Add latest changes from gitlab-org/gitlab@14-3-stable-eev14.3.0-rc42

5 files changed, 72 insertions, 18 deletions

diff --git a/doc/ci/runners/build_cloud/macos/environment.md b/doc/ci/runners/build_cloud/macos/environment.md
index e84b7d0a207..5336890b931 100644
--- a/doc/ci/runners/build_cloud/macos/environment.md
+++ b/doc/ci/runners/build_cloud/macos/environment.md
@@ -4,12 +4,12 @@ group: Runner
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
 ---
 
-# VM instances and images for Build Cloud for macOS 
+# VM instances and images for Build Cloud for macOS
 
 When you use the Build Cloud for macOS:
 
-- Each of your jobs runs in a newly provisioned VM, which is dedicated to the specific job. 
-- The VM is active only for the duration of the job and immediately deleted. 
+- Each of your jobs runs in a newly provisioned VM, which is dedicated to the specific job.
+- The VM is active only for the duration of the job and immediately deleted.
 
 ## VM types
 
diff --git a/doc/ci/runners/build_cloud/macos_build_cloud.md b/doc/ci/runners/build_cloud/macos_build_cloud.md
index 1400c7e08db..794bc2e597d 100644
--- a/doc/ci/runners/build_cloud/macos_build_cloud.md
+++ b/doc/ci/runners/build_cloud/macos_build_cloud.md
@@ -12,11 +12,11 @@ of all the capabilities of the GitLab single DevOps platform and not have to man
 build environment.
 
 Build Cloud runners for macOS are in [Beta](https://about.gitlab.com/handbook/product/gitlab-the-product/#beta)
-and shouldn't be relied upon for mission-critical production jobs. 
+and shouldn't be relied upon for mission-critical production jobs.
 
 ## Quickstart
 
-To start using Build Cloud for macOS Beta, you must submit an access request issue. After your
+To start using Build Cloud for macOS Beta, you must submit an access request [issue](https://gitlab.com/gitlab-com/macos-buildcloud-runners-beta/-/issues/new?issuable_template=beta_access_request). After your
 access has been granted and your build environment configured, you must configure your
 `.gitlab-ci.yml` pipeline file:
 
diff --git a/doc/ci/runners/configure_runners.md b/doc/ci/runners/configure_runners.md
index 2f845a05a4e..13897b934c5 100644
--- a/doc/ci/runners/configure_runners.md
+++ b/doc/ci/runners/configure_runners.md
@@ -5,7 +5,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 type: reference
 ---
 
-# Configuring runners
+# Configuring runners **(FREE)**
 
 If you have installed your own runners, you can configure and secure them in GitLab.
 
@@ -107,10 +107,10 @@ We're always looking for contributions that can mitigate these
 ### Reset the runner registration token for a project
 
 If you think that a registration token for a project was revealed, you should
-reset it. A token can be used to register another runner for the project. That new runner
-may then be used to obtain the values of secret variables or to clone project code.
+reset it. A registration token can be used to register another runner for the project.
+That new runner may then be used to obtain the values of secret variables or to clone project code.
 
-To reset the token:
+To reset the registration token:
 
 1. Go to the project's **Settings > CI/CD**.
 1. Expand the **General pipelines settings** section.
@@ -124,6 +124,16 @@ any new runners to the project. If you are using any tools to provision and
 register new runners, the tokens used in those tools should be updated to reflect the
 value of the new token.
 
+### Reset the runner authentication token
+
+If you think that an authentication token for a runner was revealed, you should
+reset it. An attacker could use the token to [clone a runner](https://docs.gitlab.com/runner/security/#cloning-a-runner).
+
+To reset the authentication token, [unregister the runner](https://docs.gitlab.com/runner/commands/#gitlab-runner-unregister)
+and then [register](https://docs.gitlab.com/runner/commands/#gitlab-runner-register) it again.
+
+To verify that the previous authentication token has been revoked, use the [Runners API](../../api/runners.md#verify-authentication-for-a-registered-runner).
+
 ## Determine the IP address of a runner
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/17286) in GitLab 10.6.
@@ -142,7 +152,7 @@ different places.
 To view the IP address of a shared runner you must have admin access to
 the GitLab instance. To determine this:
 
-1. On the top bar, select **Menu >** **{admin}** **Admin**.
+1. On the top bar, select **Menu > Admin**.
 1. On the left sidebar, select **Overview > Runners**.
 1. Find the runner in the table and view the **IP Address** column.
 
@@ -159,13 +169,13 @@ project.
 
 ![specific runner IP address](img/specific_runner_ip_address.png)
 
-## Use tags to limit the number of jobs using the runner
+## Use tags to control which jobs a runner can run
 
 You must set up a runner to be able to run all the different types of jobs
 that it may encounter on the projects it's shared over. This would be
 problematic for large amounts of projects, if it weren't for tags.
 
-GitLab CI tags are not the same as Git tags. GitLab CI tags are associated with runners.
+GitLab CI/CD tags are not the same as Git tags. GitLab CI/CD tags are associated with runners.
 Git tags are associated with commits.
 
