From 4845f4a0ba8936a6bb35bf419ae9ddac30eb4397 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Fri, 23 Apr 2021 09:09:06 +0200 Subject: [PATCH] [bitnami/jupyterhub] Add chart (#5992) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [bitnami/jupyterhub] Add chart * Fix image * Improve message * Improve network policies * Add link * More changes * Change image * Update readme * Update bitnami/jupyterhub/README.md Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/README.md Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/deployment.yaml Co-authored-by: Juan Ariza Toledano * Apply changes * fix namespace * Update bitnami/jupyterhub/values.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/secret.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/NOTES.txt Co-authored-by: Juan Ariza Toledano * Requested changes * Update readme * add changes * Update bitnami/jupyterhub/templates/NOTES.txt Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/_helpers.tpl Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/_helpers.tpl Co-authored-by: Juan Ariza Toledano * Required changes * Update bitnami/jupyterhub/templates/hub/configmap.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/deployment.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/networkpolicy.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/pdb.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/pdb.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/service-public.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/singleuser/networkpolicy.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/service-api.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/tls-secret.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/role.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/deployment.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/image-puller/daemonset.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/rolebinding.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/secret.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/service.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/hub/externaldb-secrets.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/deployment.yaml Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/networkpolicy.yaml Co-authored-by: Juan Ariza Toledano * More changes * Add container security context * Update bitnami/jupyterhub/README.md Co-authored-by: Juan Ariza Toledano * Update bitnami/jupyterhub/templates/proxy/tls-secret.yaml Co-authored-by: Juan Ariza Toledano * Update daemonset.yaml Change the name of the pull image because it exceed the length and got truncated in the testing. * Comment the global block in values.yaml * [bitnami/jupyterhub] Update components versions Signed-off-by: Bitnami Containers Co-authored-by: Juan Ariza Toledano Co-authored-by: Rafael Ríos Saavedra Co-authored-by: Bitnami Containers --- bitnami/jupyterhub/Chart.lock | 9 + bitnami/jupyterhub/Chart.yaml | 29 + bitnami/jupyterhub/README.md | 589 ++++++ bitnami/jupyterhub/templates/NOTES.txt | 64 + bitnami/jupyterhub/templates/_helpers.tpl | 160 ++ bitnami/jupyterhub/templates/extra-list.yaml | 4 + .../jupyterhub/templates/hub/configmap.yaml | 505 +++++ .../jupyterhub/templates/hub/deployment.yaml | 253 +++ .../templates/hub/externaldb-secrets.yaml | 18 + .../templates/hub/networkpolicy.yaml | 70 + bitnami/jupyterhub/templates/hub/pdb.yaml | 19 + bitnami/jupyterhub/templates/hub/role.yaml | 22 + .../jupyterhub/templates/hub/rolebinding.yaml | 20 + bitnami/jupyterhub/templates/hub/secret.yaml | 19 + .../templates/hub/service-account.yaml | 16 + bitnami/jupyterhub/templates/hub/service.yaml | 36 + .../templates/image-puller/daemonset.yaml | 125 ++ .../templates/proxy/deployment.yaml | 166 ++ .../jupyterhub/templates/proxy/ingress.yaml | 61 + .../templates/proxy/networkpolicy.yaml | 65 + bitnami/jupyterhub/templates/proxy/pdb.yaml | 18 + .../templates/proxy/service-api.yaml | 36 + .../templates/proxy/service-public.yaml | 36 + .../templates/proxy/tls-secret.yaml | 45 + .../templates/singleuser/networkpolicy.yaml | 71 + .../templates/singleuser/service-account.yaml | 16 + bitnami/jupyterhub/values.yaml | 1656 +++++++++++++++++ 27 files changed, 4128 insertions(+) create mode 100644 bitnami/jupyterhub/Chart.lock create mode 100644 bitnami/jupyterhub/Chart.yaml create mode 100644 bitnami/jupyterhub/README.md create mode 100644 bitnami/jupyterhub/templates/NOTES.txt create mode 100644 bitnami/jupyterhub/templates/_helpers.tpl create mode 100644 bitnami/jupyterhub/templates/extra-list.yaml create mode 100644 bitnami/jupyterhub/templates/hub/configmap.yaml create mode 100644 bitnami/jupyterhub/templates/hub/deployment.yaml create mode 100644 bitnami/jupyterhub/templates/hub/externaldb-secrets.yaml create mode 100644 bitnami/jupyterhub/templates/hub/networkpolicy.yaml create mode 100644 bitnami/jupyterhub/templates/hub/pdb.yaml create mode 100644 bitnami/jupyterhub/templates/hub/role.yaml create mode 100644 bitnami/jupyterhub/templates/hub/rolebinding.yaml create mode 100644 bitnami/jupyterhub/templates/hub/secret.yaml create mode 100644 bitnami/jupyterhub/templates/hub/service-account.yaml create mode 100644 bitnami/jupyterhub/templates/hub/service.yaml create mode 100644 bitnami/jupyterhub/templates/image-puller/daemonset.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/deployment.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/ingress.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/networkpolicy.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/pdb.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/service-api.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/service-public.yaml create mode 100644 bitnami/jupyterhub/templates/proxy/tls-secret.yaml create mode 100644 bitnami/jupyterhub/templates/singleuser/networkpolicy.yaml create mode 100644 bitnami/jupyterhub/templates/singleuser/service-account.yaml create mode 100644 bitnami/jupyterhub/values.yaml diff --git a/bitnami/jupyterhub/Chart.lock b/bitnami/jupyterhub/Chart.lock new file mode 100644 index 000000000..41e7b9daa --- /dev/null +++ b/bitnami/jupyterhub/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: common + repository: https://charts.bitnami.com/bitnami + version: 1.4.2 +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 10.3.18 +digest: sha256:1b990faa7c91a2d451e4aaa0c9981db82b69ca1ab88d7d19e1485ad12125674b +generated: "2021-04-23T06:41:12.258879244Z" diff --git a/bitnami/jupyterhub/Chart.yaml b/bitnami/jupyterhub/Chart.yaml new file mode 100644 index 000000000..916c12fa5 --- /dev/null +++ b/bitnami/jupyterhub/Chart.yaml @@ -0,0 +1,29 @@ +annotations: + category: MachineLearning +apiVersion: v2 +appVersion: 1.4.0 +dependencies: + - name: common + repository: https://charts.bitnami.com/bitnami + tags: + - bitnami-common + version: 1.x.x + - name: postgresql + repository: https://charts.bitnami.com/bitnami + condition: postgresql.enabled + version: 10.x.x +description: JupyterHub brings the power of notebooks to groups of users. It gives users access to computational environments and resources without burdening the users with installation and maintenance tasks +engine: gotpl +home: https://jupyter.org/hub +icon: https://bitnami.com/assets/stacks/jupyterhub/img/jupyterhub-stack-220x234.png +keywords: + - python + - scientific +maintainers: + - email: containers@bitnami.com + name: Bitnami +name: jupyterhub +sources: + - https://github.com/bitnami/bitnami-docker-jupyterhub + - https://github.com/jupyterhub/jupyterhub +version: 0.1.0 diff --git a/bitnami/jupyterhub/README.md b/bitnami/jupyterhub/README.md new file mode 100644 index 000000000..29e5080af --- /dev/null +++ b/bitnami/jupyterhub/README.md @@ -0,0 +1,589 @@ +# JupyterHub + +[JupyterHub](https://github.com/jupyterhub/jupyterhub) is a multi-user version of the notebook designed for companies, classrooms and research labs. + +## TL;DR + +```console +$ helm repo add bitnami https://charts.bitnami.com/bitnami +$ helm install my-release bitnami/jupyterhub +``` + +## Introduction + +Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads. + +This chart bootstraps a [JupyterHub](https://github.com/jupyterhub/jupyterhub) Deployment in a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. + +## Prerequisites + +- Kubernetes 1.12+ +- Helm 3.1.0 +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm repo add bitnami https://charts.bitnami.com/bitnami +$ helm install my-release bitnami/jupyterhub +``` + +These commands deploy JupyterHub on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` helm release: + +```console +$ helm uninstall my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Overview of JupyterHub + +This chart deploys three basic elements: + +- JupyterHub: Central element of the chart. Manages authentication and is responsible for creating the Jupyter Notebook instances (called Single User instances). As a consequence, the Hub requires special RBAC privileges in order to access the Kubernetes API to create and manage Deployments. +- Proxy: This is the external endpoint for users. It manages the communication with the Hub and the Single User instances. +- Image Puller: In order to improve the Single User instance boot time, a DaemonSet object is deployed that pre-pulls all the necessary images to run the Single User Notebooks. + +The following diagram shows a deployed release of the chart: + +``` + │ + │ + │ + │ + ┌────────────────┐ │ + │ │ │ + │ Image Puller │◄──────Pull images to─────┘ + │ │ all nodes + └────────────────┘ + + ┌───────────┐ ┌─────────────┐ + │ │ │ │ + │ Proxy ├──────────►│ Hub │ + │ │ │ │ + └───────────┘ └─────────────┘ +``` + +After accessing the hub and creating a Single User instance, the deployment looks as follows: + +``` + │ + │ + │ + │ + ┌────────────────┐ │ + │ │ │ + │ Image Puller │◄──────Pull images to─────┘ + │ │ all nodes + └────────────────┘ + + ┌───────────┐ ┌─────────────┐ + │ │ │ │ + │ Proxy ├──────────►│ Hub │ + │ │ │ │ + └────┬──────┘ └───────┬─────┘ + │ │ + │ │ + │ │ + │ ┌─────────────┐ │ + │ │ Single User │ │ + └────►│ Instance │◄─────┘ + └─────────────┘ +``` + +For more information, check the official [JupyterHub documentation](https://github.com/jupyterhub/jupyterhub). + +## Parameters + +The following table lists the configurable parameters of the JupyterHub chart and their default values per section/component: + +### Global parameters + +| Name | Description | Value | +|---------------------------|-------------------------------------------------|-------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | + +### Common parameters + +| Name | Description | Value | +|---------------------|----------------------------------------------------|-------| +| `kubeVersion` | Override Kubernetes version | `nil` | +| `nameOverride` | String to partially override common.names.fullname | `nil` | +| `fullnameOverride` | String to fully override common.names.fullname | `nil` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | + +### Hub deployment parameters + +| Name | Description | Value | +|---------------------------------------------|-------------------------------------------------------------------------------------------|----------------------| +| `hub.image.registry` | Hub image registry | `docker.io` | +| `hub.image.repository` | Hub image repository | `jupyterhub/k8s-hub` | +| `hub.image.tag` | Hub image tag (immutabe tags are recommended) | `0.11.1` | +| `hub.image.pullPolicy` | Hub image pull policy | `IfNotPresent` | +| `hub.image.pullSecrets` | Hub image pull secrets | `[]` | +| `hub.startupProbe.enabled` | Enable startupProbe | `true` | +| `hub.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `hub.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `hub.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `3` | +| `hub.startupProbe.failureThreshold` | Failure threshold for startupProbe | `30` | +| `hub.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `hub.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `hub.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `hub.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `hub.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `3` | +| `hub.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `30` | +| `hub.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `hub.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `hub.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `hub.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `hub.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `3` | +| `hub.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `30` | +| `hub.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `hub.baseUrl` | Hub base URL | `/` | +| `hub.adminUser` | Hub Dummy authenticator admin user | `user` | +| `hub.password` | Hub Dummy authenticator password | `nil` | +| `hub.configuration` | Hub configuration file (to be used by jupyterhub_config.py) | `{}` | +| `hub.containerPort` | Hub container port | `8081` | +| `hub.existingConfigmap` | Configmap with Hub init scripts (replaces the scripts in templates/hub/configmap.yml) | `nil` | +| `hub.existingSecret` | Secret with hub configuration (replaces the hub.configuration value) and proxy token | `nil` | +| `hub.command` | Override Hub default command | `[]` | +| `hub.args` | Override Hub default args | `[]` | +| `hub.pdb.create` | Deploy Hub PodDisruptionBudget | `false` | +| `hub.pdb.minAvailable` | Set minimum available hub instances | `nil` | +| `hub.pdb.maxUnavailable` | Set maximum available hub instances | `nil` | +| `hub.priorityClassName` | Hub pod priority class name | `nil` | +| `hub.hostAliases` | Add deployment host aliases | `[]` | +| `hub.resources.limits` | The resources limits for the Hub container | `{}` | +| `hub.resources.requests` | The requested resources for the Hub container | `{}` | +| `hub.containerSecurityContext.enabled` | Enabled Hub containers' Security Context | `true` | +| `hub.containerSecurityContext.runAsUser` | Set Hub container's Security Context runAsUser | `1000` | +| `hub.containerSecurityContext.runAsNonRoot` | Set Hub container's Security Context runAsNonRoot | `true` | +| `hub.podSecurityContext.enabled` | Enabled Hub pods' Security Context | `true` | +| `hub.podSecurityContext.fsGroup` | Set Hub pod's Security Context fsGroup | `1001` | +| `hub.podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `hub.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `hub.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `hub.nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set | `""` | +| `hub.nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set | `[]` | +| `hub.affinity` | Affinity for pod assignment | `{}` | +| `hub.nodeSelector` | Node labels for pod assignment | `{}` | +| `hub.tolerations` | Tolerations for pod assignment | `[]` | +| `hub.podLabels` | Extra labels for Hub pods | `{}` | +| `hub.podAnnotations` | Annotations for Hub pods | `{}` | +| `hub.lifecycleHooks` | Add lifecycle hooks to the Hub deployment | `{}` | +| `hub.customStartupProbe` | Override default startup probe | `{}` | +| `hub.customLivenessProbe` | Override default liveness probe | `{}` | +| `hub.customReadinessProbe` | Override default readiness probe | `{}` | +| `hub.updateStrategy.type` | Hub deployment update strategy | `RollingUpdate` | +| `hub.extraEnvVars` | Add extra environment variables to the Hub container | `[]` | +| `hub.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `nil` | +| `hub.extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `nil` | +| `hub.extraVolumes` | Optionally specify extra list of additional volumes for Hub pods | `[]` | +| `hub.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Hub container(s) | `[]` | +| `hub.initContainers` | Add additional init containers to the Hub pods | `{}` | +| `hub.sidecars` | Add additional sidecar containers to the Hub pod | `{}` | + +### Hub RBAC parameters + +| Name | Description | Value | +|-----------------------------|-----------------------------------------------|--------| +| `hub.serviceAccount.create` | Create Hub service account | `true` | +| `hub.serviceAccount.name` | Override Hub service account name | `nil` | +| `hub.rbac.create` | Create RBAC rules for the Hub service account | `true` | + +### Hub Traffic Exposure Parameters + +| Name | Description | Value | +|-------------------------------------------|----------------------------------------------------------|-------------| +| `hub.networkPolicy.enabled` | Deploy Hub network policies | `true` | +| `hub.networkPolicy.allowInterspaceAccess` | Allow communication between pods in different namespaces | `true` | +| `hub.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `hub.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `{}` | +| `hub.service.type` | Hub service type | `ClusterIP` | +| `hub.service.port` | Hub service port | `8081` | +| `hub.service.loadBalancerIP` | Hub service LoadBalancer IP | `nil` | +| `hub.service.loadBalancerSourceRanges` | loadBalancerIP source ranges for the Service | `[]` | +| `hub.service.nodePorts.http` | NodePort for the HTTP endpoint | `""` | +| `hub.service.externalTrafficPolicy` | External traffic policy for the service | `Cluster` | + +### Proxy deployment parameters + +| Name | Description | Value | +|-----------------------------------------------|-------------------------------------------------------------------------------------------|-----------------------------------| +| `proxy.image.registry` | Proxy image registry | `docker.io` | +| `proxy.image.repository` | Proxy image repository | `bitnami/configurable-http-proxy` | +| `proxy.image.tag` | Proxy image tag (immutabe tags are recommended) | `4.3.1-debian-10-r0` | +| `proxy.image.pullPolicy` | Proxy image pull policy | `IfNotPresent` | +| `proxy.image.pullSecrets` | Proxy image pull secrets | `[]` | +| `proxy.image.debug` | Activate verbose output | `false` | +| `proxy.startupProbe.enabled` | Enable startupProbe | `true` | +| `proxy.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `proxy.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `proxy.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `3` | +| `proxy.startupProbe.failureThreshold` | Failure threshold for startupProbe | `30` | +| `proxy.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `proxy.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `proxy.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `proxy.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `proxy.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `3` | +| `proxy.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `30` | +| `proxy.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `proxy.