_convert_to_bigint
   end
diff --git a/db/migrate/20210420120734_initialize_conversion_of_ci_job_artifacts_to_bigint.rb b/db/migrate/20210420120734_initialize_conversion_of_ci_job_artifacts_to_bigint.rb
index 715fe8b830a..cc8f0686841 100644
--- a/db/migrate/20210420120734_initialize_conversion_of_ci_job_artifacts_to_bigint.rb
+++ b/db/migrate/20210420120734_initialize_conversion_of_ci_job_artifacts_to_bigint.rb
@@ -13,7 +13,7 @@ class InitializeConversionOfCiJobArtifactsToBigint < ActiveRecord::Migration[6.0
 
   def down
     trigger_name = rename_trigger_name(TABLE, COLUMNS, TARGET_COLUMNS)
-    remove_rename_triggers_for_postgresql TABLE, trigger_name
+    remove_rename_triggers TABLE, trigger_name
 
     TARGET_COLUMNS.each do |column|
       remove_column TABLE, column
diff --git a/db/migrate/20210422022825_initialize_conversion_of_ci_sources_pipelines_source_job_id_to_bigint.rb b/db/migrate/20210422022825_initialize_conversion_of_ci_sources_pipelines_source_job_id_to_bigint.rb
index e6808f7e376..ea716afe84b 100644
--- a/db/migrate/20210422022825_initialize_conversion_of_ci_sources_pipelines_source_job_id_to_bigint.rb
+++ b/db/migrate/20210422022825_initialize_conversion_of_ci_sources_pipelines_source_job_id_to_bigint.rb
@@ -11,7 +11,7 @@ class InitializeConversionOfCiSourcesPipelinesSourceJobIdToBigint < ActiveRecord
   def down
     trigger_name = rename_trigger_name(:ci_sources_pipelines, :source_job_id, :source_job_id_convert_to_bigint)
 
-    remove_rename_triggers_for_postgresql :ci_sources_pipelines, trigger_name
+    remove_rename_triggers :ci_sources_pipelines, trigger_name
 
     remove_column :ci_sources_pipelines, :source_job_id_convert_to_bigint
   end
diff --git a/doc/api/deploy_tokens.md b/doc/api/deploy_tokens.md
index eae46d5f2f5..ad144946445 100644
--- a/doc/api/deploy_tokens.md
+++ b/doc/api/deploy_tokens.md
@@ -16,6 +16,12 @@ Get a list of all deploy tokens across the GitLab instance. This endpoint requir
 GET /deploy_tokens
 ```
 
+Parameters:
+
+| Attribute | Type     | Required               | Description |
+|-----------|----------|------------------------|-------------|
+| `active`  | boolean  | **{dotted-circle}** No | Limit by active status. |
+
 Example request:
 
 ```shell
@@ -31,6 +37,8 @@ Example response:
     "name": "MyToken",
     "username": "gitlab+deploy-token-1",
     "expires_at": "2020-02-14T00:00:00.000Z",
+    "revoked": false,
+    "expired": false,
     "scopes": [
       "read_repository",
       "read_registry"
@@ -55,9 +63,10 @@ GET /projects/:id/deploy_tokens
 
 Parameters:
 
-| Attribute      | Type           | Required | Description                                                                  |
-|:---------------|:---------------|:---------|:-----------------------------------------------------------------------------|
-| `id`           | integer/string | yes      | ID or [URL-encoded path of the project](README.md#namespaced-path-encoding). |
+| Attribute      | Type           | Required               | Description |
+|:---------------|:---------------|:-----------------------|:------------|
+| `id`           | integer/string | **{check-circle}** Yes | ID or [URL-encoded path of the project](README.md#namespaced-path-encoding). |
+| `active`       | boolean        | **{dotted-circle}** No | Limit by active status. |
 
 Example request:
 
@@ -74,6 +83,8 @@ Example response:
     "name": "MyToken",
     "username": "gitlab+deploy-token-1",
     "expires_at": "2020-02-14T00:00:00.000Z",
+    "revoked": false,
+    "expired": false,
     "scopes": [
       "read_repository",
       "read_registry"
@@ -92,13 +103,17 @@ Creates a new deploy token for a project.
 POST /projects/:id/deploy_tokens
 ```
 
-| Attribute  | Type | Required | Description |
-| ---------  | ---- | -------- | ----------- |
-| `id`       | integer/string   | yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
-| `name`            | string    | yes | New deploy token's name |
-| `expires_at`      | datetime  | no  | Expiration date for the deploy token. Does not expire if no value is provided. Expected in ISO 8601 format (`2019-03-15T08:00:00Z`) |
-| `username`        | string    | no  | Username for deploy token. Default is `gitlab+deploy-token-{n}` |
-| `scopes`   | array of strings | yes | Indicates the deploy token scopes. Must be at least one of `read_repository`, `read_registry`, `write_registry`, `read_package_registry`, or `write_package_registry`. |
+Parameters:
+
+| Attribute    | Type             | Required               | Description |
+| ------------ | ---------------- | ---------------------- | ----------- |
+| `id`         | integer/string   | **{check-circle}** Yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `name`       | string           | **{check-circle}** Yes | New deploy token's name |
+| `expires_at` | datetime         | **{dotted-circle}** No | Expiration date for the deploy token. Does not expire if no value is provided. Expected in ISO 8601 format (`2019-03-15T08:00:00Z`) |
+| `username`   | string           | **{dotted-circle}** No | Username for deploy token. Default is `gitlab+deploy-token-{n}` |
+| `scopes`     | array of strings | **{check-circle}** Yes | Indicates the deploy token scopes. Must be at least one of `read_repository`, `read_registry`, `write_registry`, `read_package_registry`, or `write_package_registry`. |
+
+Example request:
 
 ```shell
 curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --header "Content-Type: application/json" --data '{"name": "My deploy token", "expires_at": "2021-01-01", "username": "custom-user", "scopes": ["read_repository"]}' "https://gitlab.example.com/api/v4/projects/5/deploy_tokens/"
@@ -113,6 +128,8 @@ Example response:
   "username": "custom-user",
   "expires_at": "2021-01-01T00:00:00.000Z",
   "token": "jMRvtPNxrn3crTAGukpZ",
+  "revoked": false,
+  "expired": false,
   "scopes": [
     "read_repository"
   ]
@@ -129,10 +146,12 @@ Removes a deploy token from the project.
 DELETE /projects/:id/deploy_tokens/:token_id
 ```
 
-| Attribute | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `id`      | integer/string | yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
-| `token_id`  | integer | yes | The ID of the deploy token |
+Parameters:
+
+| Attribute  | Type           | Required               | Description |
+| ---------- | -------------- | ---------------------- | ----------- |
+| `id`       | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `token_id` | integer        | **{check-circle}** Yes | The ID of the deploy token |
 
 Example request:
 
@@ -157,9 +176,10 @@ GET /groups/:id/deploy_tokens
 
 Parameters:
 
-| Attribute      | Type           | Required | Description                                                                  |
-|:---------------|:---------------|:---------|:-----------------------------------------------------------------------------|
-| `id`           | integer/string | yes      | ID or [URL-encoded path of the project](README.md#namespaced-path-encoding). |
+| Attribute      | Type           | Required               | Description |
+|:---------------|:---------------|:-----------------------|:------------|
+| `id`           | integer/string | **{check-circle}** Yes | ID or [URL-encoded path of the project](README.md#namespaced-path-encoding). |
+| `active`       | boolean        | **{dotted-circle}** No | Limit by active status. |
 
 Example request:
 
@@ -176,6 +196,8 @@ Example response:
     "name": "MyToken",
     "username": "gitlab+deploy-token-1",
     "expires_at": "2020-02-14T00:00:00.000Z",
+    "revoked": false,
+    "expired": false,
     "scopes": [
       "read_repository",
       "read_registry"
@@ -194,13 +216,15 @@ Creates a new deploy token for a group.
 POST /groups/:id/deploy_tokens
 ```
 
-| Attribute  | Type | Required | Description |
-| ---------  | ---- | -------- | ----------- |
-| `id`              | integer/string | yes | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) owned by the authenticated user |
-| `name`            | string    | yes | New deploy token's name |
-| `expires_at`      | datetime  | no  | Expiration date for the deploy token. Does not expire if no value is provided. Expected in ISO 8601 format (`2019-03-15T08:00:00Z`) |
-| `username`        | string    | no  | Username for deploy token. Default is `gitlab+deploy-token-{n}` |
-| `scopes`   | array of strings | yes | Indicates the deploy token scopes. Must be at least one of `read_repository`, `read_registry`, `write_registry`, `read_package_registry`, or `write_package_registry`. |
+Parameters:
+
+| Attribute    | Type | Required  | Description |
+| ------------ | ---- | --------- | ----------- |
+| `id`         | integer/string   | **{check-circle}** Yes | The ID or [URL-encoded path of the group](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `name`       | string           | **{check-circle}** Yes | New deploy token's name |
+| `expires_at` | datetime         | **{dotted-circle}** No | Expiration date for the deploy token. Does not expire if no value is provided. Expected in ISO 8601 format (`2019-03-15T08:00:00Z`) |
+| `username`   | string           | **{dotted-circle}** No | Username for deploy token. Default is `gitlab+deploy-token-{n}` |
+| `scopes`     | array of strings | **{check-circle}** Yes | Indicates the deploy token scopes. Must be at least one of `read_repository`, `read_registry`, `write_registry`, `read_package_registry`, or `write_package_registry`. |
 
 Example request:
 
