Skip to content

Commit 09a9bd7

Browse files
yuvipandayuvipanda
authored
Merge pull request #7219 from bsatoriu/main
Promote MAAP staging hubs to prod
2 parents 8bae849 + 5d41a48 commit 09a9bd7

File tree

3 files changed

+351
-193
lines changed

3 files changed

+351
-193
lines changed

‎config/clusters/maap/common.values.yaml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,67 @@ jupyterhub:
5858
admin_users:
5959
- freitagb
6060
- wildintellect
61+
authenticator_class: generic-oauth
62+
enable_auth_state: true
63+
GenericOAuthenticator:
64+
# We want to get user data from the JWT that's the id token,
65+
# not from a separate userdata API call
66+
userdata_from_id_token: true
67+
scope:
68+
- basic
69+
- profile
70+
- openid
71+
username_claim: preferred_username
72+
manage_groups: true
73+
auth_state_groups_key: oauth_user.roles
74+
admin_groups:
75+
- Admin
76+
# Being granted *any* jupyterhub related role should allow you
77+
# to login
78+
allowed_groups:
79+
- Admin
80+
- CPU:XS
81+
- CPU:S
82+
- CPU:M
83+
- CPU:L
84+
- CPU:XL
85+
- CPU:XXL
86+
- CPU:XXXL
87+
- GPU:T4
88+
extraConfig:
89+
001-username-claim: |
90+
def populate_token(spawner, auth_state):
91+
# For our deployment-service-check health check user, there is no auth_state.
92+
# So these env variables need not be set.
93+
if auth_state:
94+
95+
spawner.environment.update({
96+
"MAAP_PGT": f"jwt:{auth_state.get("id_token", "")}",
97+
"KC_ACCESS_TOKEN": auth_state.get("access_token", ""),
98+
"KC_ID_TOKEN": auth_state.get("id_token", ""),
99+
"KC_REFRESH_TOKEN": auth_state.get("refresh_token", "")
100+
})
101+
102+
c.Spawner.auth_state_hook = populate_token
103+
00-volumes-and-volume-mounts-as-dict: |
104+
# The base jupyterhub config in zero-to-jupyterhub defines
105+
# volumes and volume_mounts as lists.
106+
# But we can't add new volumes or volume_mounts to the list
107+
# as that replaces the entire list.
108+
# So we convert them to dictionaries, which allows us to
109+
# add new volumes and volume_mounts as needed.
110+
if isinstance(c.KubeSpawner.volumes, list):
111+
existing_volumes = c.KubeSpawner.volumes
112+
c.KubeSpawner.volumes = {}
113+
for volume in existing_volumes:
114+
c.KubeSpawner.volumes[volume["name"]] = volume
115+
if isinstance(c.KubeSpawner.volume_mounts, list):
116+
existing_volume_mounts = c.KubeSpawner.volume_mounts
117+
c.KubeSpawner.volume_mounts = {}
118+
for idx, volume_mount in enumerate(existing_volume_mounts):
119+
c.KubeSpawner.volume_mounts[f"{idx}-{volume_mount['name']}"] = volume_mount
120+
121+
c.KubeSpawner.volumes["s3fs-volume"] = {"name": "s3fs-volume", "emptyDir": {}}
61122
singleuser:
62123
cloudMetadata:
63124
blockWithIptables: false
@@ -85,6 +146,58 @@ jupyterhub:
85146
mountPath: /home/rstudio/shared
86147
subPath: _shared
87148
readOnly: true
149+
- name: s3fs-volume
150+
mountPath: /home/jovyan/my-private-bucket
151+
subPath: my-private-bucket
152+
mountPropagation: HostToContainer
153+
readOnly: false
154+
- name: s3fs-volume
155+
mountPath: /home/jovyan/my-public-bucket
156+
subPath: my-public-bucket
157+
mountPropagation: HostToContainer
158+
readOnly: false
159+
- name: s3fs-volume
160+
mountPath: /home/jovyan/shared-buckets
161+
subPath: shared-buckets
162+
mountPropagation: HostToContainer
163+
readOnly: true
164+
- name: s3fs-volume
165+
mountPath: /home/jovyan/triaged-jobs
166+
subPath: triaged-jobs
167+
mountPropagation: HostToContainer
168+
readOnly: true
169+
extraContainers:
170+
- name: s3fs
171+
image: mas.dit.maap-project.org/root/che-sidecar-s3fs:2i2c
172+
image_pull_policy: Always
173+
securityContext:
174+
privileged: true
175+
resources:
176+
limits:
177+
memory: 512Mi
178+
cpu: 1.0
179+
requests:
180+
# If we don't set requests, k8s sets requests == limits!
181+
# So we set something tiny
182+
memory: 64Mi
183+
cpu: 0.01
184+
volumeMounts:
185+
- name: s3fs-volume
186+
mountPath: /my-public-bucket
187+
subPath: my-public-bucket
188+
mountPropagation: Bidirectional
189+
- name: s3fs-volume
190+
mountPath: /my-private-bucket
191+
subPath: my-private-bucket
192+
mountPropagation: Bidirectional
193+
- name: s3fs-volume
194+
mountPath: /shared-buckets
195+
subPath: shared-buckets
196+
mountPropagation: Bidirectional
197+
- name: s3fs-volume
198+
mountPath: /triaged-jobs
199+
subPath: triaged-jobs
200+
mountPropagation: Bidirectional
88201
profileList:
89202
- display_name: Choose your environment and resources
90203
default: true

