Add latest changes from gitlab-org/gitlab@master

44 files changed, 278 insertions, 284 deletions

diff --git a/.gitlab/issue_templates/Security developer workflow.md b/.gitlab/issue_templates/Security developer workflow.md
index 695f0167ad4..7d7dedc2ef4 100644
--- a/.gitlab/issue_templates/Security developer workflow.md
+++ b/.gitlab/issue_templates/Security developer workflow.md
@@ -64,7 +64,7 @@ After your merge request has been approved according to our [approval guidelines
 | Thanks | | |
 
 [security process for developers]: https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md
-[secpick documentation]: https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md#secpick-script
+[secpick documentation]: https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/security/utilities/secpick_script.md
 [security Release merge request template]: https://gitlab.com/gitlab-org/security/gitlab/blob/master/.gitlab/merge_request_templates/Security%20Release.md
 [code review process]: https://docs.gitlab.com/ee/development/code_review.html
 [approval guidelines]: https://docs.gitlab.com/ee/development/code_review.html#approval-guidelines
diff --git a/changelogs/unreleased/nicolasdular-additional-purchased-storage-db.yml b/changelogs/unreleased/nicolasdular-additional-purchased-storage-db.yml
new file mode 100644
index 00000000000..b43e0e7f33d
--- /dev/null
+++ b/changelogs/unreleased/nicolasdular-additional-purchased-storage-db.yml
@@ -0,0 +1,5 @@
+---
+title: Create namespace_limits table with additional purchase columns
+merge_request: 34746
+author:
+type: added
diff --git a/db/migrate/20200617150041_create_namespace_limits.rb b/db/migrate/20200617150041_create_namespace_limits.rb
new file mode 100644
index 00000000000..a3bc1cce037
--- /dev/null
+++ b/db/migrate/20200617150041_create_namespace_limits.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class CreateNamespaceLimits < ActiveRecord::Migration[6.0]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def up
+    with_lock_retries do
+      create_table :namespace_limits, id: false do |t|
+        t.bigint :additional_purchased_storage_size, default: 0, null: false
+        t.date :additional_purchased_storage_ends_on, null: true
+
+        t.references :namespace, primary_key: true, default: nil, type: :integer, index: false, foreign_key: { on_delete: :cascade }
+      end
+    end
+  end
+
+  def down
+    drop_table :namespace_limits # rubocop:disable Migration/DropTable
+  end
+end
diff --git a/db/structure.sql b/db/structure.sql
index e37f3424a29..be5b32e03a9 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -4258,6 +4258,12 @@ CREATE TABLE public.namespace_aggregation_schedules (
     namespace_id integer NOT NULL
 );
 
+CREATE TABLE public.namespace_limits (
+    additional_purchased_storage_size bigint DEFAULT 0 NOT NULL,
+    additional_purchased_storage_ends_on date,
+    namespace_id integer NOT NULL
+);
+
 CREATE TABLE public.namespace_root_storage_statistics (
     namespace_id integer NOT NULL,
     updated_at timestamp with time zone NOT NULL,
@@ -8718,6 +8724,9 @@ ALTER TABLE ONLY public.milestones
 ALTER TABLE ONLY public.namespace_aggregation_schedules
     ADD CONSTRAINT namespace_aggregation_schedules_pkey PRIMARY KEY (namespace_id);
 
+ALTER TABLE ONLY public.namespace_limits
+    ADD CONSTRAINT namespace_limits_pkey PRIMARY KEY (namespace_id);
+
 ALTER TABLE ONLY public.namespace_root_storage_statistics
     ADD CONSTRAINT namespace_root_storage_statistics_pkey PRIMARY KEY (namespace_id);
 
@@ -12319,6 +12328,9 @@ ALTER TABLE ONLY public.resource_label_events
 ALTER TABLE ONLY public.approval_merge_request_rules_groups
     ADD CONSTRAINT fk_rails_5b2ecf6139 FOREIGN KEY (approval_merge_request_rule_id) REFERENCES public.approval_merge_request_rules(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY public.namespace_limits
+    ADD CONSTRAINT fk_rails_5b3f2bc334 FOREIGN KEY (namespace_id) REFERENCES public.namespaces(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY public.protected_environment_deploy_access_levels
     ADD CONSTRAINT fk_rails_5b9f6970fe FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;
 
@@ -14088,6 +14100,7 @@ COPY "schema_migrations" (version) FROM STDIN;
 20200617001637
 20200617001848
 20200617002030
+20200617150041
 20200618105638
 20200618134223
 20200618134723
diff --git a/doc/administration/gitaly/index.md b/doc/administration/gitaly/index.md
index 1469ed64004..9522eaea88c 100644
--- a/doc/administration/gitaly/index.md
+++ b/doc/administration/gitaly/index.md
@@ -49,6 +49,12 @@ To change Gitaly settings:
 1. Edit `/home/git/gitaly/config.toml` and add or change the [Gitaly settings](https://gitlab.com/gitlab-org/gitaly/blob/master/config.toml.example).
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
 
+The following configuration options are also available:
+
+- Enabling [TLS support](#enable-tls-support).
+- Configuring the [number of `gitaly-ruby` workers](#configure-number-of-gitaly-ruby-workers).
+- Limiting [RPC concurrency](#limit-rpc-concurrency).
+
 ## Run Gitaly on its own server
 
 By default, Gitaly is run on the same server as Gitaly clients and is
@@ -72,6 +78,7 @@ The process for setting up Gitaly on its own server is:
 1. [Configure authentication](#configure-authentication).
 1. [Configure Gitaly servers](#configure-gitaly-servers).
 1. [Configure Gitaly clients](#configure-gitaly-clients).
+1. [Disable Gitaly where not required](#disable-gitaly-where-not-required-optional) (optional).
 
 When running Gitaly on its own server, note the following regarding GitLab versions:
 
@@ -116,7 +123,7 @@ The following list depicts the network architecture of Gitaly:
 DANGER: **Danger:**
 Gitaly servers must not be exposed to the public internet as Gitaly's network traffic is unencrypted
 by default. The use of firewall is highly recommended to restrict access to the Gitaly server.
-Another option is to [use TLS](#tls-support).
+Another option is to [use TLS](#enable-tls-support).
 
 In the following sections, we describe how to configure two Gitaly servers with secret token
 `abc123secret`:
@@ -457,15 +464,15 @@ If you have [server hooks](../server_hooks.md) configured, either per repository
 must move these to the Gitaly servers. If you have multiple Gitaly servers, copy your server hooks
 to all Gitaly servers.
 