@@ -217,6 +241,8 @@ Example response:
   "username": "custom-user",
   "expires_at": "2021-01-01T00:00:00.000Z",
   "token": "jMRvtPNxrn3crTAGukpZ",
+  "revoked": false,
+  "expired": false,
   "scopes": [
     "read_registry"
   ]
@@ -233,10 +259,12 @@ Removes a deploy token from the group.
 DELETE /groups/:id/deploy_tokens/:token_id
 ```
 
-| Attribute | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `id`      | integer/string | yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
-| `token_id`  | integer | yes | The ID of the deploy token |
+Parameters:
+
+| Attribute   | Type           | Required               | Description |
+| ----------- | -------------- | ---------------------- | ----------- |
+| `id`        | integer/string | **{check-circle}** Yes | The ID or [URL-encoded path of the project](README.md#namespaced-path-encoding) owned by the authenticated user |
+| `token_id`  | integer        | **{check-circle}** Yes | The ID of the deploy token |
 
 Example request:
 
diff --git a/doc/development/code_review.md b/doc/development/code_review.md
index 94430f6f7a8..48c43fd46c3 100644
--- a/doc/development/code_review.md
+++ b/doc/development/code_review.md
@@ -39,7 +39,7 @@ or more [maintainers](https://about.gitlab.com/handbook/engineering/workflow/cod
 
 For approvals, we use the approval functionality found in the merge request
 widget. For reviewers, we use the [reviewer functionality](../user/project/merge_requests/getting_started.md#reviewer) in the sidebar.
-Reviewers can add their approval by [approving additionally](../user/project/merge_requests/approvals/index.md#adding-or-removing-an-approval).
+Reviewers can add their approval by [approving additionally](../user/project/merge_requests/approvals/index.md#approve-a-merge-request).
 
 Getting your merge request **merged** also requires a maintainer. If it requires
 more than one approval, the last maintainer to review and approve merges it.
diff --git a/doc/user/application_security/configuration/index.md b/doc/user/application_security/configuration/index.md
index 4d5e3529762..36868cefc78 100644
--- a/doc/user/application_security/configuration/index.md
+++ b/doc/user/application_security/configuration/index.md
@@ -49,3 +49,6 @@ You can configure the following security controls:
   - Click either **Enable** or **Configure** to use SAST for the current project. For more details, see [Configure SAST in the UI](../sast/index.md#configure-sast-in-the-ui).
 - DAST Profiles
   - Click **Manage** to manage the available DAST profiles used for on-demand scans. For more details, see [DAST on-demand scans](../dast/index.md#on-demand-scans).
+- Secret Detection
+  - Select **Configure via Merge Request** to create a merge request with the changes required to
+    enable Secret Detection. For more details, see [Enable Secret Detection via an automatic merge request](../secret_detection/index.md#enable-secret-detection-via-an-automatic-merge-request).
diff --git a/doc/user/application_security/secret_detection/index.md b/doc/user/application_security/secret_detection/index.md
index 2a06a5e22a3..2069db401f0 100644
--- a/doc/user/application_security/secret_detection/index.md
+++ b/doc/user/application_security/secret_detection/index.md
@@ -133,6 +133,31 @@ The results are saved as a
 that you can later download and analyze. Due to implementation limitations, we
 always take the latest Secret Detection artifact available.
 
+### Enable Secret Detection via an automatic merge request **(ULTIMATE SELF)**
+
+> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/4496) in GitLab 13.11.
+> - [Deployed behind a feature flag](../../../user/feature_flags.md), enabled by default.
+> - Enabled on GitLab.com.
+> - Recommended for production use.
+> - For GitLab self-managed instances, GitLab administrators can opt to [disable it](#enable-or-disable-configure-secret-detection-via-a-merge-request). **(ULTIMATE SELF)**
+
+WARNING:
+This feature might not be available to you. Check the **version history** note above for details.
+
+There can be
+[risks when disabling released features](../../../user/feature_flags.md#risks-when-disabling-released-features).
+Refer to this feature's version history for more details.
+
+To enable Secret Detection in a project, you can create a merge request
+from the Security Configuration page.
+
+1. In the project where you want to enable Secret Detection, go to
+   **Security & Compliance > Configuration**.
+1. In the **Secret Detection** row, select **Configure via Merge Request**.
+
+This automatically creates a merge request with the changes necessary to enable Secret Detection
+that you can review and merge to complete the configuration.
+
 ### Customizing settings
 
 The Secret Detection scan settings can be changed through [CI/CD variables](#available-variables)
@@ -380,3 +405,22 @@ secret_detection:
   variables:
     GIT_DEPTH: 100
 ```
+
+### Enable or disable Configure Secret Detection via a Merge Request
+
+Configure Secret Detection via a Merge Request is under development but ready for production use.
+It is deployed behind a feature flag that is **enabled by default**.
+[GitLab administrators with access to the GitLab Rails console](../../../administration/feature_flags.md)
+can opt to disable it.
+
+To enable it:
+
+```ruby
+Feature.enable(:sec_secret_detection_ui_enable)
+```
+
+To disable it:
+
+```ruby
+Feature.disable(:sec_secret_detection_ui_enable)
+```
diff --git a/doc/user/project/merge_requests/approvals/img/approve.png b/doc/user/project/merge_requests/approvals/img/approve.png
deleted file mode 100644
index e2641f48c7a8f066f7d7d862b6eb5d85a2f10689..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6655
zcmZWuWmr`Gw;e(dkWyqoX#}K(a6r0q2uTTtZlpT}grPeex?4a*gh62Fk{Y@j>6Xrm
z??2x6-g`crvwwT9wf5Qj!+F;8oG=w-S$y1QxBvhEUtUg14FEs~-N#-JG4AhQNM17B
zKQJxCmBaynuQ7PnMi1`KXwGV~5`c;Uip~2t!%9QjMO#Txz{K7bWMpb@YzFeMb+|_X
z074!D_o1zsixG{7t&N?tfQK;MUkHKw_)nUHj^;0j%X?uuZ6y^NNqZ+V8XgcB#7QTD
zOG85=<Ya0tpe7~rZ~Fa7n9kD0#X*3B!`<B-<o*g|?_|Nj#m~>r!O6|R&CPy~V0ZSk
zb20K@w{xcdm&ku~q|BU6oU9yNtnBS*{^%MR+q=35)6xBD^xx}W?`h^?^>-&b=YNlN
zKOo1S3I`X6ljFbI_f(-jSpgL*4>KEWDJxquJLmfzB0M~NLVw}^U*+$P|6uC;&E(?d
z{wMPvm47pZIQ|UqkAeQRt-rGO>k`2g;`s0CMR1eG;>!U541kKFhV<3d)#b(I&CSj2
z?JboH5)1~Pot@p?-EC}a&<9T3+#JmuU7uWEou6NLdwXAAUEbYYr0Y{&ELANoEm66&
ztX$o7c6H9lXx*GGd|SJ?xn8@tyF0qOqw@MG-nKO`FfcJObvij<Q8rsKbL=s4Oy$;j
zcXxAg^7~-_aJkxfWo2b@`*4a=^6KhzaOV;XHtF8Jki;HNP(q)+yfe#Rs0l#AHSo7~
z58|he%7+hvf?#v<Ix~VwU@)Yzpm#ybyv$3UKJZun*W}I1^J*U?2)RkSkXtjmC{Hp1
zGh4ixN6nYEAU7|pezaZhAMqG`ZLHX{cSGhap6p*=QGJ@Y*&ju<AI(Z>UalgKe_yw@
zwk*#b^YVtmCVu~@8e5+k+Kfx9GY6xN@9uX*<u`D5bvZOVRGhGxx<6E93|>Mt8G^xY
zB8K|bHuSzDjr;eP%$%Z~miIflYC@o8hf{;c>%W>|JA=b5sLk0gCi}I>jg|F^FBNE^
z$!6acYr2=*)#gH?JKVo6d#80NyEWgQp3a=@g$n~}Y7xT?1+ohA7DmvJ_Km*TL!ZEj
z_Qh2{y@lq*Q&Sh@{@Hnb-22Oo?WSTF1Pp#On;zkg{F=EPSu@8YS2EsKxm!@a9vsVK
z5Ms^)o*q4R+-&CIbv{M)Stj;og{)&HWdHoqlV{1L+r5{cljF<-E*_tuN-rsq0q5KD
z3!<SQS>p!jV+}B5cKb&5@Z=1li@yA@J;&3aY*uomVz0cqI;k~naQtL$VSZx$Ztv$v
zW>Z4$7%`xGZ*8e3u_-sQC9h_@$p!4S)gD^b*?h8WzR}>=*!jydDBBg;4ii5bE8uZP
zY8wZH@qp<A7XxgJOoB!e6Qio)ybq?4RXI~X8)pYUDJS-i@WuA>nAHu{gbugQ<oh9w
zee+k^vLHqlseuzAhTx)>26L|th;LQ+POqJ#qkLH{kAI61guf%N%RlE!kU1m-0%q<k
z3V~>vgjc3In?N8YA^z50hG0lkIgfdhxF0Jc06=mqFD0(wF};)SC-+W=wCh#c{Ok+f
zDZ^AEC7P)rPkGADmpYYC(YM*~dT4lDWVupnB0I2{2pCA9W>Ou?!$Z?bQ??H*a9PxH
z@=)IkP`d`~Bcd#~zhbQYbfyVxYt3G&3$$I&&N=UUr?z*JF{rQE4g!t$eD{%8@!lf*
z>$6w$>f*2S=)%3&3&fx*p?J8C;<TWb?GIoG8c-<S@<)k(Cwr)XFoh_I#<E1j%TeVA
zxA7|EUO@O0Y^)?MkTnCrBNk_<!~f=I69FlJB!4UXCEN8Ni4yvg0(-~R^%NtTn?k6a
zK^TM^GNs?X7wq^We8(JnUJ{1LZ|Sh)Wvtc`b1k<^tF`S3uE~(a>v;-<&E-JmbDbvD
z1(Vlm!Ba!;x+4@F9SaW_AbC?MrMsj`HP!e^FBG68Yl%c9{ow{AaCS>Non>PK`ZrwD
z#K87n3@jAyU9w%sh~Z_rQbp*SBu<^uMsLf<0$HT_B%r*ugqpsUj6&K^%CwkQBO=-m
zZa`)V!sROYO^tAnfmOd;$sje^P!A~_lW>`g`gO&TP!liIZu{LgQMIPe+i%LAjkYMc
zCis00Y7$LWmX2T*YtvE)#9bJ3$nGpiU;;_#2xakXom@I;Igvs?QNg3}URQ-gRKbo<
zPj5Z?YfjyVGa0g`s)SV}p7X=C2N?|POQ{u1Ul)}#cgSA%%k`W3+MuW(HfL>^E=~Yr
zxPOD9&zqpd7|`RM+x+f0QaCQ*4R^%6nILUrP%QuUw82&*{mm40$?j@@`<CAFsm;%N
zDO^4fwMOIh1C0PNFe!dahq1|$rA-iv=281EvDu7Ca!?OG6nl8tX$azO_7uqZ4$tv5
zYPw^7-s-s~vUc(c)!;F$JL5hLp+2E3h{@FByf(SrB&1C^HMQTrb|gjjYW$s{R{XJz
zY7I4wY%99-BAi)<$@-4eHh3OuWSw<cy*pX<;p)H3*+-nN{+{oeDEsWtljXtXNK*D;
zV+1=$@txJ~bpVrTak4Jb`?7s^DDwrT@{pQYUhA$(^r=CRkA3dXEql3cA+{xMOk08(
zwgo+aJ6~J<+tI6*l5=Cdgakb<128Y?XRYqX!1`DEb`#q%p+;7o5hIzTa3NY*MBWg^
z?1Ft>RCy{4ON)!fO)=qYhGNl@Fw#=TIj0g6It6-vs$HVeL;#{p9Di)@2r??I(j$+>
ztvkrIHPrMVPc=+9`=aEd6;KoAarLmrq-)|xi8jH5?_&Cgn&pb^g#kC*FM|SBvlq;)
zFZu%)uJgqLYXGZ=yj)NUByK|&A{vHpW@}qriW60i+k8WpmkD+2OhIMkT!MUfdn>P)
z{ppt^W@YW-%xy<}SsT&kzV%73*9(xHj%0rU%jGRKYZ|C9DL}X4p@opv&P=B>Ybc9i
zy+{$9CshLC{`4KJ@hKyq6*GGkjR}rdf+9?c7=QAtpWuf}EHBd5xO`;kD5-JJg4;S3
z{YsNCp<%b(ch)IbBVg{c6cd1hvkN6__T97^ZL!Wig+_2QWLHRP&Tc<{jQI6rybrFZ
zw|g4|O<+qya^!XSH~+WKQv##cs`qQw9k3D{xD@-*Xc-JoVsX$%UN&QsHgThD$wj(C
zNmwr?2332d+}YD9bl1OoC?p#sI^c-2y?6H3ZNRTK8*RsS%dZ|49oIBa*VR>D;30**
zPU>@1P3h{|JSUb>5L!}-=oQ~8<~#vofW+FfHo|ZTfAcW3W(Xa;#G`6!@+@d^uxT0b
zXfxr%^5LOU$g1bu4a#b&C4|bfkX$1+cX|;!hBdS?S6Fgm<KKc1268z4$iuA5hiwny
zl^n1hu)=nO(w;dz-l)$e6(ZVxaW~p;F{rhoM#*1<6h@)V!x$RAmDNH%nHW@6YA4`5
zti-j&n=;2a;4{!iKK#InIko#VKDHj<_-QFGxX^ofGWh++z_0QK%-ydysUM98X&w>C
zoH}(wE$fh!mZ}z{ku0!VJp5Mu=3feX)_j7g5=Qn^vVjFWD$Mx`z;bG><RC*%OCE}M
zUG+YAhW^h1tg~z!7yeUR@D(RfVmSKv_&WmI!t#q+I-%T9gs}c9LX5K~%Mc;=fVmG1
z#97PYKQR)fN|@ex#a4w2%#jYa%q?)%u_rS6t^{XeOXzo9KftY2^*j^tsQ~U~FZ1$}
zmr}(#7$rfS(g&_<bzg)EV9S0Cm^5Xc$QLD|h+_uzmQ*MVu1j0{Gb$@wYMkZr8C;V&
z=s*G$V7u*9O9XtMC{Q!6$9wc>v`NIK0c&>={6$e>-282h0TSwTpvn#@_S3iJb4I;c
zM*5*<&kZ}#s3LKjZ#)#<;!-?xcoqBYQ8VLOXKD_fT<JapVfn^Yx1;28b|K@3PCPbO
zN2ducq0A>a>@Jurb+K6eJ}vEl8Ffc?ja^9QVjc%J{X;Q!fAfl~x7{zi;Hhc`Y*dlg
zB6V1Kzrw0hR&r}U_x6q*+N+r=1}e}t&JNvphjPIDAN9q%X&#)bGcUE~5`MO1d9Ea^
zV%yL%ZZ)1pjz*F-rJa9~;_<wF_NhZ0E)Js7zkq2qlR+ZbPDX0q32xCy0sr+#hb8pZ
zB>2tfQthDH2KoWk>Y;Oq`X>}*^N4^~@W%&2W%ZLG45yggx|;p4+T@j7;qBeoGxi8M
zcGJWQ7WZ}JtNa`<n&Vpa-V(bft8cR^e*w-T<7bAM+cmV9&NSRTQ!13(rS0A7`qm;p
zZIV7Cqez`|!BLy5LVvDTdeD4boO}v?1qFLs5^6Me_$ccH*N2qqvOZa#d*2t?+_;k;
z)7&k|sStcNl)z>mz`u)nQ&|sl2}Pi`{2ue_6;OZd=mERCjJ<g{L|AEsm-dt37b*#T
zKcz~C!_#s(0eC+3T)Su?G~+1c@phh4pVEv(Vd33%K<pQrMfz#%P;VyFnw@IWNj|Ui
z3>!p><{%)eJl0G$v{pEtY3*kbVM_qxfPH}}o&&R<YF3s~{tdENbO*jEr5g)EFYaW}
zx0|QXGIJsJf8%-nE(d_7hj?^YgpF0Qj)&hR-G*g9!9`lgr&U&ZNtYJ^fE2XUX{Hx#
zG{>^J+Kj3iX|fh2zzEUIONOhG<F`&DdaKULqkgovIyFV@+bHSo#q6sizlm;QJj9Yy
zacOu`+mo%J?J>e|^`InmQYw2{9$%exyPk!i{7kmZ<injd-&PD3I=5b-LPPro_p>Na
z>FfbRr^M2L#F=L%(o*2Z%FM$4p0drU$oqst9(pq$r4M=Ax2&=aKE-NvytzHDZBx#y
z+ni~y#CACeZF0FZ&>UC-Z(ICDiJk{w$`k_8svI#SY3J%22oi1-A|VQTpIs#l(kbJh
zlaYy6`BR=qUuUh7#Icp~FgV$J^uT3?POfLM+YB<PYo{+$H+NNmR~=;ED(g>xb#&|x
zpCheb+FYV`n5XnMw=h%>v4TM`2=X<j3d6k5h4oI0eGG2z_36uo?^k0wt9OfQ3aOVZ
z#JWL*(GB`+7LmO&R0@Jw<z2%ETryM3tyB`d$2k+f&r#d&WAH@OVh}bDfo?Mu$Ap5B
zW_%u@y<Uhiwkp;K_s+~r?~kGTKL+lPFZ|0M-rKwXn7h9qU$B5AECp&SxnenLf1Aj^
zP*tjpw89jb5(1PvBLy=jGUIMJrUAWolY&if-WnnQH|EODG$}Myo7O>n<&B5B0wxbD
zIwyk|!Hj51xQvj@+yF;7(KCGOgLrAkJ08~@xiQiL4eIs?QL(sT-SDRH0^QkC-v*8d
z!kJoyT9lvRV9JXGuIa5gwMqT;E5i>yP3vh^1569l>lB3${F@e~gdiDDjqgKETy@lh
zXB4W;iIUrxgHL)TAsxg?J=|aLT(u*+ib+hjBPt4tC73aO>n-Ohx=6;)J4(doVu3y5
zXnHy#c1GULh@=3G5^b&&1(BErUu086e{LIJtMqe52J~yGmglXt7JF8t3y7HZ9Nk4l
zFfK)lQK<>xYzFKFxe)L`oIbAbU7hf~MhlZvv9uod<%%H;v*_L|;m<d26aboV#baTh
zuMu&iPUz{aX)N&=gL%kyz1V*r%`N4UZRm%ooR9mFG;)7mR+h7X2Yo(WHT7vFtv-{4
zaMy=B5pD;3oli-bCkxsUVC`XJ8!<{b!=};rtfUyCtXA+69Gy7D6?)6?r9T>20;==B
z*mF=-!%&~&6qgL&i*}Kvn}dYmo`$sbjQPGtS>wG?e8Ip%sPt9Y%hTT8x4p;9XZP{b
zaOU7x-Sx9=#Sekf>q*7k8<JfSE$`(%^$~mvB+`89M@>wnZ@{u!@7MZN)K6M2>e<hM
z*Y@99N8-PyaWgKE0Aax{6;fE8Zl2aZh5hxyxuk|()mhh0@ePo&u~fl!DQanhGiXUP
zWJD_V**#7_i3%9?_o?uzSVlftIT^%m0Ks3Qj5ZzW6mub}x06P^TE@&^Q5TJx@TCI8
zR~*sNz?qEf)86|p$;gOW9(%c$z>S)!5R}2>NXc=CsMs_NF=wJKXtMVeb5LFC6HsZg
z^Fg`v+xM!fsGkgi{N7E)x^`#nGM~JGvgaN1fpN)2zIqxuWP#J|cbH0y8iXaTk4%U)
zhYAusD>&Jc0%O$k^1Ii}r#vZ`tGAwf(bk-kS#Q+D{m>`Iv~u(m0X-jtB{&o3(=-aM
zeYhGIuGxOUd@0E*`Eup0AOV|p*{pRko?YmZH#xzUp7xGhogmQVxc7`REUGY&i_Dc#
zE?7bcylENXr?0`DQm^|()7+s>rZ49pKFaijPb{(FJ>8a{`V)pMz<Gx}cs5&gnk%<<
z<ZFHrv86pO!Z2@{2QXhIOebKEDp<_g7oTbbgRDM-MY>nDNb9a=_)rV<EHza9=m+79
z&ptHbmWF0JX8Y3n_~&{w@V=@r-X3^X+<~#rH~0+XK6taTCyziWXXc-m)Dj^xmT7zT
z5zYt~k%#YIHB2(DxLxHJFUv3V&9}<gc+&D#Ev8v9d8$6;me_DlkpO9RuS)EKN5fcT
zNm?mDtA<O(+6{(k5Bn5L-j;je>i453I;oURVaA|l&PGxo3sv~mT%gHf0`ij_9eWf#
zw3&lFsyWE9M;j*zrG8*uqpGryLMbCz8c<_~Plz`CSrq=U%C9^iq9Y23llz2BdSA>h
z$+y%t<$;m~h+L1~eGgMVagRAQXf)a%Pd=_8fz-l%*e+&&W*C84{)Djb?6*VC6bweT
z%O9jrM?k#n?nw;7io^p4x2xvCCb}s=L^AbGW}E|(X=cii5kyvnEiwJR-x>B%WemOP
zt*hHs8i?woBF7T!K_YQqa;V)CDQEiB%hIx^16mJ+i_vBJlIT`L*N`)%*6D}5-?y;J
ziR&cw@lX-$!g`0*?CXte{#02+?VY{fwCZW}Kb&)e1ku7DDVoI-Z^h6s4D89ora^y|
zk?Y&Iy@xU@$!znHcSOI)^K4?s{w*P5x|pM70p_eT9o6NRU3IXc<l*?`_1pZQ%#`9+
zyqZv>Z>`;&MAPw)QuE!c?*rw9F8#UE`vlvs5Q*qK(emU_>#s<hrTFiUf2PGx?Y@he
zJQk^l{jA|SIRtK%7Nh@d{46;&Br9y5i}~q0v8ydARfjc)I&U?Pp#zdZrq1Dl3PA};
zZmq4yj-ZrP2Z1U&9H*Mf>QTzp0+15hX+_K<PoLg+HTY18C+;)V5(V-xEcp_J=t3$&
za|dQ9chOpI9q*%lH`dIz0YQRVag|b%GtRy}i1oQw6f7EJUe|UJED;f0)No!jcy*Fk
zFP~F&u#!^O($R~XT+?eeCS?useOH9;__57d0Fwpi2aRq;`ly`AYm7a;%mqpXskiA3
ze1WO>(ceOB`6{!`r_HmHcY1h+U$I%|6Z+s$EwpqIlWq6&3^T&ti;Rk=1<6d?8<XV~
z4_BvB686I+m~43kv3j4zyZ%r{g_?X6lVH~m%Tc8qc8?Qla&axBm++$=Ew1X>AhrwR
zMhLY!Xy737%ZED%juP5$iR}B^fSP<mi)BoUYEh#24D_pp^~~#(E4g0eG%UQm=@yUR
z)XMn}`f2r3Bc#wtq?ruQMga^unhMH_G|-RZH)E!JK9ms6UF3tBVEwZT0vT)V@KZSr
z{fv&q*UM%C-x=CDu{OE&;8RAKZM`mmgp?e)i7pFO2;w&aodv6nr{>$<B*H2lh!{?Y
z1?llBTvQlaX-cj38H|AD(+_);{}p1iUmJ%i#2%XbfDCxB*2>43Lu(6kz=?1a57xfI
zREK^2>D7fGdA((D8cDr5ad)0El$0>XILlhkinerjmqW)ohoP4Ea?+k~y7kau7>SFs
z$q4XnZarpfCOWRnblQY8)dq59Xi3U#3$Rf>V%3Z)q!Q@+G6WNKOIDATOanYklOQRP
z^@~`*$i5+;Ald*%w@SG21G5QU`fsT{dtM@fe>PV}>QFLK^9aKs;U!g5#`m9qU|pJ^
zh*Rq<)W-?oDXc{qnkc-(20~XwwDiItzW5XUB)h4AOkwAqjUy{Jw8wK8Xrtolu|;%y
z4eXswt(pV3%>$0Jn9Os=Y^YI>gDr~3Z~EM0Ydb<~bMf=1TM;hv4eT<q$Bw0+4IMz5
zn|wbylFQkjwx1lWfWAvenDrES^L;Q?E!|)uxp<2!4O=YKxB@QWL{sp0z2Me>h-xlV
z;<GW4SP;NR*mnq2VuJ=KM^&ijV>`#N_^rMv&jh-GQrzdWvu8)rM4CBAGTkBKEz9MW
z^rKv$FKgXsSij==b+!4QF*NM~0!s-P@{FMSnJ-7gGRU1;)qYZ2cl~}x6+<UCeG?$E
z=b`b2k1C6;5$QO4SZqes^R+84@>6uI`@FHhea)qZYZ~%l_wc23kIjmGt#Se<NynY?
zdf~@Rc>7eGz31Dr-ys}0zbrJv2dVR}7c`n;fFECY9wio9EnT3K19eQ}9OI-rrAhBY
zBoGSfF^FI*>XN>FYkEP65L+IG@8de_Ai1J_1hYqa%`R%*9rbsbLjOVf*P)4z9Qa4<
i?+X0Rj^q(N01%%sOgW!?A^YdojJ&k6RE31$$NvF`5YhPn

