Add latest changes from gitlab-org/gitlab@master

7 files changed, 397 insertions, 377 deletions

diff --git a/doc/administration/gitaly/configure_gitaly.md b/doc/administration/gitaly/configure_gitaly.md
index 69483ddf693..b9dc10a2ccd 100644
--- a/doc/administration/gitaly/configure_gitaly.md
+++ b/doc/administration/gitaly/configure_gitaly.md
@@ -199,6 +199,14 @@ Edit `/etc/gitlab/gitlab.rb`:
 
 #### Configure Gitaly server
 
+<!--
+Updates to example must be made at:
+
+- https://gitlab.com/gitlab-org/charts/gitlab/blob/master/doc/advanced/external-gitaly/external-omnibus-gitaly.md#configure-omnibus-gitlab
+- https://gitlab.com/gitlab-org/gitlab/blob/master/doc/administration/gitaly/index.md#gitaly-server-configuration
+- All reference architecture pages
+-->
+
 Configure Gitaly server in one of two ways:
 
 ::Tabs
@@ -207,13 +215,6 @@ Configure Gitaly server in one of two ways:
 
 1. Edit `/etc/gitlab/gitlab.rb`:
 
-<!--
-Updates to example must be made at:
-- https://gitlab.com/gitlab-org/charts/gitlab/blob/master/doc/advanced/external-gitaly/external-omnibus-gitaly.md#configure-omnibus-gitlab
-- https://gitlab.com/gitlab-org/gitlab/blob/master/doc/administration/gitaly/index.md#gitaly-server-configuration
-- all reference architecture pages
--->
-
    ```ruby
    # Avoid running unnecessary services on the Gitaly server
    postgresql['enable'] = false
diff --git a/doc/administration/nfs.md b/doc/administration/nfs.md
index 7349e8ad9ba..3e3712c9645 100644
--- a/doc/administration/nfs.md
+++ b/doc/administration/nfs.md
@@ -12,7 +12,7 @@ recommended for performance reasons.
 
 For data objects such as LFS, Uploads, and Artifacts, an [Object Storage service](object_storage.md)
 is recommended over NFS where possible, due to better performance.
-When eliminating the usage of NFS, there are [additional steps you need to take](object_storage.md#other-alternatives-to-file-system-storage)
+When eliminating the usage of NFS, there are [additional steps you need to take](object_storage.md#alternatives-to-file-system-storage)
 in addition to moving to Object Storage.
 
 File system performance can impact overall GitLab performance, especially for
diff --git a/doc/administration/object_storage.md b/doc/administration/object_storage.md
index 587da749766..469db2652d7 100644
--- a/doc/administration/object_storage.md
+++ b/doc/administration/object_storage.md
@@ -11,6 +11,19 @@ It's recommended over NFS and
 in general it's better in larger setups as object storage is
 typically much more performant, reliable, and scalable.
 
+There are two ways of specifying the object storage:
+
+- [Consolidated configuration](#consolidated-object-storage-configuration) (recommended): A single credential is
+  shared by all supported object types.
+- [Storage-specific configuration](#storage-specific-configuration): Every object defines its
+  own object storage [connection and configuration](#connection-settings).
+
+For more information on the differences and to transition from one form to another, see
+[Transition to consolidated form](#transition-to-consolidated-form).
+
+If you are currently storing data locally, see
+[Migrate to object storage](#migrate-to-object-storage) for migration details.
+
 ## Supported object storage providers
 
 GitLab is tightly integrated with `Fog`, so you can refer to its
@@ -30,22 +43,7 @@ Specifically, GitLab has been tested by vendors and customers on a number of obj
 - On-premises hardware and appliances from various storage vendors, whose list is not officially established.
 - MinIO. We have [a guide to deploying this](https://docs.gitlab.com/charts/advanced/external-object-storage/minio.html) within our Helm Chart documentation.
 
-## Configure the object storage
-
-There are two ways of specifying object storage configuration in GitLab:
-
-- [Consolidated form](#consolidated-object-storage-configuration): A single credential is
-  shared by all supported object types.
-- [Storage-specific form](#storage-specific-configuration): Every object defines its
-  own object storage [connection and configuration](#connection-settings).
-
-For more information on the differences and to transition from one form to another, see
-[Transition to consolidated form](#transition-to-consolidated-form).
-
-If you are currently storing data locally, see
-[Migrate to object storage](#migrate-to-object-storage) for migration details.
-
-### Consolidated object storage configuration
+## Consolidated object storage configuration
 
 > [Introduced](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4368) in GitLab 13.2.
 
@@ -73,7 +71,7 @@ Mattermost. See the [full table for a complete list](#storage-specific-configura
 However, backups can be configured with [server side encryption](../raketasks/backup_gitlab.md#s3-encrypted-buckets) separately.
 
 Enabling consolidated object storage enables object storage for all object
-types. If not all buckets are specified, `sudo gitlab-ctl reconfigure` may fail with the error like:
+types. If not all buckets are specified, you may see an error like:
 
 ```plaintext
 Object storage for <object type> must have a bucket specified
@@ -95,7 +93,333 @@ When the consolidated form is:
 
 See the section on [ETag mismatch errors](#etag-mismatch) for more details.
 