-### Disabling the Gitaly service in a cluster environment
+### Disable Gitaly where not required (optional)
+
+If you are running Gitaly [as a remote service](#run-gitaly-on-its-own-server) you may want to
+disable the local Gitaly service that runs on your GitLab server by default, leaving it only running
+where required.
 
-If you are running Gitaly [as a remote
-service](#run-gitaly-on-its-own-server) you may want to disable
-the local Gitaly service that runs on your GitLab server by default.
-Disabling Gitaly only makes sense when you run GitLab in a custom
-cluster configuration, where different services run on different
-machines. Disabling Gitaly on all machines in the cluster is not a
-valid configuration.
+Disabling Gitaly on the GitLab instance only makes sense when you run GitLab in a custom cluster configuration, where
+Gitaly runs on a separate machine from the GitLab instance. Disabling Gitaly on all machines in the cluster is not
+a valid configuration (some machines much act as Gitaly servers).
 
 To disable Gitaly on a GitLab server:
 
@@ -489,43 +496,44 @@ To disable Gitaly on a GitLab server:
 
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
 
-## TLS support
+## Enable TLS support
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/22602) in GitLab 11.8.
 
-Gitaly supports TLS encryption. To be able to communicate
-with a Gitaly instance that listens for secure connections you will need to use `tls://` URL
-scheme in the `gitaly_address` of the corresponding storage entry in the GitLab configuration.
+Gitaly supports TLS encryption. To communicate with a Gitaly instance that listens for secure
+connections, you must use `tls://` URL scheme in the `gitaly_address` of the corresponding
+storage entry in the GitLab configuration.
 
-You will need to bring your own certificates as this isn't provided automatically.
-The certificate corresponding to each Gitaly server will need to be installed
-on that Gitaly server.
+You must supply your own certificates as this isn't provided automatically. The certificate
+corresponding to each Gitaly server must be installed on that Gitaly server.
 
-Additionally the certificate, or its certificate authority, must be installed on all Gitaly servers
-(including the Gitaly server using the certificate) and on all Gitaly clients
-that communicate with it following the procedure described in
-[GitLab custom certificate configuration](https://docs.gitlab.com/omnibus/settings/ssl.html#install-custom-public-certificates) (and repeated below).
+Additionally, the certificate (or its certificate authority) must be installed on all:
 
-NOTE: **Note**
-The certificate must specify the address you use to access the
-Gitaly server. If you are addressing the Gitaly server by a hostname, you can
-either use the Common Name field for this, or add it as a Subject Alternative
-Name. If you are addressing the Gitaly server by its IP address, you must add it
-as a Subject Alternative Name to the certificate.
-[gRPC does not support using an IP address as Common Name in a certificate](https://github.com/grpc/grpc/issues/2691).
+- Gitaly servers, including the Gitaly server using the certificate.
+- Gitaly clients that communicate with it.
 
-NOTE: **Note:**
-It is possible to configure Gitaly servers with both an
-unencrypted listening address `listen_addr` and an encrypted listening
-address `tls_listen_addr` at the same time. This allows you to do a
-gradual transition from unencrypted to encrypted traffic, if necessary.
+The process is documented in the
+[GitLab custom certificate configuration](https://docs.gitlab.com/omnibus/settings/ssl.html#install-custom-public-certificates)
+and repeated below.
+
+Note the following:
+
+- The certificate must specify the address you use to access the Gitaly server. If you are:
+  - Addressing the Gitaly server by a hostname, you can either use the Common Name field for this,
+    or add it as a Subject Alternative Name.
+  - Addressing the Gitaly server by its IP address, you must add it as a Subject Alternative Name to
+    the certificate. [gRPC does not support using an IP address as Common Name in a certificate](https://github.com/grpc/grpc/issues/2691).
+- You can configure Gitaly servers with both an unencrypted listening address `listen_addr` and an
+  encrypted listening address `tls_listen_addr` at the same time. This allows you to gradually
+  transition from unencrypted to encrypted traffic if necessary.
 
 To configure Gitaly with TLS:
 
 **For Omnibus GitLab**
 
 1. Create certificates for Gitaly servers.
-1. On the Gitaly clients, copy the certificates, or their certificate authority, into the `/etc/gitlab/trusted-certs`:
+1. On the Gitaly clients, copy the certificates (or their certificate authority) into
+   `/etc/gitlab/trusted-certs`:
 
    ```shell
    sudo cp cert.pem /etc/gitlab/trusted-certs/
@@ -542,7 +550,8 @@ To configure Gitaly with TLS:
    ```
 
 1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
-1. On the Gitaly servers, create the `/etc/gitlab/ssl` directory and copy your key and certificate there:
+1. On the Gitaly servers, create the `/etc/gitlab/ssl` directory and copy your key and certificate
+   there:
 
    ```shell
    sudo mkdir -p /etc/gitlab/ssl
@@ -551,8 +560,9 @@ To configure Gitaly with TLS:
    sudo chmod 644 key.pem cert.pem
    ```
 
-1. Copy all Gitaly server certificates, or their certificate authority, to `/etc/gitlab/trusted-certs` so Gitaly server will trust the certificate when
-calling into itself or other Gitaly servers:
+1. Copy all Gitaly server certificates (or their certificate authority) to
+   `/etc/gitlab/trusted-certs` so that Gitaly servers will trust the certificate when calling into themselves
+   or other Gitaly servers:
 
    ```shell
    sudo cp cert1.pem cert2.pem /etc/gitlab/trusted-certs/
@@ -572,10 +582,13 @@ calling into itself or other Gitaly servers:
    ```
 
 1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
-1. (Optional) After [verifying that all Gitaly traffic is being served over TLS](#observe-type-of-gitaly-connections),
-   you can improve security by disabling non-TLS connections by commenting out
-   or deleting `gitaly['listen_addr']` in `/etc/gitlab/gitlab.rb`, saving the file,
-   and [reconfiguring GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
+1. Verify Gitaly traffic is being served over TLS by
+   [observing the types of Gitaly connections](#observe-type-of-gitaly-connections).
+1. (Optional) Improve security by:
+   1. Disabling non-TLS connections by commenting out or deleting `gitaly['listen_addr']` in
+      `/etc/gitlab/gitlab.rb`.
+   1. Saving the file.
+   1. [Reconfiguring GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
 
 **For installations from source**
 
@@ -605,9 +618,9 @@ calling into itself or other Gitaly servers:
    ```
 
    NOTE: **Note:**
-   `/some/dummy/path` should be set to a local folder that exists, however no
-   data will be stored in this folder. This will no longer be necessary after
-   [this issue](https://gitlab.com/gitlab-org/gitaly/-/issues/1282) is resolved.
+   `/some/dummy/path` should be set to a local folder that exists, however no data will be stored
+   in this folder. This will no longer be necessary after
+   [Gitaly issue #1282](https://gitlab.com/gitlab-org/gitaly/-/issues/1282) is resolved.
 