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `proxy.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `proxy.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `proxy.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `3` | +| `proxy.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `30` | +| `proxy.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `proxy.command` | Override Proxy default command | `[]` | +| `proxy.args` | Override Proxy default args | `[]` | +| `proxy.secretToken` | Proxy secret token (used for communication with the Hub) | `nil` | +| `proxy.hostAliases` | Add deployment host aliases | `[]` | +| `proxy.pdb.create` | Deploy Proxy PodDisruptionBudget | `false` | +| `proxy.pdb.minAvailable` | Set minimum available proxy instances | `nil` | +| `proxy.pdb.maxUnavailable` | Set maximum available proxy instances | `nil` | +| `proxy.containerPort.api` | Proxy api container port | `8001` | +| `proxy.containerPort.http` | Proxy http container port | `8000` | +| `proxy.priorityClassName` | Proxy pod priority class name | `nil` | +| `proxy.resources.limits` | The resources limits for the Proxy container | `{}` | +| `proxy.resources.requests` | The requested resources for the Proxy container | `{}` | +| `proxy.containerSecurityContext.enabled` | Enabled Proxy containers' Security Context | `true` | +| `proxy.containerSecurityContext.runAsUser` | Set Proxy container's Security Context runAsUser | `1001` | +| `proxy.containerSecurityContext.runAsNonRoot` | Set Proxy container's Security Context runAsNonRoot | `true` | +| `proxy.podSecurityContext.enabled` | Enabled Proxy pods' Security Context | `true` | +| `proxy.podSecurityContext.fsGroup` | Set Proxy pod's Security Context fsGroup | `1001` | +| `proxy.podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `proxy.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `proxy.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `proxy.nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set | `""` | +| `proxy.nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set | `[]` | +| `proxy.affinity` | Affinity for pod assignment | `{}` | +| `proxy.nodeSelector` | Node labels for pod assignment | `{}` | +| `proxy.tolerations` | Tolerations for pod assignment | `[]` | +| `proxy.podLabels` | Extra labels for Proxy pods | `{}` | +| `proxy.podAnnotations` | Annotations for Proxy pods | `{}` | +| `proxy.lifecycleHooks` | Add lifecycle hooks to the Proxy deployment | `{}` | +| `proxy.customStartupProbe` | Override default startup probe | `{}` | +| `proxy.customLivenessProbe` | Override default liveness probe | `{}` | +| `proxy.customReadinessProbe` | Override default readiness probe | `{}` | +| `proxy.updateStrategy.type` | Proxy deployment update strategy | `RollingUpdate` | +| `proxy.extraEnvVars` | Add extra environment variables to the Proxy container | `[]` | +| `proxy.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `nil` | +| `proxy.extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `nil` | +| `proxy.extraVolumes` | Optionally specify extra list of additional volumes for Proxy pods | `[]` | +| `proxy.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Proxy container(s) | `[]` | +| `proxy.initContainers` | Add additional init containers to the Proxy pods | `{}` | +| `proxy.sidecars` | Add additional sidecar containers to the Proxy pod | `{}` | + +### Proxy Traffic Exposure Parameters + +| Name | Description | Value | +|-------------------------------------------------|-------------------------------------------------------------------------------------|--------------------------| +| `proxy.networkPolicy.enabled` | Deploy Proxy network policies | `true` | +| `proxy.networkPolicy.allowInterspaceAccess` | Allow communication between pods in different namespaces | `true` | +| `proxy.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `{}` | +| `proxy.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `nil` | +| `proxy.service.api.type` | API service type | `ClusterIP` | +| `proxy.service.api.port` | API service port | `8001` | +| `proxy.service.api.loadBalancerIP` | API service LoadBalancer IP | `nil` | +| `proxy.service.api.loadBalancerSourceRanges` | loadBalancerIP source ranges for the Service | `[]` | +| `proxy.service.api.nodePorts.http` | NodePort for the HTTP endpoint | `""` | +| `proxy.service.api.externalTrafficPolicy` | External traffic policy for the service | `Cluster` | +| `proxy.service.public.type` | Public service type | `LoadBalancer` | +| `proxy.service.public.port` | Public service port | `80` | +| `proxy.service.public.loadBalancerIP` | Public service LoadBalancer IP | `nil` | +| `proxy.service.public.loadBalancerSourceRanges` | loadBalancerIP source ranges for the Service | `[]` | +| `proxy.service.public.nodePorts.http` | NodePort for the HTTP endpoint | `""` | +| `proxy.service.public.externalTrafficPolicy` | External traffic policy for the service | `Cluster` | +| `proxy.ingress.enabled` | Enable ingress for the Public service | `false` | +| `proxy.ingress.path` | Path to the Proxy pod. | `/` | +| `proxy.ingress.pathType` | Ingress path type | `ImplementationSpecific` | +| `proxy.ingress.certManager` | Add cert-manager annotations to the Ingress object | `false` | +| `proxy.ingress.hostname` | Set ingress rule hostname | `jupyterhub.local` | +| `proxy.ingress.annotations` | Add annotations to the Ingress object | `{}` | +| `proxy.ingress.tls` | Enable ingress tls configuration for the hostname defined at proxy.ingress.hostname | `false` | +| `proxy.ingress.extraHosts` | Add extra hosts to the ingress rule | `[]` | +| `proxy.ingress.extraTls` | Add extra tls configuration for additional hostnames | `[]` | +| `proxy.ingress.extraPaths` | Add extra paths to the ingress rule | `[]` | +| `proxy.ingress.secrets` | Add extra secrets for the tls configuration | `[]` | + +### Image puller deployment parameters + +| Name | Description | Value | +|-----------------------------------------------------|-------------------------------------------------------------------------------------------|-----------------| +| `imagePuller.enabled` | Deploy ImagePuller daemonset | `true` | +| `imagePuller.command` | Override ImagePuller default command | `[]` | +| `imagePuller.args` | Override ImagePuller default args | `[]` | +| `imagePuller.hostAliases` | Add deployment host aliases | `[]` | +| `imagePuller.resources.limits` | The resources limits for the ImagePuller container | `{}` | +| `imagePuller.resources.requests` | The resources request for the ImagePuller container | `{}` | +| `imagePuller.containerSecurityContext.enabled` | Enabled ImagePuller containers' Security Context | `true` | +| `imagePuller.containerSecurityContext.runAsUser` | Set ImagePuller container's Security Context runAsUser | `1001` | +| `imagePuller.containerSecurityContext.runAsNonRoot` | Set ImagePuller container's Security Context runAsNonRoot | `true` | +| `imagePuller.podSecurityContext.enabled` | Enabled ImagePuller pods' Security Context | `true` | +| `imagePuller.podSecurityContext.fsGroup` | Set ImagePuller pod's Security Context fsGroup | `1001` | +| `imagePuller.podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `imagePuller.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `imagePuller.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `imagePuller.nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set | `""` | +| `imagePuller.nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set | `[]` | +| `imagePuller.affinity` | Affinity for pod assignment | `{}` | +| `imagePuller.nodeSelector` | Node labels for pod assignment | `{}` | +| `imagePuller.tolerations` | Tolerations for pod assignment | `[]` | +| `imagePuller.podLabels` | Extra labels for ImagePuller pods | `{}` | +| `imagePuller.podAnnotations` | Annotations for ImagePuller pods | `{}` | +| `imagePuller.priorityClassName` | ImagePuller pod priority class name | `""` | +| `imagePuller.lifecycleHooks` | Add lifecycle hooks to the ImagePuller deployment | `{}` | +| `imagePuller.customStartupProbe` | Override default startup probe | `{}` | +| `imagePuller.customLivenessProbe` | Override default liveness probe | `{}` | +| `imagePuller.customReadinessProbe` | Override default readiness probe | `{}` | +| `imagePuller.updateStrategy.type` | ImagePuller deployment update strategy | `RollingUpdate` | +| `imagePuller.extraEnvVars` | Add extra environment variables to the ImagePuller container | `[]` | +| `imagePuller.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `nil` | +| `imagePuller.extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `nil` | +| `imagePuller.extraVolumes` | Optionally specify extra list of additional volumes for ImagePuller pods | `[]` | +| `imagePuller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for ImagePuller container(s) | `[]` | +| `imagePuller.initContainers` | Add additional init containers to the ImagePuller pods | `{}` | +| `imagePuller.sidecars` | Add additional sidecar containers to the ImagePuller pod | `{}` | + +### Singleuser deployment parameters + +| Name | Description | Value | +|-------------------------------------------------|---------------------------------------------------------------------------------------|--------------------------------------| +| `singleuser.image.registry` | Single User image registry | `docker.io` | +| `singleuser.image.repository` | Single User image repository | `bitnami/jupyter-base-notebook` | +| `singleuser.image.tag` | Single User image tag (immutabe tags are recommended) | `1.3.0-debian-10-r2` | +| `singleuser.image.pullPolicy` | Single User image pull policy | `IfNotPresent` | +| `singleuser.image.pullSecrets` | Single User image pull secrets | `[]` | +| `singleuser.command` | Override Single User default command | `[]` | +| `singleuser.tolerations` | Tolerations for pod assignment | `[]` | +| `singleuser.containerPort` | Single User container port | `8888` | +| `singleuser.notebookDir` | Notebook directory (it will be the same as the PVC volume mount) | `/opt/bitnami/jupyterhub-singleuser` | +| `singleuser.resources.limits` | The resources limits for the Single User container | `{}` | +| `singleuser.resources.requests` | The requested resources for the Single User container | `{}` | +| `singleuser.containerSecurityContext.enabled` | Enabled Single User containers' Security Context | `true` | +| `singleuser.containerSecurityContext.runAsUser` | Set Single User container's Security Context runAsUser | `1001` | +| `singleuser.podSecurityContext.enabled` | Enabled Single User pods' Security Context | `true` | +| `singleuser.podSecurityContext.fsGroup` | Set Single User pod's Security Context fsGroup | `1001` | +| `singleuser.nodeSelector` | Node labels for pod assignment | `{}` | +| `singleuser.podLabels` | Extra labels for Single User pods | `{}` | +| `singleuser.podAnnotations` | Annotations for Single User pods | `{}` | +| `singleuser.priorityClassName` | Single User pod priority class name | `nil` | +| `singleuser.lifecycleHooks` | Add lifecycle hooks to the Single User deployment | `{}` | +| `singleuser.extraEnvVars` | Add extra environment variables to the Single User container | `[]` | +| `singleuser.extraVolumes` | Optionally specify extra list of additional volumes for Single User pods | `[]` | +| `singleuser.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Single User container(s) | `[]` | +| `singleuser.initContainers` | Add additional init containers to the Single User pods | `{}` | +| `singleuser.sidecars` | Add additional sidecar containers to the Single User pod | `{}` | + +### Single User RBAC parameters + +| Name | Description | Value | +|------------------------------------|-------------------------------------------|--------| +| `singleuser.serviceAccount.create` | Create Single User service account | `true` | +| `singleuser.serviceAccount.name` | Override Single User service account name | `nil` | + +### Single User Persistence parameters + +| Name | Description | Value | +|-----------------------------------------|------------------------------------------------------------|-------------| +| `singleuser.persistence.enabled` | Enable persistent volume creation on Single User instances | `true` | +| `singleuser.persistence.storageClass` | Persistent Volumes storage class | `""` | +| `singleuser.persistence.accessModes[0]` | Persistent Volumes access modes | `undefined` | +| `singleuser.persistence.size` | Persistent Volumes size | `10Gi` | + +### Traffic exposure parameters + +| Name | Description | Value | +|-----------------------------------------------------|----------------------------------------------------------|---------| +| `singleuser.networkPolicy.enabled` | Deploy Single User network policies | `true` | +| `singleuser.networkPolicy.allowInterspaceAccess` | Allow communication between pods in different namespaces | `true` | +| `singleuser.networkPolicy.allowCloudMetadataAccess` | Allow Single User pods to access Cloud Metada endpoints | `false` | +| `singleuser.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `nil` | +| `singleuser.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `nil` | + +### Auxiliary image parameters + +| Name | Description | Value | +|------------------------------|-----------------------------------------------------|-------------------------| +| `auxiliaryImage.registry` | Auxiliary image registry | `docker.io` | +| `auxiliaryImage.repository` | Auxiliary image repository | `bitnami/bitnami-shell` | +| `auxiliaryImage.tag` | Auxiliary image tag (immutabe tags are recommended) | `10` | +| `auxiliaryImage.pullPolicy` | Auxiliary image pull policy | `Always` | +| `auxiliaryImage.pullSecrets` | Auxiliary image pull secrets | `[]` | + +### External Database settings + +| Name | Description | Value | +|-----------------------------------|-----------------------------------------------------------------------------------------------------------------|--------------| +| `externalDatabase.host` | Host of an external PostgreSQL instance to connect (only if postgresql.enabled=false) | `nil` | +| `externalDatabase.user` | User of an external PostgreSQL instance to connect (only if postgresql.enabled=false) | `postgres` | +| `externalDatabase.password` | Password of an external PostgreSQL instance to connect (only if postgresql.enabled=false) | `""` | +| `externalDatabase.existingSecret` | Secret containing the password of an external PostgreSQL instance to connect (only if postgresql.enabled=false) | `""` | +| `externalDatabase.database` | Database inside an external PostgreSQL to connect (only if postgresql.enabled=false) | `jupyterhub` | +| `externalDatabase.port` | Port of an external PostgreSQL to connect (only if postgresql.enabled=false) | `5432` | + +### PostgreSQL subchart settings + +| Name | Description | Value | +|----------------------------------------|------------------------------------------------------------------------------------|----------------------| +| `postgresql.enabled` | Deploy PostgreSQL subchart | `true` | +| `postgresql.nameOverride` | Override name of the PostgreSQL chart | `nil` | +| `postgresql.existingSecret` | Existing secret containing the password of the PostgreSQL chart | `nil` | +| `postgresql.postgresqlPassword` | Password for the postgres user of the PostgreSQL chart (auto-generated if not set) | `""` | +| `postgresql.postgresqlUsername` | Username to create when deploying the PostgreSQL chart | `bn_jupyterhub` | +| `postgresql.postgresqlDatabase` | Database to create when deploying the PostgreSQL chart | `bitnami_jupyterhub` | +| `postgresql.service.port` | PostgreSQL service port | `5432` | +| `postgresql.persistence.enabled` | Use PVCs when deploying the PostgreSQL chart | `true` | +| `postgresql.persistence.existingClaim` | Use an existing PVC when deploying the PostgreSQL chart | `nil` | +| `postgresql.persistence.storageClass` | storageClass of the created PVCs | `nil` | +| `postgresql.persistence.accessMode` | Access mode of the created PVCs | `ReadWriteOnce` | +| `postgresql.persistence.size` | Size of the created PVCs | `8Gi` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release \ + --set proxy.livenessProbe.successThreshold=5 \ + bitnami/jupyterhub +``` + +The above command sets the `proxy.livenessProbe.successThreshold` to `5`. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```bash +$ helm install my-release -f values.yaml bitnami/jupyterhub +``` + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Authenticator + +The chart configures the Hub [DummyAuthenticator](https://github.com/jupyterhub/dummyauthenticator) by default, with the password set in the `hub.password` (auto-generated if not set) and `user` as the administrator user. In order to change the authentication mechanism change the `hub.config.JupyterHub` section inside the `hub.configuration` value. The following example sets the [NativeAuthenticator](https://github.com/jupyterhub/nativeauthenticator) authenticator, and configures an admin user called `test`. + +```yaml +hub: + configuration: | + ... + hub: + config: + JupyterHub: + admin_access: true + authenticator_class: nativeauthenticator.NativeAuthenticator + Authenticator: + admin_users: + - test + ... +``` + +When deploying, you will need to Sign Up to set the password for the `test` user. For more information on Authenticators, check the [official JupyterHub documentation](https://jupyterhub.readthedocs.io/en/stable/getting-started/authenticators-users-basics.html). + +### Configuring the Single User instances + +As mentioned in the section [Overview of JupyterHub](#overview-of-jupyter-hub), the Hub is responsible for deploying the Single User instances. The configuration of these instances is passed to the Hub instance via the `hub.configuration` value. In order to make the chart follow Bitnami standards and to ease the generation of this configuration file, the chart has a `singleuser` section, which is then used for generating the `hub.configuration` value. The `hub.configuration` value can be easily overridden via modifying its default value or by providing a secret in the `hub.existingSecret` value. In that case, all the settings in the `singleuser` section will be ignored. + +All the settings specified in the `hub.configuration` value are consumed by the `jupyter_config.py` script available in the `templates/hub/configmap.yaml` file. This script can be changed by providing a ConfigMap in the `hub.existingConfigmap` value. Find in the [official JupyterHub documentation](https://jupyterhub.readthedocs.io/en/stable/reference/config-examples.html) more examples of the `jupyter_config.py` script. + +### Restricting traffic using NetworkPolicies + +The Bitnami JupyterHub chart enables NetworkPolicies by default. These restricts the communication between the three main components: the Proxy, the Hub and the Single User instances. There are two elements that were left open on purpose: + +- Ingress access to the Proxy instance HTTP port: by default, it is open to any IP, as it is the entry point to the JupyterHub instance. This behavior can be changed by tweaking the `proxy.networkPolicy.extraIngress` value. +- Hub egress access: As the Hub requires access to the Kubernetes API, the Hub can access to any IP by default (depending on the Kubernetes platform, the Service IP ranges can vary and so there is no easy way to detect the Kubernetes API internal IP). This behavior can be changed by tweaking the `hub.networkPolicy.extraEgress` value. + +### Sidecars and Init Containers + +If you have a need for additional containers to run within the same pod as the JupyterHub container, the Proxy container or the Single User container (e.g. an additional metrics or logging exporter), you can do so via the `proxy.sidecars`, `hub.sidecars` or `singleuser.sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +hub: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +Similarly, you can add extra init containers using the `hub.initContainers`, `proxy.initContainers` and `singleuser.initContainers` parameters. + +```yaml +hub: + initContainers: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Ingress + +This chart provides support for ingress resources for the JupyterHub proxy component. If you have an ingress controller installed on your cluster, such as [nginx-ingress-controller](https://github.com/bitnami/charts/tree/master/bitnami/nginx-ingress-controller) or [contour](https://github.com/bitnami/charts/tree/master/bitnami/contour) you can utilize the ingress controller to serve your application. + +To enable ingress integration, please set `proxy.ingress.enabled` to `true`. + +#### Hosts + +Most likely you will only want to have one hostname that maps to this JupyterHub installation. If that's your case, the property `proxy.ingress.hostname` will set it. However, it is possible to have more than one host. To facilitate this, the `proxy.ingress.extraHosts` object can be specified as an array. You can also use `proxy.ingress.extraTLS` to add the TLS configuration for extra hosts. + +For each host indicated at `proxy.ingress.extraHosts`, please indicate a `name`, `path`, and any `annotations` that you may want the ingress controller to know about. + +For annotations, please see [this document](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md). Not all annotations are supported by all ingress controllers, but this document does a good job of indicating which annotation is supported by many popular ingress controllers. + +### TLS Secrets + +This chart will facilitate the creation of TLS secrets for use with the ingress controller, however, this is not required. There are four common use cases: + +- Helm generates/manages certificate secrets based on the parameters. +- User generates/manages certificates separately. +- Helm creates self-signed certificates and generates/manages certificate secrets. +- An additional tool (like [cert-manager](https://github.com/jetstack/cert-manager/)) manages the secrets for the application. + +In the first two cases, it's needed a certificate and a key. Files are expected in PEM format. + +- If you are going to use Helm to manage the certificates based on the parameters, please copy these values into the `certificate` and `key` values for a given `proxy.ingress.secrets` entry. +- In case you are going to manage TLS secrets separately, please know that you must create a TLS secret with name *INGRESS_HOSTNAME-tls* (where *INGRESS_HOSTNAME* is a placeholder to be replaced with the hostname you set using the `proxy.ingress.hostname` parameter). +- To use self-signed certificates created by Helm, set `proxy.ingress.tls` to `true`, and `proxy.ingress.certManager` to `false`. +- If your cluster has a [cert-manager](https://github.com/jetstack/cert-manager) add-on to automate the management and issuance of TLS certificates, set `proxy.ingress.certManager` boolean to `true` to enable the corresponding annotations for cert-manager. + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `hub.affinity` and `proxy.affinity` parameters. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `hub.podAffinityPreset`, `hub.podAntiAffinityPreset`, or `hub.nodeAffinityPreset` parameters for the hub and `proxy.podAffinityPreset`, `proxy.podAntiAffinityPreset`, or `ploxy.nodeAffinityPreset` parameters for the proxy. + +### Deploying extra resources + +There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami’s Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +```bash +$ helm upgrade my-release bitnami/jupyterhub +``` diff --git a/bitnami/jupyterhub/templates/NOTES.txt b/bitnami/jupyterhub/templates/NOTES.txt new file mode 100644 index 000000000..731cb88e6 --- /dev/null +++ b/bitnami/jupyterhub/templates/NOTES.txt @@ -0,0 +1,64 @@ +************************************************************************* +*** PLEASE BE PATIENT: JupyterHub may take a few minutes to install *** +************************************************************************* + +{{- if .Values.proxy.ingress.enabled }} + +1. Get the JupyterHub URL indicated on the Ingress Rule and associate it to your cluster external IP: + + export CLUSTER_IP=$(minikube ip) # On Minikube. Use: `kubectl cluster-info` on others K8s clusters + export HOSTNAME=$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} -o jsonpath='{.spec.rules[0].host}') + echo "JupyterHub URL: http{{ if .Values.ingress.tls }}s{{ end }}://$HOSTNAME/" + echo "$CLUSTER_IP $HOSTNAME" | sudo tee -a /etc/hosts + +{{- else }} + +1. Get the JupyterHub URL by running: + +{{- if eq .Values.proxy.service.public.type "NodePort" }} + + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "common.names.fullname" . }}-proxy-public) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo "JupyterHub URL: http://$NODE_IP:$NODE_PORT/" + +{{- else if eq .Values.proxy.service.public.type "LoadBalancer" }} + +** Please ensure an external IP is associated to the {{ template "common.names.fullname" . }}-proxy-public service before proceeding ** +** Watch the status using: kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}-proxy-public ** + + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }}-proxy-public --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + +{{- $port:=.Values.proxy.service.public.port | toString }} + echo "JupyterHub URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.proxy.service.public.port }}{{ end }}/" +{{- else if eq .Values.proxy.service.public.type "ClusterIP" }} + + echo "JupyterHub URL: http://127.0.0.1:8080/" + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "common.names.fullname" . }}-proxy-public 8080:{{ .Values.proxy.service.public.port }} + +{{- end }} +{{- end }} + +2. Login with the following admin user below to create a Notebook: + + echo Admin user: {{ .Values.hub.adminUser }} + echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }}-hub -o jsonpath="{.data['values\.yaml']}" | base64 --decode | awk -F: '/password/ {gsub(/[ \t]+/, "", $2);print $2}') + +{{- include "common.warnings.rollingTag" .Values.hub.image }} +{{- include "common.warnings.rollingTag" .Values.proxy.image }} +{{- include "common.warnings.rollingTag" .Values.singleuser.image }} + +{{- $passwordValidationErrors := list -}} + +{{- if not .Values.hub.existingSecret -}} + {{- $secretName := printf "%s-hub" (include "common.names.fullname" .) -}} + {{- $requiredHubPassword := dict "valueKey" "hub.password" "secret" $secretName "field" "values.yaml" "context" $ -}} + {{- $requiredHubPasswordError := include "common.validations.values.single.empty" $requiredHubPassword -}} + {{- $passwordValidationErrors = append $passwordValidationErrors $requiredHubPasswordError -}} +{{- end }} + +{{- $postgresqlSecretName := include "jupyterhub.databaseSecretName" . -}} +{{- $postgresqlPasswordValidationErrors := include "common.validations.values.postgresql.passwords" (dict "secret" $postgresqlSecretName "subchart" true "context" $) -}} +{{- $passwordValidationErrors = append $passwordValidationErrors $postgresqlPasswordValidationErrors -}} + +{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $) -}} +{{- include "jupyterhub.validateValues" . }} diff --git a/bitnami/jupyterhub/templates/_helpers.tpl b/bitnami/jupyterhub/templates/_helpers.tpl new file mode 100644 index 000000000..9053160e0 --- /dev/null +++ b/bitnami/jupyterhub/templates/_helpers.tpl @@ -0,0 +1,160 @@ +{{/* +Return the proper hub image name +*/}} +{{- define "jupyterhub.hub.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.hub.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper hub image name +*/}} +{{- define "jupyterhub.hub.name" -}} +{{- printf "%s-hub" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper hub image name +*/}} +{{- define "jupyterhub.proxy.name" -}} +{{- printf "%s-proxy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper singleuser image name (to be set in the hub.configuration part). We cannot use common.images.image because of the tag +{{ include "jupyterhub.hubconfiguration.imageEntry" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} +*/}} +{{- define "jupyterhub.hubconfiguration.imageEntry" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if $registryName }} +{{- printf "%s/%s" $registryName $repositoryName -}} +{{- else -}} +{{- printf "%s" $repositoryName -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper hub image name +*/}} +{{- define "jupyterhub.proxy.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.proxy.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper hub image name +*/}} +{{- define "jupyterhub.auxiliary.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.auxiliaryImage "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "jupyterhub.imagePullSecrets" -}} +{{- include "common.images.pullSecrets" (dict "images" (list .Values.hub.image .Values.proxy.image .Values.auxiliaryImage) "global" .Values.global) -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "jupyterhub.hubServiceAccountName" -}} +{{- if .Values.hub.serviceAccount.create -}} + {{ default (printf "%s-hub" (include "common.names.fullname" .)) .Values.hub.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.hub.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "jupyterhub.singleuserServiceAccountName" -}} +{{- if .Values.singleuser.serviceAccount.create -}} + {{ default (printf "%s-singleuser" (include "common.names.fullname" .)) .Values.singleuser.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.singleuser.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified postgresql name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "jupyterhub.postgresql.fullname" -}} +{{- $name := default "postgresql" .Values.postgresql.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Get the Postgresql credentials secret. +*/}} +{{- define "jupyterhub.databaseSecretName" -}} +{{- if and (.Values.postgresql.enabled) (not .Values.postgresql.existingSecret) -}} + {{- printf "%s" (include "jupyterhub.postgresql.fullname" .) -}} +{{- else if and (.Values.postgresql.enabled) (.Values.postgresql.existingSecret) -}} + {{- printf "%s" .Values.postgresql.existingSecret -}} +{{- else }} + {{- if .Values.externalDatabase.existingSecret -}} + {{- printf "%s" .Values.externalDatabase.existingSecret -}} + {{- else -}} + {{ printf "%s-%s" .Release.Name "externaldb" }} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Get the Postgresql credentials secret. +*/}} +{{- define "jupyterhub.hubSecretName" -}} +{{- if .Values.hub.existingSecret -}} + {{- .Values.hub.existingSecret -}} +{{- else }} + {{- printf "%s-hub" (include "common.names.fullname" . ) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the Postgresql credentials secret. +*/}} +{{- define "jupyterhub.hubConfigmapName" -}} +{{- if .Values.hub.existingConfigmap -}} + {{- .Values.hub.existingConfigmap -}} +{{- else }} + {{- printf "%s-hub" (include "common.names.fullname" . ) -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of JupyterHub - Database */}} +{{- define "jupyterhub.validateValues.database" -}} +{{- if and .Values.postgresql.enabled .Values.externalDatabase.host -}} +jupyherhub: Database + You can only use one database. + Please choose installing a PostgreSQL chart (--set postgresql.enabled=true) or + using an external database (--set externalDatabase.host) +{{- end -}} +{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.host) -}} +jupyherhub: NoDatabase + You did not set any database. + Please choose installing a PostgreSQL chart (--set postgresql.enabled=true) or + using an external database (--set externalDatabase.host) +{{- end -}} +{{- end -}} + +{{/* +Compile all warnings into a single message. +*/}} +{{- define "jupyterhub.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "jupyterhub.validateValues.database" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/jupyterhub/templates/extra-list.yaml b/bitnami/jupyterhub/templates/extra-list.yaml new file mode 100644 index 000000000..9ac65f9e1 --- /dev/null +++ b/bitnami/jupyterhub/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/configmap.yaml b/bitnami/jupyterhub/templates/hub/configmap.yaml new file mode 100644 index 000000000..697af02a0 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/configmap.yaml @@ -0,0 +1,505 @@ +{{- if not .Values.hub.existingConfigmap }} +apiVersion: v1 +kind: ConfigMap +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + ## Taken from upstream JupyterHub chart + ## Source: https://jupyterhub.github.io/helm-chart/jupyterhub-0.11.1.tgz + jupyterhub_config.py: | + import os + import re + import sys + + from binascii import a2b_hex + + from tornado.httpclient import AsyncHTTPClient + from kubernetes import client + from jupyterhub.utils import url_path_join + + # Make sure that modules placed in the same directory as the jupyterhub config are added to the pythonpath + configuration_directory = os.path.dirname(os.path.realpath(__file__)) + sys.path.insert(0, configuration_directory) + + from z2jh import get_config, set_config_if_not_none + + def camelCaseify(s): + """convert snake_case to camelCase + + For the common case where some_value is set from someValue + so we don't have to specify the name twice. + """ + return re.sub(r"_([a-z])", lambda m: m.group(1).upper(), s) + + # Configure JupyterHub to use the curl backend for making HTTP requests, + # rather than the pure-python implementations. The default one starts + # being too slow to make a large number of requests to the proxy API + # at the rate required. + AsyncHTTPClient.configure("tornado.curl_httpclient.CurlAsyncHTTPClient") + + c.JupyterHub.spawner_class = "kubespawner.KubeSpawner" + + # Connect to a proxy running in a different pod. Note that *_SERVICE_* + # environment variables are set by Kubernetes for Services + # Adapted by Bitnami to allow other service names + c.ConfigurableHTTPProxy.api_url = ( + f"http://{{ template "common.names.fullname" . }}-proxy-api:{os.environ['PROXY_API_SERVICE_PORT']}" + ) + c.ConfigurableHTTPProxy.should_start = False + + # Do not shut down user pods when hub is restarted + c.JupyterHub.cleanup_servers = False + + # Check that the proxy has routes appropriately setup + c.JupyterHub.last_activity_interval = 60 + + # Don't wait at all before redirecting a spawning user to the progress page + c.JupyterHub.tornado_settings = { + "slow_spawn_timeout": 0, + } + + # configure the hub db connection + db_type = get_config("hub.db.type") + if db_type == "sqlite-pvc": + c.JupyterHub.db_url = "sqlite:///jupyterhub.sqlite" + elif db_type == "sqlite-memory": + c.JupyterHub.db_url = "sqlite://" + else: + set_config_if_not_none(c.JupyterHub, "db_url", "hub.db.url") + + # c.JupyterHub configuration from Helm chart's configmap + for trait, cfg_key in ( + ("concurrent_spawn_limit", None), + ("active_server_limit", None), + ("base_url", None), + # ('cookie_secret', None), # requires a Hex -> Byte transformation + ("allow_named_servers", None), + ("named_server_limit_per_user", None), + ("authenticate_prometheus", None), + ("redirect_to_server", None), + ("shutdown_on_logout", None), + ("template_paths", None), + ("template_vars", None), + ): + if cfg_key is None: + cfg_key = camelCaseify(trait) + set_config_if_not_none(c.JupyterHub, trait, "hub." + cfg_key) + + # a required Hex -> Byte transformation + cookie_secret_hex = get_config("hub.cookieSecret") + if cookie_secret_hex: + c.JupyterHub.cookie_secret = a2b_hex(cookie_secret_hex) + + # hub_bind_url configures what the JupyterHub process within the hub pod's + # container should listen to. + hub_container_port = {{ .Values.hub.containerPort }} + c.JupyterHub.hub_bind_url = f"http://:{hub_container_port}" + + # hub_connect_url is the URL for connecting to the hub for use by external + # JupyterHub services such as the proxy. Note that *_SERVICE_* environment + # variables are set by Kubernetes for Services. + c.JupyterHub.hub_connect_url = f"http://{{ template "common.names.fullname" . }}-hub:{os.environ['HUB_SERVICE_PORT']}" + + c.KubeSpawner.port = {{ .Values.singleuser.containerPort }} + c.KubeSpawner.notebook_dir = "{{ .Values.singleuser.notebookDir }}" + + # implement common labels + # this duplicates the jupyterhub.commonLabels helper + common_labels = c.KubeSpawner.common_labels = {} + common_labels["app"] = get_config( + "nameOverride", + default=get_config("Chart.Name", "jupyterhub"), + ) + common_labels["heritage"] = "jupyterhub" + chart_name = get_config("Chart.Name") + chart_version = get_config("Chart.Version") + if chart_name and chart_version: + common_labels["chart"] = "{}-{}".format( + chart_name, + chart_version.replace("+", "_"), + ) + release = get_config("Release.Name") + if release: + common_labels["release"] = release + + c.KubeSpawner.namespace = os.environ.get("POD_NAMESPACE", "default") + + # Max number of consecutive failures before the Hub restarts itself + # requires jupyterhub 0.9.2 + set_config_if_not_none( + c.Spawner, + "consecutive_failure_limit", + "hub.consecutiveFailureLimit", + ) + + for trait, cfg_key in ( + ("pod_name_template", None), + ("start_timeout", None), + ("image_pull_policy", "image.pullPolicy"), + # ('image_pull_secrets', 'image.pullSecrets'), # Managed manually below + ("events_enabled", "events"), + ("extra_labels", None), + ("extra_annotations", None), + ("uid", None), + ("fs_gid", None), + ("service_account", "serviceAccountName"), + ("storage_extra_labels", "storage.extraLabels"), + ("tolerations", "extraTolerations"), + ("node_selector", None), + ("node_affinity_required", "extraNodeAffinity.required"), + ("node_affinity_preferred", "extraNodeAffinity.preferred"), + ("pod_affinity_required", "extraPodAffinity.required"), + ("pod_affinity_preferred", "extraPodAffinity.preferred"), + ("pod_anti_affinity_required", "extraPodAntiAffinity.required"), + ("pod_anti_affinity_preferred", "extraPodAntiAffinity.preferred"), + ("lifecycle_hooks", None), + ("init_containers", None), + ("extra_containers", None), + ("mem_limit", "memory.limit"), + ("mem_guarantee", "memory.guarantee"), + ("cpu_limit", "cpu.limit"), + ("cpu_guarantee", "cpu.guarantee"), + ("extra_resource_limits", "extraResource.limits"), + ("extra_resource_guarantees", "extraResource.guarantees"), + ("environment", "extraEnv"), + ("profile_list", None), + ("extra_pod_config", None), + ): + if cfg_key is None: + cfg_key = camelCaseify(trait) + set_config_if_not_none(c.KubeSpawner, trait, "singleuser." + cfg_key) + + image = get_config("singleuser.image.name") + if image: + tag = get_config("singleuser.image.tag") + if tag: + image = "{}:{}".format(image, tag) + + c.KubeSpawner.image = image + + # Combine imagePullSecret.create (single), imagePullSecrets (list), and + # singleuser.image.pullSecrets (list). + image_pull_secrets = [] + if get_config("imagePullSecret.automaticReferenceInjection") and ( + get_config("imagePullSecret.create") or get_config("imagePullSecret.enabled") + ): + image_pull_secrets.append("image-pull-secret") + if get_config("imagePullSecrets"): + image_pull_secrets.extend(get_config("imagePullSecrets")) + if get_config("singleuser.image.pullSecrets"): + image_pull_secrets.extend(get_config("singleuser.image.pullSecrets")) + if image_pull_secrets: + c.KubeSpawner.image_pull_secrets = image_pull_secrets + + # scheduling: + if get_config("scheduling.userScheduler.enabled"): + c.KubeSpawner.scheduler_name = os.environ["HELM_RELEASE_NAME"] + "-user-scheduler" + if get_config("scheduling.podPriority.enabled"): + c.KubeSpawner.priority_class_name = ( + os.environ["HELM_RELEASE_NAME"] + "-default-priority" + ) + + # add node-purpose affinity + match_node_purpose = get_config("scheduling.userPods.nodeAffinity.matchNodePurpose") + if match_node_purpose: + node_selector = dict( + matchExpressions=[ + dict( + key="hub.jupyter.org/node-purpose", + operator="In", + values=["user"], + ) + ], + ) + if match_node_purpose == "prefer": + c.KubeSpawner.node_affinity_preferred.append( + dict( + weight=100, + preference=node_selector, + ), + ) + elif match_node_purpose == "require": + c.KubeSpawner.node_affinity_required.append(node_selector) + elif match_node_purpose == "ignore": + pass + else: + raise ValueError( + "Unrecognized value for matchNodePurpose: %r" % match_node_purpose + ) + + # add dedicated-node toleration + for key in ( + "hub.jupyter.org/dedicated", + # workaround GKE not supporting / in initial node taints + "hub.jupyter.org_dedicated", + ): + c.KubeSpawner.tolerations.append( + dict( + key=key, + operator="Equal", + value="user", + effect="NoSchedule", + ) + ) + + # Configure dynamically provisioning pvc + storage_type = get_config("singleuser.storage.type") + + if storage_type == "dynamic": + pvc_name_template = get_config("singleuser.storage.dynamic.pvcNameTemplate") + c.KubeSpawner.pvc_name_template = pvc_name_template + volume_name_template = get_config("singleuser.storage.dynamic.volumeNameTemplate") + c.KubeSpawner.storage_pvc_ensure = True + set_config_if_not_none( + c.KubeSpawner, "storage_class", "singleuser.storage.dynamic.storageClass" + ) + set_config_if_not_none( + c.KubeSpawner, + "storage_access_modes", + "singleuser.storage.dynamic.storageAccessModes", + ) + set_config_if_not_none( + c.KubeSpawner, "storage_capacity", "singleuser.storage.capacity" + ) + + # Add volumes to singleuser pods + c.KubeSpawner.volumes = [ + { + "name": volume_name_template, + "persistentVolumeClaim": {"claimName": pvc_name_template}, + } + ] + c.KubeSpawner.volume_mounts = [ + { + "mountPath": get_config("singleuser.storage.homeMountPath"), + "name": volume_name_template, + } + ] + elif storage_type == "static": + pvc_claim_name = get_config("singleuser.storage.static.pvcName") + c.KubeSpawner.volumes = [ + {"name": "home", "persistentVolumeClaim": {"claimName": pvc_claim_name}} + ] + + c.KubeSpawner.volume_mounts = [ + { + "mountPath": get_config("singleuser.storage.homeMountPath"), + "name": "home", + "subPath": get_config("singleuser.storage.static.subPath"), + } + ] + + c.KubeSpawner.volumes.extend(get_config("singleuser.storage.extraVolumes", [])) + c.KubeSpawner.volume_mounts.extend( + get_config("singleuser.storage.extraVolumeMounts", []) + ) + + c.JupyterHub.services = [] + + if get_config("cull.enabled", False): + cull_cmd = ["python3", "-m", "jupyterhub_idle_culler"] + base_url = c.JupyterHub.get("base_url", "/") + cull_cmd.append("--url=http://localhost:8081" + url_path_join(base_url, "hub/api")) + + cull_timeout = get_config("cull.timeout") + if cull_timeout: + cull_cmd.append("--timeout=%s" % cull_timeout) + + cull_every = get_config("cull.every") + if cull_every: + cull_cmd.append("--cull-every=%s" % cull_every) + + cull_concurrency = get_config("cull.concurrency") + if cull_concurrency: + cull_cmd.append("--concurrency=%s" % cull_concurrency) + + if get_config("cull.users"): + cull_cmd.append("--cull-users") + + if get_config("cull.removeNamedServers"): + cull_cmd.append("--remove-named-servers") + + cull_max_age = get_config("cull.maxAge") + if cull_max_age: + cull_cmd.append("--max-age=%s" % cull_max_age) + + c.JupyterHub.services.append( + { + "name": "cull-idle", + "admin": True, + "command": cull_cmd, + } + ) + + for name, service in get_config("hub.services", {}).items(): + # jupyterhub.services is a list of dicts, but + # in the helm chart it is a dict of dicts for easier merged-config + service.setdefault("name", name) + # handle camelCase->snake_case of api_token + api_token = service.pop("apiToken", None) + if api_token: + service["api_token"] = api_token + c.JupyterHub.services.append(service) + + set_config_if_not_none(c.Spawner, "cmd", "singleuser.cmd") + set_config_if_not_none(c.Spawner, "default_url", "singleuser.defaultUrl") + + cloud_metadata = get_config("singleuser.cloudMetadata", {}) + + if ( + cloud_metadata.get("blockWithIptables") == True + or cloud_metadata.get("enabled") == False + ): + # Use iptables to block access to cloud metadata by default + network_tools_image_name = get_config("singleuser.networkTools.image.name") + network_tools_image_tag = get_config("singleuser.networkTools.image.tag") + ip_block_container = client.V1Container( + name="block-cloud-metadata", + image=f"{network_tools_image_name}:{network_tools_image_tag}", + command=[ + "/bin/bash" + ], + args=[ + "-ec", + "install_packages iptables && iptables -A OUTPUT -d " + cloud_metadata.get("ip", "169.254.169.254") + " -j DROP" + ], + security_context=client.V1SecurityContext( + privileged=True, + run_as_user=0, + capabilities=client.V1Capabilities(add=["NET_ADMIN"]), + ), + ) + + c.KubeSpawner.init_containers.append(ip_block_container) + + if get_config("debug.enabled", False): + c.JupyterHub.log_level = "DEBUG" + c.Spawner.debug = True + + # load hub.config values + for section, sub_cfg in get_config("hub.config", {}).items(): + c[section].update(sub_cfg) + + # execute hub.extraConfig string + extra_config = get_config("hub.extraConfig", {}) + if isinstance(extra_config, str): + from textwrap import indent, dedent + + msg = dedent( + """ + hub.extraConfig should be a dict of strings, + but found a single string instead. + + extraConfig as a single string is deprecated + as of the jupyterhub chart version 0.6. + + The keys can be anything identifying the + block of extra configuration. + + Try this instead: + + hub: + extraConfig: + myConfig: | + {} + + This configuration will still be loaded, + but you are encouraged to adopt the nested form + which enables easier merging of multiple extra configurations. + """ + ) + print(msg.format(indent(extra_config, " " * 10).lstrip()), file=sys.stderr) + extra_config = {"deprecated string": extra_config} + + for key, config_py in sorted(extra_config.items()): + print("Loading extra config: %s" % key) + exec(config_py) + + ## Taken from the upstream chart + ## Source: https://jupyterhub.github.io/helm-chart/jupyterhub-0.11.1.tgz + z2jh.py: | + """ + Utility methods for use in jupyterhub_config.py and dynamic subconfigs. + + Methods here can be imported by extraConfig in values.yaml + """ + from collections import Mapping + from functools import lru_cache + import os + + import yaml + + # memoize so we only load config once + @lru_cache() + def _load_config(): + """Load configuration from disk + + Memoized to only load once + """ + cfg = {} + for source in ("config", "secret"): + path = f"/etc/jupyterhub/{source}/values.yaml" + if os.path.exists(path): + print(f"Loading {path}") + with open(path) as f: + values = yaml.safe_load(f) + cfg = _merge_dictionaries(cfg, values) + else: + print(f"No config at {path}") + return cfg + + def _merge_dictionaries(a, b): + """Merge two dictionaries recursively. + + Simplified From https://stackoverflow.com/a/7205107 + """ + merged = a.copy() + for key in b: + if key in a: + if isinstance(a[key], Mapping) and isinstance(b[key], Mapping): + merged[key] = _merge_dictionaries(a[key], b[key]) + else: + merged[key] = b[key] + else: + merged[key] = b[key] + return merged + + def get_config(key, default=None): + """ + Find a config item of a given name & return it + + Parses everything as YAML, so lists and dicts are available too + + get_config("a.b.c") returns config['a']['b']['c'] + """ + value = _load_config() + # resolve path in yaml + for level in key.split("."): + if not isinstance(value, dict): + # a parent is a scalar or null, + # can't resolve full path + return default + if level not in value: + return default + else: + value = value[level] + return value + + def set_config_if_not_none(cparent, name, key): + """ + Find a config item of a given name, set the corresponding Jupyter + configuration item if not None + """ + data = get_config(key) + if data is not None: + setattr(cparent, name, data) +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/deployment.yaml b/bitnami/jupyterhub/templates/hub/deployment.yaml new file mode 100644 index 000000000..dc6e24b79 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/deployment.yaml @@ -0,0 +1,253 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.hub.updateStrategy }} + strategy: {{- toYaml .Values.hub.updateStrategy | nindent 4 }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: hub + template: + metadata: + annotations: + {{- if .Values.hub.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.hub.podAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if empty .Values.hub.existingConfigmap }} + checksum/hub-config: {{ include (print $.Template.BasePath "/hub/configmap.yaml") . | sha256sum }} + {{- end }} + {{- if empty .Values.hub.existingSecret }} + checksum/hub-secret: {{ include (print $.Template.BasePath "/hub/secret.yaml") . | sha256sum }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: hub + hub.jupyter.org/network-access-proxy-api: "true" + hub.jupyter.org/network-access-proxy-http: "true" + hub.jupyter.org/network-access-singleuser: "true" + {{- if .Values.hub.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.hub.podLabels "context" $) | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ template "jupyterhub.hubServiceAccountName" . }} + {{- include "jupyterhub.imagePullSecrets" . | nindent 6 }} + {{- if .Values.hub.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hub.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.hub.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.hub.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.hub.podAffinityPreset "component" "hub" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.hub.podAntiAffinityPreset "component" "hub" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.hub.nodeAffinityPreset.type "key" .Values.hub.nodeAffinityPreset.key "values" .Values.hub.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.hub.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.hub.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.hub.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.hub.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.hub.priorityClassName }} + priorityClassName: {{ .Values.hub.priorityClassName | quote }} + {{- end }} + {{- if .Values.hub.podSecurityContext.enabled }} + securityContext: {{- omit .Values.hub.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + initContainers: + {{- if .Values.postgresql.enabled }} + # NOTE: The value postgresql.image is not available unless postgresql.enabled is not set. We could change this to use bitnami-shell if + # it had the binary wait-for-port. + # This init container is for avoiding CrashLoopback errors in the Hub container because the PostgreSQL container is not ready + - name: wait-for-db + image: {{ include "common.images.image" (dict "imageRoot" .Values.postgresql.image "global" .Values.global) }} + imagePullPolicy: {{ .Values.postgresql.image.pullPolicy }} + command: + - /bin/bash + args: + - -ec + - | + #!/bin/bash + + set -o errexit + set -o nounset + set -o pipefail + + . /opt/bitnami/scripts/libos.sh + . /opt/bitnami/scripts/liblog.sh + . /opt/bitnami/scripts/libpostgresql.sh + + check_postgresql_connection() { + echo "SELECT 1" | postgresql_remote_execute "$POSTGRESQL_CLIENT_DATABASE_HOST" "$POSTGRESQL_CLIENT_DATABASE_PORT_NUMBER" "$POSTGRESQL_CLIENT_DATABASE_NAME" "$POSTGRESQL_CLIENT_POSTGRES_USER" "$POSTGRESQL_CLIENT_CREATE_DATABASE_PASSWORD" + } + + info "Connecting to the PostgreSQL instance $POSTGRESQL_CLIENT_DATABASE_HOST:$POSTGRESQL_CLIENT_DATABASE_PORT_NUMBER" + if ! retry_while "check_postgresql_connection"; then + error "Could not connect to the database server" + return 1 + else + info "Connected to the PostgreSQL instance" + fi + {{- if .Values.hub.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.hub.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + env: + - name: POSTGRESQL_CLIENT_DATABASE_HOST + value: {{ ternary (include "jupyterhub.postgresql.fullname" .) .Values.externalDatabase.host .Values.postgresql.enabled }} + - name: POSTGRESQL_CLIENT_DATABASE_NAME + value: {{ ternary .Values.postgresql.postgresqlDatabase .Values.externalDatabase.port .Values.postgresql.enabled }} + - name: POSTGRESQL_CLIENT_DATABASE_PORT_NUMBER + value: {{ ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled | quote}} + - name: POSTGRESQL_CLIENT_CREATE_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "jupyterhub.databaseSecretName" . }} + key: "postgresql-password" + - name: POSTGRESQL_CLIENT_POSTGRES_USER + value: {{ ternary .Values.postgresql.postgresqlUsername .Values.externalDatabase.host .Values.postgresql.enabled | quote }} + {{- end }} + {{- if .Values.hub.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.hub.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: hub + image: {{ template "jupyterhub.hub.image" . }} + imagePullPolicy: {{ .Values.hub.image.pullPolicy }} + {{- if .Values.hub.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.hub.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.hub.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.hub.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.hub.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.hub.command "context" $) | nindent 12 }} + {{- else }} + command: + - jupyterhub + {{- end }} + {{- if .Values.hub.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.hub.args "context" $) | nindent 12 }} + {{- else }} + args: + - --config + - /etc/jupyterhub/jupyterhub_config.py + {{- if .Values.hub.image.debug }} + - --debug + {{- end }} + - --upgrade-db + {{- end }} + ports: + - name: http + containerPort: {{ .Values.hub.containerPort }} + env: + - name: PYTHONUNBUFFERED + value: "1" + - name: HELM_RELEASE_NAME + value: {{ .Release.Name | quote }} + - name: PROXY_API_SERVICE_PORT + value: {{ .Values.proxy.service.api.port | quote }} + - name: HUB_SERVICE_PORT + value: {{ .Values.hub.service.port | quote }} + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIGPROXY_AUTH_TOKEN + valueFrom: + secretKeyRef: + name: {{ include "jupyterhub.hubSecretName" . }} + key: proxy-token + - name: PGPASSWORD + valueFrom: + secretKeyRef: + name: {{ include "jupyterhub.databaseSecretName" . }} + key: {{ ternary "postgresql-password" "db-password" .Values.postgresql.enabled | quote }} + {{- if .Values.hub.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.hub.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.hub.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.hub.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.hub.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.hub.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.hub.resources }} + resources: {{- toYaml .Values.hub.resources | nindent 12 }} + {{- end }} + {{- if .Values.hub.startupProbe.enabled }} + startupProbe: + httpGet: + path: {{ .Values.hub.baseUrl | trimSuffix "/" }}/hub/health + port: http + initialDelaySeconds: {{ .Values.hub.startupProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.hub.startupProbe.periodSeconds }} + timeoutSeconds: {{ .Values.hub.startupProbe.timeoutSeconds }} + failureThreshold: {{ .Values.hub.startupProbe.failureThreshold }} + successThreshold: {{ .Values.hub.startupProbe.successThreshold }} + {{- else if .Values.hub.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.hub.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.hub.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: {{ .Values.hub.baseUrl | trimSuffix "/" }}/hub/health + port: http + initialDelaySeconds: {{ .Values.hub.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.hub.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.hub.livenessProbe.timeoutSeconds }} + failureThreshold: {{ .Values.hub.livenessProbe.failureThreshold }} + successThreshold: {{ .Values.hub.livenessProbe.successThreshold }} + {{- else if .Values.hub.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.hub.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.hub.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: {{ .Values.hub.baseUrl | trimSuffix "/" }}/hub/health + port: http + initialDelaySeconds: {{ .Values.hub.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.hub.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.hub.readinessProbe.timeoutSeconds }} + failureThreshold: {{ .Values.hub.readinessProbe.failureThreshold }} + successThreshold: {{ .Values.hub.readinessProbe.successThreshold }} + {{- else if .Values.hub.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.hub.