diff --git a/doc/user/project/merge_requests/approvals/img/approve_additionally.png b/doc/user/project/merge_requests/approvals/img/approve_additionally.png
deleted file mode 100644
index bab0cd4e041eeaf228244bd5f224df1e5786cc62..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7803
zcmZWubySqyx(7izL{M^u7LZ1e7(hx=x)G#X24rAJ>24&XJ0xWoKqRHR1%{3RsiC_s
z-*?VE=ez5^>sjyq?I(Uu?Dvno)*G&-B1ecvg@=ZQMyMb!qk)F@2=stGaWEd<-~_Yq
zhXvDGQdtrW4Hk=kWBT}Ej}Fn0lR~Q;rrCPHnYLPbE_%xEM9du>xJ)e^%`Cax9h@G#
z(9lHPMINAorHd(@yTeB?M8sW;;cpL-2mF_sn}P0c7Z-am20djpI%!8|OF98Ael8vc
zaXdOYI#Fi}D-jJD*?)&W?8F#sTwI()xVhcj+_>CcaXC6$bMp!d3v=`Ear5zUK6r3K
zJisod?wnu<<G)D$mq*4DV(x6~<YMaxru&Q6)XdS<MT~*ruSEZO{#B=?yX}87fg%5H
z>!CsJzbxFmTs++W;eH4e{YxvNX6tVGQBTI!!4eF4$RREu$SeA{|Npc6H{(Ad_5T~m
z%g6W6$bVS=9VyEFR|EfO=wH+NTl+9BaXeA(|BPN7Z=zRn01XWTP3@i5+w1G=o7-EU
zOY8mp1wTLk<>lqo_0|3T{pRK-W8n1Z?d{#&-TC?Xf~@ZC?cwG9J<zq|?sADSXwJ*a
zE8_#8F?#yu>TK!qo-uN9d1Ym7ZS8bwxYoDj<oJB==DMe+`|f6QfA64w`{Kvksbt6Y
z!tsq&!P3Ra0rH3I)YicakM#7xm3i5mJjq1)+{x9#;v0;y5qQ$ahK>Z~NBn|TLBYYl
zHZQCM_<vgQ&-GW@f8Q86xSg4q0lE)Df~MyyJHBcW-X5(8m{eb`)YPq?qgKY2V2IPh
zt-YT9n3=<>!U5Yr1pjN3`-_c@+q+6{wK<S7;^H1=&Y!z{5^TBL(cJlSVTFDvFaM*U
zBeb=+VL7nrPiwyY`qA~uaNE$(VE)JfKffY8>cd1^LDs=USE<W8&z3*)eJj5kuNOv}
zW9?z%`*+8at2LHD-{F?Zy>E$Iy=xnHTWb&j{?v}`t@!lXyqV2|len<yki4-EH7#}Z
zKSxGJO!)bSPyW<Z&*x1b#>U2NzVw=!8uzES4J;m&`H0r`uitJD-CphSwQd2ECND4U
zmb5HloL4`;Um7l)%=_Fj+;Jqp?{4AxYyNzHZ)09SIHK-&F~YMsClnbJ*L}A3YqV)$
zzrGbcEJY<}HXgRJ*)%JfFul<kyJ8865JR)uY!;9ygO2adSC}3xtfq`ix@~v#jvyKG
zkp5E#OEbq|0{jZn3g2NBQ<GC2<)H-g87IFBfIi&^yU6VPf{L{>0k@Xj!U~O`>HUd0
zrTF3VyJHI#F?h~S)zl1TLQYd~ON6FSYo<Riqr}Yb`_$a#Mo7FBe0jgJroLfp`MoVX
zvE933PNQsHxozd3Z+>m*Od44!X6oarwxFnM8aaU4*xWE4*v(BI5wQH}2)4Iy3Ys1|
zRpjSi_Y58{FrCT!mFGd#3gx#N-iwHecWFR&g-9w4!ee%aQj#Oy_oIaEQ%KQz%N6;V
z8aKZ-b|!*tY?BrOi(mm31`6drh|zjIBZ@}{Mg@%1&h0B^(a<QJ6l5f|+-Ff4Uh?nt
zfjx}EGZP6xK^G}D^mZ@nlBuF8jJ27lT<>{w$nZ6K<Psgo%Qj2(A{)lB%Gymjt6oL1
zzSEZBsQFE<AvbG>AECrnQ&XcoYe3Rpqh=Md6=>?_yCMD#Wm5_bg<6l0qnbD7Au8bE
z{e=B}x6fJuZspA>;kZnuC>~yD3I*t06yQZSk$Gr1tfLcQYW8n!Q`3o8N{V>-QZ=$x
zZmUaN^IhX1p!v%#-ozeaCf}s7y+#R&DEcP@De3>^_z(5OJvj*P^LT1ezFhh+)7H!|
z@2(#}K|}5ELo<<irjO$%wJ$*qKy&MK6ei~5dctH0NSOdWR_{i!zsPfxYG+J=?P~K9
zi<Sz%16b_wHU66pL4*42wqskwn8PYxgdg34)!Q+N73)hCd~Cg%H;+MIa+JeoNo!J%
z<3>&@o<84IZBv<eUaKteP#+8#pXnD~QKX8=1HEHq>P@6eoj&7s2n8sNCi_D3=b7wz
zp?BEpg-zvNIz|f>jrZxT!^e;8#>o|rBQ5rgW{E%w=<i#tB%YdY5YwfqtnyGaWK$A&
zXn(b&=4N}gwQjY<0J%dC)~M5j&No?_d5SEHshXi~T3*_Tt}SYD4!FT1@^0rCPY|%t
zI!ckNmxi|q>MXoB21b(=ZY(lquC^r}y@HAw;#xY1x3wRwQJaxQTu3C66n?lt(&ahA
zyM1v%YwYrSAE~;R*%PmOd0ZaC*=m$u`X>B3)*%pJ`}1==meldEkIpSfMyzmaxrdu!
z=q<_KuA){|nJY&fjprzTsN<I^E;nj!5O_^nyX{S8_sh($@7w!<eA(<6?<!M9I0=#(
ziYtiW`SJ$$vD{>G{($Ug6}VuZc~pUq#ZnL0Sf{AUi*j+>iwV;hjmNGMxafIdT9W<4
zlNz<gz{O>XQ`ql|4V4{TxPJsXq(-O@?H_&M)Zy$=nXgbTohmIIZW`VOhUOPHOdJxh
z8=h8-m)We$OX-ubE_n}U>=w?)?`M1xmLs*a_Q+??Jfz4^eCK>&{)1cSm5fP`@et#h
zhdW;tvK0VbB}r39E~}f!MQbYdbU&Ad{W(=c&VO><Z-jN_xLHp(mSF9+CeDpJwa+6M
z?d)+Ov5Uzw_&JS4O06|LW|M0O1V+8~P<x6)p)!>~D6rFsHX}ws<gGG!N==8M?PdRv
zGl(EKp?g}T!tQBE-3r^a86DWSA@3P^05X5>k{SU+bgOeTb?&4W_Tp_>JMrdHasu0S
z*^!@0juJlx4P)8;Q8EFa0SJ`m0En>G?p&lL11OT`kYZ1uEz|aosx!g-2u35X5RfXG
z7!aZ&7mKW(z9OCSul@)ZPV1i*O$B^z-?g=;Mv*msK6jt*DUKicU=~~1rx`_dyU4ld
zucw}HIfAw7`$Va6_?*P~L-h4h4Vo4?6^<~L$L14dDHGPdpbWBOGI~ck3jv;0Gd`4a
zx3+W3fU!{m<?P$uNfB-0lT+)b<BHSe#RFjwcW40hCf3x_B^szsPc)bn^z4(9L=g?4
z7|}U{N{KTpU6nj1jATzy2q@F8!0bIXnAg89vN>iY$GU4>`PO(t*e%!37)_<%MxJaS
z6LHrjXj~&roU(jSUiHK$Jgz>ZKHI(np1(qdequf<YUt1Gn;LXoLw9mkS2X46^;9f%
z=yP88?l+lNc6K*U!NUP9wu5pnvN8=$kYgS-otGnYiff8gsVmdelO7lBf$E{4vN9jO
z&CY6Boy0d5!{_VIjFNe@_L%2zL2`nKbPbblwi5&UJ@S(f!N=7EF-&VJ#xHP#$z*4@
z{nH4-p!Q6MEjZETYvgJJankXft^2&VBpM5_77Jfj9X{bHsT}UWrY)rxciZw`AiKP_
zwnLA&w^^>aU&lS6*zrB&RUq9sKn-f_l+ZJ0&A{?^#@*-2Cbe8C6bXaAEd>l2%|q-k
zQ_l+57<C2zIH%X{_GjCVDf}8LiI%(PLPZCT2B|~o;CgYdNWSN?P>JN(G-=m{v?u+(
z(^5y~I{C-&cVTVhtw^L$&wfxcrWU(M2TF*s-Qqhxl72j@xm-7@Z`qCo4X`&}j(3bf
z1DT|hUa~m(E=y^$4h1Y{hRmFOik7rzAcEL+Ec?l2%x>^VUTK)HfMsK}(WVDXf1X^D
z4reBv9F}gZ+=2sP*Dd+Q6E>*luM+r{4AX$mIIBpR`(nj&=K-MpoGn|?1^Ka0+JnHE
za3+{WtI~;{oPFXWR+*gneTG?rFF1aF%ww`&e^BKOJ!6xqQ#WKS5L!Q(uq(+9!W8_)
z&?c4$;M_akIMQ=EV#Z_1WC?}(Yo#!*m3uLfS=oufA&}qtO=+Hw3h!{mkx-{drwh~z
z4QkwCbtl&eFFfgK-VllRyO7?Kb9Jf-0YT`mFyM@?`Zfne%&7zWAFhKJ24~w_G=fi`
zSNTPD<uiK<YXe7uGm?3B%Zf52`SZi!FCy?yHCi<tz9ki_EgaF|p<~)~HNEEej>+Zp
z782BjH>D@c(Gw9diK9IKWqSktpdcwFMc7`2>sDbgr<bUiCB;$_miC8PynJ$@fto14
z&7{ECL(pZUbb6*w<rktWCU5YE;m@*+NivK{qL@QUY?rA>pb?A($|qk2Tt<VQslO5)
z^vA5oAc!H&B~f?^=TrJ6sFE$7*{A!nwB;(qLV}<Q?Hs31F+?mGdWagW#zw4M<y@qm
z27b|6chk#YtV&2S>}mC5fsWf?8C0V&9rluu9(R<zR_6Rz9SMM?pJ%@3KY0>QTh!XD
zp=55*NAfAsoP}U!b97?6JlKlsZSW!V?QzhqEnFh?mr78t3XWS|$VIyI%d||(Fi+gp
zxW|V-R?XykeWuaTsm|g}1$tsas`J-pa_LsSzIw(=sB2K%)6+v8yXGTT0&jpLe`CeA
zq^y2=1kL)az0QNzU*>FGJTIuYVup>((^v=FSvC`&C)N^R{v16tWXBeCY6WRN@?&c0
ziFsqW!L_6&KxW8jfa8w;EK~(UctJyT2K|dhWkAm_te1SRt2$04&7W80+DAe#p?)=F
zPmj={EumB$xY=!5uFN7apFGvrdx%6Cgo&-z8(fcDI<%?O7)l}{F(6}~Jo;I6_Xm6F
z(Itligo?<FQ5VxeqU`C?mLb<PdQVcMgr`>q<C8n8+*9&WH=K1an~9W&9<kC;Dd`#F
zM5H~MZ^V-x58gl2;%|-HvS55s@q&ovT@wDewbB~o`P)Dx4NbrNE-gGIt#P-bE;d`y
z+WgwnjJG71dUC+E5gb2>VdpU69aGh;Hcsn8xobs3RKeHuW4F$jizr|x3^`FlLkdS3
zm^k`jLm3o$$@_`kP#rxzT+vrqkRO0c_w_E@xO;~ev8OmMlV$2jGuTuH{Kh&x66n?M
z%lLtVa>qx_7Y>%g8HY)-;S365L*c;eF-AJiCCMs{^|;7)sw8A7G@xCnit^`;9!u!Z
zg1D|<G9l}xW)&P6GQW<~hOl$dm0x)tl%{e=ufPZxS|Wf$x1r6)=n<<8$csJap7c4R
zgUu9pScVhu!ycDb^Sj;*-$(CqdxZ0O)?2eSoqpx=J&g*>V=!O}GrPskE6SUo;|=h4
zk!9zzdw(xO9q}!JBB2cikSpGbGXFRWvlY2*UTAI>D`=-wviE*tEeiGBZ(dmWym#BO
zf4;~S@#VWoJeL;9OdDzQNO1i{CEY+Xp+Y_Z*>#zs)(dWP4Z4p$=+gS@gWk&oPNG)E
z*z`DX&1x_)O;d3X=M6fok52OW74U4jH19y_yN-`hE$@6VM8>r`PD2w$oMdpBjaTuG
zTNnjZLPZTJ2xTOYhw1#un|}EP<h~XjlO^<t>8B)@4d}&V{$7I7{^NFCTPqWz>qBmS
z+OUaTcv_&76Cgi8E)1U5hlHv2j+w+-8Lp<%E{`bWL=Z*$Dll#VhMMrolYH}p$yzip
zU@9gX4L^oy!T}VaMZ^izH=;z$clPL>8*V(5*b9*?-%TBN+gsNfTJJyRQ};aGsu9{-
zrXZ`uY#_DT%>ip0uS>^<ws&5{(zg9*X2KSI{rnjQYw09MKpS=_6B)m9;T4Kj?b32`
z|Bxx|u?6sRP`*Lj6ZnB4)ypW7y!RyD?$mgJ$4gQJXk+ZF5^Mw(xo;lppWyg4h9pHQ
z70$krR$OX2em+mSD1Is)64h~j_iU4{{;m?)Sl}_WwA}B$3cOm$`uP;YNbr1N{&_mO
z>5i2wsxC_KmH6q<SOTdXH*?gp7hAZvwO~yXh>MCr!m_Huf%oM)n~#kBQ+3Bda){`0
zvCY)OHGDtkD^a`56&=1O`TcWo|Ac8hrV=YZsr*z9s}^y8+Gz|HIa4ZeVj<jMyElex
z)d}^A5HY-wInz2K2qZjnYf(hK>`!EbSEH}N(V+mY$^{E;ig#ZaZR?plu@nX35X70r
z<y@wwT%5dCHG6Hu|2Bq1)UMXolTDs8qx+!bM}!nUTcnfSf=(-*hIEF3D1a>dW@(MQ
zu2RkhmuZ+HbLnY&P8aK?O8oc7hZcxX=aAG5HS%FXD+`nt<b8MDxP~Q|M<Dk#J@y9H
zLXSQ7`X~Q&tR(x~v6YpTF-Bwjb?-KN!zZzwTvL5tH|puc_4K*IzS?6R-et=ddx;W$
zJ2qba+V8xWSm*03?03qc5}|KQkS!ukp_Zr5LCCu)x5R0Lm%w%?yX3pi_G)#%H0Xkb
zQ#7&N3BrXmwC(<x?WVjiQ)rl==X~LACq+6OT=arQh47>DYAUJ?O_Jku13SMqr2dA`
z(wSwncC<n1hof(!EyAoXHT{u|7FXuiOThU$*17`WZ-Cb<^OUC5y20k~IE1)Z799P#
zo;Zof0AG0sPCHBt-JtOi5P0*zVGTRCALc#Wkpu|DQi0fGKZm-W@NNe4x$17!AxeC=
zBchuX4r6!QmLX4%x?9rrb1{|z(E~2t><SxE9DE2>_r};y+3x~Ijq#@4^E<OFUQY`A
zUi{va@tYZVWqalm-@L~iAZ9wkc6;KbGB!Gb$jQxyNw&^k`Cc~Ck03-Lv$EYpdC$e~
zJ}$M>XYV3);;gT6K!I|p@#30I0iv4k5R_Uje>!Uy-6+eM_xb3aBd*=@tigIIsXv{h
zg*-y>U}!V(FAy|xcT<GCM~mEML4f~CCl2VJ@=wzP{>yX+LOo%8%|IOhh@gOxP@0BP
z{8M0KmMnVScelQ~3}-j6j<T8S84l%=%N`@SOSWb=g8|JDr=;2mvbVa{ge!bPv?oH?
z86otBcCi@rF~C)W&MXl0qSQ(T4)BzL80P!N9^IfT*~?4I$j<`OXxI33KYZ)_VPfAG
zL1V~XxtJ1DE}MTC=2{i`dQt`1un-IcsBU^J&a9MG<3GV?M2|*v|9QFCTCDn>BN<Dx
zb)7%&<|^&G&5tC@nU8h-<<$}8c!f$1DvDRLn>FK^a(+O#aRvBm{#I5be0mY$f!ByD
zIwA~;ek_P5v@&LXCfgH@dTFUU@$Gx=_aCP&2J(SKpZY6fL>-5vEIG-!Y7*%!z=G_C
zI>>B#vn`V9?oLYVFE<Fb8pgGkvb`&ky?YEO(IwP@q4|6C(g6QZ&iW-owb4O#LwVf~
zJ~{g;((>{Kms=CqWR)CQuXMkaIn+U0+PxQbN}SqkAO#a?iCK&0@^4n(MQGN4vsmLv
z-7I<$^p42lXzUv`Et@w@bPVe({~(};HZL)FwHALH9FCGT`kc<g=ZV5Bv%QTD=q7dG
zpH5x~OHZ_xXk%;sd~0j_T*&~(s(8sv_+?|YNqzWD(E?O_K<8HZacRBUi$(%jbHgh?
z@yZtQ7=ROzw~^z4(Eu_JaM=|MZY&d8@=tqrRNL<SV>z~K&{!j-P_+d)iVN4X%%yU8
z7vz#s@5N_oae`3Sq=Vp9!&O~eGJ3_;-@<9uchy`y(wIB#lQFP4ZbfFa3HjuV7o1az
zxqj5_3{=0Iv;0bmS?w>|Yl24jEWv_b#FE^|eIziVF;dwZmXBC#(A|kQa;rrK@iJK<
zKt!2UQ2>{h0jW$?l*vj64;|EClNjV8E?B6uF0&U59u^-fDi%I#5sW*ipue@{1ASgk
zj)OOSPp&AOg<d+RULIM#_fjfUB{;<BW_;zj`eYYX5KkZOdM0`>={zk`-@YoP%6C)D
z4plxbS??NT2ona?sYSZ=sHNLeSRo(1yd%IL>yrrHeG-}!W+;1I_lt-t(LKrZkCB*6
z;Y~=iiO#-BO**ST0G233BpDyAW8>WM;m_I&MO_FE)rTRCLu%_+2_<38qkc~4FF);T
zlw?&}ooZXLRo45qMGmSQP)&ZHBIqG1E4Gc<vyuJwGg_8^GJe;b#nR*F*UXy5sgRHl
zGjGT0@avARs<*fKZawCL71NT9GO>cjcL;~Cu2iJO27jx6iOmEH+Bt(np^ZH&-Hx<!
zd>{xKH5yJs94zF61=x~rfR0bUq;b$&NKBz~XDtaZs4+-HHY@6{pQ(?DGoSf5bg-NK
zXB0Y|G3n{=iMLizD=sd=w{G?oxug`kNo8uxS*BLBkxz)9LW(uD@XX`hTdNGeHvU~X
zVo}$G;N1~OvZHXnKoKR&(pVLjV$kKCmd{T%6B1Uqt;KJg9EE`b5i3KJlU6z=p<j#?
z{FFRD8y0sGRX-ej3liMOHUn0DJ(C{S{GQjfV`aM%%2h?m7$x~6R59YY!y>woJDQ65
zQ!AMJ=w-z(A~FMXp=angDVg?U+FwAFh{NP|Q_hQWN^{d_6C!mjqp{ji+}Xzg;t|#a
zqcq@WM0QrNhR6Z$3j5OokGQ-TpPPUkfS>hl!pznvqz2ei{xVFT<IaoLSyvSoc5>GD
zg{9(6!6dg;EinKNJP|rocmfvz>61;r%AXLTYorlkX6@oo8>*eKp#`}PMto})TH~Sn
z9C^0CG{P|}YU&&g&4Yr6o~v*0I6==j9xgqePH_nc{fOK5egH={|IBZ@Kh8GH*Z^|s
zqZElxI^zXCEX#<5nGi5H>RuRNe{>OuI-5Et$ow^<|7!kMevwde<)hSjECb<2zu<4o
zJG!OM*e$XRRoKrb`s48`K9=d&SemO64B;B2rkjf8jrM2FdU1tfTT~O(@F}*O??Z<L
z3&MF~kZ!~uiRXt+9iOLyJ`MrqK0M>+A;f(RC3<AaqhB7D=9`C;7{UsZ;b5a=6|$8X
z_z)%|)e_DlRY!hW%Hy@p?!_FAIgY<{?zIP=b4cSV#5ucedEz#*pEWVJk+sws8hQ9a
z8b_3bj@ShnB1I=S?X$5RTr?P3(wNrv6y&*NVA5l1vXMq5U52vJvFp#GSCuy25tvv&
z4cgJB@x4jB`ZJE=66m^_lD4u>2S{wpOA3pmzgQ3$IXreuI20&3aZNM!5G@Hx%aP7n
zOf|SGCkx-XPbvD6oX;&0v*!b3BN7Jg-=Or!Y2xyg-kbI!2!%a)B-VF0J!8P(r<5Xj
zFM?%e>~hUMMQVFvh8g{0k#yggJZ8TT=COJBaL5Pstg(IGB!4P-sIKb*G=M<A0IPOT
zTrfIC4N-wmc1x+nh5>qI{GclHA%zT&cc+O01H;W2W9V{6Ou$&j9_Glm@>2B~uY>5!
zpdR{`*5=IV^1a>d)k5CTPBB(4n_9_8lg-cwabI`d`EBCR+aW-t%7&6TOueX$uJF~X
z3>t4ajMwI-mwIIFW=Q}X=kB>8dG=*A^=he;3`6>Smf60bVIs`ms?r6&h&<3)GFot8
z)!@P;uOo-uAeb~)Yu^*>$iTU7lPDNQh{pxbz!UTG=hkkpH<nwPT<|h7HFJ+C|4pYN
zi|N^$G?|$>HO|9YmaQYq#pKeRcZ1B;W$cNsd?s%3!3LWOGV>&jha5}E6K-8fCCkRd
zj>65|kzEF?guRJp-K@JiTssO9aVy&7`0}mAVQJRs2)J*f+5wVYj3NIiX5FJ#)iKKF
zQG%tY`SN={<zAsGEMB-(A-83Lcqan)w93@p9O%5?Q~)#ASYD3nY@&Q`8Ucrwv8hWX
z&)4q4sY-1XnUJ>OQh6$mm72=($ot2hjciNwBM&*g3XUrWl6d)AP>_AfHe%fgjsQ<d
z`1W~$GC)4YmfZZK&6ibO<IR+D=GP}umY|+}aXa>Bc|VK#um?#pxkXuC50^9QRP)WC
z47LvHm35l4B9#qq$Uj!=36(fQ;U9Y%oCONkYl4ro%zk=$P#ZZE`0kZ!YPgnVeOw0;
zc&+`c!$u;VC~0Z9J@qk~lUm%w&$P3cBR(%!TWv;%O5VwP@eIb&@!~0y$~`M$srAEs
zo-)0Tp{Fa}AVb=NZ#38b!K*c~bADb{#i!Q3mqS+8Jqsy!bv}Px+p>8-w8*WuVpDbA
z>($DoESoQ_eVG(F!n8}@_j%P$*Vm!-Nc>vjetnd-Le#3oZlax%raI7TLA{p<Z$^?H
z^ljF3gKUxXH~q}YVO9=NAJMw%?tOn2mbX2L-M*V3;2W0rd#VT2O%GzVzz#;`!~w{v
r1KkM!7fC_YdWot7|6aE5$GCYVXkBXuJM{nhEv)cXMW#~9B;bDlzd%nE

