273 lines
9.3 KiB
YAML
273 lines
9.3 KiB
YAML
hub:
|
|
extraEnv:
|
|
JUPYTERHUB_CRYPT_KEY: {{ .Env.JUPYTERHUB_CRYPT_KEY | quote }}
|
|
|
|
# Install packages at container startup
|
|
extraFiles:
|
|
startup.sh:
|
|
mountPath: /usr/local/bin/startup.sh
|
|
mode: 0755
|
|
stringData: |
|
|
#!/bin/bash
|
|
pip install --no-cache-dir hvac==2.3.0
|
|
exec jupyterhub --config /usr/local/etc/jupyterhub/jupyterhub_config.py --upgrade-db
|
|
user_policy.hcl:
|
|
mountPath: /srv/jupyterhub/user_policy.hcl
|
|
mode: 0644
|
|
stringData: |
|
|
{{ .Env.USER_POLICY_HCL | strings.Indent 8 }}
|
|
|
|
# Override the default command to run our startup script first
|
|
command:
|
|
- /usr/local/bin/startup.sh
|
|
|
|
config:
|
|
JupyterHub:
|
|
authenticator_class: generic-oauth
|
|
admin_access: false
|
|
|
|
Authenticator:
|
|
enable_auth_state: true
|
|
allow_all: true # allow all Keycloak users
|
|
|
|
GenericOAuthenticator:
|
|
client_id: {{ .Env.JUPYTERHUB_OIDC_CLIENT_ID }}
|
|
oauth_callback_url: "https://{{ .Env.JUPYTERHUB_HOST }}/hub/oauth_callback"
|
|
authorize_url: "https://{{ .Env.KEYCLOAK_HOST }}/realms/{{ .Env.KEYCLOAK_REALM }}/protocol/openid-connect/auth"
|
|
token_url: "https://{{ .Env.KEYCLOAK_HOST }}/realms/{{ .Env.KEYCLOAK_REALM }}/protocol/openid-connect/token"
|
|
userdata_url: "https://{{ .Env.KEYCLOAK_HOST }}/realms/{{ .Env.KEYCLOAK_REALM }}/protocol/openid-connect/userinfo"
|
|
login_service: keycloak
|
|
# username_claim: email
|
|
username_claim: preferred_username
|
|
auth_refresh_age: 300 # Refresh auth token every 5 minutes
|
|
refresh_pre_spawn: true # Refresh token before spawning server
|
|
|
|
OAuthenticator:
|
|
scope:
|
|
- openid
|
|
- profile
|
|
- email
|
|
|
|
extraConfig:
|
|
pre-spawn-hook: |
|
|
# Set environment variables for spawned containers
|
|
import hvac
|
|
|
|
async def pre_spawn_hook(spawner):
|
|
"""Set essential environment variables for spawned containers"""
|
|
# PostgreSQL configuration
|
|
spawner.environment["POSTGRES_HOST"] = "postgres-cluster-rw.postgres"
|
|
spawner.environment["POSTGRES_PORT"] = "5432"
|
|
|
|
# JupyterHub API configuration
|
|
spawner.environment["JUPYTERHUB_API_URL"] = "http://hub:8081/hub/api"
|
|
|
|
# Logging configuration
|
|
spawner.environment["BUUNSTACK_LOG_LEVEL"] = "{{ .Env.JUPYTER_BUUNSTACK_LOG_LEVEL }}"
|
|
|
|
# Create user-specific Vault token directly
|
|
try:
|
|
username = spawner.user.name
|
|
|
|
# Step 1: Initialize admin Vault client
|
|
vault_client = hvac.Client(url="{{ .Env.VAULT_ADDR }}", verify=False)
|
|
vault_client.token = "{{ .Env.JUPYTERHUB_VAULT_TOKEN }}"
|
|
|
|
if not vault_client.is_authenticated():
|
|
raise Exception("Admin token is not authenticated")
|
|
|
|
# Step 2: Create user-specific policy
|
|
user_policy_name = "jupyter-user-{}".format(username)
|
|
|
|
# Read policy template from file
|
|
import os
|
|
policy_template_path = "/srv/jupyterhub/user_policy.hcl"
|
|
with open(policy_template_path, 'r') as f:
|
|
policy_template = f.read()
|
|
|
|
# Replace {username} placeholder with actual username
|
|
user_policy = policy_template.replace("{username}", username)
|
|
|
|
# Write user-specific policy
|
|
try:
|
|
vault_client.sys.create_or_update_policy(user_policy_name, user_policy)
|
|
spawner.log.info("✅ Created policy: {}".format(user_policy_name))
|
|
except Exception as policy_e:
|
|
spawner.log.warning("Policy creation failed (may already exist): {}".format(policy_e))
|
|
|
|
# Step 3: Create user-specific token
|
|
token_response = vault_client.auth.token.create(
|
|
policies=[user_policy_name],
|
|
ttl="1h",
|
|
renewable=True,
|
|
display_name="notebook-{}".format(username)
|
|
)
|
|
|
|
user_vault_token = token_response["auth"]["client_token"]
|
|
lease_duration = token_response["auth"].get("lease_duration", 3600)
|
|
|
|
# Set user-specific Vault token as environment variable
|
|
spawner.environment["NOTEBOOK_VAULT_TOKEN"] = user_vault_token
|
|
|
|
spawner.log.info("✅ User-specific Vault token created for {} (expires in {}s, renewable)".format(username, lease_duration))
|
|
|
|
except Exception as e:
|
|
spawner.log.error("Failed to create user-specific Vault token for {}: {}".format(spawner.user.name, e))
|
|
import traceback
|
|