-#### Full example using Amazon S3
+### Common parameters
+
+In the consolidated configuration, the `object_store` section defines a
+common set of parameters. Here we use the YAML from the source
+installation because it's easier to see the inheritance:
+
+```yaml
+    object_store:
+      enabled: true
+      proxy_download: true
+      connection:
+        provider: AWS
+        aws_access_key_id: <AWS_ACCESS_KEY_ID>
+        aws_secret_access_key: <AWS_SECRET_ACCESS_KEY>
+      objects:
+        ...
+```
+
+The Omnibus configuration maps directly to this:
+
+```ruby
+gitlab_rails['object_store']['enabled'] = true
+gitlab_rails['object_store']['proxy_download'] = true
+gitlab_rails['object_store']['connection'] = {
+  'provider' => 'AWS',
+  'aws_access_key_id' => '<AWS_ACCESS_KEY_ID',
+  'aws_secret_access_key' => '<AWS_SECRET_ACCESS_KEY>'
+}
+```
+
+| Setting           | Description                       |
+|-------------------|-----------------------------------|
+| `enabled`         | Enable or disable object storage. |
+| `proxy_download`  | Set to `true` to [enable proxying all files served](#proxy-download). Option allows to reduce egress traffic as this allows clients to download directly from remote storage instead of proxying all data. |
+| `connection`      | Various [connection options](#connection-settings) described below. |
+| `storage_options` | Options to use when saving new objects, such as [server side encryption](#server-side-encryption-headers). Introduced in GitLab 13.3. |
+| `objects`         | [Object-specific configuration](#object-specific-configuration). |
+
+### Object-specific configuration
+
+The following YAML shows how the `object_store` section defines
+object-specific configuration block and how the `enabled` and
+`proxy_download` flags can be overridden. The `bucket` is the only
+required parameter within each type:
+
+```yaml
+  object_store:
+      connection:
+        ...
+      objects:
+        artifacts:
+          bucket: artifacts
+          proxy_download: false
+        external_diffs:
+          bucket: external-diffs
+        lfs:
+          bucket: lfs-objects
+        uploads:
+          bucket: uploads
+        packages:
+          bucket: packages
+        dependency_proxy:
+          enabled: false
+          bucket: dependency_proxy
+        terraform_state:
+          bucket: terraform
+        pages:
+          bucket: pages
+```
+
+This maps to this Omnibus GitLab configuration:
+
+```ruby
+gitlab_rails['object_store']['objects']['artifacts']['bucket'] = 'artifacts'
+gitlab_rails['object_store']['objects']['artifacts']['proxy_download'] = false
+gitlab_rails['object_store']['objects']['external_diffs']['bucket'] = 'external-diffs'
+gitlab_rails['object_store']['objects']['lfs']['bucket'] = 'lfs-objects'
+gitlab_rails['object_store']['objects']['uploads']['bucket'] = 'uploads'
+gitlab_rails['object_store']['objects']['packages']['bucket'] = 'packages'
+gitlab_rails['object_store']['objects']['dependency_proxy']['enabled'] = false
+gitlab_rails['object_store']['objects']['dependency_proxy']['bucket'] = 'dependency-proxy'
+gitlab_rails['object_store']['objects']['terraform_state']['bucket'] = 'terraform-state'
+gitlab_rails['object_store']['objects']['pages']['bucket'] = 'pages'
+```
+
+This is the list of valid `objects` that can be used:
+
+|  Type              | Description                                                                |
+|--------------------|----------------------------------------------------------------------------|
+| `artifacts`        | [CI artifacts](job_artifacts.md)                                           |
+| `external_diffs`   | [Merge request diffs](merge_request_diffs.md)                              |
+| `uploads`          | [User uploads](uploads.md)                                                 |
+| `lfs`              | [Git Large File Storage objects](lfs/index.md)                             |
+| `packages`         | [Project packages (for example, PyPI, Maven, or NuGet)](packages/index.md) |
+| `dependency_proxy` | [Dependency Proxy](packages/dependency_proxy.md)                    |
+| `terraform_state`  | [Terraform state files](terraform_state.md)                                |
+| `pages`            | [Pages](pages/index.md)                                             |
+
+Within each object type, three parameters can be defined:
+
+| Setting          | Required?              | Description                         |
+|------------------|------------------------|-------------------------------------|
+| `bucket`         | **{check-circle}** Yes | Bucket name for the object storage. |
+| `enabled`        | **{dotted-circle}** No | Overrides the common parameter.     |
+| `proxy_download` | **{dotted-circle}** No | Overrides the common parameter.     |
+
+#### Disable object storage for specific features
+
+As seen above, object storage can be disabled for specific types by
+setting the `enabled` flag to `false`. For example, to disable object
+storage for CI artifacts:
+
+```ruby
+gitlab_rails['object_store']['objects']['artifacts']['enabled'] = false
+```
+
+A bucket is not needed if the feature is disabled entirely. For example,
+no bucket is needed if CI artifacts are disabled with this setting:
+
+```ruby
+gitlab_rails['artifacts_enabled'] = false
+```
+
+## Storage-specific configuration
+
+For configuring object storage in GitLab 13.1 and earlier, or for storage types not
+supported by consolidated configuration form, refer to the following guides:
+
+| Object storage type | Supported by consolidated configuration? |