‎config/clusters/maap/prod.values.yaml‎

Lines changed: 217 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -5,45 +5,234 @@ userServiceAccount:
55
annotations:
66
eks.amazonaws.com/role-arn: arn:aws:iam::916098889494:role/maap-prod
77
jupyterhub:
8+
custom:
9+
2i2c:
10+
add_staff_user_ids_to_admin_users: false
11+
homepage:
12+
gitRepoBranch: master
13+
gitRepoUrl: https://github.com/MAAP-Project/maap-hub-homepage
814
singleuser:
915
extraEnv:
1016
SCRATCH_BUCKET: s3://maap-scratch-prod/$(JUPYTERHUB_USER)
17+
MAAP_API_HOST: api.maap-project.org
18+
DOCKERIMAGE_PATH_DEFAULT: mas.maap-project.org/root/maap-workspaces/custom_images/maap_base:v5.0.0
19+
DOCKERIMAGE_PATH_BASE_IMAGE: $(JUPYTER_IMAGE)
20+
WORKSPACE_BUCKET: maap-ops-workspace
1121
nodeSelector:
1222
2i2c/hub-name: prod
23+
# NOTE the only difference between profileList for staging and prod is the image tags
24+
# prod should always have the latest official release and staging has develop unless we are
25+
# actively doing a release in which case staging images point to our release tag
26+
profileList:
27+
- display_name: Choose your environment and resources
28+
default: true
29+
profile_options:
30+
image:
31+
display_name: Environment
32+
dynamic_image_building:
33+
enabled: true
34+
unlisted_choice:
35+
enabled: true
36+
display_name: Custom image
37+
validation_regex: ^.+:.+$
38+
validation_message: Must be a publicly available docker image, of form <image-name>:<tag>
39+
kubespawner_override:
40+
image: '{value}'
41+
choices:
42+
01-pangeo:
43+
display_name: Modified Pangeo Notebook
44+
description: Pangeo based notebook with a Python environment
45+
kubespawner_override:
46+
image: mas.maap-project.org/root/maap-workspaces/2i2c/pangeo:v5.0.0
47+
init_containers:
48+
- name: jupyterhub-gitpuller-init
49+
image: public.ecr.aws/nasa-veda/jupyterhub-gitpuller-init:97eb45f9d23b128aff810e45911857d5cffd05c2
50+
env:
51+
- name: TARGET_PATH
52+
value: veda-docs
53+
- name: SOURCE_REPO
54+
value: https://github.com/NASA-IMPACT/veda-docs
55+
volumeMounts:
56+
- name: home
57+
mountPath: /home/jovyan
58+
subPath: '{escaped_username}'
59+
securityContext:
60+
runAsUser: 1000
61+
runAsGroup: 1000
62+
02-rocker:
63+
display_name: Rocker Geospatial
64+
description: JupyterHub environment with many R geospatial libraries pre-installed
65+
kubespawner_override:
66+
image: mas.maap-project.org/root/maap-workspaces/2i2c/r:v5.0.0
67+
init_containers:
68+
- name: jupyterhub-gitpuller-init
69+
image: public.ecr.aws/nasa-veda/jupyterhub-gitpuller-init:97eb45f9d23b128aff810e45911857d5cffd05c2
70+
env:
71+
- name: TARGET_PATH
72+
value: veda-docs
73+
- name: SOURCE_REPO
74+
value: https://github.com/NASA-IMPACT/veda-docs
75+
volumeMounts:
76+
- name: home
77+
mountPath: /home/jovyan