spawner.log.error("Full traceback: {}".format(traceback.format_exc()))
|
|
|
|
c.Spawner.pre_spawn_hook = pre_spawn_hook
|
|
|
|
|
|
podSecurityContext:
|
|
fsGroup: {{ .Env.JUPYTER_FSGID }}
|
|
|
|
singleuser:
|
|
storage:
|
|
{{ if env.Getenv "PVC_NAME" -}}
|
|
type: static
|
|
static:
|
|
pvcName: {{ .Env.PVC_NAME }}
|
|
{{ else -}}
|
|
type: dynamic
|
|
dynamic:
|
|
{{ if env.Getenv "JUPYTERHUB_STORAGE_CLASS" -}}
|
|
storageClass: {{ .Env.JUPYTERHUB_STORAGE_CLASS }}
|
|
{{ end -}}
|
|
storageAccessModes:
|
|
- ReadWriteOnce
|
|
{{ end -}}
|
|
capacity: 10Gi
|
|
|
|
extraEnv:
|
|
VAULT_ADDR: "{{ .Env.VAULT_ADDR }}"
|
|
networkPolicy:
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: postgres
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: chroma
|
|
ports:
|
|
- port: 8000
|
|
protocol: TCP
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: qdrant
|
|
ports:
|
|
- port: 6333
|
|
protocol: TCP
|
|
- port: 6334
|
|
protocol: TCP
|
|
- port: 6335
|
|
protocol: TCP
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: litellm
|
|
ports:
|
|
- port: 4000
|
|
protocol: TCP
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: vault
|
|
ports:
|
|
- port: 8200
|
|
protocol: TCP
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
domains:
|
|
- '*.shds.dev'
|
|
|
|
image:
|
|
pullPolicy: IfNotPresent
|
|
|
|
profileList:
|
|
# https://quay.io/repository/jupyter/pyspark-notebook
|
|
{{- if eq .Env.JUPYTER_PROFILE_MINIMAL_ENABLED "true" }}
|
|
- display_name: "Minimal Jupyter Notebook Stack"
|
|
description: "Minimal Jupyter Notebook Stack"
|
|
kubespawner_override:
|
|
image: quay.io/jupyter/minimal-notebook
|
|
{{- end }}
|
|
{{ if eq .Env.JUPYTER_PROFILE_BASE_ENABLED "true" }}
|
|
- display_name: "Base Jupyter Notebook Stack"
|
|
description: "Base Jupyter Notebook Stack"
|
|
kubespawner_override:
|
|
image: quay.io/jupyter/base-notebook
|
|
{{- end }}
|
|
{{- if eq .Env.JUPYTER_PROFILE_DATASCIENCE_ENABLED "true" }}
|
|
- display_name: "Jupyter Notebook Data Science Stack"
|
|
description: "Jupyter Notebook Data Science Stack"
|
|
kubespawner_override:
|
|
image: quay.io/jupyter/datascience-notebook
|
|
{{- end }}
|
|
{{- if eq .Env.JUPYTER_PROFILE_PYSPARK_ENABLED "true" }}
|
|
- display_name: "Jupyter Notebook Python, Spark Stack"
|
|
description: "Jupyter Notebook Python, Spark Stack"
|
|
kubespawner_override:
|
|
image: quay.io/jupyter/pyspark-notebook
|
|
{{- end }}
|
|
{{- if eq .Env.JUPYTER_PROFILE_PYTORCH_ENABLED "true" }}
|
|
- display_name: "Jupyter Notebook PyTorch Deep Learning Stack"
|
|
description: "Jupyter Notebook PyTorch Deep Learning Stack"
|
|
kubespawner_override:
|
|
image: quay.io/jupyter/pytorch-notebook
|
|
{{- end }}
|
|
{{- if eq .Env.JUPYTER_PROFILE_TENSORFLOW_ENABLED "true" }}
|
|
- display_name: "Jupyter Notebook TensorFlow Deep Learning Stack"
|
|
description: "Jupyter Notebook TensorFlow Deep Learning Stack"
|
|
kubespawner_override:
|
|
image: quay.io/jupyter/tensorflow-notebook
|
|
{{- end }}
|
|
{{- if eq .Env.JUPYTER_PROFILE_BUUN_STACK_ENABLED "true" }}
|
|
- display_name: "Buun-stack"
|
|
description: "Jupyter Notebook with buun-stack"
|
|
kubespawner_override:
|
|
image: "{{ .Env.IMAGE_REGISTRY }}/{{ .Env.KERNEL_IMAGE_BUUN_STACK_REPOSITORY }}:{{ .Env.JUPYTER_PYTHON_KERNEL_TAG }}"
|
|
{{- end }}
|
|
{{- if eq .Env.JUPYTER_PROFILE_BUUN_STACK_CUDA_ENABLED "true" }}
|
|
- display_name: "Buun-stack with CUDA"
|
|
description: "Jupyter Notebook with buun-stack and CUDA support"
|
|
kubespawner_override:
|
|
image: "{{ .Env.IMAGE_REGISTRY }}/{{ .Env.KERNEL_IMAGE_BUUN_STACK_CUDA_REPOSITORY }}:{{ .Env.JUPYTER_PYTHON_KERNEL_TAG }}"
|
|
# resources:
|
|
# requests:
|
|
# nvidia.com/gpu: "1"
|
|
{{- end }}
|
|
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
kubernetes.io/ingress.class: traefik
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
ingressClassName: traefik
|
|
hosts:
|
|
- {{ .Env.JUPYTERHUB_HOST }}
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
- {{ .Env.JUPYTERHUB_HOST }}
|
|
|
|
cull:
|
|
enabled: true
|
|
timeout: 7200 # 2 hours idle timeout
|
|
every: 600 # Check every 10 minutes
|
|
adminUsers: true # Also cull admin users' server pods
|
|
users: false # Don't delete user accounts, only stop server pods
|