diff --git a/doc/user/project/merge_requests/approvals/img/remove_approval.png b/doc/user/project/merge_requests/approvals/img/remove_approval.png
deleted file mode 100644
index b178d26cf85ab603a133adbebc6bedfa5309789e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7533
zcmZvBby(Ehw*QFml7ccKosueDGjvJ_Lw7ew4<L<z<e+p24oG*0gmiaz$I#t1gFoJL
z&OP`1?!Eh2&;G9ZeAZrTKhOT>8?FqId4@xV0{{S?$;nEo0sv@CkNPL9r;j^*M@RhQ
z2i;0sQ5*oMh{8phU_9DSTvTNw0HwneyN`ORjk>n0wxWW7nWH_MiMgYx1)GPx(_<C@
zAmkzNsM=e&n$URI+c~%hcnH(|BSYX(|J%(@NAr&qS6g8^ZAE1oNk^y!4KEuH8wZ^T
z4h;>B5Y*gKKvnAfzu=FSFrBrltCIjbySuwPn>#m~Bh-qW6AT8kb8xY9aj`yTu)26U
zxSDvdI=H<4C&_>DNLjd;L2aB|Z5$nF{^m6?b#!wTrlb42(7)F|&uQUd^WT*mT>jP8
zV}tB}N7y;pIN1Nq{RkEM+bf`K<6&W^EoEbG;o$OELxh)?Q|KT0|10v}75@XN^WR8L
zPSAfM|0D7*q!9bx4g5z#|D4u8ypQ7&!4YEr_vl4%Vw$0+0Kij#vVyww{rx?aYs<r*
z$92oY!*g?eeRp^FXzc9lAb$do4-fZi)hN{2pPPjT)WhZdy|=gblC<Wp&&^amgO}68
zw}1Y`D`9l^cCW6kEuAB8E>5UEbv~eW5C{aaaY4LeZ}a|P;uKZ9cwxrJbN=Vg;oa^1
z{goKTSVz9|$A*p;#5LLS&$aQUk<rof<IUNbnG`*ep1m83(#1Ir$?e5~g}XngV>83m
ziEtz8<CD`RS)KK2m*Aja9v;iZ-cs}I<%gS_`{mK!A9<=auSWK+FD@=0&ewU3t4haD
z<bV?^T9&BmKR0uQg9F36QOWl1Es=AlLFTK~3oEFFE7a}!f}mn~&cJa`-&J*MLzK<K
z(Qs9D^~lz4v6pOi<j(zO8>&vFspN=<SAP6*2bo#9ws67TynFp{f0SQ-h?t&g$ym&9
z+dn*NYisA_4MpYx%slFl=|<VMJjir4WOK2iM^lw44^`sy?7<li$T+MK0R!{unV4K(
zp^!s|avva_Yl!kMdMU?aw=2s&I?It|V{=7j!yRXGvBN7h-DU7SR7b%2<td^im{%sh
zyC@jdor2uiGaNW{Ng5nXY6*$$YWUikxq5-j1gu%Oz=Q!eqtTznkDW``G%A0eo*;Sc
z8cS+td3jv=O8Ww)Pquu+P&+7XlYj`v_1<uCTU}`vUY^J6z3ZPu7H7-z@Kp70Cid>3
z$E9~o?C^&4Hp7j6CMQzC3#Ml`*Q+d$6=ulngkZC|LRp@cR3B7V7q4-V<VGp-Cphn9
zW@hLTF+PP%FMzo=JKKDe%bfjcs*X(eFAm{(0qA`amK5)W$n+%3P3X)FYUVWxb0{1z
zkLt;AYetrQMi$W*<QKpaqFOK4QEe7hUAq-$ix!pZRz5LL!jprGnp39E9d=q=AdA0-
z=7M5MHhVIxcN#tRI$d_#n<8^z0WFQyqoVRod95wT%lmL|Q>)>lbPE>P!2q)OFSXwN
zP-C8<wvvjfDF3}~)9r??u6ooju)JM-OdUQt06=0YCnc`#F@FHJRZz1b>-lkIzmm4R
z6KVs?B}-@Ebrp~@H6w#nrLXd}Vxm!3*S*9EGVib;At6j}g-PRunKH&jM}O<ZjEP7m
z4J{^=k>ZK$9K=jr4bC@dx;N2|<7}uBoZANH<yasrdkic$?t`Gi-r$jXp_X%@KS=<(
zyWw8}T=%OAogkC$|6i`woaic(`ja{Jj2&I*V)J0L_Z@aQKBh_*O2Kpe@Lt}70uDV4
zrh^O)Gx+}{|C3JKS(VJOCNV*$<TU4?j}wxZLRL1i=--kW`*9_@Aj+y`uoI*+NOu`S
z8z()g-*0u#>QHi^$&b660;Q|${_r`~uz0+SvrkE{YC&$mD!rJ2sUX6fphCZ8r%YBe
zyJQWOy=2O1APAAV>+<4-qD)DH^(M&IwH0O}f%}BI=3f$=+d<g!vo{QpuX<#-AP+6;
ztZ{*TQpbGN0uU*$UDdn<Hm*+4ElQP+)#1CHt*t$CB5au~HUViKJ_=yX<N$|9>E8`T
zWRrFG9Z#7T(EXfP6xemOBzigUs`(`NI-hRc^PPq@52nSMb0z@<Mosw*sUcwkZzT9I
zj1s73iJ^Wr@Xf@PyJcy<l7#UJEyaClkp^n$_}026be!gGHO~ZLp$fBgXPb9$r4xu{
z2+xwBM03BKUHiOqASry3I?^9y*7tkd)!}7Js8w-_gMJ9mIkc9Yj2h+OXf%0GP(JH)
z>v-HY<acIcttK}dwE5ot>l$Yf*xXBSva4jv)JRWLTwGIc8rwy@_a|lqzG1^`vA@4H
z4+F80e)UUO`zpQ24FOKSKk%>}uaXu@3gNn;j(x>?NgNVe`u6w>khj*k-Upf(jXqn4
zEmw&m<_d_V7)O0#4@dG2FYucf7PXDY^$*vU$>}Pe_)dp63jJhfKbD%NpF+>cQFl36
zW6&iLCt^rSIp*bGi3@29=lw2L+}qcV{b`>I&dd~9Y_vj3)*TF2e~BUh$<b$15Xy;;
zgzq`2sTonwCpFh6ZK~LK|G2wgryaWa&Dm35CIYrA&N{M9%hdrAF&Ww39jwgwjn<d>
z6=W$jxy3t>Ti>0Mm{*iM?OZUu^YEV(fSkHNeX3YhG3k3*#J`+droiESR9?GFG9`35
ze00^>7Lb<vDsKNxHh+hqqkiiP2P=NoReCF@Pv!V(#sel2x~`K;R=$c32kGFMEkmX`
z_0d}z-SN-B(q9|6aeI0aA`zLUGrVV6BCUPjJ`+MG;?+Krv0W(fS174`wdvgTHs=#P
z1Gijn-om8M-%?5+bZtota0hQ?<V2TAW^#bAZwqWoHGjNSPtU=SXJ*paJ!wL#e9zSL
zjWX}>yJ)<c<ZSWaE6{Fn|5X%@V<$M0oGSCE0Kw+42O266N*>V=H?X00z@%6-(4Tr=
zQAx;H#8k=Pw5Wdd21M&NX(0ts=S63IAE>8fBD{k03HSEN!Ed}~v%Egu^%a$NOjR{B
zbu1pgeFlWc3X;u<3hgq`9U$0H)efQDbT<up>Wz0fy1`g8_C#i>vjte~5LH4A!PJ`5
z`$hb|bu-EFtK8Vf*PhYj2@;koB;NK`-dXt>4`0z!^!n=L?2A(u5G|NHA5s<+@$)}=
zxlT$$&NCbVI<ZO8<nXPm3n{}kH!Df8kX|VqU1*<aMWYA)3JwtiPRzj)m<3nk<tLHX
zHqb9qd3FpC^+h&kL4N%q4Sbe*J9(pT;Z}8PxCZ)s(7>_lsIyRYC*s2Tx26m|hwUP~
zObR*N`WkM(Vt+J5kJuyHtbdZEtQE4Wt3NC04R=RGv&0CIDpaz_Ir2!=<<SQ(&Z^;X
zz*S9P1g`t&5MB9076fBvjc^QoSB@{_)1E(&QWLX-=JxdvO%oqH2JQ_LVc4j6=8<M!
zyI~9nr*kV*1fWs<P?J1atjQDUBc<neQ^F4aa_*m%22amAb#pLdW{QocBALU}6M1p<
zp5+Pa9@%Ztyaxbx$EJA=jWM2n_?d(8)fGO0>}(`}X_N2G@=x>qE2)V{L&HQlrlGCk
zMj0B_!IG}#Mqqi&a1v!<#*2}6iND=h6F+yodC4Fu_ZgQ-6?Ld0kP>0jMQcRFwAdFV
zQn*g$!V&u%^3={G?kNHwA{`5Rs~wM)6?hV=KBkjU+L?<R^E?-3Rp_4u<Ls4bQO|7&
zY()QhIM5BAdkY;OSE8C>IxJACbQ2>yiHvq$MI3|BDzwPIEHR2ZeqR-4pgIOLrn2O-
zb4!4pB&+T7qUkC32oX^2GmExjZf~d@0z`ontv{&aWbxB~)04MsbXQ{fnJp^+wRZ7D
zCVJ9TxhKSFor@~kkyOs#C-5U*)+<m*O1{9))&X^fPAc*@Buhs4+E-u-cDcbhXq^`^
z_860VrH*|u5H5ByuN(F2b`X+BDym~I!*sp{4hQh@z=+*hn(md+={BuCkigCV+KZfe
zvKJ&!U7zti+mdYnTbsC21uX1~-wx(x9A2e)BIdu#u0>B2&1>xxZ`7!+^z%nPI>etC
z8yaYvjC^Z)gSHgm!WEslf%J#kHGCw3FZR5Fc5{TiI0sR<zt{7RBT=vOgP<)*h_nrh
z``o!x2&!`U$&1_x3o%8rQh_M4lrq)zzG=S?dO|xBClUZ$eKwBobY|lphi-z|{=syW
zn}6087j$Q?To?ZwB5)(2PDRv?ovE_1ovmp-8hQ5R^1AIfZlTu2#U0+o5NX>vg3T9Q
z`amTrz*A#inbB%>_4uGi11l!a=p@8>M`GfL0bl9(B*>a0Yiw_)A}Oq~O)Fy~DFZVD
zaZKyTienn;H_Bk0XiT@!N{n^k8*M7_OzG-{BN(7v94A%!kTM#kze+29bEP(~=N2t!
zb%f&t^?pK^2#@7sJ+}=2HXqs1wH<jv#7M<*Tj2E$qAW&vd)rwAg1qPw7%=sOWK!?B
z21qQH>`Bkr2UVxJp^+f@QE{OkKsnE9bAG&Yc<YVL9#w!GvpN2#rwlIwH?DyyH#_0*
zg<-<EaK*lbvV6LaSl#u;W$Js(YYa&FX#O|sllrGf=2Hkg)PQb%LfFWCHAMh0_;r4%
zeN%kNSwM0RlE|HXgrvw&=@fanH_WYl8B`j)>}gQE4Ib0o#1GYPXmI1)13u+vd`0I;
zPs!EEfu80l-{2pYN#XFu*YBlPS=cBZbi8+lj+c?*`x~b~*!Qicw6|tNznL{TWp(D>
zmPP<+ctRC=v8REoQgZDsrdT_(V*JmX0?T;lF_o%~;*TclQ6JUNF1HF}DBggTVvq3r
zbv4dZiLyR?#0+c2p08u!q)`r*W~Z2yDrd~#i_CZ;lZ($)_7#I+tvh8WDSyKoA9ws_
zHgP7+It@7GIkLfesqGVOWIZjid<G8x^ez66g`QZ?v_JBWn^8d0mqtZSdSFLeF+B4*
z{ek3U#SjC}J4(He&u-VSEnogNpw>rdf6yAQAbo!3bJX7K5+){ysnTr;6`2VWn0_{I
z=J#@pWO=5K_VH~%lwvcpFS5a5EEonvhqf}%MGA!^S4C84s!Np3zQEI)rVwwXy;$29
z`4RTIl7zq?B$xw<w9L>jyXVe<oQ7D@077ZnUvhj>Jx-Y#n=w35D$=w<e_>R<quGp-
zwiOFIjI!vjWZq3Ym5rAz$SoL~R!ogo_{gnT$mq6GKhu1DhHq{s4JYWkYFcr}?-3FG
z9OZK4Mn22h)famFGw9f!1lI4UI@-O`wH~Oliq5ctT(feN0Kw7{LE^Na)900Fy+VIZ
zc|{U1dW_mbskHD@yq*aJ{SXr-bD>o&`d-_ab`!gepj9s<;PsdBwXi$LDtQ5MLcz#a
zv4UGR#v)DA<!}Ge;-$vHCcMk>AHZBuycK`#I$B30F*G9@C9DFt<f6KK0=iYx?>ydq
zn~Ws(zhlPp`EVc@T3d(y`3y_IQDJRYA&RZaSHyE~e%TaDI1hFWd8I`(uxE<Yu0pNI
zBpBJ1*)&-wmu9nV1-W@+oYSNA=lv8h$rf(!(i}GGQSS6PzShT6|6OLFWsFb5F5ONm
z;bVZDU&wrgt~Dr%23Za!K3)&I^c`&~5&Mit(p}9SZHsb#k6Z2U#R9Pm=VNa`@3LRK
ztX01$zhz+Eb*<j%RXcSQ4EdHGM~;fz+!FWAQl?4tb)0U$AxE<o_54yB>>q0R9g$mL
zIeSjIwtfBl&sGh0NNa$eKfaSv*-zPU6Na2XqL9qhA8P@tN$^E_0exDva7|tr7*kOp
zETX88F``UEYhZfrVRGK<cg<9*b0L}QJ^SIJ{PbL>uNcYXaCUZfYS>0%3&HmvMbDRg
zE~0<P4Co!Gouq|H&YHhQu+-n1Q>P&T8Tv;WSMGGq+XoUK&ekiT2SNj@xG-x}KzS*b
z%Tdy6&K8(!`JYsxQhLcIl$DK4o!2p<<{TjFd|B{1I=grJ(Dv8L-TJF#bSc?6ul-N=
z^3#XJEv5dtsi}3SmN{Y_Th#F0;Ztaz&h?QmUjw4j`{8uV;@!}f8vnVpjU%o5=XHWH
z__4UPrTI_0(wMT&d|SDvw*QnLa?!tu%lGOQp;2@B{TD|D$Ti+}skzd(Rk~D7qUckq
z>Y3YG5%Kx{&yp>_3JKb4@`%CNvn~Gd`m==30_Pfn%1-cur3#tCvcsjTh1UyLevr)}
z^8owp^g&J}<=)2auLz^FhMsneQZczV$mzp_xP7HpFJNHkt-{nTcha_gUUoW3zL)yK
zA5YiK85UMoO5XVsMrn|aS#~*IT&?_!aOUmtfS4TaV$zH2&q#`1U(%w^nE~g({PwwP
zPfkIcZJFcO(4RARo9HZt56xpyy}nudNx%n@i?6kxRFS?rqzDn$_P%zF`3g$Xo+xVe
zL0P&MTXE2>(d4DnG$xZ27862}Rs!^YNsyDo{}6Lus6<dNMRF(*h7|+;U#OU%Z;MmN
z70rqPTWQ3?5cWiOwP&bzQ_i5iM%7bMaLTrdjxQyfQRs-UOc&QXtCqQOW6SNc*78rd
z56?a)(oWR>0-1d0(sOLw_JZ_rG^T;qh`zl3a`WdqBhquQSaY}Ljw-%zX8*pUO7{uF
z=AK<ugZRJ@lx4K#%I}pGHtC@a9<2qdb32EAt7VlZ+toapH6!yNXJ|pYBiboHIkLwx
zzkRn<w~1W?JV}r}2nb$MUd}x7j*(8d4jyDBN2GJS%3=UnAmG<|-3RY+pFDC&WccR|
zE|4>aUnA%sBJQ3K<<uHNl%&bl@0kzsqYK*a%6$IJ+lk3$RqP4se-+xPz9@Jr$)Wkd
za&xHpRlSVKS4dFzAePM`7PtqC$u<-iB3W<fsACLb63Oc%$BLJW>$%a;uQS->NTzrr
zIqOIkU(gzHL13dVEX-!B)H0I5rslkbo4_xrL-Q;-A(=H^L3%Dmx+v$JI89ezHDSDs
zqruisz5@k21tZhWZHO8)OCUAZUSP0A;ppKzN2NSG9v@SPfq_p?PH3ystg0qFGJ|w6
z%w*K$>|Qal?bD>l_`AYIFJCXE&^BGYAEkRIZj;lxIS8r!;z9NE*n(!|f?pB%!4`+_
zA%d2CA@KL--!U+1GPlH3fPTx81o7h-5d<IywLp1?$$|-boKQPIltX*(o>RNm2fI_S
zwm(o$r(o!HB6G3XsF8`25T%yN1`uDe>hmaVq0gP)H;wS<DHuq8V|?E?vwv|k&!Km4
zOPUgTmEe*I<ATh^%$ZJe-L!$+R)*!PQt56&7-YVJlil95W4on?IaLxuJ}oX(n9uGG
zo%+9BW9WHxGQYk+!a|pvCZMpfL9}-29Jf&*CvW&2-?wGKLRx+$no!5!&B_+O%2c{T
zg;hZnw|M20j{28*HaC(6$F;9pxL4_8cIJcK?^xoNzT^qqIs<F+WF;Bg$1ieT?k(yN
zNs;iotyZkE5k^=q^$0P|?uhX#8tsb6C8TLEjOS60HmC#u+h9pP9G)*j*tpZiu!+=l
zw|9$pe08N$y<MZ16&Xan;NN_1-CAJ{tNyUx$fHQS8j{3TMh?O6Y5wdX2a#v@a-mC)
z$Gi3t>R7K<m7fUfbIf-FrOyW>$#YH_hb&@UPU`yB)JRUxQ)P>rG7hLq6vDs(qN_o;
z7D*rA+Hhu)%Gp%NZ-$qh8^qwYu#<B7@dD>19tGw|wgPoZUqVP8E;EDBXE9=9Nck8e
z$H$=E(vHxJoNei9A{WAn^{Q0Gi-aQSz`Ku4`21rAyWNV`cdOQPC2!%mm}e1x(cFwX
zRJiN9b1atph9)@ZiaJ|q*&Pt3BRqxEmQC8S#2CrzJcRqP$=9SX;OhC7PVHQ5VoyP&
zFsDFO-!amW-^r<6rw{bx_rRb*R@1jarV(o7=#c7R8mO-M6cIky?YR%3&9h@Ynna3^
z?_~Y(Cfp*U<ZPCnI|2w<N3cnj0Ip=O;duT^%wzyarlyZ|1F#z_n-R^{Sm1drb|`PJ
z)t)uKYp8edmtk}wo>;FL($!la?BjixK)(_o{wqVG>4yEXzv2aR8r;xxF?n?Zf)ObQ
z{Bl-THJ1m?dA&J0suCtxAnC<&gg(X2-1gHL61bWCEE8sA_$9idhtjW2aUJp8_w_9s
zJ~>Zz&Nl;tkrQ|CYg&Vh;n6vI1cR%VmX>ck(1~RhR~p39ddIj*|FO#@*2nEm=LN)N
zqJqp-(T6Kew}<-$ST?(aeBV*F=_#E}YPEycGqXw`2tNC!vUcH&re+BEMXZiqxK_W}
z=~;@I#GsktnULo3I5QX#B9!Q2dzT}WxYmCUr>%+ZvE(zq;{D#Gd3CR5rYo3TZWG;;
zxf&lsc&`0wYbbI%P9}YyMwa9`C@I?Kx-7~O>n{PHD^LA+;I$ou&;x@0R-~lqgOLE}
z8@NIqUQWmK6AQD?9aG+otiT<Pled)YkUdgL4FSX%e3%rp=ljv4hX!Aruj>SouqEuR
z$CRrRlPh<r6|jW_lJuJp84-V;GMn08QZ=AZ*D_R=dArdct*J?D`$bl8>+57!^jQDQ
z#}B)72N)jcI43X|4)k016CCLLq-^TbDB`Ft>5XAIJBl>~eXc40NVqY>R`)gs6JWmE
zi^3hx$G-?@2BbbDq~huG!i22H;;pLPSl6<F`m_mwd(3LDu#6$lkUta4myOIXWKNH-
zIk-9BvHhS0GyDoAqU_Y<k;A%Pjp~qkBT*FMVxYN86NqpNZw(I4p)<A6!a5{*C%szm
zL#jN~K0}n|RRd8c)z$p<x2#CfLYrFV`D<{&c{4%s?TzoT@AAg}N4DhnuYvDoE`sg^
z7Tznuhe+7^#yYMhNOtV5To-m1`CvA-d~OwJ0(v%Tz8gf}2;uZMK7q>b2<6VOrIS>;
z6|+}uo+@dpRxSt|9~hGd4&G$VwCUWftqU~eod;pSdInshdqj+J5$FSEZf{E#S!M)T
zafC8PO8s*Ees#_VAYXd4<E`xprUOrGR(-MeY;E)IKV>2xqV`kCMX#{~i@Dqd>k|f9
zMprrY-vr@E7}btUayf6jx$WJpUBEEmyW2VG)!`O$5?Ps5w^tsPn(PV@$XFm|5XWk^
z#4h!gs<o19Yy5>hE4S`1k-TuPxWaOL5v<*hlZ4R=YO~JODD^W{a!YM$y2w%3W!sp7
ztjJrvdTZ#<G@wx@<kI|*Hhzcp?uq+U8tsB*DPEJUGt-aENnJrf=N^;yb)kPLiFxLu
zqXlRTSW|Nh7OpEyY}i=hq>XA*KPT&2SofK)CrtR}E4J(gxqMIN*{p6eI~guwJlfPk
zTv2x&F@AmTFBG%hF==tr&)`ex^Qrz)9+$D<$wG?9l9O@Qd8vm|$nUM#>fRdk$k4%f
zP?q->_x32CCzEF0mxaL?X~kT5=uopJKen{nov|$(L%yC6%(`dRFMERWU8Jduy7cN`
zL*7e?1hL`uXo`kFd2bPDLp>VnQM}Dy&~C6{U{(?+D@aQCin!Gxu7CQRcpO#WB2P!V
zJ_*jzzN=%U&O=RX#WyC@_>6M7L9idfhKYqX;e;c6@#=fw$+N9Y4wvoER}Q1A0z~<!
z2U5-JV&K+CG05C{nJw{`L&?jX5BTCV(M(tfY&6fnn_3UTZtp;jHee$I7Prs~*_$JR
zC<W)$0!|M|BsS>e<r^V)T+cwUw0|T1OFcsm5E7?Rdfp4{T<PGSwR%0F$bdTj`$wpp
MG(@UY!Z`5%0d?S>ssI20