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - mountPath: /etc/jupyterhub/jupyterhub_config.py + subPath: jupyterhub_config.py + name: config + - mountPath: /etc/jupyterhub/z2jh.py + subPath: z2jh.py + name: config + - mountPath: /etc/jupyterhub/secret/ + name: secret + {{- if .Values.hub.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.hub.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.hub.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.hub.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: config + configMap: + name: {{ include "jupyterhub.hubConfigmapName" . }} + - name: secret + secret: + secretName: {{ include "jupyterhub.hubSecretName" . }} + {{- if .Values.hub.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.hub.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/bitnami/jupyterhub/templates/hub/externaldb-secrets.yaml b/bitnami/jupyterhub/templates/hub/externaldb-secrets.yaml new file mode 100644 index 000000000..41f8e31d8 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/externaldb-secrets.yaml @@ -0,0 +1,18 @@ +{{- if not .Values.postgresql.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-%s" .Release.Name "externaldb" | trunc 63 | trimSuffix "-" }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + app.kubernetes.io/component: hub + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + db-password: {{ .Values.externalDatabase.password | b64enc | quote }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/networkpolicy.yaml b/bitnami/jupyterhub/templates/hub/networkpolicy.yaml new file mode 100644 index 000000000..4285016e8 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/networkpolicy.yaml @@ -0,0 +1,70 @@ +{{- if .Values.hub.networkPolicy.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: hub + policyTypes: + - Ingress + - Egress + ingress: + {{- if .Values.hub.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.hub.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} + # Pods with label "hub.jupyter.org/network-access-hub" --> Hub + - ports: + - port: {{ .Values.hub.containerPort }} + from: + - podSelector: + matchLabels: + hub.jupyter.org/network-access-hub: "true" + {{- if .Values.hub.networkPolicy.allowInterspaceAccess }} + namespaceSelector: + matchLabels: {} + - namespaceSelector: + matchLabels: + hub.jupyter.org/network-access-hub: "true" + {{- end }} + egress: + # Hub --> Proxy API + - ports: + - port: {{ .Values.proxy.containerPort.api }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} + app.kubernetes.io/component: proxy + # Hub --> Single User + - ports: + - port: {{ .Values.singleuser.containerPort }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} + app.kubernetes.io/component: singleuser + ## DNS access + - ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + ## PostgreSQL access + - ports: + - protocol: UDP + port: {{ .Values.postgresql.service.port }} + - protocol: TCP + port: {{ .Values.postgresql.service.port }} + {{- if .Values.hub.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.hub.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/pdb.yaml b/bitnami/jupyterhub/templates/hub/pdb.yaml new file mode 100644 index 000000000..b87436c68 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/pdb.yaml @@ -0,0 +1,19 @@ +{{- if .Values.hub.pdb.create -}} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} +spec: + minAvailable: {{ .Values.hub.pdb.minAvailable }} + maxUnavailable: {{ .Values.hub.pdb.maxUnavailable }} + selector: + matchLabels: + {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: hub +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/role.yaml b/bitnami/jupyterhub/templates/hub/role.yaml new file mode 100644 index 000000000..55c508aba --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/role.yaml @@ -0,0 +1,22 @@ +{{ if .Values.hub.rbac.create }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + namespace: {{ .Release.Namespace | quote }} +rules: + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims"] + verbs: ["get", "watch", "list", "create", "delete"] + - apiGroups: [""] # "" indicates the core API group + resources: ["events"] + verbs: ["get", "watch", "list"] +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/rolebinding.yaml b/bitnami/jupyterhub/templates/hub/rolebinding.yaml new file mode 100644 index 000000000..12fbc340e --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/rolebinding.yaml @@ -0,0 +1,20 @@ +{{ if .Values.hub.rbac.create }} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} +subjects: + - kind: ServiceAccount + name: {{ template "jupyterhub.hubServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ template "common.names.fullname" . }}-hub + apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/secret.yaml b/bitnami/jupyterhub/templates/hub/secret.yaml new file mode 100644 index 000000000..c05c87473 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/secret.yaml @@ -0,0 +1,19 @@ +{{- if not .Values.hub.existingSecret }} +apiVersion: v1 +kind: Secret +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + values.yaml: {{ include "common.tplvalues.render" ( dict "value" .Values.hub.configuration "context" $ ) | b64enc | quote }} + proxy-token: {{ default (randAlphaNum 32) .Values.proxy.secretToken | b64enc | quote }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/service-account.yaml b/bitnami/jupyterhub/templates/hub/service-account.yaml new file mode 100644 index 000000000..738bbc226 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/service-account.yaml @@ -0,0 +1,16 @@ +{{- if .Values.hub.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ template "jupyterhub.hubServiceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- include "jupyterhub.imagePullSecrets" . | nindent 2 }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/hub/service.yaml b/bitnami/jupyterhub/templates/hub/service.yaml new file mode 100644 index 000000000..b4e03f3b6 --- /dev/null +++ b/bitnami/jupyterhub/templates/hub/service.yaml @@ -0,0 +1,36 @@ +apiVersion: v1 +kind: Service +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: hub + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.hub.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.hub.service.type }} + {{- if (or (eq .Values.hub.service.type "LoadBalancer") (eq .Values.hub.service.type "NodePort")) }} + externalTrafficPolicy: {{ .Values.hub.service.externalTrafficPolicy | quote }} + {{- end }} + {{ if eq .Values.hub.service.type "LoadBalancer" }} + loadBalancerSourceRanges: {{ .Values.hub.service.loadBalancerSourceRanges }} + {{ end }} + {{- if (and (eq .Values.hub.service.type "LoadBalancer") (not (empty .Values.hub.service.loadBalancerIP))) }} + loadBalancerIP: {{ .Values.hub.service.loadBalancerIP }} + {{- end }} + ports: + - name: http + port: {{ .Values.hub.service.port }} + targetPort: http + protocol: TCP + {{- if (and (or (eq .Values.hub.service.type "NodePort") (eq .Values.hub.service.type "LoadBalancer")) (not (empty .Values.hub.service.nodePorts.http))) }} + nodePort: {{ .Values.hub.service.nodePorts.http }} + {{- else if eq .Values.hub.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: hub diff --git a/bitnami/jupyterhub/templates/image-puller/daemonset.yaml b/bitnami/jupyterhub/templates/image-puller/daemonset.yaml new file mode 100644 index 000000000..0e24b7c49 --- /dev/null +++ b/bitnami/jupyterhub/templates/image-puller/daemonset.yaml @@ -0,0 +1,125 @@ +{{ if .Values.imagePuller.enabled }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: image-puller + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ printf "%s-image-puller" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.imagePuller.updateStrategy }} + updateStrategy: {{- toYaml .Values.imagePuller.updateStrategy | nindent 4 }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: image-puller + template: + metadata: + {{- if .Values.imagePuller.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: image-puller + {{- if .Values.imagePuller.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.podLabels "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "jupyterhub.imagePullSecrets" . | nindent 6 }} + {{- if .Values.imagePuller.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.imagePuller.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.imagePuller.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.imagePuller.podAffinityPreset "component" "image-puller" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.imagePuller.podAntiAffinityPreset "component" "image-puller" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.imagePuller.nodeAffinityPreset.type "key" .Values.imagePuller.nodeAffinityPreset.key "values" .Values.imagePuller.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.imagePuller.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.imagePuller.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.imagePuller.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.imagePuller.priorityClassName }} + priorityClassName: {{ .Values.imagePuller.priorityClassName | quote }} + {{- end }} + {{- if .Values.imagePuller.podSecurityContext.enabled }} + securityContext: {{- omit .Values.imagePuller.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + initContainers: + {{- range $index, $image := (list .Values.singleuser.image .Values.auxiliaryImage) }} + - name: pull-{{ $index }} + image: {{ include "common.images.image" (dict "imageRoot" . "global" $.Values.global) }} + imagePullPolicy: {{ .pullPolicy }} + command: + - /bin/sh + - -c + - echo "Pulling complete" + {{- end }} + {{- if .Values.imagePuller.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: pause + image: {{ template "jupyterhub.auxiliary.image" . }} + imagePullPolicy: {{ .Values.auxiliaryImage.pullPolicy }} + {{- if .Values.imagePuller.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.imagePuller.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/sh + - -c + - sleep infinity + {{- end }} + {{- if .Values.imagePuller.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.args "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.extraEnvVars }} + env: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.imagePuller.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.imagePuller.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.imagePuller.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.imagePuller.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.imagePuller.resources }} + resources: {{- toYaml .Values.imagePuller.resources | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.customStartupProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.extraVolumeMounts }} + volumeMounts: + {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.imagePuller.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.imagePuller.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.imagePuller.extraVolumes }} + volumes: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.extraVolumes "context" $) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/proxy/deployment.yaml b/bitnami/jupyterhub/templates/proxy/deployment.yaml new file mode 100644 index 000000000..4dded0406 --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/deployment.yaml @@ -0,0 +1,166 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: proxy + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.proxy.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.proxy.updateStrategy }} + strategy: {{- toYaml .Values.proxy.updateStrategy | nindent 4 }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: proxy + template: + metadata: + {{- if .Values.proxy.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.podAnnotations "context" $) | nindent 8 }} + checksum/hub-secret: {{ include (print $.Template.BasePath "/hub/secret.yaml") . | sha256sum }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: proxy + hub.jupyter.org/network-access-hub: "true" + hub.jupyter.org/network-access-singleuser: "true" + {{- if .Values.proxy.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.proxy.podLabels "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "jupyterhub.imagePullSecrets" . | nindent 6 }} + {{- if .Values.proxy.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.proxy.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.proxy.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.proxy.podAffinityPreset "component" "proxy" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.proxy.podAntiAffinityPreset "component" "proxy" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.proxy.nodeAffinityPreset.type "key" .Values.proxy.nodeAffinityPreset.key "values" .Values.proxy.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.proxy.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.proxy.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.proxy.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.tolerations "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.proxy.priorityClassName }} + priorityClassName: {{ .Values.proxy.priorityClassName | quote }} + {{- end }} + {{- if .Values.proxy.podSecurityContext.enabled }} + securityContext: {{- omit .Values.proxy.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.proxy.initContainers }} + initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: proxy + image: {{ template "jupyterhub.proxy.image" . }} + imagePullPolicy: {{ .Values.proxy.image.pullPolicy }} + {{- if .Values.proxy.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.proxy.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.proxy.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.proxy.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.proxy.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.args "context" $) | nindent 12 }} + {{- else }} + args: + - configurable-http-proxy + - "--ip=::" + - "--api-ip=::" + - --api-port={{ .Values.proxy.containerPort.api }} + - --default-target=http://{{ template "common.names.fullname" . }}-hub:{{ .Values.hub.service.port }} + - --error-target=http://{{ template "common.names.fullname" . }}-hub:{{ .Values.hub.service.port }}/hub/error + - --port={{ .Values.proxy.containerPort.http }} + {{- if .Values.proxy.image.debug }} + - --log-level=debug + {{- end }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.proxy.containerPort.http }} + protocol: TCP + - name: api + containerPort: {{ .Values.proxy.containerPort.api }} + protocol: TCP + env: + - name: CONFIGPROXY_AUTH_TOKEN + valueFrom: + secretKeyRef: + name: {{ include "jupyterhub.hubSecretName" . }} + key: proxy-token + {{- if .Values.proxy.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.proxy.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.proxy.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.proxy.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.proxy.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.proxy.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- if .Values.proxy.resources }} + resources: {{- toYaml .Values.proxy.resources | nindent 12 }} + {{- end }} + {{- if .Values.proxy.startupProbe.enabled }} + startupProbe: + httpGet: + path: /_chp_healthz + port: http + initialDelaySeconds: {{ .Values.proxy.startupProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.proxy.startupProbe.periodSeconds }} + timeoutSeconds: {{ .Values.proxy.startupProbe.timeoutSeconds }} + successThreshold: {{ .Values.proxy.startupProbe.successThreshold }} + failureThreshold: {{ .Values.proxy.startupProbe.failureThreshold }} + {{- else if .Values.proxy.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.proxy.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /_chp_healthz + port: http + initialDelaySeconds: {{ .Values.proxy.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.proxy.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.proxy.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.proxy.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.proxy.livenessProbe.failureThreshold }} + {{- else if .Values.proxy.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.proxy.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /_chp_healthz + port: http + initialDelaySeconds: {{ .Values.proxy.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.proxy.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.proxy.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.proxy.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.proxy.readinessProbe.failureThreshold }} + {{- else if .Values.proxy.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.proxy.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.proxy.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.proxy.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.proxy.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.proxy.extraVolumes }} + volumes: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/bitnami/jupyterhub/templates/proxy/ingress.yaml b/bitnami/jupyterhub/templates/proxy/ingress.yaml new file mode 100644 index 000000000..8abf7be9f --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.proxy.ingress.enabled }} +apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ include "common.names.fullname" . }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + app.kubernetes.io/component: proxy + namespace: {{ .Release.Namespace | quote }} + annotations: + {{- if .Values.proxy.ingress.certManager }} + kubernetes.io/tls-acme: "true" + {{- end }} + {{- if .Values.proxy.ingress.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.proxy.ingress.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + rules: + {{- if .Values.proxy.ingress.hostname }} + - host: {{ .Values.proxy.ingress.hostname | quote }} + http: + paths: + {{- if .Values.proxy.ingress.extraPaths }} + {{- toYaml .Values.proxy.ingress.extraPaths | nindent 10 }} + {{- end }} + - path: {{ .Values.proxy.ingress.path }} + {{- if eq "true" (include "common.ingress.supportsPathType" .) }} + pathType: {{ .Values.proxy.ingress.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (printf "%s-proxy-public" (include "common.names.fullname" . )) "servicePort" "http" "context" $) | nindent 14 }} + {{- end }} + {{- range .Values.proxy.ingress.extraHosts }} + - host: {{ .name | quote }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "http" "context" $) | nindent 14 }} + {{- end }} + {{- if or .Values.proxy.ingress.tls .Values.proxy.ingress.extraTls }} + tls: + {{- if .Values.proxy.ingress.tls }} + - hosts: + - {{ .Values.proxy.ingress.hostname | quote }} + {{- range .Values.proxy.ingress.extraHosts }} + - {{ .name | quote }} + {{- end }} + secretName: {{ printf "%s-tls" .Values.proxy.ingress.hostname }} + {{- end }} + {{- if .Values.proxy.ingress.extraTls }} + {{- include "common.tplvalues.render" ( dict "value" .Values.proxy.ingress.extraTls "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/proxy/networkpolicy.yaml b/bitnami/jupyterhub/templates/proxy/networkpolicy.yaml new file mode 100644 index 000000000..787260086 --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/networkpolicy.yaml @@ -0,0 +1,65 @@ +{{- if .Values.proxy.networkPolicy.