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
 1. On the Gitaly servers, create or edit `/etc/default/gitlab` and add:
@@ -625,7 +638,9 @@ calling into itself or other Gitaly servers:
    sudo chmod 644 key.pem cert.pem
    ```
 
-1. Copy all Gitaly server certificates, or their certificate authority, to the system trusted certificates so Gitaly server will trust the certificate when calling into itself or other Gitaly servers.
+1. Copy all Gitaly server certificates (or their certificate authority) to the system trusted
+   certificates folder so Gitaly server will trust the certificate when calling into itself or other Gitaly
+   servers.
 
    ```shell
    sudo cp cert.pem /usr/local/share/ca-certificates/gitaly.crt
@@ -643,15 +658,18 @@ calling into itself or other Gitaly servers:
    ```
 
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
-1. (Optional) After [verifying that all Gitaly traffic is being served over TLS](#observe-type-of-gitaly-connections),
-   you can improve security by disabling non-TLS connections by commenting out
-   or deleting `listen_addr` in `/home/git/gitaly/config.toml`, saving the file,
-   and [restarting GitLab](../restart_gitlab.md#installations-from-source).
+1. Verify Gitaly traffic is being served over TLS by
+   [observing the types of Gitaly connections](#observe-type-of-gitaly-connections).
+1. (Optional) Improve security by:
+   1. Disabling non-TLS connections by commenting out or deleting `listen_addr` in
+      `/home/git/gitaly/config.toml`.
+   1. Saving the file.
+   1. [Restarting GitLab](../restart_gitlab.md#installations-from-source).
 
 ### Observe type of Gitaly connections
 
-To observe what type of connections are actually being used in a
-production environment you can use the following Prometheus query:
+[Prometheus](../monitoring/prometheus/index.md) can be used observe what type of connections Gitaly
+is serving a production environment. Use the following Prometheus query:
 
 ```prometheus
 sum(rate(gitaly_connections_total[5m])) by (type)
@@ -660,24 +678,26 @@ sum(rate(gitaly_connections_total[5m])) by (type)
 ## `gitaly-ruby`
 
 Gitaly was developed to replace the Ruby application code in GitLab.
-In order to save time and/or avoid the risk of rewriting existing
-application logic, in some cases we chose to copy some application code
-from GitLab into Gitaly almost as-is. To be able to run that code,
-`gitaly-ruby` was created, which is a "sidecar" process for the main Gitaly Go
-process. Some examples of things that are implemented in `gitaly-ruby` are
-RPCs that deal with wikis, and RPCs that create commits on behalf of
-a user, such as merge commits.
 
-### Number of `gitaly-ruby` workers
+To save time and avoid the risk of rewriting existing application logic, we chose to copy some
+application code from GitLab into Gitaly.
+
+To be able to run that code, `gitaly-ruby` was created, which is a "sidecar" process for the main
+Gitaly Go process. Some examples of things that are implemented in `gitaly-ruby` are:
+
+- RPCs that deal with wikis.
+- RPCs that create commits on behalf of a user, such as merge commits.
 
-`gitaly-ruby` has much less capacity than Gitaly itself. If your Gitaly
-server has to handle a lot of requests, the default setting of having
-just one active `gitaly-ruby` sidecar might not be enough. If you see
-`ResourceExhausted` errors from Gitaly, it's very likely that you have not
-enough `gitaly-ruby` capacity.
+### Configure number of `gitaly-ruby` workers
 
-You can increase the number of `gitaly-ruby` processes on your Gitaly
-server with the following settings.
+`gitaly-ruby` has much less capacity than Gitaly implemented in Go. If your Gitaly server has to handle lots of
+requests, the default setting of having just one active `gitaly-ruby` sidecar might not be enough.
+
+If you see `ResourceExhausted` errors from Gitaly, it's very likely that you have not enough
+`gitaly-ruby` capacity.
+
+You can increase the number of `gitaly-ruby` processes on your Gitaly server with the following
+settings:
 
 **For Omnibus GitLab**
 
@@ -702,13 +722,16 @@ server with the following settings.
 
 1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
 
-## Limiting RPC concurrency
+## Limit RPC concurrency
+
+Clone traffic can put a large strain on your Gitaly service. The bulk of the work gets done in the
+either of the following RPCs:
 
-It can happen that CI clone traffic puts a large strain on your Gitaly
-service. The bulk of the work gets done in the SSHUploadPack (for Git
-SSH) and PostUploadPack (for Git HTTP) RPC's. To prevent such workloads
-from overcrowding your Gitaly server you can set concurrency limits in
-Gitaly's configuration file.
+- `SSHUploadPack` (for Git SSH).
+- `PostUploadPack` (for Git HTTP).
+
+To prevent such workloads from overwhelming your Gitaly server, you can set concurrency limits in
+Gitaly's configuration file. For example:
 
 ```ruby
 # in /etc/gitlab/gitlab.rb
@@ -725,24 +748,28 @@ gitaly['concurrency'] = [
 ]
 ```
 
-This will limit the number of in-flight RPC calls for the given RPC's.
-The limit is applied per repository. In the example above, each on the
-Gitaly server can have at most 20 simultaneous `PostUploadPack` calls in
-flight, and the same for `SSHUploadPack`. If another request comes in for
-a repository that has used up its 20 slots, that request will get
-queued.
-
-You can observe the behavior of this queue via the Gitaly logs and via
-Prometheus. In the Gitaly logs, you can look for the string (or
-structured log field) `acquire_ms`. Messages that have this field are
-reporting about the concurrency limiter. In Prometheus, look for the
-`gitaly_rate_limiting_in_progress`, `gitaly_rate_limiting_queued` and
-`gitaly_rate_limiting_seconds` metrics.
-
-The name of the Prometheus metric is not quite right because this is a
-concurrency limiter, not a rate limiter. If a Gitaly client makes 1000 requests
-in a row in a very short timespan, the concurrency will not exceed 1,
-and this mechanism (the concurrency limiter) will do nothing.
+This limits the number of in-flight RPC calls for the given RPCs. The limit is applied per
+repository. In the example above:
+
+- Each repository served by the Gitaly server can have at most 20 simultaneous `PostUploadPack` RPC
+  calls in flight, and the same for `SSHUploadPack`.
+- If another request comes in for a repository that has used up its 20 slots, that request gets
+  queued.
+
+You can observe the behavior of this queue using the Gitaly logs and Prometheus:
+
+- In the Gitaly logs, look for the string (or structured log field) `acquire_ms`. Messages that have
+  this field are reporting about the concurrency limiter.
+- In Prometheus, look for the following metrics:
+
+  - `gitaly_rate_limiting_in_progress`.
+  - `gitaly_rate_limiting_queued`.
+  - `gitaly_rate_limiting_seconds`.
+
+NOTE: **Note:**
+Though the name of the Prometheus metric contains `rate_limiting`, it is a concurrency limiter, not
+a rate limiter. If a Gitaly client makes 1000 requests in a row very quickly, concurrency will not
+exceed 1 and the concurrency limiter has no effect.
 
 ## Rotating a Gitaly authentication token
 
diff --git a/doc/administration/gitaly/reference.md b/doc/administration/gitaly/reference.md
index 52fd6fa6900..0429149ec2d 100644
--- a/doc/administration/gitaly/reference.md
+++ b/doc/administration/gitaly/reference.md
@@ -91,7 +91,7 @@ certificate_path = '/home/git/cert.cert'
 key_path = '/home/git/key.pem'
 ```
 