diff --git a/doc/user/project/merge_requests/approvals/index.md b/doc/user/project/merge_requests/approvals/index.md
index 526272e2b35..1b157f9a93f 100644
--- a/doc/user/project/merge_requests/approvals/index.md
+++ b/doc/user/project/merge_requests/approvals/index.md
@@ -6,111 +6,124 @@ type: reference, concepts
 disqus_identifier: 'https://docs.gitlab.com/ee/user/project/merge_requests/merge_request_approvals.html'
 ---
 
-# Merge Request Approvals **(FREE)**
+# Merge request approvals **(FREE)**
 
-> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/580) in GitLab Enterprise Edition 7.2. Available in GitLab Free and higher tiers.
-> - Redesign [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/1979) in [GitLab Premium](https://about.gitlab.com/pricing/) 11.8 and [feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/10685) in 12.0.
+> Redesign [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/1979) in [GitLab Premium](https://about.gitlab.com/pricing/) 11.8 and [feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/10685) in 12.0.
 
-Code review is an essential practice of every successful project. Approving a
-merge request is an important part of the review
-process, as it clearly communicates the ability to merge the change.
-A [merge request approvals API](../../../../api/merge_request_approvals.md) is also available.
+Successful projects depend on code reviews. Merge request approvals clearly communicate
+someone's ability to merge proposed changes. Approvals [are optional](#optional-approvals)
+in GitLab Free, but you can require them for your project in higher tiers.
 
-## Optional Approvals
+Merge request approvals are configured at the project level. Administrator users
+of self-managed GitLab installations can also configure
+[instance-level approval rules](../../../admin_area/merge_requests_approvals.md)
+that cannot be overridden on a project-level basis.
+
+With [merge request approval rules](rules.md), you can set the minimum number of
+required approvals before work can merge into your project. You can also extend these
+rules to define what types of users can approve work. Some examples of rules you can create include:
+
+- Users with specific permissions can always approve work.
+- [Code owners](../../code_owners.md) can approve work for files they own.
+- Users with specific permissions can approve work, even if they don't have merge rights
+  to the repository.
+- Users with specific permissions can be allowed or denied the ability
+  to override approval rules on a specific merge request.
+
+You can also configure additional [settings for merge request approvals](settings.md)
+for more control of the level of oversight and security your project needs, including:
+
+- Prevent users from overriding a merge request approval rule.
+- Reset approvals when new code is pushed.
+- Allow (or disallow) authors and committers to approve their own merge requests.
+- Require password authentication when approving.
+- Require security team approval.
+
+You can configure your merge request approval rules and settings through the GitLab
+user interface or [with the API](../../../../api/merge_request_approvals.md).
+
+## Approve a merge request
+
+When an [eligible approver](rules.md#eligible-approvers) visits an open merge request,
+GitLab displays one of these buttons after the body of the merge request:
+
+- **Approve**: The merge request doesn't yet have the required number of approvals.
+- **Approve additionally**: The merge request has the required number of approvals.
+- **Revoke approval**: The user viewing the merge request has already approved
+  the merge request.
+
+Eligible approvers can also use the `/approve`
+[quick action](../../../project/quick_actions.md) when adding a comment to
+a merge request.
+
+After a merge request receives the [number and type of approvals](rules.md) you configure, it can merge
+unless it's blocked for another reason. Merge requests can be blocked by other problems,
+such as merge conflicts, [pending discussions](../../../discussions/index.md#only-allow-merge-requests-to-be-merged-if-all-threads-are-resolved),
+or a [failed CI/CD pipeline](../merge_when_pipeline_succeeds.md).
+
+To prevent merge request authors from approving their own merge requests,
+enable [**Prevent author approval**](settings.md#allowing-merge-request-authors-to-approve-their-own-merge-requests)
+in your project's settings.
+
+If you enable [approval rule overrides](settings.md#prevent-overriding-default-approvals),
+merge requests created before a change to default approval rules are not affected.
+The only exceptions are changes to the [target branch](rules.md#scoped-to-protected-branch)
+of the rule.
+
+## Optional approvals
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/27426) in GitLab 13.2.
 
-Any user with Developer or greater [permissions](../../../permissions.md) can approve a merge request in GitLab Free and higher tiers.
-This provides a consistent mechanism for reviewers to approve merge requests, and ensures
-maintainers know a change is ready to merge. Approvals in Free are optional, and do
-not prevent a merge request from being merged when there is no approval.
+GitLab allows all users with Developer or greater [permissions](../../../permissions.md)
+to approve merge requests. Approvals in GitLab Free are optional, and don't prevent
+a merge request from merging without approval.
 
-## External approvals **(ULTIMATE)**
+## Required approvals **(PREMIUM)**
+
+> Moved to [GitLab Premium](https://about.gitlab.com/pricing/) in 13.9.
+
+Required approvals enforce code reviews by the number and type of users you specify.
+Without the approvals, the work cannot merge. Required approvals enable multiple use cases:
+
+- Enforce review of all code that gets merged into a repository.
+- Specify reviewers for a given proposed code change, and a minimum number
+  of reviewers, through [Approval rules](rules.md).
+- Specify categories of reviewers, such as backend, frontend, quality assurance, or
+  database, for all proposed code changes.
+- Use the [code owners of changed files](rules.md#code-owners-as-eligible-approvers),
+  to determine who should review the work.
+- [Require approval from a security team](../../../application_security/index.md#security-approvals-in-merge-requests)
+  before merging code that could introduce a vulnerability. **(ULTIMATE)**
+
+## Notify external services **(ULTIMATE)**
 
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/3869) in GitLab Ultimate 13.10.
-> - It's [deployed behind a feature flag](../../../feature_flags.md), disabled by default.
-> - It's disabled on GitLab.com.
-> - It's not recommended for production use.
-> - To use it in GitLab self-managed instances, ask a GitLab administrator to [enable it](../../../../api/merge_request_approvals.md#enable-or-disable-external-project-level-mr-approvals). **(ULTIMATE SELF)**
+> - [Deployed behind a feature flag](../../../feature_flags.md), disabled by default.
+> - Disabled on GitLab.com.
+> - Not recommended for production use.
+> - To use in GitLab self-managed instances, ask a GitLab administrator to [enable it](../../../../api/merge_request_approvals.md#enable-or-disable-external-project-level-mr-approvals). **(ULTIMATE SELF)**
 
 WARNING:
 This feature might not be available to you. Check the **version history** note above for details.
 
-When you create an external approval rule, the following merge request actions sends information
-about a merge request to a third party service:
+You can create an external approval rule to integrate approvals with third-party tools.
+When users create, change, or close merge requests, GitLab sends a notification.
+The users of the third-party tools can then approve merge requests from outside of GitLab.
 
-- Create
-- Change
-- Close
+With this integration, you can integrate with third-party workflow tools, like
+[ServiceNow](https://www.servicenow.co.uk/), or the custom tool of your choice.
+You can modify your external approval rules
+[by using the REST API](../../../../api/merge_request_approvals.md#external-project-level-mr-approvals).
 
-This action enables use-cases such as:
+The lack of an external approval doesn't block the merging of a merge request.
 
-- Integration with 3rd party workflow tools, such as [ServiceNow](https://www.servicenow.co.uk/).
-- Integration with custom tools designed to approve merge requests from outside of GitLab.
+To learn more about use cases, feature discovery, and development timelines,
+see the [External API approval rules epic](https://gitlab.com/groups/gitlab-org/-/epics/3869).
 
