Merge pull request #7503 from GeorgianaElena/upgrade-z2jh4.3

GeorgianaElena · web-flow · commit 031a2c40ab99 · 2026-01-30T11:05:12.000+02:00
Upgrade a few hubs to latest z2jh chart version
diff --git a/config/clusters/cloudbank/cluster.yaml b/config/clusters/cloudbank/cluster.yaml
diff --git a/config/clusters/cloudbank/common.values.yaml b/config/clusters/cloudbank/common.values.yaml
@@ -9,6 +9,10 @@ nfs:
     - noatime
     # MUST HAVE TRAILING SLASH
 jupyterhub:
+  hub:
+    image:
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
   singleuser:
     cpu:
       # Each node has about 4 CPUs total, and if we limit users to no more than
diff --git a/config/clusters/disasters/cluster.yaml b/config/clusters/disasters/cluster.yaml
@@ -23,6 +23,7 @@ hubs:
   - staging.values.yaml
   - enc-imagebuilding-common.secret.values.yaml
   - enc-staging.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: prod
   display_name: Disasters
   domain: hub.disasters.2i2c.cloud
diff --git a/config/clusters/disasters/staging.values.yaml b/config/clusters/disasters/staging.values.yaml
@@ -10,13 +10,18 @@ jupyterhub:
     nodeSelector:
       2i2c/hub-name: staging
   hub:
+    image:
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
     config:
       GitHubOAuthenticator:
         oauth_callback_url: https://staging.hub.disasters.2i2c.cloud/hub/oauth_callback
       GenericOAuthenticator:
         oauth_callback_url: https://staging.hub.disasters.2i2c.cloud/hub/oauth_callback
         token_url: https://keycloak.delta-backend.xyz/realms/veda/protocol/openid-connect/token
         authorize_url: https://keycloak.delta-backend.xyz/realms/veda/protocol/openid-connect/auth
+      Authenticator:
+        auth_refresh_age: 0
   ingress:
     hosts: [staging.hub.disasters.2i2c.cloud]
     tls:
diff --git a/config/clusters/jupyter-health/cluster.yaml b/config/clusters/jupyter-health/cluster.yaml
@@ -23,6 +23,7 @@ hubs:
   - enc-common.secret.values.yaml
   - staging.values.yaml
   - enc-staging.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: prod
   display_name: Jupyter Health (prod)
   domain: jupyter-health.2i2c.cloud
@@ -32,3 +33,4 @@ hubs:
   - enc-common.secret.values.yaml
   - prod.values.yaml
   - enc-prod.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
diff --git a/config/clusters/jupyter-health/common.values.yaml b/config/clusters/jupyter-health/common.values.yaml
@@ -32,13 +32,9 @@ jupyterhub:
           name: Jupyter Health
           url: https://github.com/jupyterhealth/
   hub:
-    # FIXME: Experiment to use oauthenticator 17.1, should be transitioned away
-    #        as part of upgrading to z2jh 4, see
-    #        https://github.com/2i2c-org/infrastructure/pull/4968
-    #
     image:
-      name: quay.io/2i2c/pkce-experiment
-      tag: 0.0.1-0.dev.git.14004.h556ee4be8
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
     allowNamedServers: true
     config:
       JupyterHub:
diff --git a/config/clusters/maap/cluster.yaml b/config/clusters/maap/cluster.yaml
@@ -23,6 +23,7 @@ hubs:
   - staging.values.yaml
   - enc-common.secret.values.yaml
   - enc-staging.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: prod
   display_name: MAAP - prod
   domain: hub.maap-project.org
diff --git a/config/clusters/maap/common.values.yaml b/config/clusters/maap/common.values.yaml
@@ -103,7 +103,6 @@ jupyterhub:
           c.KubeSpawner.volume_mounts = {}
           for idx, volume_mount in enumerate(existing_volume_mounts):
             c.KubeSpawner.volume_mounts[f"{idx}-{volume_mount['name']}"] = volume_mount
-
         c.KubeSpawner.volumes["s3fs-volume"] = {"name": "s3fs-volume", "emptyDir": {}}
   singleuser:
     extraFiles:
diff --git a/config/clusters/maap/staging.values.yaml b/config/clusters/maap/staging.values.yaml
@@ -12,6 +12,13 @@ jupyterhub:
       gitRepoBranch: staging
       gitRepoUrl: https://github.com/MAAP-Project/maap-hub-homepage
   singleuser:
+    storage:
+      extraVolumes:
+      - name: dev-shm
+        emptyDir:
+          medium: Memory
+      - name: s3fs-volume
+        emptyDir: {}
     extraEnv:
       SCRATCH_BUCKET: s3://maap-scratch-staging/$(JUPYTERHUB_USER)
       MAAP_API_HOST: api.uat.maap-project.org
@@ -244,11 +251,22 @@ jupyterhub:
         extra_resource_limits:
           nvidia.com/gpu: '1'
   hub:
+    image:
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
+    extraConfig:
+      # Undo unnecessary common config
+      00-volumes-and-volume-mounts-as-dict: ''
+
     config:
       GenericOAuthenticator:
         oauth_callback_url: https://staging.hub.maap-project.org/hub/oauth_callback