-[Read more](index.md#tls-support) about TLS in Gitaly.
+[Read more](index.md#enable-tls-support) about TLS in Gitaly.
 
 ### Storage
 
diff --git a/doc/development/geo/framework.md b/doc/development/geo/framework.md
index 85fecc41cfb..40190108b7a 100644
--- a/doc/development/geo/framework.md
+++ b/doc/development/geo/framework.md
@@ -215,7 +215,7 @@ For example, to add support for files referenced by a `Widget` model with a
 
    require 'spec_helper'
 
-   describe Geo::WidgetReplicator do
+   RSpec.describe Geo::WidgetReplicator do
      let(:model_record) { build(:widget) }
 
      it_behaves_like 'a blob replicator'
@@ -301,7 +301,7 @@ For example, to add support for files referenced by a `Widget` model with a
 
    require 'spec_helper'
 
-   describe Geo::WidgetRegistry, :geo, type: :model do
+   RSpec.describe Geo::WidgetRegistry, :geo, type: :model do
      let_it_be(:registry) { create(:widget_registry) }
 
      specify 'factory is valid' do
@@ -428,7 +428,7 @@ Widgets should now be verified by Geo!
 
    require 'spec_helper'
 
-   describe Resolvers::Geo::WidgetRegistriesResolver do
+   RSpec.describe Resolvers::Geo::WidgetRegistriesResolver do
      it_behaves_like 'a Geo registries resolver', :widget_registry
    end
    ```
@@ -452,7 +452,7 @@ Widgets should now be verified by Geo!
 
    require 'spec_helper'
 
-   describe Geo::WidgetRegistryFinder do
+   RSpec.describe Geo::WidgetRegistryFinder do
      it_behaves_like 'a framework registry finder', :widget_registry
    end
    ```
@@ -484,7 +484,7 @@ Widgets should now be verified by Geo!
 
    require 'spec_helper'
 
-   describe GitlabSchema.types['WidgetRegistry'] do
+   RSpec.describe GitlabSchema.types['WidgetRegistry'] do
      it_behaves_like 'a Geo registry type'
 
      it 'has the expected fields (other than those included in RegistryType)' do
diff --git a/doc/development/gotchas.md b/doc/development/gotchas.md
index 7e08da8162b..34fe3f11489 100644
--- a/doc/development/gotchas.md
+++ b/doc/development/gotchas.md
@@ -20,7 +20,7 @@ Consider the following API spec:
 ```ruby
 require 'spec_helper'
 
-describe API::Labels do
+RSpec.describe API::Labels do
   it 'creates a first label' do
     create(:label)
 
@@ -71,7 +71,7 @@ Following is the fixed API spec:
 ```ruby
 require 'spec_helper'
 
-describe API::Labels do
+RSpec.describe API::Labels do
   it 'creates a first label' do
     create(:label, title: 'foo')
 
diff --git a/doc/development/testing_guide/testing_migrations_guide.md b/doc/development/testing_guide/testing_migrations_guide.md
index a03b940fe40..8ee758177c3 100644
--- a/doc/development/testing_guide/testing_migrations_guide.md
+++ b/doc/development/testing_guide/testing_migrations_guide.md
@@ -112,7 +112,7 @@ migration. You can find the complete spec in
 require 'spec_helper'
 require Rails.root.join('db', 'post_migrate', '20170526185842_migrate_pipeline_stages.rb')
 
-describe MigratePipelineStages do
+RSpec.describe MigratePipelineStages do
   # Create test data - pipeline and CI/CD jobs.
   let(:jobs) { table(:ci_builds) }
   let(:stages) { table(:ci_stages) }
diff --git a/doc/user/infrastructure/index.md b/doc/user/infrastructure/index.md
index bb8cf3228d9..38ba3979006 100644
--- a/doc/user/infrastructure/index.md
+++ b/doc/user/infrastructure/index.md
@@ -8,6 +8,8 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 ## GitLab managed Terraform State
 
+> [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/2673) in GitLab 13.0.
+
 [Terraform remote backends](https://www.terraform.io/docs/backends/index.html)
 enable you to store the state file in a remote, shared store. GitLab uses the
 [Terraform HTTP backend](https://www.terraform.io/docs/backends/types/http.html)
@@ -95,64 +97,73 @@ to the repository.
    }
    ```
 
-1. In the root directory of your project repository, configure a `.gitlab-ci.yaml` file.
-   This example uses a pre-built image:
+1. In the root directory of your project repository, configure a
+   `.gitlab-ci.yaml` file. This example uses a pre-built image which includes a
+   `gitlab-terraform` helper. For supported Terraform versions, see the [GitLab
+   Terraform Images project](https://gitlab.com/gitlab-org/terraform-images).
 