-You can find more information about use-cases, development timelines and the feature discovery in
-the [External API approval rules epic](https://gitlab.com/groups/gitlab-org/-/epics/3869).
+## Related links
 
-The intention for this feature is to allow those 3rd party tools to approve a merge request similarly to how users current do.
-
-NOTE:
-The lack of an external approval does not block the merging of a merge request.
-
-You can modify external approval rules through the [REST API](../../../../api/merge_request_approvals.md#external-project-level-mr-approvals).
-
-## Required Approvals **(PREMIUM)**
-
-> - [Introduced](https://about.gitlab.com/releases/2015/06/22/gitlab-7-12-released/#merge-request-approvers-ee-only) in GitLab Enterprise Edition 7.12.
-> - Moved to GitLab Premium in 13.9.
-
-Required approvals enable enforced code review by requiring specified people
-to approve a merge request before it can be merged.
-
-Required approvals enable multiple use cases:
-
-- Enforcing review of all code that gets merged into a repository.
-- Specifying reviewers for a given proposed code change, as well as a minimum number
-  of reviewers, through [Approval rules](rules.md).
-- Specifying categories of reviewers, such as backend, frontend, quality assurance,
-  database, and so on, for all proposed code changes.
-- Designating [Code Owners as eligible approvers](rules.md#code-owners-as-eligible-approvers),
-  determined by the files changed in a merge request.
-- [Requiring approval from a security team](../../../application_security/index.md#security-approvals-in-merge-requests)
-  before merging code that could introduce a vulnerability.**(ULTIMATE)**
-
-### Adding or removing an approval
-
-When an [eligible approver](rules.md#eligible-approvers) visits an open merge request,
-one of the following is possible:
-
-- If the required number of approvals has _not_ been yet met, they can approve
-  it by clicking the displayed **Approve** button.
-
-  ![Approve](img/approve.png)
-
-- If the required number of approvals has already been met, they can still
-  approve it by clicking the displayed **Approve additionally** button.
-
-  ![Add approval](img/approve_additionally.png)
-
-- **They have already approved this merge request**: They can remove their approval.
-
-  ![Remove approval](img/remove_approval.png)
-
-When [approval rule overrides](settings.md#prevent-overriding-default-approvals) are allowed,
-changes to default approval rules will **not** be applied to existing
-merge requests, except for changes to the [target branch](rules.md#scoped-to-protected-branch)
-of the rule.
-
-NOTE:
-The merge request author is not allowed to approve their own merge request if
-[**Prevent author approval**](settings.md#allowing-merge-request-authors-to-approve-their-own-merge-requests)
-is enabled in the project settings.
-
-After the approval rules have been met, the merge request can be merged if there is nothing
-else blocking it. Note that the merge request could still be blocked by other conditions,
-such as merge conflicts, [pending discussions](../../../discussions/index.md#only-allow-merge-requests-to-be-merged-if-all-threads-are-resolved),
-or a [failed CI/CD pipeline](../merge_when_pipeline_succeeds.md).
+- [Merge request approvals API](../../../../api/merge_request_approvals.md)
+- [Instance-level approval rules](../../../admin_area/merge_requests_approvals.md) for self-managed installations
 
 <!-- ## Troubleshooting
 
diff --git a/lib/api/deploy_tokens.rb b/lib/api/deploy_tokens.rb
index 30ec4e52b2a..e9beeb18d62 100644
--- a/lib/api/deploy_tokens.rb
+++ b/lib/api/deploy_tokens.rb
@@ -18,6 +18,10 @@ module API
         result_hash[:read_repository] = scopes.include?('read_repository')
         result_hash
       end
+
+      params :filter_params do
+        optional :active, type: Boolean, desc: 'Limit by active status'
+      end
     end
 
     desc 'Return all deploy tokens' do
@@ -26,11 +30,18 @@ module API
     end
     params do
       use :pagination
+      use :filter_params
     end
     get 'deploy_tokens' do
       authenticated_as_admin!
 
-      present paginate(DeployToken.all), with: Entities::DeployToken
+      deploy_tokens = ::DeployTokens::TokensFinder.new(
+        current_user,
+        :all,
+        declared_params
+      ).execute
+
+      present paginate(deploy_tokens), with: Entities::DeployToken
     end
 
     params do
@@ -39,6 +50,7 @@ module API
     resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
       params do
         use :pagination
+        use :filter_params
       end
       desc 'List deploy tokens for a project' do
         detail 'This feature was introduced in GitLab 12.9'
@@ -47,7 +59,13 @@ module API
       get ':id/deploy_tokens' do
         authorize!(:read_deploy_token, user_project)
 
-        present paginate(user_project.deploy_tokens), with: Entities::DeployToken
+        deploy_tokens = ::DeployTokens::TokensFinder.new(
+          current_user,
+          user_project,
+          declared_params
+        ).execute
+
+        present paginate(deploy_tokens), with: Entities::DeployToken
       end
 
       params do
@@ -98,6 +116,7 @@ module API
     resource :groups, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
       params do
         use :pagination
+        use :filter_params
       end
       desc 'List deploy tokens for a group' do
         detail 'This feature was introduced in GitLab 12.9'
@@ -106,7 +125,13 @@ module API
       get ':id/deploy_tokens' do
         authorize!(:read_deploy_token, user_group)
 
-        present paginate(user_group.deploy_tokens), with: Entities::DeployToken
+        deploy_tokens = ::DeployTokens::TokensFinder.new(
+          current_user,
+          user_group,
+          declared_params
+        ).execute
+
+        present paginate(deploy_tokens), with: Entities::DeployToken
       end
 
       params do
diff --git a/lib/api/entities/deploy_token.rb b/lib/api/entities/deploy_token.rb
index 9c5bf54e299..daee104ba6b 100644
--- a/lib/api/entities/deploy_token.rb
+++ b/lib/api/entities/deploy_token.rb
@@ -4,7 +4,8 @@ module API
   module Entities
     class DeployToken < Grape::Entity
       # exposing :token is a security risk and should be avoided
-      expose :id, :name, :username, :expires_at, :scopes
+      expose :id, :name, :username, :expires_at, :scopes, :revoked
+      expose :expired?, as: :expired
     end
   end
 end
diff --git a/lib/gitlab/database/migration_helpers.rb b/lib/gitlab/database/migration_helpers.rb
index 74daca20da9..874131f5155 100644
--- a/lib/gitlab/database/migration_helpers.rb
+++ b/lib/gitlab/database/migration_helpers.rb
@@ -565,7 +565,7 @@ module Gitlab
 
         check_trigger_permissions!(table)
 
-        remove_rename_triggers_for_postgresql(table, trigger_name)
+        remove_rename_triggers(table, trigger_name)
 
         remove_column(table, new)
       end
@@ -576,8 +576,19 @@ module Gitlab
       # table - The name of the table to install the trigger in.
       # old_column - The name of the old column.
       # new_column - The name of the new column.
-      def install_rename_triggers(table, old_column, new_column)
-        install_rename_triggers_for_postgresql(table, old_column, new_column)
+      # trigger_name - The name of the trigger to use (optional).
+      def install_rename_triggers(table, old, new, trigger_name: nil)
+        Gitlab::Database::UnidirectionalCopyTrigger.on_table(table).create(old, new, trigger_name: trigger_name)
+      end
+
+      # Removes the triggers used for renaming a column concurrently.
+      def remove_rename_triggers(table, trigger)
+        Gitlab::Database::UnidirectionalCopyTrigger.on_table(table).drop(trigger)
+      end
+
+      # Returns the (base) name to use for triggers when renaming columns.
+      def rename_trigger_name(table, old, new)
+        Gitlab::Database::UnidirectionalCopyTrigger.on_table(table).name(old, new)
       end
 
       # Changes the type of a column concurrently.
@@ -690,7 +701,7 @@ module Gitlab
 
         check_trigger_permissions!(table)
 
-        remove_rename_triggers_for_postgresql(table, trigger_name)
+        remove_rename_triggers(table, trigger_name)
 
         remove_column(table, old)
       end
@@ -982,7 +993,7 @@ module Gitlab
         temporary_columns = columns.map { |column| convert_to_bigint_column(column) }
 
         trigger_name = rename_trigger_name(table, columns, temporary_columns)
-        remove_rename_triggers_for_postgresql(table, trigger_name)
+        remove_rename_triggers(table, trigger_name)
 
         temporary_columns.each { |column| remove_column(table, column) }
       end
@@ -1079,21 +1090,6 @@ module Gitlab
         execute("DELETE FROM batched_background_migrations WHERE #{conditions}")
       end
 
-      # Performs a concurrent column rename when using PostgreSQL.
-      def install_rename_triggers_for_postgresql(table, old, new, trigger_name: nil)
-        Gitlab::Database::UnidirectionalCopyTrigger.on_table(table).create(old, new, trigger_name: trigger_name)
-      end
-
-      # Removes the triggers used for renaming a PostgreSQL column concurrently.
-      def remove_rename_triggers_for_postgresql(table, trigger)
-        Gitlab::Database::UnidirectionalCopyTrigger.on_table(table).drop(trigger)
-      end
-
-      # Returns the (base) name to use for triggers when renaming columns.
-      def rename_trigger_name(table, old, new)
-        Gitlab::Database::UnidirectionalCopyTrigger.on_table(table).name(old, new)
-      end
-
       # Returns an Array containing the indexes for the given column
       def indexes_for(table, column)
         column = column.to_s
diff --git a/lib/gitlab/sidekiq_logging/structured_logger.rb b/lib/gitlab/sidekiq_logging/structured_logger.rb
index 8000ec03f80..98f8e1abe35 100644
--- a/lib/gitlab/sidekiq_logging/structured_logger.rb
+++ b/lib/gitlab/sidekiq_logging/structured_logger.rb
@@ -70,6 +70,8 @@ module Gitlab
 
         message = base_message(payload)
 
+        payload['database_chosen'] = job[:database_chosen] if job[:database_chosen]
+
         if job_exception
           payload['message'] = "#{message}: fail: #{payload['duration_s']} sec"
           payload['job_status'] = 'fail'
diff --git a/lib/gitlab/usage_data_counters/known_events/common.yml b/lib/gitlab/usage_data_counters/known_events/common.yml
index a89c61d93e8..bbfa69f47ac 100644
--- a/lib/gitlab/usage_data_counters/known_events/common.yml
+++ b/lib/gitlab/usage_data_counters/known_events/common.yml
@@ -53,17 +53,14 @@
   category: search
   redis_slot: search
   aggregation: weekly
-  feature_flag: search_track_unique_users
 - name: i_search_advanced
   category: search
   redis_slot: search
   aggregation: weekly
-  feature_flag: search_track_unique_users
 - name: i_search_paid
   category: search
   redis_slot: search
   aggregation: weekly
-  feature_flag: search_track_unique_users
 - name: wiki_action
   category: source_code
   aggregation: daily
diff --git a/lib/sidebars/projects/menus/operations_menu.rb b/lib/sidebars/projects/menus/operations_menu.rb
new file mode 100644
index 00000000000..adfb5fd2016
--- /dev/null
+++ b/lib/sidebars/projects/menus/operations_menu.rb
@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+module Sidebars
+  module Projects
+    module Menus
+      class OperationsMenu < ::Sidebars::Menu
+        override :configure_menu_items
+        def configure_menu_items
+          return false unless context.project.feature_available?(:operations, context.current_user)
+
+          add_item(metrics_dashboard_menu_item)
+          add_item(logs_menu_item)
+          add_item(tracing_menu_item)
+          add_item(error_tracking_menu_item)
+          add_item(alert_management_menu_item)
+          add_item(incidents_menu_item)
+          add_item(serverless_menu_item)
+          add_item(terraform_menu_item)
+          add_item(kubernetes_menu_item)
+          add_item(environments_menu_item)
+          add_item(feature_flags_menu_item)
+          add_item(product_analytics_menu_item)
+
+          true
+        end
+
+        override :link
+        def link
+          if can?(context.current_user, :read_environment, context.project)
+            metrics_project_environments_path(context.project)
+          else
+            project_feature_flags_path(context.project)
+          end
+        end
+
+        override :extra_container_html_options
+        def extra_container_html_options
+          {
+            class: 'shortcuts-operations'
+          }
+        end
+
+        override :title
+        def title
+          _('Operations')
+        end
+
+        override :sprite_icon
+        def sprite_icon
+          'cloud-gear'
+        end
+
+        override :active_routes
+        def active_routes
+          { controller: [:user, :gcp] }
+        end
+
+        private
+
+        def metrics_dashboard_menu_item
+          return unless can?(context.current_user, :metrics_dashboard, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Metrics'),
+            link: project_metrics_dashboard_path(context.project),
+            active_routes: { path: 'metrics_dashboard#show' },
+            container_html_options: { class: 'shortcuts-metrics' },
+            item_id: :metrics
+          )
+        end
+
+        def logs_menu_item
+          return unless can?(context.current_user, :read_environment, context.project)
+          return unless can?(context.current_user, :read_pod_logs, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Logs'),
+            link: project_logs_path(context.project),
+            active_routes: { path: 'logs#index' },
+            item_id: :logs
+          )
+        end
+
+        def tracing_menu_item
+          return unless can?(context.current_user, :read_environment, context.project)
+          return unless can?(context.current_user, :admin_project, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Tracing'),
+            link: project_tracing_path(context.project),
+            active_routes: { path: 'tracings#show' },
+            item_id: :tracing
+          )
+        end
+
+        def error_tracking_menu_item
+          return unless can?(context.current_user, :read_sentry_issue, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Error Tracking'),
+            link: project_error_tracking_index_path(context.project),
+            active_routes: { controller: :error_tracking },
+            item_id: :error_tracking
+          )
+        end
+
+        def alert_management_menu_item
+          return unless can?(context.current_user, :read_alert_management_alert, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Alerts'),
+            link: project_alert_management_index_path(context.project),
+            active_routes: { controller: :alert_management },
+            item_id: :alert_management
+          )
+        end
+
+        def incidents_menu_item
+          return unless can?(context.current_user, :read_issue, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Incidents'),
+            link: project_incidents_path(context.project),
+            active_routes: { controller: [:incidents, :incident_management] },
+            item_id: :incidents
+          )
+        end
+
+        def serverless_menu_item
+          return unless can?(context.current_user, :read_cluster, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Serverless'),
+            link: project_serverless_functions_path(context.project),
+            active_routes: { controller: :functions },
+            item_id: :serverless
+          )
+        end
+
+        def terraform_menu_item
+          return unless can?(context.current_user, :read_terraform_state, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Terraform'),
+            link: project_terraform_index_path(context.project),
+            active_routes: { controller: :terraform },
+            item_id: :terraform
+          )
+        end
+
+        def kubernetes_menu_item
+          return unless can?(context.current_user, :read_cluster, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Kubernetes'),
+            link: project_clusters_path(context.project),
+            active_routes: { controller: [:cluster_agents, :clusters] },
+            container_html_options: { class: 'shortcuts-kubernetes' },
+            hint_html_options: kubernetes_hint_html_options,
+            item_id: :kubernetes
+          )
+        end
+
+        def kubernetes_hint_html_options
+          return {} unless context.show_cluster_hint
+
+          { disabled: true,
+            data: { trigger: 'manual',
+              container: 'body',
+              placement: 'right',
+              highlight: UserCalloutsHelper::GKE_CLUSTER_INTEGRATION,
+              highlight_priority: UserCallout.feature_names[:GKE_CLUSTER_INTEGRATION],
+              dismiss_endpoint: user_callouts_path,
+              auto_devops_help_path: help_page_path('topics/autodevops/index.md') } }
+        end
+
+        def environments_menu_item
+          return unless can?(context.current_user, :read_environment, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Environments'),
+            link: project_environments_path(context.project),
+            active_routes: { controller: :environments },
+            container_html_options: { class: 'shortcuts-environments' },
+            item_id: :environments
+          )
+        end
+
+        def feature_flags_menu_item
+          return unless can?(context.current_user, :read_feature_flag, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Feature Flags'),
+            link: project_feature_flags_path(context.project),
+            active_routes: { controller: :feature_flags },
+            container_html_options: { class: 'shortcuts-feature-flags' },
+            item_id: :feature_flags
+          )
+        end
+
+        def product_analytics_menu_item
+          return if Feature.disabled?(:product_analytics, context.project)
+          return unless can?(context.current_user, :read_product_analytics, context.project)
+
+          ::Sidebars::MenuItem.new(
+            title: _('Product Analytics'),
+            link: project_product_analytics_path(context.project),
+            active_routes: { controller: :product_analytics },
+            item_id: :product_analytics
+          )
+        end
+      end
+    end
+  end
+end
+
+Sidebars::Projects::Menus::OperationsMenu.prepend_if_ee('EE::Sidebars::Projects::Menus::OperationsMenu')
diff --git a/lib/sidebars/projects/panel.rb b/lib/sidebars/projects/panel.rb
index 5e2eae989c1..50a82a97adf 100644
--- a/lib/sidebars/projects/panel.rb
+++ b/lib/sidebars/projects/panel.rb
@@ -16,6 +16,7 @@ module Sidebars
         add_menu(Sidebars::Projects::Menus::MergeRequestsMenu.new(context))
         add_menu(Sidebars::Projects::Menus::CiCdMenu.new(context))
         add_menu(Sidebars::Projects::Menus::SecurityComplianceMenu.new(context))
+        add_menu(Sidebars::Projects::Menus::OperationsMenu.new(context))
       end
 
       override :render_raw_menus_partial
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index e91678678a0..701326cab5c 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -22571,6 +22571,12 @@ msgstr ""
 msgid "OnCallSchedules|The schedule could not be updated. Please try again."
 msgstr ""
 
+msgid "OnCallSchedules|To create an escalation policy that defines which schedule is used when, visit the %{linkStart}escalation policy%{linkEnd} page."
+msgstr ""
+
+msgid "OnCallSchedules|To create an escalation policy using this schedule, visit the %{linkStart}escalation policy%{linkEnd} page."
+msgstr ""
+
 msgid "OnCallSchedules|Try adding a rotation"
 msgstr ""
 
@@ -22586,7 +22592,7 @@ msgstr ""
 msgid "OnCallSchedules|You are currently a part of:"
 msgstr ""
 