78+
subPath: '{escaped_username}'
79+
securityContext:
80+
runAsUser: 1000
81+
runAsGroup: 1000
82+
03-isce3:
83+
display_name: isce3
84+
description: Pangeo based notebook with a Python environment and isce3
85+
kubespawner_override:
86+
image: mas.maap-project.org/root/maap-workspaces/2i2c/isce3:v5.0.0
87+
init_containers:
88+
- name: jupyterhub-gitpuller-init
89+
image: public.ecr.aws/nasa-veda/jupyterhub-gitpuller-init:97eb45f9d23b128aff810e45911857d5cffd05c2
90+
env:
91+
- name: TARGET_PATH
92+
value: veda-docs
93+
- name: SOURCE_REPO
94+
value: https://github.com/NASA-IMPACT/veda-docs
95+
volumeMounts:
96+
- name: home
97+
mountPath: /home/jovyan
98+
subPath: '{escaped_username}'
99+
securityContext:
100+
runAsUser: 1000
101+
runAsGroup: 1000
102+
04-qgis:
103+
display_name: QGIS on Linux Desktop
104+
description: Linux desktop in the browser, with qgis installed
105+
kubespawner_override:
106+
# Launch people directly into the Linux desktop when they start
107+
default_url: /desktop
108+
# Built from https://github.com/2i2c-org/nasa-qgis-image
109+
image: quay.io/2i2c/nasa-qgis-image:d76118ea0c15
110+
resource_allocation:
111+
display_name: Resource Allocation
112+
choices:
113+
mem_1_9:
114+
display_name: 1.9 GB RAM, upto 3.7 CPUs
115+
allowed_groups:
116+
- CPU:XS
117+
kubespawner_override:
118+
mem_guarantee: 1991244775
119+
mem_limit: 1991244775
120+
cpu_guarantee: 0.2328125
121+
cpu_limit: 3.725
122+
node_selector:
123+
node.kubernetes.io/instance-type: r5.xlarge
124+
mem_3_7:
125+
display_name: 3.7 GB RAM, upto 3.7 CPUs
126+
allowed_groups:
127+
- CPU:S
128+
kubespawner_override:
129+
mem_guarantee: 3982489550
130+
mem_limit: 3982489550
131+
cpu_guarantee: 0.465625
132+
cpu_limit: 3.725
133+
node_selector:
134+
node.kubernetes.io/instance-type: r5.xlarge
135+
mem_7_4:
136+
display_name: 7.4 GB RAM, upto 3.7 CPUs
137+
allowed_groups:
138+
- CPU:M
139+
kubespawner_override:
140+
mem_guarantee: 7964979101
141+
mem_limit: 7964979101
142+
cpu_guarantee: 0.93125
143+
cpu_limit: 3.725
144+
node_selector:
145+
node.kubernetes.io/instance-type: r5.xlarge
146+
mem_14_8:
147+
display_name: 14.8 GB RAM, upto 3.7 CPUs
148+
allowed_groups:
149+
- CPU:L
150+
kubespawner_override:
151+
mem_guarantee: 15929958203
152+
mem_limit: 15929958203
153+
cpu_guarantee: 1.8625
154+
cpu_limit: 3.725
155+
node_selector:
156+
node.kubernetes.io/instance-type: r5.xlarge
157+
default: true
158+
mem_29_7:
159+
display_name: 29.7 GB RAM, upto 3.7 CPUs
160+
allowed_groups:
161+
- CPU:XL
162+
kubespawner_override:
163+
mem_guarantee: 31859916406
164+
mem_limit: 31859916406
165+
cpu_guarantee: 3.725
166+
cpu_limit: 3.725
167+
node_selector:
168+
node.kubernetes.io/instance-type: r5.xlarge
169+
mem_60_6:
170+
display_name: 60.6 GB RAM, upto 15.6 CPUs