    ```yaml
-   image:
-     name: hashicorp/terraform:light
-     entrypoint:
-       - '/usr/bin/env'
-       - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
+   image: registry.gitlab.com/gitlab-org/terraform-images/stable:latest
    ```
 
-1. In the `.gitlab-ci.yaml` file, define some environment variables to ease development. In this
-   example, `GITLAB_TF_ADDRESS` is the URL of the GitLab instance where this pipeline
-   runs, and `TF_ROOT` is the directory where the Terraform commands must be executed:
+1. In the `.gitlab-ci.yaml` file, define some environment variables to ease
+   development. In this example, `TF_STATE` is the name of the Terraform state
+   (projects may have multiple states), `TF_ADDRESS` is the URL to the state on
+   the GitLab instance where this pipeline runs, and `TF_ROOT` is the directory
+   where the Terraform commands must be executed:
 
    ```yaml
    variables:
-     GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${CI_PROJECT_NAME}
+     TF_STATE: ${CI_PROJECT_NAME}
+     TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${TF_STATE}
      TF_ROOT: ${CI_PROJECT_DIR}/environments/cloudflare/production
 
    cache:
+     key: ${TF_STATE}
      paths:
-       - .terraform
+       - ${TF_ROOT}/.terraform
    ```
 
-1. In a `before_script`, pass a `terraform init` call containing configuration parameters
-   corresponding to variables required by the
-   [HTTP backend](https://www.terraform.io/docs/backends/types/http.html):
+1. In a `before_script`, change to your `TF_ROOT`:
 
    ```yaml
    before_script:
      - cd ${TF_ROOT}
-     - terraform --version
-     - terraform init -backend-config="address=${GITLAB_TF_ADDRESS}" -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" -backend-config="username=gitlab-ci-token" -backend-config="password=${CI_JOB_TOKEN}" -backend-config="lock_method=POST" -backend-config="unlock_method=DELETE" -backend-config="retry_wait_min=5"
 
    stages:
+     - prepare
      - validate
      - build
-     - test
      - deploy
 
+   init:
+     stage: prepare
+     script:
+       - gitlab-terraform init
+
    validate:
      stage: validate
      script:
-       - terraform validate
+       - gitlab-terraform validate
 
    plan:
      stage: build
      script:
-       - terraform plan
-       - terraform show
+       - gitlab-terraform plan
+       - gitlab-terraform plan-json
+     artifacts:
+       name: plan
+       paths:
+         - ${TF_ROOT}/plan.cache
+       reports:
+         terraform: ${TF_ROOT}/plan.json
 
    apply:
      stage: deploy
      environment:
        name: production
      script:
-       - terraform apply
+       - gitlab-terraform apply
      dependencies:
        - plan
      when: manual
@@ -160,8 +171,9 @@ to the repository.
        - master
    ```
 
-1. Push your project to GitLab, which triggers a CI job pipeline. This pipeline runs
-   the `terraform init`, `terraform validate`, and `terraform plan` commands.
+1. Push your project to GitLab, which triggers a CI job pipeline. This pipeline
+   runs the `gitlab-terraform init`, `gitlab-terraform validate`, and
+   `gitlab-terraform plan` commands.
 
 The output from the above `terraform` commands should be viewable in the job logs.
 
@@ -176,15 +188,18 @@ you can expose details from `terraform plan` runs directly into a merge request
 enabling you to see statistics about the resources that Terraform will create,
 modify, or destroy.
 
-Let's explore how to configure a GitLab Terraform Report artifact:
+Let's explore how to configure a GitLab Terraform Report artifact. You can
+either use a pre-built image which includes a `gitlab-terraform` helper as
+above, where `gitlab-terraform plan-json` outputs the required artifact, or you
+can configure this manually as follows:
 
 1. For simplicity, let's define a few reusable variables to allow us to
    refer to these files multiple times:
 
    ```yaml
    variables:
-     PLAN: plan.tfplan
-     PLAN_JSON: tfplan.json
+     PLAN: plan.cache
+     PLAN_JSON: plan.json
    ```
 
 1. Install `jq`, a
@@ -216,7 +231,8 @@ Let's explore how to configure a GitLab Terraform Report artifact:
          terraform: $PLAN_JSON
    ```
 
-   For a full example, see [Example `.gitlab-ci.yaml` file](#example-gitlab-ciyaml-file).
+   For a full example using the pre-built image, see [Example `.gitlab-ci.yaml`
+   file](#example-gitlab-ciyaml-file).
 
    For an example displaying multiple reports, see [`.gitlab-ci.yaml` multiple reports file](#mulitple-terraform-plan-reports).
 
@@ -232,63 +248,60 @@ Let's explore how to configure a GitLab Terraform Report artifact:
 ### Example `.gitlab-ci.yaml` file
 
 ```yaml
-image:
-  name: hashicorp/terraform:light
-  entrypoint:
-    - '/usr/bin/env'
-    - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
+image: registry.gitlab.com/gitlab-org/terraform-images/stable:latest
 
-# Default output file for Terraform plan
 variables:
-  GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${CI_PROJECT_NAME}
-  PLAN: plan.tfplan
-  PLAN_JSON: tfplan.json
-  TF_ROOT: ${CI_PROJECT_DIR}
+  TF_STATE: ${CI_PROJECT_NAME}
+  TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${TF_STATE}
+  TF_ROOT: ${CI_PROJECT_DIR}/environments/cloudflare/production
 
 cache:
+  key: ${TF_STATE}
   paths:
-    - .terraform
+    - ${TF_ROOT}/.terraform
 
 before_script:
-  - apk --no-cache add jq
-  - alias convert_report="jq -r '([.resource_changes[]?.change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'"
   - cd ${TF_ROOT}
-  - terraform --version
-  - terraform init -backend-config="address=${GITLAB_TF_ADDRESS}" -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" -backend-config="username=${GITLAB_USER_LOGIN}" -backend-config="password=${GITLAB_TF_PASSWORD}" -backend-config="lock_method=POST" -backend-config="unlock_method=DELETE" -backend-config="retry_wait_min=5"
 
 stages:
+  - prepare
   - validate
   - build
   - deploy
 
+init:
+  stage: prepare
+  script:
+    - gitlab-terraform init
+
 validate:
   stage: validate
   script:
-    - terraform validate
+    - gitlab-terraform validate
 
 plan:
   stage: build
   script:
-    - terraform plan -out=$PLAN
-    - terraform show --json $PLAN | convert_report > $PLAN_JSON
+    - gitlab-terraform plan
+    - gitlab-terraform plan-json
   artifacts:
+    name: plan
+    paths:
+      - ${TF_ROOT}/plan.cache
     reports:
-      terraform: ${TF_ROOT}/tfplan.json
+      terraform: ${TF_ROOT}/plan.json
 
-# Separate apply job for manual launching Terraform as it can be destructive
-# action.
 apply:
   stage: deploy
   environment:
     name: production
   script:
-    - terraform apply -input=false $PLAN
+    - gitlab-terraform apply
   dependencies:
     - plan
   when: manual
   only:
     - master
-
 ```
 