         token_url: https://keycloak.delta-backend.xyz/realms/maap/protocol/openid-connect/token
         authorize_url: https://keycloak.delta-backend.xyz/realms/maap/protocol/openid-connect/auth
+      # Disable for now the authentication token refreshing
+      # https://oauthenticator.readthedocs.io/en/latest/reference/api/gen/oauthenticator.oauth2.html#oauthenticator.oauth2.OAuthenticator.auth_refresh_age
+      Authenticator:
+        auth_refresh_age: 0
   ingress:
     hosts: [staging.hub.maap-project.org]
     tls:
diff --git a/config/clusters/opensci/big-binder.values.yaml b/config/clusters/opensci/big-binder.values.yaml
@@ -74,6 +74,9 @@ jupyterhub:
     initContainers: []
     profileList: []
   hub:
+    image:
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
     config:
       BinderSpawnerMixin:
         auth_enabled: true
diff --git a/config/clusters/opensci/cluster.yaml b/config/clusters/opensci/cluster.yaml
@@ -22,6 +22,7 @@ hubs:
   - common.values.yaml
   - staging.values.yaml
   - enc-staging.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: sciencecore
   display_name: Sciencecore
   domain: sciencecore.opensci.2i2c.cloud
@@ -31,6 +32,7 @@ hubs:
   - sciencecore.values.yaml
   - enc-imagebuilding-common.secret.values.yaml
   - enc-sciencecore.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: climaterisk
   display_name: climaterisk
   domain: climaterisk.opensci.2i2c.cloud
@@ -39,6 +41,7 @@ hubs:
   - common.values.yaml
   - climaterisk.values.yaml
   - enc-climaterisk.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: small-binder
   display_name: OpenSci Binder (Small)
   domain: hub.binder.opensci.2i2c.cloud
@@ -47,6 +50,7 @@ hubs:
   - small-binder.values.yaml
   - enc-imagebuilding-common.secret.values.yaml
   - enc-small-binder.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
 - name: big-binder
   display_name: OpenSci Binder (Big)
   domain: hub.big.binder.opensci.2i2c.cloud
@@ -55,3 +59,4 @@ hubs:
   - big-binder.values.yaml
   - enc-imagebuilding-common.secret.values.yaml
   - enc-big-binder.secret.values.yaml
+  chart_override: helm-charts/basehub/Z2jh-4.3.3-chart.yaml
diff --git a/config/clusters/opensci/common.values.yaml b/config/clusters/opensci/common.values.yaml
@@ -15,3 +15,7 @@ jupyterhub:
   scheduling:
     userScheduler:
       enabled: true
+  hub:
+    image:
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
diff --git a/config/clusters/opensci/small-binder.values.yaml b/config/clusters/opensci/small-binder.values.yaml
@@ -60,6 +60,9 @@ jupyterhub:
       # launch the notebook server
       os.execvp(exe, sys.argv)
   hub:
+    image:
+      name: quay.io/2i2c/z2jh-433
+      tag: 0.0.1-0.dev.git.14741.h1ea063d04
     config:
       BinderSpawnerMixin:
         auth_enabled: false
diff --git a/deployer/commands/deployer.py b/deployer/commands/deployer.py
@@ -28,6 +28,7 @@
 from deployer.infra_components.cluster import Cluster
 from deployer.utils.file_acquisition import (
     HELM_CHARTS_DIR,
+    REPO_ROOT_PATH,
     get_decrypted_file,
 )
 from deployer.utils.rendering import print_colour
@@ -117,15 +118,20 @@ def deploy(
         for i, hub in enumerate(hubs):
             default_chart_dir = HELM_CHARTS_DIR / hub.spec["helm_chart"]
             chart_override = hub.spec.get("chart_override", None)
-            chart_override_path = (
-                hub.cluster.config_dir / chart_override if chart_override else None
-            )
+            if chart_override and "/" in chart_override:
+                chart_override_path = REPO_ROOT_PATH / chart_override
+                chart_override = chart_override.split("/")[-1]
+            else:
+                chart_override_path = (
+                    hub.cluster.config_dir / chart_override if chart_override else None
+                )
             with get_chart_dir(
                 default_chart_dir, chart_override, chart_override_path
             ) as chart_dir:
                 if chart_override_path:
                     print_colour(
-                        f"Deploying a custom helm chart for a {hub.spec['helm_chart']} from {chart_dir}"
+                        f"Deploying a custom helm chart for a {hub.spec['helm_chart']} from {chart_dir}, for {chart_override_path}",
+                        "yellow",
                     )
                 else:
                     print_colour(
@@ -145,6 +151,7 @@ def deploy(
                 validate_authenticator_config(
                     cluster_name, hub.spec["name"], chart_dir, skip_refresh
                 )
+                cleanup_values_schema_json(chart_dir)
 
