values.yaml

etcJupyter:
  jupyter_notebook_config.json:
    # if a user leaves a notebook with a running kernel,
    # the effective idle timeout will typically be CULL_TIMEOUT + CULL_KERNEL_TIMEOUT
    # as culling the kernel will register activity,
    # resetting the no_activity timer for the server as a whole
    MappingKernelManager:
      # shutdown kernels after no activity
      cull_idle_timeout: 3600
      # check for idle kernels this often
      cull_interval: 300
      # a kernel with open connections but no activity still counts as idle
      # this is what allows us to shutdown servers
      # when people leave a notebook open and wander off
      cull_connected: true

nfsPVC:
  enabled: true
  shareCreator:
    tolerations: []
  nfs:
    mountOptions:
      - soft
      - noatime
      - vers=4.2
    serverIP: nfs-server-01
    # MUST HAVE TRAILING SLASH
    baseShareName: /export/home-01/homes/

jupyterhub:
  custom:
    cloudResources:
      provider: null
      gcp:
        projectId: null
      scratchBucket:
        enabled: false
  ingress:
    enabled: true
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 256m
      kubernetes.io/ingress.class: nginx
      cert-manager.io/cluster-issuer: letsencrypt-prod
  scheduling:
    userPlaceholder:
      enabled: true
      replicas: 0
    podPriority:
      enabled: true
      globalDefault: false
      defaultPriority: 0
      userPlaceholderPriority: -10
    userScheduler:
      enabled: true
      nodeSelector:
        hub.jupyter.org/node-purpose: core
      resources:
        requests:
          # FIXME: Just unset this?
          cpu: 0.01
          memory: 64Mi
        limits:
          memory: 1G
  prePuller:
    continuous:
      enabled: false
    hook:
      enabled: false
  proxy:
    https:
      enabled: false
    service:
      type: ClusterIP
    chp:
      nodeSelector:
        hub.jupyter.org/node-purpose: core
      resources:
        requests:
          # FIXME: We want no guarantees here!!!
          # This is lowest possible value
          cpu: 0.01
          memory: 64Mi
        limits:
          memory: 1Gi
    traefik:
      nodeSelector:
        hub.jupyter.org/node-purpose: core
      resources:
        requests:
          memory: 64Mi
        limits:
          memory: 1Gi
    https:
      enabled: false
      letsencrypt:
        contactEmail: yuvipanda@gmail.com
  singleuser:
    admin:
      extraVolumeMounts:
        - name: home
          mountPath: /home/jovyan/shared-readwrite
          subPath: _shared
    startTimeout: 600 # 10 mins, because sometimes we have too many new nodes coming up together
    defaultUrl: /tree
    nodeSelector:
      hub.jupyter.org/node-purpose: user
    image:
      name: set_automatically_by_automation
      tag: 524cf58
    storage:
      type: static
      static:
        pvcName: home-nfs
        subPath: '{username}'
      extraVolumeMounts:
        - name: home
          mountPath: /home/jovyan/shared
          subPath: _shared
          readOnly: true
    memory:
      guarantee: 256M
      limit: 1G
    networkPolicy:
      # In clusters with NetworkPolicy enabled, do not
      # allow outbound internet access that's not DNS, HTTP or HTTPS
      # We can override this on a case to case basis where
      # required.
      enabled: true
      egress:
        - ports:
            - port: 53
              protocol: UDP
        - ports:
            - port: 80
              protocol: TCP
        - ports:
            - port: 443
              protocol: TCP
  hub:
    extraFiles:
      configurator-schema-default:
        mountPath: /usr/local/etc/jupyterhub-configurator/00-default.schema.json
        data:
          type: object
          name: config
          properties:
            KubeSpawner.image:
              type: string
              title: User docker image
              description: Determines languages, libraries and interfaces available
              help: Leave this blank to use the default
            Spawner.default_url:
              type: string
              title: Default User Interface
              enum:
                - "/tree"
                - "/lab"
                - "/rstudio"
              default: "/tree"
              enumMetadata:
                interfaces:
                  - value: "/tree"
                    title: Classic Notebook
                    description: The original single-document interface for creating Jupyter Notebooks.
                  - value: "/lab"
                    title: JupyterLab
                    description: A Powerful next generation notebook interface
                  - value: "/rstudio"
                    title: RStudio
                    description: An IDE For R, created by the RStudio company