+|---------------------|------------------------------------------|
+| [Backups](../raketasks/backup_gitlab.md#upload-backups-to-a-remote-cloud-storage) | **{dotted-circle}** No |
+| [Job artifacts](job_artifacts.md#using-object-storage) including archived job logs | **{check-circle}** Yes |
+| [LFS objects](lfs/index.md#storing-lfs-objects-in-remote-object-storage) | **{check-circle}** Yes |
+| [Uploads](uploads.md#using-object-storage) | **{check-circle}** Yes |
+| [Container Registry](packages/container_registry.md#use-object-storage) (optional feature) | **{dotted-circle}** No |
+| [Merge request diffs](merge_request_diffs.md#using-object-storage) | **{check-circle}** Yes |
+| [Mattermost](https://docs.mattermost.com/configure/file-storage-configuration-settings.html)| **{dotted-circle}** No |
+| [Packages](packages/index.md#use-object-storage) (optional feature) | **{check-circle}** Yes |
+| [Dependency Proxy](packages/dependency_proxy.md#using-object-storage) (optional feature) | **{check-circle}** Yes |
+| [Autoscale runner caching](https://docs.gitlab.com/runner/configuration/autoscale.html#distributed-runners-caching) (optional for improved performance) | **{dotted-circle}** No |
+| [Terraform state files](terraform_state.md#using-object-storage) | **{check-circle}** Yes |
+| [Pages content](pages/index.md#using-object-storage) | **{check-circle}** Yes |
+
+WARNING:
+The use of [encrypted S3 buckets](#encrypted-s3-buckets) with non-consolidated configuration is not supported.
+You may start getting [ETag mismatch errors](#etag-mismatch) if you use it.
+
+## Connection settings
+
+Both consolidated configuration form and storage-specific configuration form must configure a connection. The following sections describe parameters that can be used
+in the `connection` setting.
+
+### Amazon S3
+
+The connection settings match those provided by [fog-aws](https://github.com/fog/fog-aws):
+
+| Setting                                     | Description                        | Default |
+|---------------------------------------------|------------------------------------|---------|
+| `provider`                                  | Always `AWS` for compatible hosts. | `AWS` |
+| `aws_access_key_id`                         | AWS credentials, or compatible.    | |
+| `aws_secret_access_key`                     | AWS credentials, or compatible.    | |
+| `aws_signature_version`                     | AWS signature version to use. `2` or `4` are valid options. Digital Ocean Spaces and other providers may need `2`. | `4` |
+| `enable_signature_v4_streaming`             | Set to `true` to enable HTTP chunked transfers with [AWS v4 signatures](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be `false`.       | `true` |
+| `region`                                    | AWS region.                        | |
+| `host`                                      | DEPRECATED: Use `endpoint` instead. S3 compatible host for when not using AWS. For example, `localhost` or `storage.example.com`. HTTPS and port 443 is assumed. | `s3.amazonaws.com` |
+| `endpoint`                                  | Can be used when configuring an S3 compatible service such as [MinIO](https://min.io), by entering a URL such as `http://127.0.0.1:9000`. This takes precedence over `host`. Always use `endpoint` for consolidated form. | (optional) |
+| `path_style`                                | Set to `true` to use `host/bucket_name/object` style paths instead of `bucket_name.host/object`. Set to `true` for using [MinIO](https://min.io). Leave as `false` for AWS S3. | `false`. |
+| `use_iam_profile`                           | Set to `true` to use IAM profile instead of access keys. | `false` |
+| `aws_credentials_refresh_threshold_seconds` | Sets the [automatic refresh threshold](https://github.com/fog/fog-aws#controlling-credential-refresh-time-with-iam-authentication) when using temporary credentials in IAM. | `15` |
+
+### Oracle Cloud S3
+
+Oracle Cloud S3 must be sure to use the following settings:
+
+| Setting                         | Value   |
+|---------------------------------|---------|
+| `enable_signature_v4_streaming` | `false` |
+| `path_style`                    | `true`  |
+
+If `enable_signature_v4_streaming` is set to `true`, you may see the
+following error in `production.log`:
+
+```plaintext
+STREAMING-AWS4-HMAC-SHA256-PAYLOAD is not supported
+```
+
+### Google Cloud Storage (GCS)
+
+Here are the valid connection parameters for GCS:
+
+| Setting                      | Description       | Example |
+|------------------------------|-------------------|---------|
+| `provider`                   | Provider name.    | `Google` |
+| `google_project`             | GCP project name. | `gcp-project-12345` |
+| `google_json_key_location`   | JSON key path.    | `/path/to/gcp-project-12345-abcde.json` |
+| `google_json_key_string`     | JSON key string.  | `{ "type": "service_account", "project_id": "example-project-382839", ... }` |
+| `google_application_default` | Set to `true` to use [Google Cloud Application Default Credentials](https://cloud.google.com/docs/authentication#adc) to locate service account credentials. | |
+
+GitLab reads the value of `google_json_key_location`, then `google_json_key_string`, and finally, `google_application_default`.
+It uses the first of these settings that has a value.
+
+The service account must have permission to access the bucket. For more information,
+see the [Cloud Storage authentication documentation](https://cloud.google.com/storage/docs/authentication).
+
+NOTE:
+Bucket encryption with the [Cloud Key Management Service (KMS)](https://cloud.google.com/kms/docs) is not supported and results in [ETag mismatch errors](#etag-mismatch).
+
+#### GCS example
+
+For Omnibus installations, this is an example of the `connection` setting
+in the consolidated form:
+
+```ruby
+gitlab_rails['object_store']['connection'] = {
+  'provider' => 'Google',
+  'google_project' => '<GOOGLE PROJECT>',
+  'google_json_key_location' => '<FILENAME>'
+}
+```
+
+#### GCS example with ADC
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/275979) in GitLab 13.6.
+
+Google Cloud Application Default Credentials (ADC) are typically
+used with GitLab to use the default service account. This eliminates the
+need to supply credentials for the instance. For example, in the consolidated form:
+
+```ruby
+gitlab_rails['object_store']['connection'] = {
+  'provider' => 'Google',
+  'google_project' => '<GOOGLE PROJECT>',
+  'google_application_default' => true
+}
+```
+
+If you use ADC, be sure that:
+
+- The service account that you use has the
+[`iam.serviceAccounts.signBlob` permission](https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob).
+  Typically this is done by granting the `Service Account Token Creator` role to the service account.
+- Your virtual machines have the [correct access scopes to access Google Cloud APIs](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes). If the machines do not have the right scope, the error logs may show:
+
+  ```markdown
+  Google::Apis::ClientError (insufficientPermissions: Request had insufficient authentication scopes.)
+  ```
+
+### Azure Blob storage
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/25877) in GitLab 13.4.
+
+Although Azure uses the word `container` to denote a collection of
+blobs, GitLab standardizes on the term `bucket`. Be sure to configure
+Azure container names in the `bucket` settings.
+
+Azure Blob storage can only be used with the [consolidated form](#consolidated-object-storage-configuration)
+because a single set of credentials are used to access multiple
+containers. The [storage-specific form](#storage-specific-configuration)
+is not supported. For more details, see [how to transition to consolidated form](#transition-to-consolidated-form).
+
+The following are the valid connection parameters for Azure. For more information, see the
+[Azure Blob Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+
+| Setting                      | Description    | Example   |
+|------------------------------|----------------|-----------|
+| `provider`                   | Provider name. | `AzureRM` |
+| `azure_storage_account_name` | Name of the Azure Blob Storage account used to access the storage. | `azuretest` |
+| `azure_storage_access_key`   | Storage account access key used to access the container. This is typically a secret, 512-bit encryption key encoded in base64. | `czV2OHkvQj9FKEgrTWJRZVRoV21ZcTN0Nnc5eiRDJkYpSkBOY1JmVWpYbjJy\nNHU3eCFBJUQqRy1LYVBkU2dWaw==\n` |
+| `azure_storage_domain`       | Domain name used to contact the Azure Blob Storage API (optional). Defaults to `blob.core.windows.net`. Set this if you are using Azure China, Azure Germany, Azure US Government, or some other custom Azure domain. | `blob.core.windows.net` |
+
+- For Omnibus installations, this is an example of the `connection` setting
+  in the consolidated form:
+
+  ```ruby
+  gitlab_rails['object_store']['connection'] = {
+    'provider' => 'AzureRM',
+    'azure_storage_account_name' => '<AZURE STORAGE ACCOUNT NAME>',
+    'azure_storage_access_key' => '<AZURE STORAGE ACCESS KEY>',
+    'azure_storage_domain' => '<AZURE STORAGE DOMAIN>'
+  }
+  ```
+
+- For source installations, Workhorse also needs to be configured with Azure
+  credentials. This isn't needed in Omnibus installs, because the Workhorse
+  settings are populated from the previous settings.
+
+  1. Edit `/home/git/gitlab-workhorse/config.toml` and add or amend the following lines:
+
+     ```toml
+     [object_storage]
+       provider = "AzureRM"
+
+     [object_storage.azurerm]
+       azure_storage_account_name = "<AZURE STORAGE ACCOUNT NAME>"
+       azure_storage_access_key = "<AZURE STORAGE ACCESS KEY>"
+     ```
+
+  If you are using a custom Azure storage domain,
+  `azure_storage_domain` does **not** have to be set in the Workhorse
+  configuration. This information is exchanged in an API call between
+  GitLab Rails and Workhorse.
+
+### Storj Gateway (SJ)
+
+NOTE:
+The Storj Gateway [does not support](https://github.com/storj/gateway-st/blob/4b74c3b92c63b5de7409378b0d1ebd029db9337d/docs/s3-compatibility.md) multi-threaded copying (see `UploadPartCopy` in the table).
+While an implementation [is planned](https://github.com/storj/roadmap/issues/40), you must [disable multi-threaded copying](#multi-threaded-copying) until completion.
+
+The [Storj Network](https://www.storj.io/) provides an S3-compatible API gateway. Use the following configuration example:
+
+```ruby
+gitlab_rails['object_store']['connection'] = {
+  'provider' => 'AWS',
+  'endpoint' => 'https://gateway.storjshare.io',
+  'path_style' => true,
+  'region' => 'eu1',
+  'aws_access_key_id' => 'ACCESS_KEY',
+  'aws_secret_access_key' => 'SECRET_KEY',
+  'aws_signature_version' => 2,
+  'enable_signature_v4_streaming' => false
+}
+```
+
+The signature version must be `2`. Using v4 results in a HTTP 411 Length Required error.
+For more information, see [issue #4419](https://gitlab.com/gitlab-org/gitlab/-/issues/4419).
+
+## Full example using the consolidated object storage and Amazon S3
 