                 print_colour(f"{progress_str}Deploying hub {hub.spec['name']}...")
                 hub.deploy(chart_dir, dask_gateway_version, debug, dry_run)
diff --git a/deployer/commands/validate/config.py b/deployer/commands/validate/config.py
@@ -21,13 +21,14 @@
 from deployer.infra_components.cluster import Cluster
 from deployer.utils.file_acquisition import (
     HELM_CHARTS_DIR,
+    REPO_ROOT_PATH,
 )
 from deployer.utils.jsonnet import render_jsonnet
 from deployer.utils.rendering import print_colour
 
 yaml = YAML(typ="safe", pure=True)
 
-HUB_CHART_PREFIX = "2i2c-custom-hub-chart"
+CUSTOM_HUB_CHART_PREFIX = "2i2c-custom-hub-chart"
 
 
 @functools.lru_cache
@@ -63,9 +64,10 @@ def _prepare_support_helm_charts_dependencies_and_schema():
 def _prepare_hub_helm_charts_dependencies_and_schema(hub_chart_dir, legacy_daskub):
     # FIXME: replace all string paths with Path objects
     hub_chart_dir = Path(hub_chart_dir)
+    cleanup_values_schema_json(hub_chart_dir)
 
     if legacy_daskub:
-        if not hub_chart_dir.name.startswith(HUB_CHART_PREFIX):
+        if not hub_chart_dir.name.startswith(CUSTOM_HUB_CHART_PREFIX):
             _generate_values_schema_json(HELM_CHARTS_DIR / "basehub")
             subprocess.check_call(["helm", "dep", "up", HELM_CHARTS_DIR / "basehub"])
     else:
@@ -154,7 +156,7 @@ def get_chart_dir(default_chart_dir, chart_override, chart_override_path):
             # that we're copying the contents for helm-charts/basehub and not the
             # deprecated daskhub chart
             default_chart_dir = HELM_CHARTS_DIR / "basehub"
-            temp_chart_dir = tempfile.TemporaryDirectory(prefix=HUB_CHART_PREFIX)
+            temp_chart_dir = tempfile.TemporaryDirectory(prefix=CUSTOM_HUB_CHART_PREFIX)
             temp_chart_dir_name = temp_chart_dir.name
             # copy the chart directory into the temporary location
             shutil.copytree(default_chart_dir, temp_chart_dir_name, dirs_exist_ok=True)
@@ -331,9 +333,13 @@ def all_hub_config(
     for i, hub in enumerate(hubs):
         default_chart_dir = HELM_CHARTS_DIR / hub.spec["helm_chart"]
         chart_override = hub.spec.get("chart_override", None)
-        chart_override_path = (
-            hub.cluster.config_dir / chart_override if chart_override else None
-        )
+        if chart_override and "/" in chart_override:
+            chart_override_path = REPO_ROOT_PATH / chart_override
+            chart_override = chart_override.split("/")[-1]
+        else:
+            chart_override_path = (
+                hub.cluster.config_dir / chart_override if chart_override else None
+            )
         with get_chart_dir(
             default_chart_dir, chart_override, chart_override_path
         ) as chart_dir:
diff --git a/helm-charts/basehub/Z2jh-4.3.3-chart.yaml b/helm-charts/basehub/Z2jh-4.3.3-chart.yaml
@@ -0,0 +1,35 @@
+apiVersion: v2
+appVersion: '1.0'
+description: Deployment Chart for JupyterHub
+name: basehub
+# Updates to this version must be kept in sync with the dependency reference in
+# the daskhub chart. Since we don't publish this, we opt to have it frozen at
+# version 0.1.0 instead.
+version: 0.1.0
+dependencies:
+- name: jupyterhub
+    # Updates to this version should follow go hand in hand with updates to
+    # images/hub/Dockerfile, and will also involve manually building and pushing
+    # the Dockerfile to https://quay.io/2i2c/pilot-hub. Details about this can
+    # be found in the Dockerfile's comments.
+  version: 4.3.3-0.dev.git.7272.h2ff70453
+  repository: https://jupyterhub.github.io/helm-chart/
+- name: binderhub-service
+  version: 0.1.0-0.dev.git.318.h477a6fa
+  repository: https://2i2c.org/binderhub-service/
+  condition: binderhub-service.enabled
+    # If bumping the version of dask-gateway, please also bump the default version set
+    # in the deployer's CLI
+    # https://github.com/2i2c-org/infrastructure/blob/HEAD/deployer/commands/deployer.py#L100
+- name: dask-gateway
+  version: 2024.1.0
+  repository: https://helm.dask.org/
+  condition: dask-gateway.enabled
+- name: jupyterhub-home-nfs
+  version: 1.2.1-0.dev.git.1.h1c81b4b
+  repository: oci://ghcr.io/2i2c-org/jupyterhub-home-nfs
+  condition: jupyterhub-home-nfs.enabled
+- name: jupyterhub-groups-exporter
+  version: 1.1.1-0.dev.git.133.hd9f9ccc
+  repository: https://2i2c.org/jupyterhub-groups-exporter
+  condition: jupyterhub-groups-exporter.enabled
diff --git a/helm-charts/basehub/values.yaml b/helm-charts/basehub/values.yaml
@@ -1622,6 +1622,17 @@ jupyterhub:
         elif c.JupyterHub.authenticator_class == "github":
           print("No GitHubOAuthenticator.allowed_organizations found, setting to ['2i2c-org:hub-access-for-2i2c-staff']")
           c.GitHubOAuthenticator.allowed_organizations = ["2i2c-org:hub-access-for-2i2c-staff"]
+      10-skip_refresh_for_test_user.py: |
+        def refresh_user_hook(authenticator, user, auth_state):
+            if user.name == "deployment-service-check":
+                # if this is the user,
+                # refresh_user doesn't make sense
+                # consider it always fresh
+                return True
+            # for all other users, refresh as usual
+            return None
+
+        c.OAuthenticator.refresh_user_hook = refresh_user_hook
 