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: proxy + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.proxy.name" . }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: proxy + policyTypes: + - Ingress + - Egress + ingress: + {{- if .Values.proxy.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.proxy.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} + # Pods with label "hub.jupyter.org/network-access-proxy-api" --> Proxy API + - ports: + - port: {{ .Values.proxy.containerPort.api }} + from: + - podSelector: + matchLabels: + hub.jupyter.org/network-access-proxy-api: "true" + {{- if .Values.proxy.networkPolicy.allowInterspaceAccess }} + namespaceSelector: + matchLabels: {} + - namespaceSelector: + matchLabels: + hub.jupyter.org/network-access-proxy-api: "true" + {{- end }} + egress: + # Proxy --> Hub + - ports: + - port: {{ .Values.hub.containerPort }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} + app.kubernetes.io/component: hub + # Proxy --> Single User + - ports: + - port: {{ .Values.singleuser.containerPort }} + to: + - podSelector: + matchLabels: + {{- include "common.labels.matchLabels" . | nindent 14 }} + app.kubernetes.io/component: singleuser + ## DNS access + - ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + {{- if .Values.proxy.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.proxy.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/proxy/pdb.yaml b/bitnami/jupyterhub/templates/proxy/pdb.yaml new file mode 100644 index 000000000..af426fa0d --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/pdb.yaml @@ -0,0 +1,18 @@ +{{- if .Values.proxy.pdb.create -}} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: proxy + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ include "jupyterhub.proxy.name" . }} + namespace: {{ .Release.Namespace | quote }} +spec: + minAvailable: {{ .Values.proxy.pdb.minAvailable }} + maxUnavailable: {{ .Values.proxy.pdb.maxUnavailable }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: proxy +{{- end }} diff --git a/bitnami/jupyterhub/templates/proxy/service-api.yaml b/bitnami/jupyterhub/templates/proxy/service-api.yaml new file mode 100644 index 000000000..ad5ba8f1d --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/service-api.yaml @@ -0,0 +1,36 @@ +apiVersion: v1 +kind: Service +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: proxy + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ printf "%s-proxy-api" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.proxy.service.api.type }} + {{- if (or (eq .Values.proxy.service.api.type "LoadBalancer") (eq .Values.proxy.service.api.type "NodePort")) }} + externalTrafficPolicy: {{ .Values.proxy.service.api.externalTrafficPolicy | quote }} + {{- end }} + {{ if eq .Values.proxy.service.api.type "LoadBalancer" }} + loadBalancerSourceRanges: {{ .Values.proxy.service.api.loadBalancerSourceRanges }} + {{ end }} + {{- if (and (eq .Values.proxy.service.api.type "LoadBalancer") (not (empty .Values.proxy.service.api.loadBalancerIP))) }} + loadBalancerIP: {{ .Values.proxy.service.api.loadBalancerIP }} + {{- end }} + ports: + - name: http + port: {{ .Values.proxy.service.api.port }} + targetPort: api + protocol: TCP + {{- if (and (or (eq .Values.proxy.service.api.type "NodePort") (eq .Values.proxy.service.api.type "LoadBalancer")) (not (empty .Values.proxy.service.api.nodePorts.http))) }} + nodePort: {{ .Values.proxy.service.api.nodePorts.http }} + {{- else if eq .Values.proxy.service.api.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: proxy diff --git a/bitnami/jupyterhub/templates/proxy/service-public.yaml b/bitnami/jupyterhub/templates/proxy/service-public.yaml new file mode 100644 index 000000000..19991cdaa --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/service-public.yaml @@ -0,0 +1,36 @@ +apiVersion: v1 +kind: Service +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: proxy + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ printf "%s-proxy-public" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.proxy.service.public.type }} + {{- if (or (eq .Values.proxy.service.public.type "LoadBalancer") (eq .Values.proxy.service.public.type "NodePort")) }} + externalTrafficPolicy: {{ .Values.proxy.service.public.externalTrafficPolicy | quote }} + {{- end }} + {{ if eq .Values.proxy.service.public.type "LoadBalancer" }} + loadBalancerSourceRanges: {{ .Values.proxy.service.public.loadBalancerSourceRanges }} + {{ end }} + {{- if (and (eq .Values.proxy.service.public.type "LoadBalancer") (not (empty .Values.proxy.service.public.loadBalancerIP))) }} + loadBalancerIP: {{ .Values.proxy.service.public.loadBalancerIP }} + {{- end }} + ports: + - name: http + port: {{ .Values.proxy.service.public.port }} + targetPort: http + protocol: TCP + {{- if (and (or (eq .Values.proxy.service.public.type "NodePort") (eq .Values.proxy.service.public.type "LoadBalancer")) (not (empty .Values.proxy.service.public.nodePorts.http))) }} + nodePort: {{ .Values.proxy.service.public.nodePorts.http }} + {{- else if eq .Values.proxy.service.public.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: proxy diff --git a/bitnami/jupyterhub/templates/proxy/tls-secret.yaml b/bitnami/jupyterhub/templates/proxy/tls-secret.yaml new file mode 100644 index 000000000..4967aa054 --- /dev/null +++ b/bitnami/jupyterhub/templates/proxy/tls-secret.yaml @@ -0,0 +1,45 @@ +{{- if .Values.proxy.ingress.enabled }} +{{- if .Values.proxy.ingress.secrets }} +{{- range .Values.proxy.ingress.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + namespace: {{ $.Release.Namespace | quote }} + labels: {{- include "common.labels.standard" $ | nindent 4 }} + {{- if $.Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + app.kubernetes.io/component: proxy + {{- if $.Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- end }} +{{- if and .Values.proxy.ingress.tls (not .Values.proxy.ingress.certManager) }} +{{- $ca := genCA "jupyter-ca" 365 }} +{{- $cert := genSignedCert .Values.proxy.ingress.hostname nil (list .Values.proxy.ingress.hostname) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-tls" .Values.proxy.ingress.hostname | trunc 63 | trimSuffix "-" }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} +{{- end }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/singleuser/networkpolicy.yaml b/bitnami/jupyterhub/templates/singleuser/networkpolicy.yaml new file mode 100644 index 000000000..17d211d6b --- /dev/null +++ b/bitnami/jupyterhub/templates/singleuser/networkpolicy.yaml @@ -0,0 +1,71 @@ +{{- if .Values.singleuser.networkPolicy.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: singleuser + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ printf "%s-singleuser" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ .Release.Namespace | quote }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: singleuser + policyTypes: + - Ingress + - Egress + ingress: + {{- if .Values.singleuser.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} + # Pods with label "hub.jupyter.org/network-access-singleuser" --> Single User + - ports: + - port: {{ .Values.singleuser.containerPort }} + from: + - podSelector: + matchLabels: + hub.jupyter.org/network-access-singleuser: "true" + {{- if .Values.singleuser.networkPolicy.allowInterspaceAccess }} + namespaceSelector: + matchLabels: {} + - namespaceSelector: + matchLabels: + hub.jupyter.org/network-access-singleuser: "true" + {{- end }} + egress: + # Single User --> Hub + - ports: + - port: {{ .Values.hub.containerPort }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} + app.kubernetes.io/component: hub + {{- if not .Values.singleuser.networkPolicy.allowCloudMetadataAccess }} + ## Limit access to the Cloud Metadata API + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 169.254.169.254/32 + {{- end }} + ## DNS access + - ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + ## PostgreSQL access + - ports: + - protocol: UDP + port: {{ .Values.postgresql.service.port }} + - protocol: TCP + port: {{ .Values.postgresql.service.port }} + {{- if .Values.singleuser.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/bitnami/jupyterhub/templates/singleuser/service-account.yaml b/bitnami/jupyterhub/templates/singleuser/service-account.yaml new file mode 100644 index 000000000..abd451cae --- /dev/null +++ b/bitnami/jupyterhub/templates/singleuser/service-account.yaml @@ -0,0 +1,16 @@ +{{ if .Values.singleuser.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: singleuser + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + name: {{ template "jupyterhub.singleuserServiceAccountName" . }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + namespace: {{ .Release.Namespace | quote }} + {{- include "jupyterhub.imagePullSecrets" . | nindent 2 }} +{{- end }} diff --git a/bitnami/jupyterhub/values.yaml b/bitnami/jupyterhub/values.yaml new file mode 100644 index 000000000..4c0335234 --- /dev/null +++ b/bitnami/jupyterhub/values.yaml @@ -0,0 +1,1656 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## @section Global parameters +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## +# global: +# imageRegistry: +# imagePullSecrets: [] +# - myRegistryKeySecretName +# storageClass: myStorageClass + +## @section Common parameters +## Override Kubernetes version +## @param kubeVersion Override Kubernetes version +## +kubeVersion: + +## String to partially override common.names.fullname template (will maintain the release name) +## @param nameOverride String to partially override common.names.fullname +## +nameOverride: + +## String to fully override common.names.fullname template +## @param fullnameOverride String to fully override common.names.fullname +## +fullnameOverride: + +## Add labels to all the deployed resources +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} + +## Add annotations to all the deployed resources +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} + +## Extra objects to deploy (value evaluated as a template) +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] + +## @section Hub deployment parameters +## Hub deployment parameters +## +hub: + image: + ## @param hub.image.registry Hub image registry + ## + registry: docker.io + ## @param hub.image.repository Hub image repository + ## + repository: bitnami/jupyterhub + ## @param hub.image.tag Hub image tag (immutabe tags are recommended) + ## + tag: 1.4.0-debian-10-r1 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + ## @param hub.image.pullPolicy Hub image pull policy + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## @param hub.image.pullSecrets Hub image pull secrets + ## + pullSecrets: [] + + ## Configure extra options for startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-startup-readiness-probes/#configure-probes + ## + ## @param hub.startupProbe.enabled Enable startupProbe + ## @param hub.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param hub.startupProbe.periodSeconds Period seconds for startupProbe + ## @param hub.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param hub.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param hub.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 3 + successThreshold: 1 + + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## + ## @param hub.livenessProbe.enabled Enable livenessProbe + ## @param hub.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param hub.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param hub.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param hub.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param hub.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 3 + successThreshold: 1 + + ## @param hub.readinessProbe.enabled Enable readinessProbe + ## @param hub.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param hub.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param hub.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param hub.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param hub.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 3 + successThreshold: 1 + + ## Hub base URL + ## @param hub.baseUrl Hub base URL + ## + baseUrl: / + + ## Hub admin user + ## @param hub.adminUser Hub Dummy authenticator admin user + ## + adminUser: user + + ## Hub Dummy authenticator password + ## @param hub.password Hub Dummy authenticator password + ## + password: + + ## Configuration file passed to the hub. This will be used by the jupyterhub_config.py file + ## This configuration uses the values for the `singleuser` section. In the upstream chart the + ## values.yaml file is mounted in the hub container. This is chart, we tried to separate both + ## configuration so we could follow the Bitnami value standards + ## @param hub.configuration [object] Hub configuration file (to be used by jupyterhub_config.py) + ## + configuration: | + Chart: + Name: {{ .Chart.Name }} + Version: {{ .Chart.Version }} + Release: + Name: {{ .Release.Name }} + Namespace: {{ .Release.Namespace }} + Service: {{ .Release.Service }} + hub: + config: + JupyterHub: + admin_access: true + authenticator_class: dummy + cookie_secret_file: /tmp/jupyterhub_cookie_secret + DummyAuthenticator: + {{- if .Values.hub.password }} + password: {{ .Values.hub.password | quote }} + {{- else }} + password: {{ randAlphaNum 10 | quote }} + {{- end }} + Authenticator: + admin_users: + - {{ .Values.hub.adminUser }} + cookieSecret: + concurrentSpawnLimit: 64 + consecutiveFailureLimit: 5 + activeServerLimit: + db: + type: postgres + url: postgresql://{{ ternary .Values.postgresql.postgresqlUsername .Values.externalDatabase.user .Values.postgresql.enabled }}@{{ ternary (include "jupyterhub.postgresql.fullname" .) .Values.externalDatabase.host .Values.postgresql.enabled }}:{{ ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled }}/{{ ternary .Values.postgresql.postgresqlDatabase .Values.externalDatabase.database .Values.postgresql.enabled }} + services: {} + allowNamedServers: false + namedServerLimitPerUser: + authenticatePrometheus: + redirectToServer: + shutdownOnLogout: + singleuser: + podNameTemplate: {{ include "common.names.fullname" . }}-jupyter-{username} + {{- if .Values.singleuser.tolerations }} + extraTolerations: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.tolerations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.nodeSelector "context" $) | nindent 4 }} + {{- end }} + networkTools: + image: + name: {{ include "jupyterhub.hubconfiguration.imageEntry" ( dict "imageRoot" .Values.auxiliaryImage "global" $) }} + tag: {{ .Values.auxiliaryImage.tag }} + pullPolicy: {{ .Values.auxiliaryImage.pullPolicy }} + pullSecrets: {{- include "jupyterhub.imagePullSecrets" . | nindent 8 }} + cloudMetadata: + blockWithIptables: false + events: true + extraAnnotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.podAnnotations "context" $ ) | nindent 4 }} + {{- end }} + extraLabels: + hub.jupyter.org/network-access-hub: "true" + app.kubernetes.io/component: singleuser + {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.extraEnvVars }} + extraEnv: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.extraEnvVars "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.lifecycleHooks }} + lifecycleHooks: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.lifecycleHooks "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.initContainers }} + initContainers: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.initContainers "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.sidecars }} + extraContainers: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.sidecars "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.containerSecurityContext.enabled }} + uid: {{ .Values.singleuser.containerSecurityContext.runAsUser }} + {{- end }} + {{- if .Values.singleuser.podSecurityContext.enabled }} + fsGid: {{ .Values.singleuser.podSecurityContext.fsGroup }} + {{- end }} + serviceAccountName: {{ template "jupyterhub.singleuserServiceAccountName" . }} + storage: + {{- if .Values.singleuser.persistence.enabled }} + type: dynamic + {{- else }} + type: none + {{- end }} + extraLabels: + app.kubernetes.io/component: singleuser + {{- include "common.labels.standard" . | nindent 6 }} + {{- if .Values.singleuser.extraVolumes }} + extraVolumes: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.extraVolumes "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.singleuser.extraVolumeMounts }} + extraVolumeMounts: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.extraVolumeMounts "context" $ ) | nindent 4 }} + {{- end }} + capacity: {{ .Values.singleuser.persistence.size }} + homeMountPath: {{ .Values.singleuser.notebookDir }} + dynamic: + storageClass: {{ include "common.storage.class" (dict "persistence" .Values.singleuser.persistence "global" .Values.global) }} + pvcNameTemplate: {{ include "common.names.fullname" . }}-claim-{username}{servername} + volumeNameTemplate: {{ include "common.names.fullname" . }}-volume-{username}{servername} + storageAccessModes: {{- include "common.tplvalues.render" ( dict "value" .Values.singleuser.persistence.accessModes "context" $ ) | nindent 8 }} + image: + name: {{ include "jupyterhub.hubconfiguration.imageEntry" ( dict "imageRoot" .Values.singleuser.image "global" $) }} + tag: {{ .Values.singleuser.image.tag }} + pullPolicy: {{ .Values.singleuser.image.pullPolicy }} + pullSecrets: {{- include "jupyterhub.imagePullSecrets" . | nindent 8 }} + startTimeout: 300 + {{- /* We need to replace the Kubernetes memory/cpu terminology (e.g. 10Gi, 10Mi) with one compatible with Python (10G, 10M) */}} + cpu: + limit: {{ regexReplaceAll "([A-Za-z])i" (default "" .Values.singleuser.resources.limits.cpu) "${1}"}} + guarantee: {{ regexReplaceAll "([A-Za-z])i" (default "" .Values.singleuser.resources.requests.cpu) "${1}" }} + memory: + limit: {{ regexReplaceAll "([A-Za-z])i" (default "" .Values.singleuser.resources.limits.memory) "${1}" }} + guarantee: {{ regexReplaceAll "([A-Za-z])i" (default "" .Values.singleuser.resources.requests.memory) "${1}" }} + {{- if .Values.singleuser.command }} + cmd: {{- include "common.tplvalues.render" (dict "value" .Values.singleuser.command "context" $) | nindent 12 }} + {{- else }} + cmd: jupyterhub-singleuser + {{- end }} + defaultUrl: + cull: + enabled: true + users: false + removeNamedServers: false + timeout: 3600 + every: 600 + concurrency: 10 + maxAge: 0 + + ## Hub Container port + ## @param hub.containerPort Hub container port + ## + containerPort: 8081 + + ## ConfigMap with hub init scripts + ## @param hub.existingConfigmap Configmap with Hub init scripts (replaces the scripts in templates/hub/configmap.yml) + ## + existingConfigmap: + + ## Secret with hub configuration + ## @param hub.existingSecret Secret with hub configuration (replaces the hub.configuration value) and proxy token + ## + existingSecret: + + ## Command and args for running the container (set to default if not set). Use array form + ## @param hub.command Override Hub default command + ## @param hub.args Override Hub default args + ## + command: [] + args: [] + + pdb: + ## @param hub.pdb.create Deploy Hub PodDisruptionBudget + ## + create: false + ## @param hub.pdb.minAvailable Set minimum available hub instances + ## + minAvailable: + ## @param hub.pdb.maxUnavailable Set maximum available hub instances + ## + maxUnavailable: + + ## @param hub.priorityClassName Hub pod priority class name + ## + priorityClassName: + + ## Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## @param hub.hostAliases Add deployment host aliases + ## + hostAliases: [] + + ## hub resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param hub.resources.limits The resources limits for the Hub container + ## + limits: {} + # cpu: 200m + # memory: 256Mi + ## @param hub.resources.requests The requested resources for the Hub container + ## + requests: {} + # cpu: 200m + # memory: 10Mi + + ## hub containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param hub.containerSecurityContext.enabled Enabled Hub containers' Security Context + ## @param hub.containerSecurityContext.runAsUser Set Hub container's Security Context runAsUser + ## @param hub.containerSecurityContext.runAsNonRoot Set Hub container's Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1000 + runAsNonRoot: true + + ## hub pods' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param hub.podSecurityContext.enabled Enabled Hub pods' Security Context + ## @param hub.podSecurityContext.fsGroup Set Hub pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + + ## Pod affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## @param hub.