171+
allowed_groups:
172+
- CPU:XXL
173+
kubespawner_override:
174+
mem_guarantee: 65094448840
175+
mem_limit: 65094448840
176+
cpu_guarantee: 7.8475
177+
cpu_limit: 15.695
178+
node_selector:
179+
node.kubernetes.io/instance-type: r5.4xlarge
180+
mem_121_2:
181+
display_name: 121.2 GB RAM, upto 15.6 CPUs
182+
allowed_groups:
183+
- CPU:XXXL
184+
kubespawner_override:
185+
mem_guarantee: 130188897681
186+
mem_limit: 130188897681
187+
cpu_guarantee: 15.695
188+
cpu_limit: 15.695
189+
node_selector:
190+
node.kubernetes.io/instance-type: r5.4xlarge
191+
- display_name: NVIDIA Tesla T4, ~16 GB, ~4 CPUs
192+
description: Start a container on a dedicated node with a GPU
193+
slug: gpu
194+
allowed_groups:
195+
- GPU:T4
196+
profile_options:
197+
image:
198+
display_name: Environment
199+
dynamic_image_building:
200+
enabled: true
201+
unlisted_choice:
202+
enabled: true
203+
display_name: Custom image
204+
validation_regex: ^.+:.+$
205+
validation_message: Must be a publicly available docker image of form <image-name>:<tag>
206+
kubespawner_override:
207+
image: '{value}'
208+
choices:
209+
pytorch:
210+
display_name: Pangeo PyTorch ML Notebook
211+
default: false
212+
slug: pytorch
213+
kubespawner_override:
214+
image: quay.io/pangeo/pytorch-notebook:2024.11.11
215+
tensorflow2:
216+
display_name: Pangeo Tensorflow2 ML Notebook
217+
default: true
218+
slug: tensorflow2
219+
kubespawner_override:
220+
image: quay.io/pangeo/ml-notebook:2024.11.11
221+
kubespawner_override:
222+
environment:
223+
NVIDIA_DRIVER_CAPABILITIES: compute,utility
224+
mem_limit:
225+
mem_guarantee: 14G
226+
node_selector:
227+
node.kubernetes.io/instance-type: g4dn.xlarge
228+
extra_resource_limits:
229+
nvidia.com/gpu: '1'
13230
hub:
14231
config:
15-
JupyterHub:
16-
authenticator_class: generic-oauth
17-
Authenticator:
18-
admin_users: []
19232
GenericOAuthenticator:
20233
oauth_callback_url: https://hub.maap-project.org/hub/oauth_callback
21234
token_url: https://auth.openveda.cloud/realms/maap/protocol/openid-connect/token
22235
authorize_url: https://auth.openveda.cloud/realms/maap/protocol/openid-connect/auth
23-
# We want to get user data from the JWT that's the id token,
24-
# not from a separate userdata API call
25-
userdata_from_id_token: true
26-
scope:
27-
- basic
28-
- profile
29-
- openid
30-
username_claim: preferred_username
31-
manage_groups: true
32-
auth_state_groups_key: oauth_user.roles
33-
admin_groups:
34-
- Admin
35-
# Being granted *any* jupyterhub related role should allow you
36-
# to login
37-
allowed_groups:
38-
- Admin
39-
- CPU:XS
40-
- CPU:S
41-
- CPU:M
42-
- CPU:L
43-
- CPU:XL
44-
- CPU:XXL
45-
- CPU:XXXL
46-
- GPU:T4
47236
ingress:
48237
hosts: [hub.maap-project.org]
49238
tls:

0 commit comments

Comments
 (0)