 By tagging a runner for the types of jobs it can handle, you can make sure
@@ -174,6 +184,8 @@ shared runners will [only run the jobs they are equipped to run](../yaml/index.m
 For instance, at GitLab we have runners tagged with `rails` if they contain
 the appropriate dependencies to run Rails test suites.
 
+### Set a runner to run untagged jobs
+
 When you [register a runner](https://docs.gitlab.com/runner/register/), its default behavior is to **only pick**
 [tagged jobs](../yaml/index.md#tags).
 To change this, you must have the [Owner role](../../user/permissions.md#project-members-permissions) for the project.
@@ -228,6 +240,48 @@ Example 2:
 1. A job that has no tags defined is executed and run.
 1. A second job that has a `docker` tag defined is stuck.
 
+### Use tags to run jobs on different platforms
+
+You can use tags to run different jobs on different platforms. For
+example, if you have an OS X runner with tag `osx` and a Windows runner with tag
+`windows`, you can run a job on each platform:
+
+```yaml
+windows job:
+  stage:
+    - build
+  tags:
+    - windows
+  script:
+    - echo Hello, %USERNAME%!
+
+osx job:
+  stage:
+    - build
+  tags:
+    - osx
+  script:
+    - echo "Hello, $USER!"
+```
+
+### Use CI/CD variables in tags
+
+> Introduced in [GitLab 14.1](https://gitlab.com/gitlab-org/gitlab/-/issues/35742).
+
+You can use [CI/CD variables](../variables/index.md) with `tags` for dynamic runner selection:
+
+```yaml
+variables:
+  KUBERNETES_RUNNER: kubernetes
+
+  job:
+    tags:
+      - docker
+      - $KUBERNETES_RUNNER
+    script:
+      - echo "Hello runner selector feature"
+```
+
 ## Configure runner behavior with variables
 
 You can use [CI/CD variables](../variables/index.md) to configure runner Git behavior
@@ -546,7 +600,7 @@ the following stages:
 | Variable                        | Description                                            |
 |---------------------------------|--------------------------------------------------------|
 | `ARTIFACT_DOWNLOAD_ATTEMPTS`    | Number of attempts to download artifacts running a job |
-| `EXECUTOR_JOB_SECTION_ATTEMPTS` | [In GitLab 12.10](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/4450) and later, the number of attempts to run a section in a job after a [`No Such Container`](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/4450) error ([Docker executor](https://docs.gitlab.com/runner/executors/docker.html) only). |
+| `EXECUTOR_JOB_SECTION_ATTEMPTS` | In [GitLab 12.10 and later](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/4450), the number of attempts to run a section in a job after a [`No Such Container`](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/4450) error ([Docker executor](https://docs.gitlab.com/runner/executors/docker.html) only). |
 | `GET_SOURCES_ATTEMPTS`          | Number of attempts to fetch sources running a job      |
 | `RESTORE_CACHE_ATTEMPTS`        | Number of attempts to restore the cache running a job  |
 
diff --git a/doc/ci/runners/index.md b/doc/ci/runners/index.md
index 6642913a9d8..9acca60c4b4 100644
--- a/doc/ci/runners/index.md
+++ b/doc/ci/runners/index.md
@@ -5,7 +5,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 type: reference
 ---
 
-# GitLab Build Cloud runners
+# GitLab Build Cloud runners **(FREE)**
 
 If you are using self-managed GitLab or you want to use your own runners on GitLab.com, you can
 [install and configure your own runners](https://docs.gitlab.com/runner/install/).
diff --git a/doc/ci/runners/runners_scope.md b/doc/ci/runners/runners_scope.md
index 2af373384d2..b16957ae83c 100644
--- a/doc/ci/runners/runners_scope.md
+++ b/doc/ci/runners/runners_scope.md
@@ -5,7 +5,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 type: reference
 ---
 
-# The scope of runners
+# The scope of runners **(FREE)**
 
 Runners are available based on who you want to have access:
 
@@ -168,7 +168,7 @@ You must have the [Owner role](../../user/permissions.md#group-members-permissio
 
    | Attribute    | Description |
    | ------------ | ----------- |
-   | Type         | Displays the runner type: `group` or `specific`, together with the optional states `locked` and `paused` |
+   | Type         | Displays the runner type: `group` or `specific`, and the optional state `paused` |
    | Runner token | Token used to identify the runner, and that the runner uses to communicate with the GitLab instance |
    | Description  | Description given to the runner when it was created |
    | Version      | GitLab Runner version |
@@ -242,10 +242,10 @@ You can configure a specific runner so it is "locked" and cannot be enabled for
 This setting can be enabled when you first [register a runner](https://docs.gitlab.com/runner/register/),
 but can also be changed later.
 
-To lock or unlock a runner:
+To lock or unlock a specific runner:
 
 1. Go to the project's **Settings > CI/CD** and expand the **Runners** section.
-1. Find the runner you want to lock or unlock. Make sure it's enabled.
+1. Find the specific runner you want to lock or unlock. Make sure it's enabled. You cannot lock shared or group runners.
 1. Click the pencil button.
 1. Check the **Lock to current projects** option.
 1. Click **Save changes**.