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + podAffinityPreset: "" + + ## Pod anti-affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## @param hub.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + podAntiAffinityPreset: soft + + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## Allowed values: soft, hard + ## @param hub.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param hub.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set + ## @param hub.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set + ## + nodeAffinityPreset: + ## Node affinity type + ## Allowed values: soft, hard + ## + type: "" + ## Node label key to match + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## Node label values to match + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + + ## Affinity for pod assignment. Evaluated as a template. + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## @param hub.affinity Affinity for pod assignment + ## + affinity: {} + + ## Node labels for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## @param hub.nodeSelector Node labels for pod assignment + ## + nodeSelector: {} + + ## Tolerations for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## @param hub.tolerations Tolerations for pod assignment + ## + tolerations: [] + + ## Pod extra labels + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param hub.podLabels Extra labels for Hub pods + ## + podLabels: {} + + ## Annotations for server pods. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## @param hub.podAnnotations Annotations for Hub pods + ## + podAnnotations: {} + + ## lifecycleHooks for the hub container to automate configuration before or after startup. + ## @param hub.lifecycleHooks Add lifecycle hooks to the Hub deployment + ## + lifecycleHooks: {} + + ## Custom Startup probes for hub + ## @param hub.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + + ## Custom Liveness probes for hub + ## @param hub.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + + ## Custom Rediness probes hub + ## @param hub.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + + ## Update strategy - only really applicable for deployments with RWO PVs attached + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## @param hub.updateStrategy.type Hub deployment update strategy + ## + updateStrategy: + type: RollingUpdate + + ## Additional environment variables to set + ## Example: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## @param hub.extraEnvVars Add extra environment variables to the Hub container + ## + extraEnvVars: [] + + ## ConfigMap with extra environment variables + ## @param hub.extraEnvVarsCM Name of existing ConfigMap containing extra env vars + ## + extraEnvVarsCM: + + ## Secret with extra environment variables + ## @param hub.extraEnvVarsSecret Name of existing Secret containing extra env vars + ## + extraEnvVarsSecret: + + ## Extra volumes to add to the deployment + ## @param hub.extraVolumes Optionally specify extra list of additional volumes for Hub pods + ## + extraVolumes: [] + + ## Extra volume mounts to add to the container + ## @param hub.extraVolumeMounts Optionally specify extra list of additional volumeMounts for Hub container(s) + ## + extraVolumeMounts: [] + + ## Add init containers to the hub pods. + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param hub.initContainers Add additional init containers to the Hub pods + ## + initContainers: {} + + ## Add sidecars to the hub pods. + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param hub.sidecars Add additional sidecar containers to the Hub pod + ## + sidecars: {} + + ## @section Hub RBAC parameters + ## Specifies whether a ServiceAccount should be created + ## + serviceAccount: + ## @param hub.serviceAccount.create Create Hub service account + ## + create: true + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + ## + ## @param hub.serviceAccount.name Override Hub service account name + ## + name: + + ## Specifies whether RBAC resources should be created + ## + rbac: + ## @param hub.rbac.create Create RBAC rules for the Hub service account + ## + create: true + + ## @section Hub Traffic Exposure Parameters + ## + + ## Network policy + ## + networkPolicy: + ## @param hub.networkPolicy.enabled Deploy Hub network policies + ## + enabled: true + ## @param hub.networkPolicy.allowInterspaceAccess Allow communication between pods in different namespaces + ## + allowInterspaceAccess: true + ## @param hub.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: [] + + ## @param hub.networkPolicy.extraEgress [object] Add extra ingress rules to the NetworkPolicy + ## + extraEgress: | + ## Hub --> Any IP:PORT + ## + - to: + + service: + ## @param hub.service.type Hub service type + ## + type: ClusterIP + ## @param hub.service.port Hub service port + # HTTP Port + port: 8081 + ## loadBalancerIP for the Hub Service (optional, cloud specific) + ## ref: http://kubernetes.io/docs/user-guide/services/#type-loadbalancer + ## @param hub.service.loadBalancerIP Hub service LoadBalancer IP + ## + loadBalancerIP: + ## loadBalancerIP source ranges for the Service + ## @param hub.service.loadBalancerSourceRanges loadBalancerIP source ranges for the Service + ## + loadBalancerSourceRanges: [] + ## + ## nodePorts: + ## http: + ## https: + ## + ## @param hub.service.nodePorts.http NodePort for the HTTP endpoint + ## + nodePorts: + http: "" + ## Enable client source IP preservation + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## @param hub.service.externalTrafficPolicy External traffic policy for the service + ## + externalTrafficPolicy: Cluster + +## @section Proxy deployment parameters +## Proxy deployment parameters +## +proxy: + image: + ## @param proxy.image.registry Proxy image registry + ## + registry: docker.io + ## @param proxy.image.repository Proxy image repository + ## + repository: bitnami/configurable-http-proxy + ## @param proxy.image.tag Proxy image tag (immutabe tags are recommended) + ## + tag: 4.3.2-debian-10-r10 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + ## @param proxy.image.pullPolicy Proxy image pull policy + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + ## @param proxy.image.pullSecrets Proxy image pull secrets + ## + pullSecrets: [] + ## @param proxy.image.debug Activate verbose output + ## + debug: false + + ## Configure extra options for startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-startup-readiness-probes/#configure-probes + ## + ## @param proxy.startupProbe.enabled Enable startupProbe + ## @param proxy.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param proxy.startupProbe.periodSeconds Period seconds for startupProbe + ## @param proxy.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param proxy.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param proxy.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 3 + successThreshold: 1 + + ## Configure extra options for liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## + ## @param proxy.livenessProbe.enabled Enable livenessProbe + ## @param proxy.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param proxy.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param proxy.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param proxy.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param proxy.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 3 + successThreshold: 1 + + ## @param proxy.readinessProbe.enabled Enable readinessProbe + ## @param proxy.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param proxy.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param proxy.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param proxy.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param proxy.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 3 + successThreshold: 1 + + ## Command and args for running the container (set to default if not set). Use array form + ## + ## @param proxy.command Override Proxy default command + ## @param proxy.args Override Proxy default args + ## + command: [] + args: [] + + ## @param proxy.secretToken Proxy secret token (used for communication with the Hub) + ## + secretToken: + + ## Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## @param proxy.hostAliases Add deployment host aliases + ## + hostAliases: [] + + ## PodDisruptionBudget settings + ## + pdb: + ## @param proxy.pdb.create Deploy Proxy PodDisruptionBudget + ## + create: false + ## @param proxy.pdb.minAvailable Set minimum available proxy instances + ## + minAvailable: + ## @param proxy.pdb.maxUnavailable Set maximum available proxy instances + ## + maxUnavailable: + + ## Container ports + ## + containerPort: + ## @param proxy.containerPort.api Proxy api container port + ## + api: 8001 + ## @param proxy.containerPort.http Proxy http container port + ## + http: 8000 + + ## @param proxy.priorityClassName Proxy pod priority class name + ## + priorityClassName: + + ## proxy resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param proxy.resources.limits The resources limits for the Proxy container + ## + limits: {} + # cpu: 200m + # memory: 256Mi + ## @param proxy.resources.requests The requested resources for the Proxy container + ## + requests: {} + # cpu: 200m + # memory: 10Mi + + ## proxy containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param proxy.containerSecurityContext.enabled Enabled Proxy containers' Security Context + ## @param proxy.containerSecurityContext.runAsUser Set Proxy container's Security Context runAsUser + ## @param proxy.containerSecurityContext.runAsNonRoot Set Proxy container's Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + + ## proxy pods' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param proxy.podSecurityContext.enabled Enabled Proxy pods' Security Context + ## @param proxy.podSecurityContext.fsGroup Set Proxy pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + + ## Pod affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## @param proxy.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + podAffinityPreset: "" + + ## Pod anti-affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## @param proxy.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + podAntiAffinityPreset: soft + + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## Allowed values: soft, hard + ## @param proxy.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param proxy.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set + ## @param proxy.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set + ## + nodeAffinityPreset: + ## Node affinity type + ## Allowed values: soft, hard + ## + type: "" + ## Node label key to match + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## Node label values to match + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + + ## Affinity for pod assignment. Evaluated as a template. + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## @param proxy.affinity Affinity for pod assignment + ## + affinity: {} + + ## Node labels for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## @param proxy.nodeSelector Node labels for pod assignment + ## + nodeSelector: {} + + ## Tolerations for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## @param proxy.tolerations Tolerations for pod assignment + ## + tolerations: [] + + ## Pod extra labels + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param proxy.podLabels Extra labels for Proxy pods + ## + podLabels: {} + + ## Annotations for server pods. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## @param proxy.podAnnotations Annotations for Proxy pods + ## + podAnnotations: {} + + ## lifecycleHooks for the proxy container to automate configuration before or after startup. + ## @param proxy.lifecycleHooks Add lifecycle hooks to the Proxy deployment + ## + lifecycleHooks: {} + + ## Custom Startup probes for proxy + ## @param proxy.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + + ## Custom Liveness probes for proxy + ## @param proxy.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + + ## Custom Rediness probes proxy + ## @param proxy.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + + ## Update strategy - only really applicable for deployments with RWO PVs attached + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## @param proxy.updateStrategy.type Proxy deployment update strategy + ## + updateStrategy: + type: RollingUpdate + + ## Additional environment variables to set + ## Example: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + ## @param proxy.extraEnvVars Add extra environment variables to the Proxy container + ## + extraEnvVars: [] + + ## ConfigMap with extra environment variables + ## @param proxy.extraEnvVarsCM Name of existing ConfigMap containing extra env vars + ## + extraEnvVarsCM: + + ## Secret with extra environment variables + ## @param proxy.extraEnvVarsSecret Name of existing Secret containing extra env vars + ## + extraEnvVarsSecret: + + ## Extra volumes to add to the deployment + ## @param proxy.extraVolumes Optionally specify extra list of additional volumes for Proxy pods + ## + extraVolumes: [] + + ## Extra volume mounts to add to the container + ## @param proxy.extraVolumeMounts Optionally specify extra list of additional volumeMounts for Proxy container(s) + ## + extraVolumeMounts: [] + + ## Add init containers to the proxy pods. + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param proxy.initContainers Add additional init containers to the Proxy pods + ## + initContainers: {} + + ## Add sidecars to the proxy pods. + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param proxy.sidecars Add additional sidecar containers to the Proxy pod + ## + sidecars: {} + + ## @section Proxy Traffic Exposure Parameters + ## + + ## Network policy + ## + networkPolicy: + ## @param proxy.networkPolicy.enabled Deploy Proxy network policies + ## + enabled: true + ## @param proxy.networkPolicy.allowInterspaceAccess Allow communication between pods in different namespaces + ## + allowInterspaceAccess: true + ## @param proxy.networkPolicy.extraIngress [object] Add extra ingress rules to the NetworkPolicy + ## + extraIngress: | + ## Any IP --> Proxy + ## + - ports: + - port: {{ .Values.proxy.containerPort.http }} + + ## @param proxy.