 ### Mulitple Terraform Plan reports
diff --git a/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb b/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb
index 73f2fef5f1d..f685d2e39ed 100644
--- a/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb
+++ b/qa/qa/specs/features/browser_ui/6_release/deploy_key/clone_using_deploy_key_spec.rb
@@ -20,7 +20,7 @@ module QA
           resource.project = @project
           resource.name = @runner_name
           resource.tags = %w[qa docker]
-          resource.image = 'gitlab/gitlab-runner:ubuntu'
+          resource.image = 'gitlab/gitlab-runner:alpine'
         end
       end
 
@@ -51,6 +51,7 @@ module QA
           gitlab_ci = <<~YAML
           cat-config:
             script:
+              - apk add --update --no-cache openssh-client
               - mkdir -p ~/.ssh
               - ssh-keyscan -p #{@repository_location.port} #{@repository_location.host} >> ~/.ssh/known_hosts
               - eval $(ssh-agent -s)
diff --git a/spec/rubocop/cop/gitlab/duplicate_spec_location_spec.rb b/spec/rubocop/cop/gitlab/duplicate_spec_location_spec.rb
index 3a0a74a4713..fb18045b390 100644
--- a/spec/rubocop/cop/gitlab/duplicate_spec_location_spec.rb
+++ b/spec/rubocop/cop/gitlab/duplicate_spec_location_spec.rb
@@ -2,12 +2,10 @@
 
 require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
 
 require_relative '../../../../rubocop/cop/gitlab/duplicate_spec_location'
 
-describe RuboCop::Cop::Gitlab::DuplicateSpecLocation do
-  include RuboCop::RSpec::ExpectOffense
+describe RuboCop::Cop::Gitlab::DuplicateSpecLocation, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/graphql/authorize_types_spec.rb b/spec/rubocop/cop/graphql/authorize_types_spec.rb
index 98797a780e0..ed3b9867a56 100644
--- a/spec/rubocop/cop/graphql/authorize_types_spec.rb
+++ b/spec/rubocop/cop/graphql/authorize_types_spec.rb
@@ -2,11 +2,10 @@
 
 require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
+
 require_relative '../../../../rubocop/cop/graphql/authorize_types'
 
-describe RuboCop::Cop::Graphql::AuthorizeTypes do
-  include RuboCop::RSpec::ExpectOffense
+describe RuboCop::Cop::Graphql::AuthorizeTypes, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/graphql/descriptions_spec.rb b/spec/rubocop/cop/graphql/descriptions_spec.rb
index 8cfdc05172d..245b0c17fb8 100644
--- a/spec/rubocop/cop/graphql/descriptions_spec.rb
+++ b/spec/rubocop/cop/graphql/descriptions_spec.rb
@@ -2,11 +2,9 @@
 
 require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
 require_relative '../../../../rubocop/cop/graphql/descriptions'
 
-describe RuboCop::Cop::Graphql::Descriptions do
-  include RuboCop::RSpec::ExpectOffense
+describe RuboCop::Cop::Graphql::Descriptions, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_column_with_default_spec.rb b/spec/rubocop/cop/migration/add_column_with_default_spec.rb
index 5d4fc59fb95..3427dd57ceb 100644
--- a/spec/rubocop/cop/migration/add_column_with_default_spec.rb
+++ b/spec/rubocop/cop/migration/add_column_with_default_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_column_with_default'
 
-describe RuboCop::Cop::Migration::AddColumnWithDefault do
+describe RuboCop::Cop::Migration::AddColumnWithDefault, type: :rubocop do
   include CopHelper
 
   let(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_columns_to_wide_tables_spec.rb b/spec/rubocop/cop/migration/add_columns_to_wide_tables_spec.rb
index 5b179168eab..b626e79cb9d 100644
--- a/spec/rubocop/cop/migration/add_columns_to_wide_tables_spec.rb
+++ b/spec/rubocop/cop/migration/add_columns_to_wide_tables_spec.rb
@@ -1,11 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
+require 'fast_spec_helper'
 require 'rubocop'
-
 require_relative '../../../../rubocop/cop/migration/add_columns_to_wide_tables'
 
-describe RuboCop::Cop::Migration::AddColumnsToWideTables do
+describe RuboCop::Cop::Migration::AddColumnsToWideTables, type: :rubocop do
   include CopHelper
 
   let(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_concurrent_foreign_key_spec.rb b/spec/rubocop/cop/migration/add_concurrent_foreign_key_spec.rb
index dfc3898af24..efb4869ee93 100644
--- a/spec/rubocop/cop/migration/add_concurrent_foreign_key_spec.rb
+++ b/spec/rubocop/cop/migration/add_concurrent_foreign_key_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_concurrent_foreign_key'
 
-describe RuboCop::Cop::Migration::AddConcurrentForeignKey do
+describe RuboCop::Cop::Migration::AddConcurrentForeignKey, type: :rubocop do
   include CopHelper
 
   let(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_concurrent_index_spec.rb b/spec/rubocop/cop/migration/add_concurrent_index_spec.rb
index 9812e64216f..b08070d679e 100644
--- a/spec/rubocop/cop/migration/add_concurrent_index_spec.rb
+++ b/spec/rubocop/cop/migration/add_concurrent_index_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_concurrent_index'
 
-describe RuboCop::Cop::Migration::AddConcurrentIndex do
+describe RuboCop::Cop::Migration::AddConcurrentIndex, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_index_spec.rb b/spec/rubocop/cop/migration/add_index_spec.rb
index ca1aadb381b..6be2a019fc2 100644
--- a/spec/rubocop/cop/migration/add_index_spec.rb
+++ b/spec/rubocop/cop/migration/add_index_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_index'
 
-describe RuboCop::Cop::Migration::AddIndex do
+describe RuboCop::Cop::Migration::AddIndex, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_limit_to_text_columns_spec.rb b/spec/rubocop/cop/migration/add_limit_to_text_columns_spec.rb
index 39ca9ace73d..888f9aa6259 100644
--- a/spec/rubocop/cop/migration/add_limit_to_text_columns_spec.rb
+++ b/spec/rubocop/cop/migration/add_limit_to_text_columns_spec.rb
@@ -1,12 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_limit_to_text_columns'
 
-describe RuboCop::Cop::Migration::AddLimitToTextColumns do
+describe RuboCop::Cop::Migration::AddLimitToTextColumns, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_reference_spec.rb b/spec/rubocop/cop/migration/add_reference_spec.rb
index 03348ecc744..1bc67820396 100644
--- a/spec/rubocop/cop/migration/add_reference_spec.rb
+++ b/spec/rubocop/cop/migration/add_reference_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_reference'
 