       # Initially copied from https://github.com/dask/helm-chart/blob/main/daskhub/values.yaml
       daskhub-01-add-dask-gateway-values: |
diff --git a/helm-charts/chartpress.yaml b/helm-charts/chartpress.yaml
@@ -16,9 +16,9 @@ charts:
         valuesPath: jupyterhub.hub.image
         buildArgs:
           REQUIREMENTS_FILE: requirements.txt
-      pkce-experiment:
-        imageName: quay.io/2i2c/pkce-experiment
+      z2jh-433:
+        imageName: quay.io/2i2c/z2jh-433
         buildArgs:
-          REQUIREMENTS_FILE: pkce-requirements.txt
+          REQUIREMENTS_FILE: requirements.txt
         contextPath: images/hub
-        dockerfilePath: images/hub/Dockerfile
+        dockerfilePath: images/hub/Dockerfile-z2jh-433
diff --git a/helm-charts/images/hub/Dockerfile-z2jh-433 b/helm-charts/images/hub/Dockerfile-z2jh-433
@@ -0,0 +1,27 @@
+# This image tag should match the dependent JupyterHub Helm chart's version as
+# declared in basehub/Chart.yaml.
+#
+# If you make an update to this tag and the JupyterHub Helm chart's version,
+# then first commit those changes.
+# Then, from the `helm-charts` directory where the `chartpress.yaml` is located,
+# perform `chartpress --push` with your quay.io container registry credentials
+# configured to have access to https://quay.io/repository/2i2c/pilot-hub.
+#
+# Note: if on macOs with M1, you need to run chartpress with docker buildx under the hood and specify
+# the architecture to use.
+# `chartpress --push --builder docker-buildx --platform linux/amd64`
+# Ref: https://cloudolife.com/2022/03/05/Infrastructure-as-Code-IaC/Container/Docker/Docker-buildx-support-multiple-architectures-images/
+#
+FROM jupyterhub/k8s-hub:4.3.3-0.dev.git.7263.h1d8bfb12
+
+# chartpress.yaml defines multiple hub images differentiated only by a
+# requirements.txt file with dependencies, this build argument allows us to
+# reuse this Dockerfile for all images.
+ARG REQUIREMENTS_FILE
+COPY ${REQUIREMENTS_FILE} /tmp/
+
+USER root
+
+RUN pip install -r /tmp/${REQUIREMENTS_FILE}
+
+USER $NB_USER
diff --git a/helm-charts/images/hub/pkce-requirements.txt b/helm-charts/images/hub/pkce-requirements.txt