 The following example uses AWS S3 to enable object storage for all supported services:
 
@@ -379,309 +703,7 @@ The following example uses AWS S3 to enable object storage for all supported ser
 
 ::EndTabs
 
-#### Common parameters
-
-In the consolidated configuration, the `object_store` section defines a
-common set of parameters. Here we use the YAML from the source
-installation because it's easier to see the inheritance:
-
-```yaml
-    object_store:
-      enabled: true
-      proxy_download: true
-      connection:
-        provider: AWS
-        aws_access_key_id: <AWS_ACCESS_KEY_ID>
-        aws_secret_access_key: <AWS_SECRET_ACCESS_KEY>
-      objects:
-        ...
-```
-
-The Omnibus configuration maps directly to this:
-
-```ruby
-gitlab_rails['object_store']['enabled'] = true
-gitlab_rails['object_store']['proxy_download'] = true
-gitlab_rails['object_store']['connection'] = {
-  'provider' => 'AWS',
-  'aws_access_key_id' => '<AWS_ACCESS_KEY_ID',
-  'aws_secret_access_key' => '<AWS_SECRET_ACCESS_KEY>'
-}
-```
-
-| Setting           | Description                       |
-|-------------------|-----------------------------------|
-| `enabled`         | Enable or disable object storage. |
-| `proxy_download`  | Set to `true` to [enable proxying all files served](#proxy-download). Option allows to reduce egress traffic as this allows clients to download directly from remote storage instead of proxying all data. |
-| `connection`      | Various [connection options](#connection-settings) described below. |
-| `storage_options` | Options to use when saving new objects, such as [server side encryption](#server-side-encryption-headers). Introduced in GitLab 13.3. |
-| `objects`         | [Object-specific configuration](#object-specific-configuration). |
-
-### Connection settings
-
-Both consolidated configuration form and storage-specific configuration form must configure a connection. The following sections describe parameters that can be used
-in the `connection` setting.
-
-#### Amazon S3
-
-The connection settings match those provided by [fog-aws](https://github.com/fog/fog-aws):
-
-| Setting                                     | Description                        | Default |
-|---------------------------------------------|------------------------------------|---------|
-| `provider`                                  | Always `AWS` for compatible hosts. | `AWS` |
-| `aws_access_key_id`                         | AWS credentials, or compatible.    | |
-| `aws_secret_access_key`                     | AWS credentials, or compatible.    | |
-| `aws_signature_version`                     | AWS signature version to use. `2` or `4` are valid options. Digital Ocean Spaces and other providers may need `2`. | `4` |
-| `enable_signature_v4_streaming`             | Set to `true` to enable HTTP chunked transfers with [AWS v4 signatures](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html). Oracle Cloud S3 needs this to be `false`.       | `true` |
-| `region`                                    | AWS region.                        | |
-| `host`                                      | DEPRECATED: Use `endpoint` instead. S3 compatible host for when not using AWS. For example, `localhost` or `storage.example.com`. HTTPS and port 443 is assumed. | `s3.amazonaws.com` |
-| `endpoint`                                  | Can be used when configuring an S3 compatible service such as [MinIO](https://min.io), by entering a URL such as `http://127.0.0.1:9000`. This takes precedence over `host`. Always use `endpoint` for consolidated form. | (optional) |
-| `path_style`                                | Set to `true` to use `host/bucket_name/object` style paths instead of `bucket_name.host/object`. Set to `true` for using [MinIO](https://min.io). Leave as `false` for AWS S3. | `false`. |
-| `use_iam_profile`                           | Set to `true` to use IAM profile instead of access keys. | `false` |
-| `aws_credentials_refresh_threshold_seconds` | Sets the [automatic refresh threshold](https://github.com/fog/fog-aws#controlling-credential-refresh-time-with-iam-authentication) when using temporary credentials in IAM. | `15` |
-
-#### Oracle Cloud S3
-
-Oracle Cloud S3 must be sure to use the following settings:
-
-| Setting                         | Value   |
-|---------------------------------|---------|
-| `enable_signature_v4_streaming` | `false` |
-| `path_style`                    | `true`  |
-
-If `enable_signature_v4_streaming` is set to `true`, you may see the
-following error in `production.log`:
-
-```plaintext
-STREAMING-AWS4-HMAC-SHA256-PAYLOAD is not supported
-```
-
-#### Google Cloud Storage (GCS)
-
-Here are the valid connection parameters for GCS:
-
-| Setting                      | Description       | Example |
-|------------------------------|-------------------|---------|
-| `provider`                   | Provider name.    | `Google` |
-| `google_project`             | GCP project name. | `gcp-project-12345` |
-| `google_json_key_location`   | JSON key path.    | `/path/to/gcp-project-12345-abcde.json` |
-| `google_json_key_string`     | JSON key string.  | `{ "type": "service_account", "project_id": "example-project-382839", ... }` |
-| `google_application_default` | Set to `true` to use [Google Cloud Application Default Credentials](https://cloud.google.com/docs/authentication#adc) to locate service account credentials. | |
-
-GitLab reads the value of `google_json_key_location`, then `google_json_key_string`, and finally, `google_application_default`.
-It uses the first of these settings that has a value.
-
-The service account must have permission to access the bucket. For more information,
-see the [Cloud Storage authentication documentation](https://cloud.google.com/storage/docs/authentication).
-
-NOTE:
-Bucket encryption with the [Cloud Key Management Service (KMS)](https://cloud.google.com/kms/docs) is not supported and results in [ETag mismatch errors](#etag-mismatch).
-
-##### GCS example
-
-For Omnibus installations, this is an example of the `connection` setting
-in the consolidated form:
-
-```ruby
-gitlab_rails['object_store']['connection'] = {
-  'provider' => 'Google',
-  'google_project' => '<GOOGLE PROJECT>',
-  'google_json_key_location' => '<FILENAME>'
-}
-```
-
-##### GCS example with ADC
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/275979) in GitLab 13.6.
-
-Google Cloud Application Default Credentials (ADC) are typically
-used with GitLab to use the default service account. This eliminates the
-need to supply credentials for the instance. For example, in the consolidated form:
-
-```ruby
-gitlab_rails['object_store']['connection'] = {
-  'provider' => 'Google',
-  'google_project' => '<GOOGLE PROJECT>',
-  'google_application_default' => true
-}
-```
-
-If you use ADC, be sure that:
-
-- The service account that you use has the
-[`iam.serviceAccounts.signBlob` permission](https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob).
-  Typically this is done by granting the `Service Account Token Creator` role to the service account.
-- Your virtual machines have the [correct access scopes to access Google Cloud APIs](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes). If the machines do not have the right scope, the error logs may show:
-
-  ```markdown
-  Google::Apis::ClientError (insufficientPermissions: Request had insufficient authentication scopes.)
-  ```
-
-#### Azure Blob storage
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/25877) in GitLab 13.4.
-