-msgid "OnCallSchedules|Your schedule has been successfully created and all alerts from this project will now be routed to this schedule. Currently, only one schedule can be created per project. More coming soon! To add individual users to this schedule, use the add a rotation button."
+msgid "OnCallSchedules|Your schedule has been successfully created. To add individual users to this schedule, use the add a rotation button."
 msgstr ""
 
 msgid "OnDemandScans|Could not fetch scanner profiles. Please refresh the page, or try again later."
diff --git a/qa/qa/page/project/sub_menus/operations.rb b/qa/qa/page/project/sub_menus/operations.rb
index af716d1af0d..077da697a63 100644
--- a/qa/qa/page/project/sub_menus/operations.rb
+++ b/qa/qa/page/project/sub_menus/operations.rb
@@ -12,20 +12,13 @@ module QA
 
             base.class_eval do
               include QA::Page::Project::SubMenus::Common
-
-              view 'app/views/layouts/nav/sidebar/_project_menus.html.haml' do
-                element :operations_link
-                element :operations_environments_link
-                element :operations_metrics_link
-                element :operations_incidents_link
-              end
             end
           end
 
           def go_to_operations_environments
             hover_operations do
               within_submenu do
-                click_element(:operations_environments_link)
+                click_element(:sidebar_menu_item_link, menu_item: 'Environments')
               end
             end
           end
@@ -33,7 +26,7 @@ module QA
           def go_to_operations_metrics
             hover_operations do
               within_submenu do
-                click_element(:operations_metrics_link)
+                click_element(:sidebar_menu_item_link, menu_item: 'Metrics')
               end
             end
           end
@@ -49,7 +42,7 @@ module QA
           def go_to_operations_incidents
             hover_operations do
               within_submenu do
-                click_element(:operations_incidents_link)
+                click_element(:sidebar_menu_item_link, menu_item: 'Incidents')
               end
             end
           end
@@ -58,8 +51,8 @@ module QA
 
           def hover_operations
             within_sidebar do
-              scroll_to_element(:operations_link)
-              find_element(:operations_link).hover
+              scroll_to_element(:sidebar_menu_link, menu_item: 'Operations')
+              find_element(:sidebar_menu_link, menu_item: 'Operations').hover
 
               yield
             end
diff --git a/spec/controllers/groups/settings/repository_controller_spec.rb b/spec/controllers/groups/settings/repository_controller_spec.rb
index 14bbdc05282..cbf55218b94 100644
--- a/spec/controllers/groups/settings/repository_controller_spec.rb
+++ b/spec/controllers/groups/settings/repository_controller_spec.rb
@@ -59,6 +59,8 @@ RSpec.describe Groups::Settings::RepositoryController do
             'username' => deploy_token_params[:username],
             'expires_at' => Time.zone.parse(deploy_token_params[:expires_at]),
             'token' => be_a(String),
+            'expired' => false,
+            'revoked' => false,
             'scopes' => deploy_token_params.inject([]) do |scopes, kv|
               key, value = kv
               key.to_s.start_with?('read_') && value.to_i != 0 ? scopes << key.to_s : scopes
diff --git a/spec/controllers/projects/settings/repository_controller_spec.rb b/spec/controllers/projects/settings/repository_controller_spec.rb
index 394f1ff28f2..2bb93990c58 100644
--- a/spec/controllers/projects/settings/repository_controller_spec.rb
+++ b/spec/controllers/projects/settings/repository_controller_spec.rb
@@ -78,6 +78,8 @@ RSpec.describe Projects::Settings::RepositoryController do
             'username' => deploy_token_params[:username],
             'expires_at' => Time.zone.parse(deploy_token_params[:expires_at]),
             'token' => be_a(String),
+            'expired' => false,
+            'revoked' => false,
             'scopes' => deploy_token_params.inject([]) do |scopes, kv|
               key, value = kv
               key.to_s.start_with?('read_') && value.to_i != 0 ? scopes << key.to_s : scopes
diff --git a/spec/features/issues/issue_sidebar_spec.rb b/spec/features/issues/issue_sidebar_spec.rb
index 0566ce968d2..23ffb4190e4 100644
--- a/spec/features/issues/issue_sidebar_spec.rb
+++ b/spec/features/issues/issue_sidebar_spec.rb
@@ -190,6 +190,7 @@ RSpec.describe 'Issue Sidebar' do
             end
 
             find('.js-right-sidebar').click
+            wait_for_requests
 
             open_assignees_dropdown
 
diff --git a/spec/features/operations_sidebar_link_spec.rb b/spec/features/operations_sidebar_link_spec.rb
index 798f9092db0..c1a325a92cc 100644
--- a/spec/features/operations_sidebar_link_spec.rb
+++ b/spec/features/operations_sidebar_link_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 RSpec.describe 'Operations dropdown sidebar', :aggregate_failures do
   let_it_be_with_reload(:project) { create(:project, :internal, :repository) }
+
   let(:user) { create(:user) }
   let(:access_level) { ProjectFeature::PUBLIC }
   let(:role) { nil }
@@ -37,16 +38,16 @@ RSpec.describe 'Operations dropdown sidebar', :aggregate_failures do
   context 'user is not a member' do
     it 'has the correct `Operations` menu items', :aggregate_failures do
       expect(page).to have_selector('a.shortcuts-operations', text: 'Operations')
-      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
-      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
+      expect(page).to have_link('Incidents', href: project_incidents_path(project))
+      expect(page).to have_link('Environments', href: project_environments_path(project))
 
-      expect(page).not_to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
-      expect(page).not_to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
-      expect(page).not_to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
-      expect(page).not_to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
-      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
-      expect(page).not_to have_link(title: 'Logs', href: project_logs_path(project))
-      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+      expect(page).not_to have_link('Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).not_to have_link('Alerts', href: project_alert_management_index_path(project))
+      expect(page).not_to have_link('Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).not_to have_link('Product Analytics', href: project_product_analytics_path(project))
+      expect(page).not_to have_link('Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link('Logs', href: project_logs_path(project))
+      expect(page).not_to have_link('Kubernetes', href: project_clusters_path(project))
     end
 
     context 'when operations project feature is PRIVATE' do
@@ -71,16 +72,16 @@ RSpec.describe 'Operations dropdown sidebar', :aggregate_failures do
 
     it 'has the correct `Operations` menu items' do
       expect(page).to have_selector('a.shortcuts-operations', text: 'Operations')
-      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
-      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
+      expect(page).to have_link('Incidents', href: project_incidents_path(project))
+      expect(page).to have_link('Environments', href: project_environments_path(project))
 
-      expect(page).not_to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
-      expect(page).not_to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
-      expect(page).not_to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
-      expect(page).not_to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
-      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
-      expect(page).not_to have_link(title: 'Logs', href: project_logs_path(project))
-      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+      expect(page).not_to have_link('Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).not_to have_link('Alerts', href: project_alert_management_index_path(project))
+      expect(page).not_to have_link('Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).not_to have_link('Product Analytics', href: project_product_analytics_path(project))
+      expect(page).not_to have_link('Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link('Logs', href: project_logs_path(project))
+      expect(page).not_to have_link('Kubernetes', href: project_clusters_path(project))
     end
 
     it_behaves_like 'shows Operations menu based on the access level'
@@ -90,16 +91,16 @@ RSpec.describe 'Operations dropdown sidebar', :aggregate_failures do
     let(:role) { :reporter }
 
     it 'has the correct `Operations` menu items' do
-      expect(page).to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
-      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
-      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
-      expect(page).to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
-      expect(page).to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
+      expect(page).to have_link('Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).to have_link('Incidents', href: project_incidents_path(project))
+      expect(page).to have_link('Environments', href: project_environments_path(project))
+      expect(page).to have_link('Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).to have_link('Product Analytics', href: project_product_analytics_path(project))
 
-      expect(page).not_to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
-      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
-      expect(page).not_to have_link(title: 'Logs', href: project_logs_path(project))
-      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+      expect(page).not_to have_link('Alerts', href: project_alert_management_index_path(project))
+      expect(page).not_to have_link('Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link('Logs', href: project_logs_path(project))
+      expect(page).not_to have_link('Kubernetes', href: project_clusters_path(project))
     end
 
     it_behaves_like 'shows Operations menu based on the access level'
@@ -109,16 +110,16 @@ RSpec.describe 'Operations dropdown sidebar', :aggregate_failures do
     let(:role) { :developer }
 
     it 'has the correct `Operations` menu items' do
-      expect(page).to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
-      expect(page).to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
-      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
-      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
-      expect(page).to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
-      expect(page).to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
-      expect(page).to have_link(title: 'Logs', href: project_logs_path(project))
+      expect(page).to have_link('Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).to have_link('Alerts', href: project_alert_management_index_path(project))
+      expect(page).to have_link('Incidents', href: project_incidents_path(project))
+      expect(page).to have_link('Environments', href: project_environments_path(project))
+      expect(page).to have_link('Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).to have_link('Product Analytics', href: project_product_analytics_path(project))
+      expect(page).to have_link('Logs', href: project_logs_path(project))
 
-      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
-      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+      expect(page).not_to have_link('Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link('Kubernetes', href: project_clusters_path(project))
     end
 
     it_behaves_like 'shows Operations menu based on the access level'
@@ -128,15 +129,15 @@ RSpec.describe 'Operations dropdown sidebar', :aggregate_failures do
     let(:role) { :maintainer }
 
     it 'has the correct `Operations` menu items' do
-      expect(page).to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
-      expect(page).to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
-      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
-      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
-      expect(page).to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
-      expect(page).to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
-      expect(page).to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
-      expect(page).to have_link(title: 'Logs', href: project_logs_path(project))
-      expect(page).to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+      expect(page).to have_link('Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).to have_link('Alerts', href: project_alert_management_index_path(project))
+      expect(page).to have_link('Incidents', href: project_incidents_path(project))
+      expect(page).to have_link('Environments', href: project_environments_path(project))
+      expect(page).to have_link('Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).to have_link('Product Analytics', href: project_product_analytics_path(project))
+      expect(page).to have_link('Serverless', href: project_serverless_functions_path(project))
+      expect(page).to have_link('Logs', href: project_logs_path(project))
+      expect(page).to have_link('Kubernetes', href: project_clusters_path(project))
     end
 
     it_behaves_like 'shows Operations menu based on the access level'
diff --git a/spec/finders/deploy_tokens/tokens_finder_spec.rb b/spec/finders/deploy_tokens/tokens_finder_spec.rb
new file mode 100644
index 00000000000..7f19c5bf11b
--- /dev/null
+++ b/spec/finders/deploy_tokens/tokens_finder_spec.rb
@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe DeployTokens::TokensFinder do
+  include AdminModeHelper
+
+  let_it_be(:admin)      { create(:admin) }
+  let_it_be(:user)       { create(:user) }
+  let_it_be(:other_user) { create(:user) }
+  let_it_be(:project)    { create(:project, creator_id: user.id) }
+  let_it_be(:group)      { create(:group) }
+
+  let!(:project_deploy_token) { create(:deploy_token, projects: [project]) }
+  let!(:revoked_project_deploy_token) { create(:deploy_token, projects: [project], revoked: true) }
+  let!(:expired_project_deploy_token) { create(:deploy_token, projects: [project], expires_at: '1988-01-11T04:33:04-0600') }
+  let!(:group_deploy_token) { create(:deploy_token, :group, groups: [group]) }
+  let!(:revoked_group_deploy_token) { create(:deploy_token, :group, groups: [group], revoked: true) }
+  let!(:expired_group_deploy_token) { create(:deploy_token, :group, groups: [group], expires_at: '1988-01-11T04:33:04-0600') }
+
+  describe "#execute" do
+    let(:params) { {} }
+
+    context 'when scope is :all' do
+      subject { described_class.new(admin, :all, params).execute }
+
+      before do
+        enable_admin_mode!(admin)
+      end
+
+      it 'returns all deploy tokens' do
+        expect(subject.size).to eq(6)
+        is_expected.to match_array([
+          project_deploy_token,
+          revoked_project_deploy_token,
+          expired_project_deploy_token,
+          group_deploy_token,
+          revoked_group_deploy_token,
+          expired_group_deploy_token
+        ])
+      end
+
+      context 'and active filter is applied' do
+        let(:params) { { active: true } }
+
+        it 'returns only active tokens' do
+          is_expected.to match_array([
+            project_deploy_token,
+            group_deploy_token
+          ])
+        end
+      end
+
+      context 'but user is not an admin' do
+        subject { described_class.new(user, :all, params).execute }
+
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { subject }.to raise_error(Gitlab::Access::AccessDeniedError)
+        end
+      end
+    end
+
+    context 'when scope is a Project' do
+      subject { described_class.new(user, project, params).execute }
+
+      before do
+        project.add_maintainer(user)
+      end
+
+      it 'returns all deploy tokens for the project' do
+        is_expected.to match_array([
+          project_deploy_token,
+          revoked_project_deploy_token,
+          expired_project_deploy_token
+        ])
+      end
+
+      context 'and active filter is applied' do
+        let(:params) { { active: true } }
+
+        it 'returns only active tokens for the project' do
+          is_expected.to match_array([project_deploy_token])
+        end
+      end
+
+      context 'but user is not a member' do
+        subject { described_class.new(other_user, :all, params).execute }
+
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { subject }.to raise_error(Gitlab::Access::AccessDeniedError)
+        end
+      end
+    end
+
+    context 'when scope is a Group' do
+      subject { described_class.new(user, group, params).execute }
+
+      before do
+        group.add_maintainer(user)
+      end
+
+      it 'returns all deploy tokens for the group' do
+        is_expected.to match_array([
+          group_deploy_token,
+          revoked_group_deploy_token,
+          expired_group_deploy_token
+        ])
+      end
+
+      context 'and active filter is applied' do
+        let(:params) { { active: true } }
+
+        it 'returns only active tokens for the group' do
+          is_expected.to match_array([group_deploy_token])
+        end
+      end
+
+      context 'but user is not a member' do
+        subject { described_class.new(other_user, :all, params).execute }
+
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { subject }.to raise_error(Gitlab::Access::AccessDeniedError)
+        end
+      end
+    end
+
+    context 'when scope is nil' do
+      subject { described_class.new(user, nil, params).execute }
+
+      it 'raises ArgumentError' do
+        expect { subject }.to raise_error(ArgumentError)
+      end
+    end
+  end
+end
diff --git a/spec/frontend/vue_shared/components/runner_instructions/runner_instructions_modal_spec.js b/spec/frontend/vue_shared/components/runner_instructions/runner_instructions_modal_spec.js
index 4033c943b82..32ef2d27ba7 100644
--- a/spec/frontend/vue_shared/components/runner_instructions/runner_instructions_modal_spec.js
+++ b/spec/frontend/vue_shared/components/runner_instructions/runner_instructions_modal_spec.js
@@ -1,4 +1,5 @@
-import { GlAlert, GlLoadingIcon, GlSkeletonLoader } from '@gitlab/ui';
+import { GlAlert, GlButton, GlLoadingIcon, GlSkeletonLoader } from '@gitlab/ui';
+import { GlBreakpointInstance as bp } from '@gitlab/ui/dist/utils';
 import { shallowMount, createLocalVue } from '@vue/test-utils';
 import { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
@@ -18,6 +19,24 @@ import {
 const localVue = createLocalVue();
 localVue.use(VueApollo);
 
+let resizeCallback;
+const MockResizeObserver = {
+  bind(el, { value }) {
+    resizeCallback = value;
+  },
+  mockResize(size) {
+    bp.getBreakpointSize.mockReturnValue(size);
+    resizeCallback();
+  },
+  unbind() {
+    resizeCallback = null;
+  },
+};
+
+localVue.directive('gl-resize-observer', MockResizeObserver);
+
+jest.mock('@gitlab/ui/dist/utils');
+
 describe('RunnerInstructionsModal component', () => {
   let wrapper;
   let fakeApollo;
@@ -27,7 +46,8 @@ describe('RunnerInstructionsModal component', () => {
   const findSkeletonLoader = () => wrapper.findComponent(GlSkeletonLoader);
   const findGlLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
   const findAlert = () => wrapper.findComponent(GlAlert);
-  const findPlatformButtons = () => wrapper.findAllByTestId('platform-button');
+  const findPlatformButtonGroup = () => wrapper.findByTestId('platform-buttons');
+  const findPlatformButtons = () => findPlatformButtonGroup().findAllComponents(GlButton);
   const findArchitectureDropdownItems = () => wrapper.findAllByTestId('architecture-dropdown-item');
   const findBinaryInstructions = () => wrapper.findByTestId('binary-instructions');
   const findRegisterCommand = () => wrapper.findByTestId('register-command');
@@ -141,6 +161,22 @@ describe('RunnerInstructionsModal component', () => {
     });
   });
 
+  describe('when the modal resizes', () => {
+    it('to an xs viewport', async () => {
+      MockResizeObserver.mockResize('xs');
+      await nextTick();
+
+      expect(findPlatformButtonGroup().attributes('vertical')).toBeTruthy();
+    });
+
+    it('to a non-xs viewport', async () => {
+      MockResizeObserver.mockResize('sm');
+      await nextTick();
+
+      expect(findPlatformButtonGroup().props('vertical')).toBeFalsy();
+    });
+  });
+
   describe('when apollo is loading', () => {
     it('should show a skeleton loader', async () => {
       createComponent();
diff --git a/spec/helpers/projects_helper_spec.rb b/spec/helpers/projects_helper_spec.rb
index a311d783996..fe7aa9894e9 100644
--- a/spec/helpers/projects_helper_spec.rb
+++ b/spec/helpers/projects_helper_spec.rb
@@ -477,43 +477,6 @@ RSpec.describe ProjectsHelper do
     end
   end
 
-  describe '#can_view_operations_tab?' do
-    before do
-      allow(helper).to receive(:current_user).and_return(user)
-      allow(helper).to receive(:can?).and_return(false)
-    end
-
-    subject { helper.send(:can_view_operations_tab?, user, project) }
-
-    where(:ability) do
-      [
-        :metrics_dashboard,
-        :read_alert_management_alert,
-        :read_environment,
-        :read_issue,
-        :read_sentry_issue,
-        :read_cluster
-      ]
-    end
-
-    with_them do
-      it 'includes operations tab' do
-        allow(helper).to receive(:can?).with(user, ability, project).and_return(true)
-
-        is_expected.to be(true)
-      end
-
-      context 'when operations feature is disabled' do
-        it 'does not include operations tab' do
-          allow(helper).to receive(:can?).with(user, ability, project).and_return(true)
-          project.project_feature.update_attribute(:operations_access_level, ProjectFeature::DISABLED)
-
-          is_expected.to be(false)
-        end
-      end
-    end
-  end
-
   describe '#show_projects' do
     let(:projects) do
       Project.all
diff --git a/spec/lib/gitlab/database/migration_helpers_spec.rb b/spec/lib/gitlab/database/migration_helpers_spec.rb
index 172af0ade90..40720628a89 100644
--- a/spec/lib/gitlab/database/migration_helpers_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers_spec.rb
@@ -835,7 +835,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
         it 'renames a column concurrently' do
           expect(model).to receive(:check_trigger_permissions!).with(:users)
 