-describe RuboCop::Cop::Migration::AddReference do
+describe RuboCop::Cop::Migration::AddReference, type: :rubocop do
   include CopHelper
 
   let(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/add_timestamps_spec.rb b/spec/rubocop/cop/migration/add_timestamps_spec.rb
index a3314d878e5..da4b7d91a57 100644
--- a/spec/rubocop/cop/migration/add_timestamps_spec.rb
+++ b/spec/rubocop/cop/migration/add_timestamps_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/add_timestamps'
 
-describe RuboCop::Cop::Migration::AddTimestamps do
+describe RuboCop::Cop::Migration::AddTimestamps, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/datetime_spec.rb b/spec/rubocop/cop/migration/datetime_spec.rb
index e3023406dce..98ce8ec0666 100644
--- a/spec/rubocop/cop/migration/datetime_spec.rb
+++ b/spec/rubocop/cop/migration/datetime_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/datetime'
 
-describe RuboCop::Cop::Migration::Datetime do
+describe RuboCop::Cop::Migration::Datetime, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/hash_index_spec.rb b/spec/rubocop/cop/migration/hash_index_spec.rb
index e8b05a94653..917556a446b 100644
--- a/spec/rubocop/cop/migration/hash_index_spec.rb
+++ b/spec/rubocop/cop/migration/hash_index_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/hash_index'
 
-describe RuboCop::Cop::Migration::HashIndex do
+describe RuboCop::Cop::Migration::HashIndex, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/prevent_strings_spec.rb b/spec/rubocop/cop/migration/prevent_strings_spec.rb
index d0e97874aed..bcb845cde9d 100644
--- a/spec/rubocop/cop/migration/prevent_strings_spec.rb
+++ b/spec/rubocop/cop/migration/prevent_strings_spec.rb
@@ -1,12 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/prevent_strings'
 
-describe RuboCop::Cop::Migration::PreventStrings do
+describe RuboCop::Cop::Migration::PreventStrings, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/remove_column_spec.rb b/spec/rubocop/cop/migration/remove_column_spec.rb
index bc2fa04ce64..ea9ce89431f 100644
--- a/spec/rubocop/cop/migration/remove_column_spec.rb
+++ b/spec/rubocop/cop/migration/remove_column_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/remove_column'
 
-describe RuboCop::Cop::Migration::RemoveColumn do
+describe RuboCop::Cop::Migration::RemoveColumn, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/remove_concurrent_index_spec.rb b/spec/rubocop/cop/migration/remove_concurrent_index_spec.rb
index 9de4c756f12..5a71d72be46 100644
--- a/spec/rubocop/cop/migration/remove_concurrent_index_spec.rb
+++ b/spec/rubocop/cop/migration/remove_concurrent_index_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/remove_concurrent_index'
 
-describe RuboCop::Cop::Migration::RemoveConcurrentIndex do
+describe RuboCop::Cop::Migration::RemoveConcurrentIndex, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/remove_index_spec.rb b/spec/rubocop/cop/migration/remove_index_spec.rb
index d343d27484a..852ff563665 100644
--- a/spec/rubocop/cop/migration/remove_index_spec.rb
+++ b/spec/rubocop/cop/migration/remove_index_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/remove_index'
 
-describe RuboCop::Cop::Migration::RemoveIndex do
+describe RuboCop::Cop::Migration::RemoveIndex, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/safer_boolean_column_spec.rb b/spec/rubocop/cop/migration/safer_boolean_column_spec.rb
index b27a4cd4f80..8c78bbba490 100644
--- a/spec/rubocop/cop/migration/safer_boolean_column_spec.rb
+++ b/spec/rubocop/cop/migration/safer_boolean_column_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/safer_boolean_column'
 
-describe RuboCop::Cop::Migration::SaferBooleanColumn do
+describe RuboCop::Cop::Migration::SaferBooleanColumn, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/timestamps_spec.rb b/spec/rubocop/cop/migration/timestamps_spec.rb
index d03c75e7cfc..866e922686f 100644
--- a/spec/rubocop/cop/migration/timestamps_spec.rb
+++ b/spec/rubocop/cop/migration/timestamps_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/timestamps'
 
-describe RuboCop::Cop::Migration::Timestamps do
+describe RuboCop::Cop::Migration::Timestamps, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/with_lock_retries_disallowed_method_spec.rb b/spec/rubocop/cop/migration/with_lock_retries_disallowed_method_spec.rb
index 48570c1c8d8..acb583475be 100644
--- a/spec/rubocop/cop/migration/with_lock_retries_disallowed_method_spec.rb
+++ b/spec/rubocop/cop/migration/with_lock_retries_disallowed_method_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/with_lock_retries_disallowed_method'
 
-describe RuboCop::Cop::Migration::WithLockRetriesDisallowedMethod do
+describe RuboCop::Cop::Migration::WithLockRetriesDisallowedMethod, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/migration/with_lock_retries_with_change_spec.rb b/spec/rubocop/cop/migration/with_lock_retries_with_change_spec.rb
index 75a1f939a9f..38fe1f510c4 100644
--- a/spec/rubocop/cop/migration/with_lock_retries_with_change_spec.rb
+++ b/spec/rubocop/cop/migration/with_lock_retries_with_change_spec.rb
@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
-
+require 'fast_spec_helper'
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/migration/with_lock_retries_with_change'
 
-describe RuboCop::Cop::Migration::WithLockRetriesWithChange do
+describe RuboCop::Cop::Migration::WithLockRetriesWithChange, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/performance/ar_count_each_spec.rb b/spec/rubocop/cop/performance/ar_count_each_spec.rb
index 534fa55dd45..2bcc6f4cfd6 100644
--- a/spec/rubocop/cop/performance/ar_count_each_spec.rb
+++ b/spec/rubocop/cop/performance/ar_count_each_spec.rb
@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require 'fast_spec_helper'
+require 'rubocop'
 require_relative '../../../../rubocop/cop/performance/ar_count_each.rb'
 
 describe RuboCop::Cop::Performance::ARCountEach, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/performance/ar_exists_and_present_blank_spec.rb b/spec/rubocop/cop/performance/ar_exists_and_present_blank_spec.rb
index da44004f947..b0c260df733 100644
--- a/spec/rubocop/cop/performance/ar_exists_and_present_blank_spec.rb
+++ b/spec/rubocop/cop/performance/ar_exists_and_present_blank_spec.rb
@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require 'fast_spec_helper'
+require 'rubocop'
 require_relative '../../../../rubocop/cop/performance/ar_exists_and_present_blank.rb'
 