-Although Azure uses the word `container` to denote a collection of
-blobs, GitLab standardizes on the term `bucket`. Be sure to configure
-Azure container names in the `bucket` settings.
-
-Azure Blob storage can only be used with the [consolidated form](#consolidated-object-storage-configuration)
-because a single set of credentials are used to access multiple
-containers. The [storage-specific form](#storage-specific-configuration)
-is not supported. For more details, see [how to transition to consolidated form](#transition-to-consolidated-form).
-
-The following are the valid connection parameters for Azure. For more information, see the
-[Azure Blob Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
-
-| Setting                      | Description    | Example   |
-|------------------------------|----------------|-----------|
-| `provider`                   | Provider name. | `AzureRM` |
-| `azure_storage_account_name` | Name of the Azure Blob Storage account used to access the storage. | `azuretest` |
-| `azure_storage_access_key`   | Storage account access key used to access the container. This is typically a secret, 512-bit encryption key encoded in base64. | `czV2OHkvQj9FKEgrTWJRZVRoV21ZcTN0Nnc5eiRDJkYpSkBOY1JmVWpYbjJy\nNHU3eCFBJUQqRy1LYVBkU2dWaw==\n` |
-| `azure_storage_domain`       | Domain name used to contact the Azure Blob Storage API (optional). Defaults to `blob.core.windows.net`. Set this if you are using Azure China, Azure Germany, Azure US Government, or some other custom Azure domain. | `blob.core.windows.net` |
-
-- For Omnibus installations, this is an example of the `connection` setting
-  in the consolidated form:
-
-  ```ruby
-  gitlab_rails['object_store']['connection'] = {
-    'provider' => 'AzureRM',
-    'azure_storage_account_name' => '<AZURE STORAGE ACCOUNT NAME>',
-    'azure_storage_access_key' => '<AZURE STORAGE ACCESS KEY>',
-    'azure_storage_domain' => '<AZURE STORAGE DOMAIN>'
-  }
-  ```
-
-- For source installations, Workhorse also needs to be configured with Azure
-  credentials. This isn't needed in Omnibus installs, because the Workhorse
-  settings are populated from the previous settings.
-
-  1. Edit `/home/git/gitlab-workhorse/config.toml` and add or amend the following lines:
-
-     ```toml
-     [object_storage]
-       provider = "AzureRM"
-
-     [object_storage.azurerm]
-       azure_storage_account_name = "<AZURE STORAGE ACCOUNT NAME>"
-       azure_storage_access_key = "<AZURE STORAGE ACCESS KEY>"
-     ```
-
-  If you are using a custom Azure storage domain,
-  `azure_storage_domain` does **not** have to be set in the Workhorse
-  configuration. This information is exchanged in an API call between
-  GitLab Rails and Workhorse.
-
-#### Storj Gateway (SJ)
-
-NOTE:
-The Storj Gateway [does not support](https://github.com/storj/gateway-st/blob/4b74c3b92c63b5de7409378b0d1ebd029db9337d/docs/s3-compatibility.md) multi-threaded copying (see `UploadPartCopy` in the table).
-While an implementation [is planned](https://github.com/storj/roadmap/issues/40), you must [disable multi-threaded copying](#multi-threaded-copying) until completion.
-
-The [Storj Network](https://www.storj.io/) provides an S3-compatible API gateway. Use the following configuration example:
-
-```ruby
-gitlab_rails['object_store']['connection'] = {
-  'provider' => 'AWS',
-  'endpoint' => 'https://gateway.storjshare.io',
-  'path_style' => true,
-  'region' => 'eu1',
-  'aws_access_key_id' => 'ACCESS_KEY',
-  'aws_secret_access_key' => 'SECRET_KEY',
-  'aws_signature_version' => 2,
-  'enable_signature_v4_streaming' => false
-}
-```
-
-The signature version must be `2`. Using v4 results in a HTTP 411 Length Required error.
-For more information, see [issue #4419](https://gitlab.com/gitlab-org/gitlab/-/issues/4419).
-
-### Object-specific configuration
-
-The following YAML shows how the `object_store` section defines
-object-specific configuration block and how the `enabled` and
-`proxy_download` flags can be overridden. The `bucket` is the only
-required parameter within each type:
-
-```yaml
-  object_store:
-      connection:
-        ...
-      objects:
-        artifacts:
-          bucket: artifacts
-          proxy_download: false
-        external_diffs:
-          bucket: external-diffs
-        lfs:
-          bucket: lfs-objects
-        uploads:
-          bucket: uploads
-        packages:
-          bucket: packages
-        dependency_proxy:
-          enabled: false
-          bucket: dependency_proxy
-        terraform_state:
-          bucket: terraform
-        pages:
-          bucket: pages
-```
-
-This maps to this Omnibus GitLab configuration:
-
-```ruby
-gitlab_rails['object_store']['objects']['artifacts']['bucket'] = 'artifacts'
-gitlab_rails['object_store']['objects']['artifacts']['proxy_download'] = false
-gitlab_rails['object_store']['objects']['external_diffs']['bucket'] = 'external-diffs'
-gitlab_rails['object_store']['objects']['lfs']['bucket'] = 'lfs-objects'
-gitlab_rails['object_store']['objects']['uploads']['bucket'] = 'uploads'
-gitlab_rails['object_store']['objects']['packages']['bucket'] = 'packages'
-gitlab_rails['object_store']['objects']['dependency_proxy']['enabled'] = false
-gitlab_rails['object_store']['objects']['dependency_proxy']['bucket'] = 'dependency-proxy'
-gitlab_rails['object_store']['objects']['terraform_state']['bucket'] = 'terraform-state'
-gitlab_rails['object_store']['objects']['pages']['bucket'] = 'pages'
-```
-
-This is the list of valid `objects` that can be used:
-
-|  Type              | Description                                                                |
-|--------------------|----------------------------------------------------------------------------|
-| `artifacts`        | [CI artifacts](job_artifacts.md)                                           |
-| `external_diffs`   | [Merge request diffs](merge_request_diffs.md)                              |
-| `uploads`          | [User uploads](uploads.md)                                                 |
-| `lfs`              | [Git Large File Storage objects](lfs/index.md)                             |
-| `packages`         | [Project packages (for example, PyPI, Maven, or NuGet)](packages/index.md) |
-| `dependency_proxy` | [Dependency Proxy](packages/dependency_proxy.md)                    |
-| `terraform_state`  | [Terraform state files](terraform_state.md)                                |
-| `pages`            | [Pages](pages/index.md)                                             |
-
-Within each object type, three parameters can be defined:
-
-| Setting          | Required?              | Description                         |
-|------------------|------------------------|-------------------------------------|
-| `bucket`         | **{check-circle}** Yes | Bucket name for the object storage. |
-| `enabled`        | **{dotted-circle}** No | Overrides the common parameter.     |
-| `proxy_download` | **{dotted-circle}** No | Overrides the common parameter.     |
-
-#### Disable object storage for specific features
-
-As seen above, object storage can be disabled for specific types by
-setting the `enabled` flag to `false`. For example, to disable object
-storage for CI artifacts:
-
-```ruby
-gitlab_rails['object_store']['objects']['artifacts']['enabled'] = false
-```
-
-A bucket is not needed if the feature is disabled entirely. For example,
-no bucket is needed if CI artifacts are disabled with this setting:
-
-```ruby
-gitlab_rails['artifacts_enabled'] = false
-```
-
-### Migrate to object storage
+## Migrate to object storage
 
