values.yaml

etcGitConfig:
  enabled: false
nfsPVC:
  enabled: true

jupyterhub:
  prePuller:
    hook:
      pullOnlyOnChanges: true
  ingress:
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: 256m
      kubernetes.io/ingress.class: nginx
      cert-manager.io/cluster-issuer: letsencrypt-prod
      acme.cert-manager.io/http01-edit-in-place: "true"
  scheduling:
    podPriority:
      enabled: true
      globalDefault: false
      defaultPriority: 0
      userPlaceholderPriority: -10
    userScheduler:
      enabled: false
      resources:
        requests:
          # FIXME: Just unset this?
          cpu: 0.01
          memory: 128Mi
        limits:
          memory: 1G
  proxy:
    service:
      type: ClusterIP
    chp:
      resources:
        requests:
          # FIXME: We want no guarantees here!!!
          # This is lowest possible value
          cpu: 0.001
          memory: 64Mi
        limits:
          memory: 1Gi
    traefik:
      resources:
        requests:
          memory: 96Mi
        limits:
          memory: 1Gi
    https:
      enabled: true
      letsencrypt:
        contactEmail: yuvipanda@berkeley.edu
  singleuser:
    extraFiles:
      culling-config:
        mountPath: /etc/jupyter/jupyter_notebook_config.json
        data:
          NotebookApp:
            # shutdown the server after no 30 mins of no activity
            shutdown_no_activity_timeout: 1800

          # if a user leaves a notebook with a running kernel,
          # the effective idle timeout will typically be CULL_TIMEOUT + CULL_KERNEL_TIMEOUT
          # as culling the kernel will register activity,
          # resetting the no_activity timer for the server as a whole
          MappingKernelManager:
            # shutdown kernels after 30 mins of no activity
            cull_idle_timeout: 1800
            # check for idle kernels this often
            cull_interval: 60
            # a kernel with open connections but no activity still counts as idle
            # this is what allows us to shutdown servers
            # when people leave a notebook open and wander off
            cull_connected: true
          NotebookNotary:
            # Use memory for notebook notary file to workaround corrupted files on nfs
            # https://www.sqlite.org/inmemorydb.html
            # https://github.com/jupyter/jupyter/issues/174
            # https://github.com/ipython/ipython/issues/9163
            db_file: ":memory:"
      popularity-contest:
        mountPath: /opt/conda/etc/ipython/startup/000-popularity-contest.py
        stringData: |
          import popularity_contest.reporter
          popularity_contest.reporter.setup_reporter()
    extraEnv:
      SHELL: /bin/bash
      PYTHON_POPCONTEST_STATSD_HOST: 'support-prometheus-statsd-exporter.support'
      PYTHON_POPCONTEST_STATSD_PORT: '9125'
    startTimeout: 600 # 10 mins, because sometimes we have too many new nodes coming up together
    networkPolicy:
      enabled: true
      # We enable all outgoing access to the broader internet, but not to private IP ranges
      # of pods and services inside the cluster - except for outbound UDP and TCP to statsd,
      # for python-popularity-package.
      egress:
        # Allow code in hubs to talk to ingress provider, so they can talk to the hub via its
        # public URL
        - to:
            - namespaceSelector:
                matchLabels:
                  name: support
              podSelector:
                matchLabels:
                  app.kubernetes.io/name: ingress-nginx
          ports:
            - port: 443
              protocol: TCP
            - port: 80
              protocol: TCP
        # datahub.berkeley.edu is still not using the ingress provider, so
        # we have to explicitly allow access to it from our user pods.
        - to:
            - podSelector:
                matchLabels:
                  app: jupyterhub
                  component: autohttps
              namespaceSelector:
                matchLabels:
                  name: datahub-prod
          ports:
            - port: http
              protocol: TCP
            - port: https
              protocol: TCP
        # Allow user code to send packets to statsd for python-popularity-contest
        - to:
            - namespaceSelector:
                matchLabels:
                  name: support
              podSelector:
                matchLabels:
                  app.kubernetes.io/name: prometheus-statsd-exporter
          ports:
            # statsd ports
            - port: 9125
              protocol: TCP
            - port: 9125
              protocol: UDP
        - to:
            - ipBlock:
                cidr: 0.0.0.0/0
                except:
              # Don't allow network access to private IP ranges
              # Listed in https://datatracker.ietf.org/doc/html/rfc1918
                  - 10.0.0.0/8
                  - 172.16.0.0/12
                  - 192.168.0.0/16
              # Don't allow network access to the metadata IP
                  - 169.254.169.254/32
  hub:
    # The default of 64 is way too low for us
    concurrentSpawnLimit: 200
    config:
      Pagination:
        # Disable pagination completely, since there's no search functionality yet
        default_per_page: 30000
        max_per_page: 30000
      JupyterHub:
        authenticator_class: canvasauthenticator.CanvasOAuthenticator
        # Return 424, not 503, when requests go to a stopped server
        # Keeps our 503 error graphs clearer
        use_legacy_stopped_server_status_code: false
      Authenticator:
        enable_auth_state: true
      CanvasOAuthenticator:
        canvas_url: https://bcourses.berkeley.edu/
        strip_email_domain: berkeley.edu
        login_service: bCourses
        scope:
          - url:GET|/api/v1/users/:user_id/profile
          - url:GET|/api/v1/courses
        username_key: primary_email