 describe RuboCop::Cop::Performance::ARExistsAndPresentBlank, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/performance/readlines_each_spec.rb b/spec/rubocop/cop/performance/readlines_each_spec.rb
index e71aaaf3056..aee098b80eb 100644
--- a/spec/rubocop/cop/performance/readlines_each_spec.rb
+++ b/spec/rubocop/cop/performance/readlines_each_spec.rb
@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require 'fast_spec_helper'
+require 'rubocop'
 require_relative '../../../../rubocop/cop/performance/readlines_each'
 
 describe RuboCop::Cop::Performance::ReadlinesEach, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/rspec/modify_sidekiq_middleware_spec.rb b/spec/rubocop/cop/rspec/modify_sidekiq_middleware_spec.rb
index d3d323b6643..670c70889f2 100644
--- a/spec/rubocop/cop/rspec/modify_sidekiq_middleware_spec.rb
+++ b/spec/rubocop/cop/rspec/modify_sidekiq_middleware_spec.rb
@@ -6,7 +6,6 @@ require_relative '../../../../rubocop/cop/rspec/modify_sidekiq_middleware'
 
 describe RuboCop::Cop::RSpec::ModifySidekiqMiddleware, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/rspec/top_level_describe_path_spec.rb b/spec/rubocop/cop/rspec/top_level_describe_path_spec.rb
index ee6b6d39cb4..f03b75ecc73 100644
--- a/spec/rubocop/cop/rspec/top_level_describe_path_spec.rb
+++ b/spec/rubocop/cop/rspec/top_level_describe_path_spec.rb
@@ -1,14 +1,10 @@
 # frozen_string_literal: true
 
 require 'fast_spec_helper'
-
 require 'rubocop'
-require 'rubocop/rspec/support'
-
 require_relative '../../../../rubocop/cop/rspec/top_level_describe_path'
 
-describe RuboCop::Cop::RSpec::TopLevelDescribePath do
-  include RuboCop::RSpec::ExpectOffense
+describe RuboCop::Cop::RSpec::TopLevelDescribePath, type: :rubocop do
   include CopHelper
 
   subject(:cop) { described_class.new }
diff --git a/spec/rubocop/cop/scalability/bulk_perform_with_context_spec.rb b/spec/rubocop/cop/scalability/bulk_perform_with_context_spec.rb
index 61603d0100e..5c333aea5cf 100644
--- a/spec/rubocop/cop/scalability/bulk_perform_with_context_spec.rb
+++ b/spec/rubocop/cop/scalability/bulk_perform_with_context_spec.rb
@@ -6,7 +6,6 @@ require_relative '../../../../rubocop/cop/scalability/bulk_perform_with_context'
 
 describe RuboCop::Cop::Scalability::BulkPerformWithContext, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/scalability/cron_worker_context_spec.rb b/spec/rubocop/cop/scalability/cron_worker_context_spec.rb
index e917d33b1e5..3add0a44ba4 100644
--- a/spec/rubocop/cop/scalability/cron_worker_context_spec.rb
+++ b/spec/rubocop/cop/scalability/cron_worker_context_spec.rb
@@ -6,7 +6,6 @@ require_relative '../../../../rubocop/cop/scalability/cron_worker_context'
 
 describe RuboCop::Cop::Scalability::CronWorkerContext, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/scalability/file_uploads_spec.rb b/spec/rubocop/cop/scalability/file_uploads_spec.rb
index b0be9ac2b51..d3102b2a961 100644
--- a/spec/rubocop/cop/scalability/file_uploads_spec.rb
+++ b/spec/rubocop/cop/scalability/file_uploads_spec.rb
@@ -6,7 +6,6 @@ require_relative '../../../../rubocop/cop/scalability/file_uploads'
 
 describe RuboCop::Cop::Scalability::FileUploads, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/rubocop/cop/scalability/idempotent_worker_spec.rb b/spec/rubocop/cop/scalability/idempotent_worker_spec.rb
index 73cacc984e9..97b1886310a 100644
--- a/spec/rubocop/cop/scalability/idempotent_worker_spec.rb
+++ b/spec/rubocop/cop/scalability/idempotent_worker_spec.rb
@@ -6,7 +6,6 @@ require_relative '../../../../rubocop/cop/scalability/idempotent_worker'
 
 describe RuboCop::Cop::Scalability::IdempotentWorker, type: :rubocop do
   include CopHelper
-  include ExpectOffense
 
   subject(:cop) { described_class.new }
 
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 84de5119505..41f53ef5196 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -103,7 +103,6 @@ RSpec.configure do |config|
   config.include ActiveJob::TestHelper
   config.include ActiveSupport::Testing::TimeHelpers
   config.include CycleAnalyticsHelpers
-  config.include ExpectOffense
   config.include FactoryBot::Syntax::Methods
   config.include FixtureHelpers
   config.include NonExistingRecordsHelpers
diff --git a/spec/support/helpers/expect_offense.rb b/spec/support/helpers/expect_offense.rb
deleted file mode 100644
index 76301fe19ff..00000000000
--- a/spec/support/helpers/expect_offense.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-require 'rubocop/rspec/support'
-
-# https://github.com/backus/rubocop-rspec/blob/master/spec/support/expect_offense.rb
-# rubocop-rspec gem extension of RuboCop's ExpectOffense module.
-#
-# This mixin is the same as rubocop's ExpectOffense except the default
-# filename ends with `_spec.rb`
-module ExpectOffense
-  include RuboCop::RSpec::ExpectOffense
-
-  DEFAULT_FILENAME = 'example_spec.rb'.freeze
-
-  def expect_offense(source, filename = DEFAULT_FILENAME)
-    super
-  end
-
-  def expect_no_offenses(source, filename = DEFAULT_FILENAME)
-    super
-  end
-end
diff --git a/spec/support/rspec.rb b/spec/support/rspec.rb
index 7d011c5eb95..63b8c9b153e 100644
--- a/spec/support/rspec.rb
+++ b/spec/support/rspec.rb
@@ -4,7 +4,7 @@ require_relative "helpers/stub_configuration"
 require_relative "helpers/stub_metrics"
 require_relative "helpers/stub_object_storage"
 require_relative "helpers/stub_env"
-require_relative "helpers/expect_offense"
+require 'rubocop/rspec/support'
 
 RSpec.configure do |config|
   config.mock_with :rspec
@@ -15,5 +15,5 @@ RSpec.configure do |config|
   config.include StubObjectStorage
   config.include StubENV
 
-  config.include ExpectOffense, type: :rubocop
+  config.include RuboCop::RSpec::ExpectOffense, type: :rubocop
 end