    services:
      configurator:
        url: http://configurator:10101
        command:
          - python3
          - -m
          - jupyterhub_configurator.app
          - --Configurator.config_file=/usr/local/etc/jupyterhub-configurator/jupyterhub_configurator_config.py
    image:
      name: quay.io/2i2c/pilot-hub
      tag: '0.0.1-n569.hb296398'
    config:
      JupyterHub:
        authenticator_class: oauthenticator.generic.GenericOAuthenticator
    nodeSelector:
      hub.jupyter.org/node-purpose: core
    networkPolicy:
      enabled: true
      ingress:
        - from:
            - podSelector:
                matchLabels:
                  app: jupyterhub
                  component: hub
          ports:
            - port: 8081
              protocol: TCP
        - from:
            - podSelector:
                matchLabels:
                  app: jupyterhub
                  component: proxy
            - podSelector:
                matchLabels:
                  app: jupyterhub
                  component: hub
          ports:
            - port: 10101
              protocol: TCP
        - from:
            - namespaceSelector:
                matchLabels:
                  name: support
              podSelector:
                matchLabels:
                  app: prometheus
                  component: server
          ports:
            - port: http
              protocol: TCP
    resources:
      requests:
        # Very small unit, since we don't want any CPU guarantees
        cpu: 0.01
        memory: 128Mi
      limits:
        memory: 2Gi
    extraConfig:
      01-working-dir: |
        # Make sure working directory is ${HOME}
        # hubploy has a bug where it unconditionally puts workingdir to be /srv/repo
        c.KubeSpawner.working_dir = '/home/jovyan'
      02-prometheus: |
        # Allow unauthenticated prometheus requests
        # Otherwise our prometheus server can't get to these
        c.JupyterHub.authenticate_prometheus = False
      03-no-setuid: |
        c.KubeSpawner.extra_container_config = {
          'securityContext': {
            # Explicitly disallow setuid binaries from working inside the container
            'allowPrivilegeEscalation': False
          }
        }
      04-custom-theme: |
        from z2jh import get_config
        c.JupyterHub.template_paths = ['/usr/local/share/jupyterhub/custom_templates/']

        c.JupyterHub.template_vars = {
          'custom':get_config('custom.homepage.templateVars')
        }
      05-custom-admin: |
        from z2jh import get_config
        from kubespawner import KubeSpawner
        from jupyterhub_configurator.mixins import ConfiguratorSpawnerMixin

        class CustomSpawner(ConfiguratorSpawnerMixin, KubeSpawner):
          def start(self, *args, **kwargs):
            custom_admin = get_config('singleuser.admin', {})
            if custom_admin and self.user.admin:
                extra_init_containers = custom_admin.get('initContainers', [])
                extra_volume_mounts = custom_admin.get('extraVolumeMounts', [])

                self.init_containers += [container for container in extra_init_containers if container not in self.init_containers]
                self.volume_mounts += [volume for volume in extra_volume_mounts if volume not in self.volume_mounts]

            return super().start(*args, **kwargs)


        c.JupyterHub.spawner_class = CustomSpawner

      06-custom-authenticator: |
        from oauthenticator.generic import GenericOAuthenticator
        from jupyterhub.handlers import LogoutHandler
        from tornado.httputil import url_concat
        from traitlets import Unicode
        from z2jh import get_config

        class CustomLogoutHandler(LogoutHandler):
          """
          Handle custom logout URLs. If a custom logout url
          is specified, the 'logout' button will log the user out of that identity
          provider in addition to clearing the session with Jupyterhub, otherwise
          only the Jupyterhub session is cleared.
          """

          async def render_logout_page(self):
            if self.authenticator.logout_redirect_url:
              # Return to the hub main page after logout
              params = {
                'returnTo': f'https://{self.request.host}'
              }
              self.redirect(
                url_concat(self.authenticator.logout_redirect_url, params),
                permanent=False
              )
              return

            super().render_logout_page()

        class CustomOAuthenticator(GenericOAuthenticator):
          logout_redirect_url = Unicode(help="""URL for logging out.""", default_value='').tag(config=True)

          def get_handlers(self, app):
            return super().get_handlers(app) + [(r'/logout', CustomLogoutHandler)]

          async def authenticate(self, *args, **kwargs):
            resp = await super().authenticate(*args, **kwargs)
            if self.username_key == 'sub':
              # auth0 returns 'sub' in the form of <provider>|<id>. For our
              # friendly names, we just want <id>, since we don't support multiple
              # authentication methods in the same hub
              # This could've been a lambda set to username_key,
              # but we would need to know which authentication mechanism
              # auth0 is sending us, so we can use sub / email / nick as
              # needed. This method is simpler
              resp['name'] = resp['name'].split('|')[-1]
            return resp

        c.JupyterHub.authenticator_class = CustomOAuthenticator

      07-cloud-storage-bucket: |
        from z2jh import get_config
        cloud_resources = get_config('custom.cloudResources')
        scratch_bucket = cloud_resources['scratchBucket']
        import os

        if scratch_bucket['enabled']:
          # FIXME: Support other providers too
          assert cloud_resources['provider'] == 'gcp'
          project_id = cloud_resources['gcp']['projectId']

          release = os.environ['HELM_RELEASE_NAME']
          bucket_protocol = 'gcs'
          bucket_name = f'{project_id}-{release}-scratch-bucket'
          env = {
            'SCRATCH_BUCKET_PROTOCOL': bucket_protocol,
            # Matches "daskhub.scratchBUcket.name" helm template
            'SCRATCH_BUCKET_NAME': bucket_name,
            # Use k8s syntax of $(ENV_VAR) to substitute env vars dynamically in other env vars
            'SCRATCH_BUCKET': f'{bucket_protocol}://{bucket_name}/$(JUPYTERHUB_USER)',
            'PANGEO_SCRATCH': f'{bucket_protocol}://{bucket_name}/$(JUPYTERHUB_USER)',
          }

          c.KubeSpawner.environment.update(env)