    # Generated by chartpress
    image:
      name: gcr.io/ucb-datahub-2018/jupyterhub-hub
      tag: '0.0.1-n4691.hff360c34'
    networkPolicy:
      enabled: true
      ingress:
        - from:
            - namespaceSelector:
                matchLabels:
                  name: support
              podSelector:
                matchLabels:
                  app: prometheus
                  component: server
          ports:
            - port: http
              protocol: TCP
    livenessProbe:
      enabled: true
      initialDelaySeconds: 180
    resources:
      requests:
        # Very small unit, since we don't want any CPU guarantees
        # FIXME: Can't seem to get this to null?
        cpu: 0.001
        memory: 256Mi
      limits:
        memory: 2Gi
    extraEnv:
      # This is unfortunately still needed by canvas auth
      OAUTH2_AUTHORIZE_URL: https://bcourses.berkeley.edu/login/oauth2/auth
    extraConfig:
      # Use 0x-<title> in `values.yaml` extraConfig values.
      # We want these to come *before* the extraConfig values
      # in `values.yaml`. Since these are ordered alphabetically,
      # 1x-<title> used in `common.yaml` will come after
      # 0x-<title> used in `values.yaml` - so config set there
      # will override config set here.
      01-custom-attr-spawner: |
        import os
        from kubespawner import KubeSpawner
        from tornado import gen
        import z2jh

        hosted_domain = 'berkeley.edu'
        course_profile_tmpl = '/srv/jupyterhub/profiles.d/{}-{}.txt'

        def memparse(val):
          '''Parse memory for relative comparisons.'''
          if type(val) != str or len(val) == 0:
            return val
          mem = int(val.upper()[0:-1])
          unit = val[-1]
          n = {'B':0, 'K':1, 'M':2, 'G':3}[unit]
          return mem * 1024**n

        def mem_cmp(a, b):
          '''Compare memory values.'''
          x = memparse(a)
          y = memparse(b)
          return (x > y) - (x < y)

        def course_profile_filename(course, constituent):
          return course_profile_tmpl.format(course, constituent)

        def course_members(course, constituent, hd=None):
          '''Extracts usernames from files containing email addresses.'''
          members = []
          filename = course_profile_filename(course, constituent)
          if not os.path.exists(filename): return members
          with open(filename) as f:
            line = f.readline()
            while line != '':
              email = line.strip()
              if hd and email.endswith('@' + hd):
                members.append(email.split('@')[0])
              elif not hd:
                members.append(email)
              line = f.readline()
          return members

        # TODO: move canvas_course_data to canvasauthenticator
        def canvas_course_data(course_key, course_val, user_canvas_courses):
          '''
             Return a user's canvas course data given a list of all their
             courses, the key to find the course, and value of the key
             we are looking for.
          '''
          try:
            return next(
              item for item in user_canvas_courses if \
                item.get(course_key, '') == course_val
            )
          except StopIteration:
            return {}

        class CustomAttrSpawner(KubeSpawner):
          def _build_common_labels(self, extra_labels):
            labels = super()._build_common_labels(extra_labels)
            # Until https://github.com/jupyterhub/kubespawner/issues/498
            # is fixed
            del labels['hub.jupyter.org/username']
            return labels

          async def start(self):
            # custom.memory
            custom_memory = z2jh.get_config('custom.memory', {})
            for attr, users in custom_memory.items():
              if self.user.name in users:
                self.mem_limit = attr
                self.mem_guarantee = attr
                break