-          expect(model).to receive(:install_rename_triggers_for_postgresql)
+          expect(model).to receive(:install_rename_triggers)
             .with(:users, :old, :new)
 
           expect(model).to receive(:add_column)
@@ -947,7 +947,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
     it 'reverses the operations of rename_column_concurrently' do
       expect(model).to receive(:check_trigger_permissions!).with(:users)
 
-      expect(model).to receive(:remove_rename_triggers_for_postgresql)
+      expect(model).to receive(:remove_rename_triggers)
         .with(:users, /trigger_.{12}/)
 
       expect(model).to receive(:remove_column).with(:users, :new)
@@ -960,7 +960,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
     it 'cleans up the renaming procedure' do
       expect(model).to receive(:check_trigger_permissions!).with(:users)
 
-      expect(model).to receive(:remove_rename_triggers_for_postgresql)
+      expect(model).to receive(:remove_rename_triggers)
         .with(:users, /trigger_.{12}/)
 
       expect(model).to receive(:remove_column).with(:users, :old)
@@ -1000,7 +1000,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
       it 'reverses the operations of cleanup_concurrent_column_rename' do
         expect(model).to receive(:check_trigger_permissions!).with(:users)
 
-        expect(model).to receive(:install_rename_triggers_for_postgresql)
+        expect(model).to receive(:install_rename_triggers)
           .with(:users, :old, :new)
 
         expect(model).to receive(:add_column)
@@ -1095,7 +1095,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
     it 'reverses the operations of change_column_type_concurrently' do
       expect(model).to receive(:check_trigger_permissions!).with(:users)
 
-      expect(model).to receive(:remove_rename_triggers_for_postgresql)
+      expect(model).to receive(:remove_rename_triggers)
         .with(:users, /trigger_.{12}/)
 
       expect(model).to receive(:remove_column).with(:users, "old_for_type_change")
@@ -1160,7 +1160,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
         expect(model).to receive(:rename_column)
           .with(:users, temp_undo_cleanup_column, :old)
 
-        expect(model).to receive(:install_rename_triggers_for_postgresql)
+        expect(model).to receive(:install_rename_triggers)
           .with(:users, :old, 'old_for_type_change')
 
         model.undo_cleanup_concurrent_column_type_change(:users, :old, :string)
@@ -1186,7 +1186,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
         expect(model).to receive(:rename_column)
           .with(:users, temp_undo_cleanup_column, :old)
 
-        expect(model).to receive(:install_rename_triggers_for_postgresql)
+        expect(model).to receive(:install_rename_triggers)
           .with(:users, :old, 'old_for_type_change')
 
         model.undo_cleanup_concurrent_column_type_change(
@@ -1207,8 +1207,8 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
     end
   end
 
-  describe '#install_rename_triggers_for_postgresql' do
-    it 'installs the triggers for PostgreSQL' do
+  describe '#install_rename_triggers' do
+    it 'installs the triggers' do
       copy_trigger = double('copy trigger')
 
       expect(Gitlab::Database::UnidirectionalCopyTrigger).to receive(:on_table)
@@ -1216,11 +1216,11 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
 
       expect(copy_trigger).to receive(:create).with(:old, :new, trigger_name: 'foo')
 
-      model.install_rename_triggers_for_postgresql(:users, :old, :new, trigger_name: 'foo')
+      model.install_rename_triggers(:users, :old, :new, trigger_name: 'foo')
     end
   end
 
-  describe '#remove_rename_triggers_for_postgresql' do
+  describe '#remove_rename_triggers' do
     it 'removes the function and trigger' do
       copy_trigger = double('copy trigger')
 
@@ -1229,7 +1229,7 @@ RSpec.describe Gitlab::Database::MigrationHelpers do
 
       expect(copy_trigger).to receive(:drop).with('foo')
 
-      model.remove_rename_triggers_for_postgresql('bar', 'foo')
+      model.remove_rename_triggers('bar', 'foo')
     end
   end
 
diff --git a/spec/lib/sidebars/projects/menus/operations_menu_spec.rb b/spec/lib/sidebars/projects/menus/operations_menu_spec.rb
new file mode 100644
index 00000000000..f8b4fc3757d
--- /dev/null
+++ b/spec/lib/sidebars/projects/menus/operations_menu_spec.rb
@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Sidebars::Projects::Menus::OperationsMenu do
+  let_it_be_with_refind(:project) { create(:project) }
+
+  let(:user) { project.owner }
+  let(:show_cluster_hint) { true }
+  let(:context) { Sidebars::Projects::Context.new(current_user: user, container: project, show_cluster_hint: show_cluster_hint) }
+
+  subject { described_class.new(context) }
+
+  describe '#render?' do
+    context 'when operations feature is disabled' do
+      it 'returns false' do
+        project.project_feature.update!(operations_access_level: Featurable::DISABLED)
+
+        expect(subject.render?).to be false
+      end
+    end
+
+    context 'when operation feature is enabled' do
+      context 'when menu does not have any menu items' do
+        it 'returns false' do
+          allow(subject).to receive(:has_items?).and_return(false)
+
+          expect(subject.render?).to be false
+        end
+      end
+
+      context 'when menu has menu items' do
+        it 'returns true' do
+          expect(subject.render?).to be true
+        end
+      end
+    end
+  end
+
+  describe '#link' do
+    context 'when metrics dashboard is visible' do
+      it 'returns link to the metrics dashboard page' do
+        expect(subject.link).to include('/-/environments/metrics')
+      end
+    end
+
+    context 'when metrics dashboard is not visible' do
+      it 'returns link to the feature flags page' do
+        project.project_feature.update!(operations_access_level: Featurable::DISABLED)
+
+        expect(subject.link).to include('/-/feature_flags')
+      end
+    end
+  end
+
+  context 'Menu items' do
+    subject { described_class.new(context).items.index { |e| e.item_id == item_id } }
+
+    describe 'Metrics Dashboard' do
+      let(:item_id) { :metrics }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Logs' do
+      let(:item_id) { :logs }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Tracing' do
+      let(:item_id) { :tracing }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Error Tracking' do
+      let(:item_id) { :error_tracking }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Alert Management' do
+      let(:item_id) { :alert_management }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Incidents' do
+      let(:item_id) { :incidents }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Serverless' do
+      let(:item_id) { :serverless }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Terraform' do
+      let(:item_id) { :terraform }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Kubernetes' do
+      let(:item_id) { :kubernetes }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Environments' do
+      let(:item_id) { :environments }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Feature Flags' do
+      let(:item_id) { :feature_flags }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        specify { is_expected.to be_nil }
+      end
+    end
+
+    describe 'Product Analytics' do
+      let(:item_id) { :product_analytics }
+
+      specify { is_expected.not_to be_nil }
+
+      describe 'when feature flag :product_analytics is disabled' do
+        specify do
+          stub_feature_flags(product_analytics: false)
+
+          is_expected.to be_nil
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/deploy_tokens_spec.rb b/spec/requests/api/deploy_tokens_spec.rb
index 7a31ff725c8..e8426270622 100644
--- a/spec/requests/api/deploy_tokens_spec.rb
+++ b/spec/requests/api/deploy_tokens_spec.rb
@@ -8,7 +8,11 @@ RSpec.describe API::DeployTokens do
   let_it_be(:project)       { create(:project, creator_id: creator.id) }
   let_it_be(:group)         { create(:group) }
   let!(:deploy_token) { create(:deploy_token, projects: [project]) }
+  let!(:revoked_deploy_token) { create(:deploy_token, projects: [project], revoked: true) }
+  let!(:expired_deploy_token) { create(:deploy_token, projects: [project], expires_at: '1988-01-11T04:33:04-0600') }
   let!(:group_deploy_token) { create(:deploy_token, :group, groups: [group]) }
+  let!(:revoked_group_deploy_token) { create(:deploy_token, :group, groups: [group], revoked: true) }
+  let!(:expired_group_deploy_token) { create(:deploy_token, :group, groups: [group], expires_at: '1988-01-11T04:33:04-0600') }
 
   describe 'GET /deploy_tokens' do
     subject do
@@ -36,8 +40,31 @@ RSpec.describe API::DeployTokens do
       it 'returns all deploy tokens' do
         subject
 
+        token_ids = json_response.map { |token| token['id'] }
         expect(response).to include_pagination_headers
         expect(response).to match_response_schema('public_api/v4/deploy_tokens')
+        expect(token_ids).to match_array([
+          deploy_token.id,
+          revoked_deploy_token.id,
+          expired_deploy_token.id,
+          group_deploy_token.id,
+          revoked_group_deploy_token.id,
+          expired_group_deploy_token.id
+        ])
+      end
+
+      context 'and active=true' do
+        it 'only returns active deploy tokens' do
+          get api('/deploy_tokens?active=true', user)
+
+          token_ids = json_response.map { |token| token['id'] }
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(token_ids).to match_array([
+            deploy_token.id,
+            group_deploy_token.id
+          ])
+        end
       end
     end
   end
@@ -82,7 +109,22 @@ RSpec.describe API::DeployTokens do
         subject
 
         token_ids = json_response.map { |token| token['id'] }
-        expect(token_ids).not_to include(other_deploy_token.id)
+        expect(token_ids).to match_array([
+          deploy_token.id,
+          expired_deploy_token.id,
+          revoked_deploy_token.id
+        ])
+      end
+
+      context 'and active=true' do
+        it 'only returns active deploy tokens for the project' do
+          get api("/projects/#{project.id}/deploy_tokens?active=true", user)
+
+          token_ids = json_response.map { |token| token['id'] }
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(token_ids).to match_array([deploy_token.id])
+        end
       end
     end
   end
@@ -119,8 +161,10 @@ RSpec.describe API::DeployTokens do
       it 'returns all deploy tokens for the group' do
         subject
 
+        token_ids = json_response.map { |token| token['id'] }
         expect(response).to include_pagination_headers
         expect(response).to match_response_schema('public_api/v4/deploy_tokens')
+        expect(token_ids.length).to be(3)
       end
 
       it 'does not return deploy tokens for other groups' do
@@ -129,6 +173,17 @@ RSpec.describe API::DeployTokens do
         token_ids = json_response.map { |token| token['id'] }
         expect(token_ids).not_to include(other_deploy_token.id)
       end
+
+      context 'and active=true' do
+        it 'only returns active deploy tokens for the group' do
+          get api("/groups/#{group.id}/deploy_tokens?active=true", user)
+
+          token_ids = json_response.map { |token| token['id'] }
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(token_ids).to eql([group_deploy_token.id])
+        end
+      end
     end
   end
 
diff --git a/spec/views/layouts/nav/sidebar/_project.html.haml_spec.rb b/spec/views/layouts/nav/sidebar/_project.html.haml_spec.rb
index ea0bdb1a9ae..f83a515fb23 100644
--- a/spec/views/layouts/nav/sidebar/_project.html.haml_spec.rb
+++ b/spec/views/layouts/nav/sidebar/_project.html.haml_spec.rb
@@ -348,6 +348,238 @@ RSpec.describe 'layouts/nav/sidebar/_project' do
     end
   end
 
+  describe 'Operations' do
+    it 'top level navigation link is visible for user with permissions' do
+      render
+
+      expect(rendered).to have_link('Operations')
+    end
+
+    describe 'Metrics Dashboard' do
+      it 'has a link to the metrics dashboard page' do
+        render
+
+        expect(rendered).to have_link('Metrics', href: project_metrics_dashboard_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the metrics page' do
+          render
+
+          expect(rendered).not_to have_link('Metrics')
+        end
+      end
+    end
+
+    describe 'Logs' do
+      it 'has a link to the pod logs page' do
+        render
+
+        expect(rendered).to have_link('Logs', href: project_logs_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the pod logs page' do
+          render
+
+          expect(rendered).not_to have_link('Logs')
+        end
+      end
+    end
+
+    describe 'Tracing' do
+      it 'has a link to the tracing page' do
+        render
+
+        expect(rendered).to have_link('Tracing', href: project_tracing_path(project))
+      end
+
+      context 'without project.tracing_external_url' do
+        it 'has a link to the tracing page' do
+          render
+
+          expect(rendered).to have_link('Tracing', href: project_tracing_path(project))
+        end
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the tracing page' do
+          render
+
+          expect(rendered).not_to have_text 'Tracing'
+        end
+      end
+    end
+
+    describe 'Error Tracking' do
+      it 'has a link to the error tracking page' do
+        render
+
+        expect(rendered).to have_link('Error Tracking', href: project_error_tracking_index_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the error tracking page' do
+          render
+
+          expect(rendered).not_to have_link('Error Tracking')
+        end
+      end
+    end
+
+    describe 'Alert Management' do
+      it 'has a link to the alert management page' do
+        render
+
+        expect(rendered).to have_link('Alerts', href: project_alert_management_index_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the alert management page' do
+          render
+
+          expect(rendered).not_to have_link('Alerts')
+        end
+      end
+    end
+
+    describe 'Incidents' do
+      it 'has a link to the incidents page' do
+        render
+
+        expect(rendered).to have_link('Incidents', href: project_incidents_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the incidents page' do
+          render
+
+          expect(rendered).not_to have_link('Incidents')
+        end
+      end
+    end
+
+    describe 'Serverless' do
+      it 'has a link to the serverless page' do
+        render
+
+        expect(rendered).to have_link('Serverless', href: project_serverless_functions_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the serverless page' do
+          render
+
+          expect(rendered).not_to have_link('Serverless')
+        end
+      end
+    end
+
+    describe 'Terraform' do
+      it 'has a link to the terraform page' do
+        render
+
+        expect(rendered).to have_link('Terraform', href: project_terraform_index_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the terraform page' do
+          render
+
+          expect(rendered).not_to have_link('Terraform')
+        end
+      end
+    end
+
+    describe 'Kubernetes' do
+      it 'has a link to the kubernetes page' do
+        render
+
+        expect(rendered).to have_link('Kubernetes', href: project_clusters_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the kubernetes page' do
+          render
+
+          expect(rendered).not_to have_link('Kubernetes')
+        end
+      end
+    end
+
+    describe 'Environments' do
+      it 'has a link to the environments page' do
+        render
+
+        expect(rendered).to have_link('Environments', href: project_environments_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the environments page' do
+          render
+
+          expect(rendered).not_to have_link('Environments')
+        end
+      end
+    end
+
+    describe 'Feature Flags' do
+      it 'has a link to the feature flags page' do
+        render
+
+        expect(rendered).to have_link('Feature Flags', href: project_feature_flags_path(project))
+      end
+
+      describe 'when the user does not have access' do
+        let(:user) { nil }
+
+        it 'does not have a link to the feature flags page' do
+          render
+
+          expect(rendered).not_to have_link('Feature Flags')
+        end
+      end
+    end
+
+    describe 'Product Analytics' do
+      it 'has a link to the product analytics page' do
+        render
+
+        expect(rendered).to have_link('Product Analytics', href: project_product_analytics_path(project))
+      end
+
+      describe 'when feature flag :product_analytics is disabled' do
+        it 'does not have a link to the feature flags page' do
+          stub_feature_flags(product_analytics: false)
+
+          render
+
+          expect(rendered).not_to have_link('Product Analytics')
+        end
+      end
+    end
+  end
+
   describe 'packages tab' do
     before do
       stub_container_registry_config(enabled: true)
@@ -510,6 +742,32 @@ RSpec.describe 'layouts/nav/sidebar/_project' do
     end
   end
 
+  describe 'value stream analytics entry' do
+    let(:read_cycle_analytics) { true }
+
+    before do
+      allow(view).to receive(:can?).with(user, :read_cycle_analytics, project).and_return(read_cycle_analytics)
+    end
+
+    describe 'when value stream analytics is enabled' do
+      it 'shows the value stream analytics entry' do
+        render
+
+        expect(rendered).to have_link('Value Stream', href: project_cycle_analytics_path(project))
+      end
+    end
+
+    describe 'when value stream analytics is disabled' do
+      let(:read_cycle_analytics) { false }
+
+      it 'does not show the value stream analytics entry' do
+        render
+
+        expect(rendered).not_to have_link('Value Stream', href: project_cycle_analytics_path(project))
+      end
+    end
+  end
+
   describe 'operations settings tab' do
     describe 'archive projects' do
       before do
@@ -536,64 +794,6 @@ RSpec.describe 'layouts/nav/sidebar/_project' do
         end
       end
     end
-
-    describe 'Tracing' do
-      it 'is not visible to unauthorized user' do
-        allow(view).to receive(:can?).and_return(false)
-
-        render
-
-        expect(rendered).not_to have_text 'Tracing'
-      end
-
-      it 'links to Tracing page' do
-        render
-
-        expect(rendered).to have_link('Tracing', href: project_tracing_path(project))
-      end
-
-      context 'without project.tracing_external_url' do
-        it 'links to Tracing page' do
-          render
-
-          expect(rendered).to have_link('Tracing', href: project_tracing_path(project))
-        end
-      end
-    end
-
-    describe 'Alert Management' do
-      it 'shows the Alerts sidebar entry' do
-        render
-
-        expect(rendered).to have_css('a[title="Alerts"]')
-      end
-    end
-  end
-
-  describe 'value stream analytics entry' do
-    let(:read_cycle_analytics) { true }
-
-    before do
-      allow(view).to receive(:can?).with(user, :read_cycle_analytics, project).and_return(read_cycle_analytics)
-    end
-
-    describe 'when value stream analytics is enabled' do
-      it 'shows the value stream analytics entry' do
-        render
-
-        expect(rendered).to have_link('Value Stream', href: project_cycle_analytics_path(project))
-      end
-    end
-
-    describe 'when value stream analytics is disabled' do
-      let(:read_cycle_analytics) { false }
-
-      it 'does not show the value stream analytics entry' do
-        render
-
-        expect(rendered).not_to have_link('Value Stream', href: project_cycle_analytics_path(project))
-      end
-    end
   end
 
   describe 'project access tokens' do