 To migrate existing local data to object storage see the following guides:
 
@@ -694,7 +716,7 @@ To migrate existing local data to object storage see the following guides:
 - [Terraform state files](terraform_state.md#migrate-to-object-storage)
 - [Pages content](pages/index.md#migrate-pages-deployments-to-object-storage)
 
-### Transition to consolidated form
+## Transition to consolidated form
 
 Prior to GitLab 13.2:
 
@@ -730,43 +752,6 @@ the original form is omitted. To move to the consolidated form, remove the
 original configuration (for example, `artifacts_object_store_enabled`, or
 `uploads_object_store_connection`)
 
-### Storage-specific configuration
-
-For configuring object storage in GitLab 13.1 and earlier, or for storage types not
-supported by consolidated configuration form, refer to the following guides:
-
-| Object storage type | Supported by consolidated configuration? |
-|---------------------|------------------------------------------|
-| [Backups](../raketasks/backup_gitlab.md#upload-backups-to-a-remote-cloud-storage) | **{dotted-circle}** No |
-| [Job artifacts](job_artifacts.md#using-object-storage) including archived job logs | **{check-circle}** Yes |
-| [LFS objects](lfs/index.md#storing-lfs-objects-in-remote-object-storage) | **{check-circle}** Yes |
-| [Uploads](uploads.md#using-object-storage) | **{check-circle}** Yes |
-| [Container Registry](packages/container_registry.md#use-object-storage) (optional feature) | **{dotted-circle}** No |
-| [Merge request diffs](merge_request_diffs.md#using-object-storage) | **{check-circle}** Yes |
-| [Mattermost](https://docs.mattermost.com/configure/file-storage-configuration-settings.html)| **{dotted-circle}** No |
-| [Packages](packages/index.md#use-object-storage) (optional feature) | **{check-circle}** Yes |
-| [Dependency Proxy](packages/dependency_proxy.md#using-object-storage) (optional feature) | **{check-circle}** Yes |
-| [Autoscale runner caching](https://docs.gitlab.com/runner/configuration/autoscale.html#distributed-runners-caching) (optional for improved performance) | **{dotted-circle}** No |
-| [Terraform state files](terraform_state.md#using-object-storage) | **{check-circle}** Yes |
-| [Pages content](pages/index.md#using-object-storage) | **{check-circle}** Yes |
-
-WARNING:
-The use of [encrypted S3 buckets](#encrypted-s3-buckets) with non-consolidated configuration is not supported.
-You may start getting [ETag mismatch errors](#etag-mismatch) if you use it.
-
-### Other alternatives to file system storage
-
-If you're working to [scale out](reference_architectures/index.md) your GitLab implementation,
-or add fault tolerance and redundancy, you may be
-looking at removing dependencies on block or network file systems.
-See the following additional guides:
-
-1. Make sure the [`git` user home directory](https://docs.gitlab.com/omnibus/settings/configuration.html#moving-the-home-directory-for-a-user) is on local disk.
-1. Configure [database lookup of SSH keys](operations/fast_ssh_key_lookup.md)
-   to eliminate the need for a shared `authorized_keys` file.
-1. [Prevent local disk usage for job logs](job_logs.md#prevent-local-disk-usage).
-1. [Disable Pages local storage](pages/index.md#disable-pages-local-storage).
-
 ## Use Amazon instance profiles
 
 Instead of supplying AWS access and secret keys in object storage
@@ -889,6 +874,19 @@ After you have done at least one successful Rclone copy from the old location to
 1. Perform a final `rclone sync` run, knowing that your users cannot add new objects so you do not leave any behind in the old bucket.
 1. Update the object storage configuration of your GitLab server to use the new provider for `uploads`.
 