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy + ## + extraEgress: + + service: + api: + ## @param proxy.service.api.type API service type + ## + type: ClusterIP + # HTTP Port + ## @param proxy.service.api.port API service port + ## + port: 8001 + ## loadBalancerIP for the Service (optional, cloud specific) + ## ref: http://kubernetes.io/docs/user-guide/services/#type-loadbalancer + ## @param proxy.service.api.loadBalancerIP API service LoadBalancer IP + ## + loadBalancerIP: + ## loadBalancerIP source ranges for the Service + ## @param proxy.service.api.loadBalancerSourceRanges loadBalancerIP source ranges for the Service + ## + loadBalancerSourceRanges: [] + ## + ## nodePorts: + ## http: + ## https: + ## @param proxy.service.api.nodePorts.http NodePort for the HTTP endpoint + ## + nodePorts: + http: "" + ## Enable client source IP preservation + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## @param proxy.service.api.externalTrafficPolicy External traffic policy for the service + ## + externalTrafficPolicy: Cluster + + public: + ## @param proxy.service.public.type Public service type + ## + type: LoadBalancer + # HTTP Port + ## @param proxy.service.public.port Public service port + ## + port: 80 + ## loadBalancerIP for the Service (optional, cloud specific) + ## ref: http://kubernetes.io/docs/user-guide/services/#type-loadbalancer + ## @param proxy.service.public.loadBalancerIP Public service LoadBalancer IP + ## + loadBalancerIP: + ## loadBalancerIP source ranges for the Service + ## @param proxy.service.public.loadBalancerSourceRanges loadBalancerIP source ranges for the Service + ## + loadBalancerSourceRanges: [] + ## + ## nodePorts: + ## http: + ## https: + ## @param proxy.service.public.nodePorts.http NodePort for the HTTP endpoint + ## + nodePorts: + http: "" + ## Enable client source IP preservation + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## @param proxy.service.public.externalTrafficPolicy External traffic policy for the service + ## + externalTrafficPolicy: Cluster + + ## Configure the ingress resource that allows you to access to your JupyterHub instance + ## + ingress: + ## Set to true to enable ingress record generation + ## @param proxy.ingress.enabled Enable ingress for the Public service + ## + enabled: false + + ## Ingress Path + ## @param proxy.ingress.path Path to the Proxy pod. + ## + path: / + + ## Ingress Path type + ## @param proxy.ingress.pathType Ingress path type + ## + pathType: ImplementationSpecific + + ## Set this to true in order to add the corresponding annotations for cert-manager + ## @param proxy.ingress.certManager Add cert-manager annotations to the Ingress object + ## + certManager: false + + ## When the ingress is enabled, a host pointing to this will be created + ## @param proxy.ingress.hostname Set ingress rule hostname + ## + hostname: jupyterhub.local + + ## Ingress annotations done as key:value pairs + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md + ## + ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set + ## @param proxy.ingress.annotations Add annotations to the Ingress object + ## + annotations: {} + + ## Enable TLS configuration for the hostname defined at ingress.hostname parameter + ## TLS certificates will be retrieved from a TLS secret with name: {{- printf "%s-tls" .Values.ingress.hostname }} + ## You can use the ingress.secrets parameter to create this TLS secret, relay on cert-manager to create it, or + ## let the chart create self-signed certificates for you + ## @param proxy.ingress.tls Enable ingress tls configuration for the hostname defined at proxy.ingress.hostname + ## + tls: false + + ## The list of additional hostnames to be covered with this ingress record. + ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array + ## extraHosts: + ## - name: aspnet-core.local + ## path: / + ## @param proxy.ingress.extraHosts Add extra hosts to the ingress rule + ## + extraHosts: [] + + ## The tls configuration for additional hostnames to be covered with this ingress record. + ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## extraTls: + ## - hosts: + ## - aspnet-core.local + ## secretName: aspnet-core.local-tls + ## @param proxy.ingress.extraTls Add extra tls configuration for additional hostnames + ## + extraTls: [] + + ## Any additional arbitrary paths that may need to be added to the ingress under the main host. + ## For example: The ALB ingress controller requires a special rule for handling SSL redirection. + ## @param proxy.ingress.extraPaths Add extra paths to the ingress rule + ## + extraPaths: [] + + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or -----BEGIN RSA PRIVATE KEY----- + ## name should line up with a secretName set further up + ## + ## If it is not set and you're using cert-manager, this is unneeded, as it will create the secret for you + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## @param proxy.ingress.secrets Add extra secrets for the tls configuration + ## + secrets: [] + ## - name: aspnet-core.local-tls + ## key: + ## certificate: + ## + +## @section Image puller deployment parameters +## Image Puller deployment parameters +## +imagePuller: + ## @param imagePuller.enabled Deploy ImagePuller daemonset + ## + enabled: true + + ## Command and args for running the container (set to default if not set). Use array form + ## @param imagePuller.command Override ImagePuller default command + ## @param imagePuller.args Override ImagePuller default args + ## + command: [] + args: [] + + ## Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## @param imagePuller.hostAliases Add deployment host aliases + ## + hostAliases: [] + + ## imagePuller resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param imagePuller.resources.limits The resources limits for the ImagePuller container + ## + limits: {} + # cpu: 200m + # memory: 256Mi + ## @param imagePuller.resources.requests The resources request for the ImagePuller container + ## + requests: {} + # cpu: 200m + # memory: 10Mi + + ## imagePuller containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param imagePuller.containerSecurityContext.enabled Enabled ImagePuller containers' Security Context + ## @param imagePuller.containerSecurityContext.runAsUser Set ImagePuller container's Security Context runAsUser + ## @param imagePuller.containerSecurityContext.runAsNonRoot Set ImagePuller container's Security Context runAsNonRoot + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + + ## imagePuller pods' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param imagePuller.podSecurityContext.enabled Enabled ImagePuller pods' Security Context + ## @param imagePuller.podSecurityContext.fsGroup Set ImagePuller pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + + ## Pod affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## @param imagePuller.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + podAffinityPreset: "" + + ## Pod anti-affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## @param imagePuller.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + podAntiAffinityPreset: soft + + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## Allowed values: soft, hard + ## @param imagePuller.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param imagePuller.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set + ## @param imagePuller.nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set + ## + nodeAffinityPreset: + ## Node affinity type + ## Allowed values: soft, hard + ## + type: "" + ## Node label key to match + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## Node label values to match + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + + ## Affinity for pod assignment. Evaluated as a template. + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## @param imagePuller.affinity Affinity for pod assignment + ## + affinity: {} + + ## Node labels for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## @param imagePuller.nodeSelector Node labels for pod assignment + ## + nodeSelector: {} + + ## Tolerations for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## @param imagePuller.tolerations Tolerations for pod assignment + ## + tolerations: [] + + ## Pod extra labels + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param imagePuller.podLabels Extra labels for ImagePuller pods + ## + podLabels: {} + + ## Annotations for server pods. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## @param imagePuller.podAnnotations Annotations for ImagePuller pods + ## + podAnnotations: {} + + ## imagePuller pods' priority. + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ + ## @param imagePuller.priorityClassName ImagePuller pod priority class name + ## + priorityClassName: "" + + ## lifecycleHooks for the imagePuller container to automate configuration before or after startup. + ## @param imagePuller.lifecycleHooks Add lifecycle hooks to the ImagePuller deployment + ## + lifecycleHooks: {} + + ## Custom Startup probes for imagePuller + ## @param imagePuller.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + + ## Custom Liveness probes for imagePuller + ## @param imagePuller.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + + ## Custom Rediness probes imagePuller + ## @param imagePuller.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + + ## Update strategy - only really applicable for deployments with RWO PVs attached + ## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the + ## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will + ## terminate the single previous pod, so that the new, incoming pod can attach to the PV + ## @param imagePuller.updateStrategy.type ImagePuller deployment update strategy + ## + updateStrategy: + type: RollingUpdate + + ## Additional environment variables to set + ## Example: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## @param imagePuller.extraEnvVars Add extra environment variables to the ImagePuller container + ## + extraEnvVars: [] + + ## ConfigMap with extra environment variables + ## @param imagePuller.extraEnvVarsCM Name of existing ConfigMap containing extra env vars + ## + extraEnvVarsCM: + + ## Secret with extra environment variables + ## @param imagePuller.extraEnvVarsSecret Name of existing Secret containing extra env vars + ## + extraEnvVarsSecret: + + ## Extra volumes to add to the deployment + ## @param imagePuller.extraVolumes Optionally specify extra list of additional volumes for ImagePuller pods + ## + extraVolumes: [] + + ## Extra volume mounts to add to the container + ## @param imagePuller.extraVolumeMounts Optionally specify extra list of additional volumeMounts for ImagePuller container(s) + ## + extraVolumeMounts: [] + + ## Add init containers to the imagePuller pods. + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param imagePuller.initContainers Add additional init containers to the ImagePuller pods + ## + initContainers: {} + + ## Add sidecars to the imagePuller pods. + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param imagePuller.sidecars Add additional sidecar containers to the ImagePuller pod + ## + sidecars: {} + +## @section Singleuser deployment parameters +## Singleuser deployment parameters +## NOTE: The values in this section are used for generating the hub.configuration value. In case you provide +## a custom hub.configuration or a configmap, these will be ignored. +## +singleuser: + image: + ## @param singleuser.image.registry Single User image registry + ## + registry: docker.io + ## @param singleuser.image.repository Single User image repository + ## + repository: bitnami/jupyter-base-notebook + ## @param singleuser.image.tag Single User image tag (immutabe tags are recommended) + ## + tag: 1.3.0-debian-10-r13 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + ## @param singleuser.image.pullPolicy Single User image pull policy + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + ## @param singleuser.image.pullSecrets Single User image pull secrets + ## + pullSecrets: [] + + ## Command for running the container (set to default if not set). Use array form + ## @param singleuser.command Override Single User default command + ## + command: [] + + ## Tolerations for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## @param singleuser.tolerations Tolerations for pod assignment + ## + tolerations: [] + + ## @param singleuser.containerPort Single User container port + ## + containerPort: 8888 + + ## @param singleuser.notebookDir Notebook directory (it will be the same as the PVC volume mount) + ## + notebookDir: /opt/bitnami/jupyterhub-singleuser + + ## singleuser resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param singleuser.resources.limits The resources limits for the Single User container + ## + limits: {} + ## @param singleuser.resources.requests The requested resources for the Single User container + ## + requests: {} + + ## singleuser containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param singleuser.containerSecurityContext.enabled Enabled Single User containers' Security Context + ## @param singleuser.containerSecurityContext.runAsUser Set Single User container's Security Context runAsUser + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + + ## singleuser pods' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param singleuser.podSecurityContext.enabled Enabled Single User pods' Security Context + ## @param singleuser.podSecurityContext.fsGroup Set Single User pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + + ## Node labels for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## @param singleuser.nodeSelector Node labels for pod assignment + ## + nodeSelector: {} + + ## Pod extra labels + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## @param singleuser.podLabels Extra labels for Single User pods + ## + podLabels: {} + + ## Annotations for server pods. + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## @param singleuser.podAnnotations Annotations for Single User pods + ## + podAnnotations: {} + + ## singleuser pods' priority. + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ + ## @param singleuser.priorityClassName Single User pod priority class name + ## + priorityClassName: + + ## lifecycleHooks for the singleuser container to automate configuration before or after startup. + ## @param singleuser.lifecycleHooks Add lifecycle hooks to the Single User deployment + ## + lifecycleHooks: {} + + ## Additional environment variables to set + ## Example: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## @param singleuser.extraEnvVars Add extra environment variables to the Single User container + ## + extraEnvVars: [] + + ## Extra volumes to add to the deployment + ## @param singleuser.extraVolumes Optionally specify extra list of additional volumes for Single User pods + ## + extraVolumes: [] + + ## Extra volume mounts to add to the container + ## @param singleuser.extraVolumeMounts Optionally specify extra list of additional volumeMounts for Single User container(s) + ## + extraVolumeMounts: [] + + ## Add init containers to the singleuser pods. + ## Example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param singleuser.initContainers Add additional init containers to the Single User pods + ## + initContainers: {} + + ## Add sidecars to the singleuser pods. + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## @param singleuser.sidecars Add additional sidecar containers to the Single User pod + ## + sidecars: {} + + ## @section Single User RBAC parameters + ## Specifies whether a ServiceAccount should be created + ## + serviceAccount: + ## @param singleuser.serviceAccount.create Create Single User service account + ## + create: true + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + ## @param singleuser.serviceAccount.name Override Single User service account name + ## + name: + + ## @section Single User Persistence parameters + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + persistence: + ## If true, use a Persistent Volume Claim, If false, use emptyDir + ## @param singleuser.persistence.enabled Enable persistent volume creation on Single User instances + ## + enabled: true + ## Single User data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## @param singleuser.persistence.storageClass Persistent Volumes storage class + ## + storageClass: "" + ## Persistent Volume Access Modes + ## @param singleuser.persistence.accessModes[0] Persistent Volumes access modes + ## + accessModes: + - ReadWriteOnce + ## Persistent Volume size + ## @param singleuser.persistence.size Persistent Volumes size + ## + size: 10Gi + + ## @section Traffic exposure parameters + ## Network policy + ## + networkPolicy: + ## @param singleuser.networkPolicy.enabled Deploy Single User network policies + ## + enabled: true + ## @param singleuser.networkPolicy.allowInterspaceAccess Allow communication between pods in different namespaces + ## + allowInterspaceAccess: true + ## @param singleuser.networkPolicy.allowCloudMetadataAccess Allow Single User pods to access Cloud Metada endpoints + ## + allowCloudMetadataAccess: false + ## @param singleuser.networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## + extraIngress: + + ## @param singleuser.networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy + ## + extraEgress: + +## @section Auxiliary image parameters +## +auxiliaryImage: + ## @param auxiliaryImage.registry Auxiliary image registry + ## + registry: docker.io + ## @param auxiliaryImage.repository Auxiliary image repository + ## + repository: bitnami/bitnami-shell + ## @param auxiliaryImage.tag Auxiliary image tag (immutabe tags are recommended) + ## + tag: "10" + ## @param auxiliaryImage.pullPolicy Auxiliary image pull policy + ## + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + ## @param auxiliaryImage.pullSecrets Auxiliary image pull secrets + ## + pullSecrets: [] + ## - myRegistryKeySecretName + ## + +## @section External Database settings +## + +## +## External Database Configuration +## +## All of these values are only used when postgresql.enabled is set to false +## +externalDatabase: + ## Database host + ## @param externalDatabase.host Host of an external PostgreSQL instance to connect (only if postgresql.enabled=false) + ## + host: + ## @param externalDatabase.user User of an external PostgreSQL instance to connect (only if postgresql.enabled=false) + ## + user: postgres + ## Database password + ## @param externalDatabase.password Password of an external PostgreSQL instance to connect (only if postgresql.enabled=false) + ## + password: "" + ## Name of an existing secret resource containing the DB password in a 'postgresql-password' key + ## @param externalDatabase.existingSecret Secret containing the password of an external PostgreSQL instance to connect (only if postgresql.enabled=false) + ## + existingSecret: "" + ## Name of the database + ## @param externalDatabase.database Database inside an external PostgreSQL to connect (only if postgresql.enabled=false) + ## + database: jupyterhub + + ## Database port number + ## @param externalDatabase.port Port of an external PostgreSQL to connect (only if postgresql.enabled=false) + ## + port: 5432 + +## @section PostgreSQL subchart settings +## PostgreSQL chart configuration +## +## https://github.com/bitnami/charts/blob/master/bitnami/postgresql/values.yaml +## +postgresql: + ## @param postgresql.enabled Deploy PostgreSQL subchart + ## + enabled: true + ## @param postgresql.nameOverride Override name of the PostgreSQL chart + ## + nameOverride: + ## @param postgresql.existingSecret Existing secret containing the password of the PostgreSQL chart + ## + existingSecret: + ## PostgreSQL password + ## ref: https://hub.docker.com/_/postgres/ + ## @param postgresql.postgresqlPassword Password for the postgres user of the PostgreSQL chart (auto-generated if not set) + ## + postgresqlPassword: '' + + ## @param postgresql.postgresqlUsername Username to create when deploying the PostgreSQL chart + ## + postgresqlUsername: bn_jupyterhub + + ## @param postgresql.postgresqlDatabase Database to create when deploying the PostgreSQL chart + ## + postgresqlDatabase: bitnami_jupyterhub + + ## PostgreSQL service + ## + service: + ## @param postgresql.service.port PostgreSQL service port + ## + port: 5432 + + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + persistence: + ## @param postgresql.persistence.enabled Use PVCs when deploying the PostgreSQL chart + ## + enabled: true + ## If you want to reuse an existing claim, you can pass the name of the PVC using + ## the existingClaim variable + ## @param postgresql.persistence.existingClaim Use an existing PVC when deploying the PostgreSQL chart + ## + existingClaim: + + ## postgresql data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + ## @param postgresql.persistence.storageClass storageClass of the created PVCs + ## + storageClass: + ## @param postgresql.persistence.accessMode Access mode of the created PVCs + ## + accessMode: ReadWriteOnce + ## @param postgresql.persistence.size Size of the created PVCs + ## + size: 8Gi