CI: only:kubernetes:active cannot be overriden in included or extended jobs

gitlab-ce~2278648 ~Verify

Summary

If an included or extended job contains the only:kubernetes:active key, it is not possible for any descending jobs to remove this key.

Steps to reproduce

The Auto-DevOps job performance defines

  only:
    refs:
      - branches
      - tags
    kubernetes: active

When including this job and customizing it to the own projects needs, only:refs: can be redefined but only:kubernetes: cannot:

include:
  - template: Jobs/Browser-Performance-Testing.gitlab-ci.yml

performance:
  stage: review
  tags:
    - docker
  environment:
    name: $RUNNER_ENVIRONMENT_NAME/$CI_COMMIT_REF_SLUG
    url: $RUNNER_ENVIRONMENT_URL/$CI_COMMIT_REF_SLUG/
  only:
    refs:
      - branches@group/project
    variables:
      - $PRIVILEGED_RUNNER

Per CI_LINT this jobs only policy will contain kubernetes:active: Only policy: refs, branches@group/project, kubernetes, active, variables, $PRIVILEGED_RUNNER . Notice that only:refs:tags is gone.

To override the kubernetes key, a new value needs to be assigned. But the only valid value for only:kubernetes is active. There is no any.

Possible fixes

Add a key only:kubernetes:any (or similar) that does not restrict the job and allows to override a previous defined only:kubernetes key.

OR

deep_merge: false from gitlab-ce#52680 would solve this for included jobs but not for extended ones.