+## Alternatives to file system storage
+
+If you're working to [scale out](reference_architectures/index.md) your GitLab implementation,
+or add fault tolerance and redundancy, you may be
+looking at removing dependencies on block or network file systems.
+See the following additional guides:
+
+1. Make sure the [`git` user home directory](https://docs.gitlab.com/omnibus/settings/configuration.html#moving-the-home-directory-for-a-user) is on local disk.
+1. Configure [database lookup of SSH keys](operations/fast_ssh_key_lookup.md)
+   to eliminate the need for a shared `authorized_keys` file.
+1. [Prevent local disk usage for job logs](job_logs.md#prevent-local-disk-usage).
+1. [Disable Pages local storage](pages/index.md#disable-pages-local-storage).
+
 ## Troubleshooting
 
 ### Objects are not included in GitLab backups
diff --git a/doc/api/packages/debian.md b/doc/api/packages/debian.md
index 87b583de5e6..71ae3583f62 100644
--- a/doc/api/packages/debian.md
+++ b/doc/api/packages/debian.md
@@ -46,7 +46,8 @@ See [Authenticate to the Debian Package Repositories](../../user/packages/debian
 
 ## Upload a package file
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/62028) in GitLab 14.0.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/62028) in GitLab 14.0.
+> - Upload with explicit distribution and component [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/101838) in GitLab 15.9.
 
 Upload a Debian package file:
 
@@ -54,18 +55,29 @@ Upload a Debian package file:
 PUT projects/:id/packages/debian/:file_name
 ```
 
-| Attribute | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `id`        | string | yes | The ID or full path of the project.  |
-| `file_name` | string | yes | The name of the Debian package file. |
+| Attribute      | Type   | Required | Description |
+| -------------- | ------ | -------- | ----------- |
+| `id`           | string | yes      | The ID or full path of the project.  |
+| `file_name`    | string | yes      | The name of the Debian package file. |
+| `distribution` | string | no       | The distribution codename or suite. Used with `component` for upload with explicit distribution and component. |
+| `component`    | string | no       | The package file component. Used with `distribution` for upload with explicit distribution and component. |
 
 ```shell
 curl --request PUT \
-     --user <username>:<personal_access_token> \
+     --user "<username>:<personal_access_token>" \
      --upload-file path/to/mypkg.deb \
      "https://gitlab.example.com/api/v4/projects/1/packages/debian/mypkg.deb"
 ```
 
+Upload with explicit distribution and component:
+
+```shell
+curl --request PUT \
+  --user "<username>:<personal_access_token>" \
+  --upload-file  /path/to/myother.deb \
+  "https://gitlab.example.com/api/v4/projects/1/packages/debian/myother.deb?distribution=sid&component=main"
+```
+
 ## Download a package
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/64923) in GitLab 14.2.
diff --git a/doc/api/rest/index.md b/doc/api/rest/index.md
index 51fea290e55..53c03b37332 100644
--- a/doc/api/rest/index.md
+++ b/doc/api/rest/index.md
@@ -644,6 +644,14 @@ For example, suppose a project with `id: 42` has an issue with `id: 46` and
 Not all resources with the `iid` field are fetched by `iid`. For guidance
 regarding which field to use, see the documentation for the specific resource.
 
+## `null` vs `false`
+
+In API responses, some boolean fields can have `null` values.
+A `null` boolean has no default value and is neither `true` nor `false`.
+GitLab treats `null` values in boolean fields the same as `false`.
+
+In boolean arguments, you should only set `true` or `false` values (not `null`).
+
 ## Data validation and error reporting
 
 When working with the API you may encounter validation errors, in which case
diff --git a/doc/install/aws/manual_install_aws.md b/doc/install/aws/manual_install_aws.md
index 51ae16ccd17..a59854ba6ed 100644
--- a/doc/install/aws/manual_install_aws.md
+++ b/doc/install/aws/manual_install_aws.md
@@ -845,6 +845,6 @@ If you see this page when trying to set a password via the web interface, make s
 
 ### Some job logs are not uploaded to object storage
 
-When the GitLab deployment is scaled up to more than one node, some job logs may not be uploaded to [object storage](../../administration/object_storage.md) properly. [Incremental logging is required](../../administration/object_storage.md#other-alternatives-to-file-system-storage) for CI to use object storage.
+When the GitLab deployment is scaled up to more than one node, some job logs may not be uploaded to [object storage](../../administration/object_storage.md) properly. [Incremental logging is required](../../administration/object_storage.md#alternatives-to-file-system-storage) for CI to use object storage.
 
 Enable [incremental logging](../../administration/job_logs.md#enable-or-disable-incremental-logging) if it has not already been enabled.
diff --git a/doc/user/packages/debian_repository/index.md b/doc/user/packages/debian_repository/index.md
index 05574c54112..577667b7a16 100644
--- a/doc/user/packages/debian_repository/index.md
+++ b/doc/user/packages/debian_repository/index.md
@@ -162,9 +162,9 @@ EOF
 dput --config=dput.cf --unchecked --no-upload-log gitlab <your_package>.changes
 ```
 
-## Directly upload a package
+## Upload a package with explicit distribution and component
 
-> Direct upload [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/101838) in GitLab 15.9.
+> Upload with explicit distribution and component [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/101838) in GitLab 15.9.
 
 When you don't have access to `.changes` file, you can directly upload a `.deb` by passing
 distribution `codename` and target `component` as parameters with
@@ -173,7 +173,8 @@ For example, to upload to component `main` of distribution `sid` using a persona
 
 ```shell
 curl --request PUT --user "<username>:<personal_access_token>" \
-  "https://gitlab.example.com/api/v4/projects/<project_id>/packages/debian/?distribution=sid&component=main" \
+  --get --data "distribution=sid" --data "component=main" \
+  "https://gitlab.example.com/api/v4/projects/<project_id>/packages/debian/" \
   --upload-file  /path/to/your.deb
 ```