            # custom.profiles
            custom_profiles = z2jh.get_config('custom.profiles', {})
            is_student = False
            is_instructor = False
            for course, profile_data in custom_profiles.items():
              customize = False
              if 'users' in profile_data and self.user.name in profile_data['users']:
                customize = True
              else:
                students = course_members(course, 'students', hosted_domain)
                instructors = course_members(course, 'instructors', hosted_domain)
                is_student |= (self.user.name in students)
                is_instructor |= (self.user.name in instructors)
                customize = self.user.name in students or self.user.name in instructors
              if customize:
                self.log.warning(f'using profile {course}')
                self.volumes += profile_data.get('extraVolumes', [])
                self.volume_mounts += profile_data.get('extraVolumeMounts', [])
                # set new mem thresholds if specified are bigger than current
                if 'mem_limit' in profile_data and \
                mem_cmp(profile_data['mem_limit'], self.mem_limit) == 1:
                  self.mem_limit = profile_data['mem_limit']
                if 'mem_guarantee' in profile_data and \
                mem_cmp(profile_data['mem_guarantee'], self.mem_guarantee) == 1:
                  self.mem_guarantee = profile_data['mem_guarantee']

            # if the user is a student in any course specified by a profile,
            # they never get to be an admin
            if is_student:
              self.user.admin = False
            elif is_instructor:
              self.user.admin = True

            # custom.canvas_courses
            auth_state = await self.user.get_auth_state()

            # a list of the user's canvas courses specified by some identifier
            user_canvas_courses_identifiers = []

            if auth_state is not None and 'courses' in auth_state:
              # this is retrieved by the authenticator
              # TODO: retrieve using self.authenticator if the
              # authenticator's type is canvasauthenticator
              user_canvas_courses = auth_state.get('courses', [])
              # see https://canvas.instructure.com/doc/api/courses.html

              # the key we use to uniquely identify courses. different
              # deployments could use different keys, depending on their
              # canvas usage e.g. 'sis_course_id' or 'name'
              # TODO: this can be a traitlet within canvasauthenticator
              canvas_course_key = 'id'
              # get a list of the user's canvas course identifiers
              # TODO: this can be a function within canvasauthenticator
              user_canvas_courses_identifiers = list(
                map(
                  # we convert to string to be agnostic about how to handle
                  # matches in custom.canvas_courses
                  lambda x: str(x.get(canvas_course_key, '')),
                  user_canvas_courses
                )
              )

              # get our customizations for our specified canvas courses
              canvas_course_customizations = z2jh.get_config('custom.canvas_courses', {})
              is_student = False
              is_instructor = False
              for course, customizations in canvas_course_customizations.items():
                # we apply customizations if the user is in the course
                if not course in user_canvas_courses_identifiers:
                  continue

                self.log.info(f'user in {course}')
                # the canvas data for our customized course
                canvas_course = canvas_course_data(canvas_course_key, course, user_canvas_courses)
                # set admin status based on their enrollment type
                enrollments = canvas_course.get('enrollments', [])
                for enrollment in enrollments:
                  is_student |= (enrollment['type'] in ['teacher', 'ta'])
                  is_instructor |= (enrollment['type'] == 'student')

                self.volumes += customizations.get('extraVolumes', [])
                self.volume_mounts += customizations.get('extraVolumeMounts', [])
                # set new mem thresholds if specified are bigger than current
                if 'mem_limit' in customizations and \
                mem_cmp(customizations['mem_limit'], self.mem_limit) == 1:
                  self.mem_limit = customizations['mem_limit']
                if 'mem_guarantee' in customizations and \
                mem_cmp(customizations['mem_guarantee'], self.mem_guarantee) == 1:
                  self.mem_guarantee = customizations['mem_guarantee']

              # if the user is a student in any course specified by a profile,
              # they never get to be an admin
              if is_student:
                self.user.admin = False
              elif is_instructor:
                self.user.admin = True

            # custom.admin
            custom_admin = z2jh.get_config('custom.admin', {})
            if custom_admin and self.user.admin:
              self.init_containers += custom_admin.get('initContainers', [])
              self.volume_mounts += custom_admin.get('extraVolumeMounts', [])

            return (await super().start())

        c.JupyterHub.spawner_class = CustomAttrSpawner
      02-working-dir: |
        # Make sure working directory is ${HOME}
        # hubploy has a bug where it unconditionally puts workingdir to be /srv/repo
        c.KubeSpawner.working_dir = '/home/jovyan'
      03-prometheus: |
        # Allow unauthenticated prometheus requests
        # Otherwise our prometheus server can't get to these
        c.JupyterHub.authenticate_prometheus = False
      04-no-setuid: |
        c.KubeSpawner.extra_container_config = {
          'securityContext': {
            # Explicitly disallow setuid binaries from working inside the container
            'allowPrivilegeEscalation': False
          }
        }
      05-popularity-contest: |
        # Emit metrics for which python packages are being imported
        import os
        pod_namespace = os.environ['POD_NAMESPACE']
        c.KubeSpawner.environment.update({
          'PYTHON_POPCONTEST_STATSD_PREFIX': f'python_popcon.namespace.{pod_namespace}'
        })