reloader:
# This section configures the reloader settings.
# In general this is kept unchanged from one deployment to another.
reloader:
# Set to true to enable the reloader for automatically restarting pods on
# changes in the JupyterHub configuration or in Vault.
enabled: true
# If true, the reloader will watch ConfigMaps and Secrets in all namespaces,
# not just its own.
watchGlobally: false
# Set to true if using Argo Rollouts for managing deployments, which may
# require specific handling.
isArgoRollouts: true
serviceAccount:
# Set to true to create a new service account for the reloader. If false,
# it will use an existing one.
create: false
# Ensures the reloader container's filesystem is mounted as read-only to
# enhance security.
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
f7t4jhub:
# This section configures the deployment of JupyterHub and the proxy
setup:
# URL for the Firecrest service
# Replace with the URL of the FirecREST service targeting your cluster
firecrestUrl: 'https://firecrest.cscs.ch'
# URL to obtain an auth token from your identity provider
authTokenUrl: 'https://auth.cscs.ch/auth/realms/<realm>/protocol/openid-connect/token'
proxy:
# Image for the configurable HTTP proxy
image: 'ghcr.io/eth-cscs/chp:4.6.2'
hub:
# Image for the JupyterHub application
image: 'ghcr.io/eth-cscs/f7t4jhub:4.1.6'
# If true, this set JupyterHub's log level to logging.DEBUG.
# Otherwise, the default log level is used
debug: false
reloader:
# Enable or disable reloader integration
enabled: true
vault:
# URL for the Vault service
url: 'https://vault.example.cscs.ch'
# Secret engine used in Vault
secretEngine: 'jupyterhub'
# AppRole authentication configuration for Vault access.
appRole:
# Path where the AppRole authentication method is mounted in Vault
path: "approle_kapps"
# Role ID for accessing Vault secrets (replace with your own role ID)
roleId: 'd9362ef4-e1b8-6ccf-4d2d-e74a59471dc7'
# Credentials for both the Keycloak Authorization Code Flow client (used
# to manage the access to JupyterHub as well as the authentication with
# FirecREST) and the Client Credentials client (optionally used as service
# account for job status polling)
keycloak:
# Enable or disable Vault integration
enabled: true
# Secret path in Vault
secretPath: 'secret/path/keycloack'
# Container registry credentials
# This can be used for docker container registries requiring authenticatoin
containerRegistry:
# Enable or disable Vault integration
enabled: false
# Secret path in Vault
secretPath: 'secret/path/containers'
# Proxy-Hub authentication token
# This is used in JupyterHub to secure communication between the hub and
# the proxy
configProxyAuthToken:
# Enable or disable Vault integration
enabled: true
# Secret path in Vault
secretPath: 'secret/path/proxy'
# Service account for polling jobs
serviceAccount:
# Enable or disable service account for polling jobs
# If enabled, the client's id and secret for the service accounts
# are accessed with the same secrets used for keycloak
enabled: true
# URL to obtain an auth token from your identity provider
authTokenUrl: 'https://auth.cscs.ch/auth/realms/<realm>/protocol/openid-connect/token'
metricbeat:
# Enable or disable annotations for metric beat monitoring
enabled: true
# Allow or deny access to /hub/metrics
# Access to the metrics endpoint can be denied to allow
# monitoring tools to read the data without setting up
# authentication
deny_metrics_endpoint: false
network:
# Ports configuration for the application
appPort: 8000
apiPort: 8001
externalPort: 8081
config:
# List of URLs and the corresponding challenges for the JupyterHub instance
certificates:
letsencrypt:
urls:
- 'jupyterhub-<cluster-name-1>.cscs.ch'
# letsencrypt-http01:
# urls:
# - 'jupyterhub-<cluster-name-2>.cscs.ch'
# Admin users for the JupyterHub instance
adminUsers: ["user1", "user2"]
# Limited Admin users for the JupyterHub instance
# This users are granted the scope "limited-admin" (see
# the configuration file)
limitedAdminUsers: ["user3", "user4"]
# Users that can launch servers as service accounts
# This users are granted the scope "service-account" (see
# the configuration file)
serviceAccountUsers: ["testuser"]
# Default URL for the hub
hubDefaultUrl: '/hub/home'
auth:
# OAuth callback URL
oauthCallbackUrl: 'https://jupyterhub-<cluster-name>.cscs.ch/hub/oauth_callback'
# Authorization URL for your identity provider
authorizeUrl: 'https://auth.cscs.ch/auth/realms/<realm>/protocol/openid-connect/auth'
# Token URL for your identity provider
tokenUrl: 'https://auth.cscs.ch/auth/realms/<realm>/protocol/openid-connect/token'
# User data URL for your identity provider
userDataUrl: 'https://auth.cscs.ch/auth/realms/<realm>/protocol/openid-connect/userinfo'
# Login service URL
loginService: 'https://auth.cscs.ch'
# Key for the username field in the user data response
userNameKey: 'preferred_username'
# Additional parameters for user data request (customize as needed)
userDataParams: '{"state": "state"}'
# Scopes for the authentication request (customize as needed)
scope: '["openid", "profile", "firecrest"]'
spawner:
# Name of the cluster where the notebooks are going to be launched
host: '<cluster-name>'
# Working directory for the notebook job
workdir: '/home'
# Port for the single-user server. Set to 0 to use a random port
port: 57001
# Node name template for the cluster
nodeNameTemplate: '{}.example.cscs.ch'
# Name of the job that runs the notebook server
jobName: 'spawner-jupyterhub'
# Name of the partition of the job scheduler (e.g. normal, debug, long)
partition: '<slurm-partition>'
# Name of a reservation in the job scheduler
reservation: '<slurm-reservation>'
# Constraint for the job scheduler (e.g. gpu, mc, nvgpu)
constraint: '<slurm-constraint>'
# srun command customization
# Can be left as empty string, meaning the the notebook server will run
# on the master node without using srun
#
# Can be used to pass command line options to slurm such as
# `srun --interactive`
srun: ''
# Command to start the JupyterHub single-user server (customize as needed)
# The basic command is `firecrestspawner-singleuser jupyterhub-singleuser`
# but customization is often needed. For instance, adding something before
# the command, like when using a uenv:
# 'bash -c ". /user-environment/env/default/activate.sh && \
# firecrestspawner-singleuser jupyterhub-singleuser"'
cmd: 'firecrestspawner-singleuser jupyterhub-singleuser'
# Pre-launch commands
# This is to add logic before the `srun` line
# It can be used to setup environment variables for instance
prelaunchCmds: ''
# Custom state get host function (customize as needed)
# This is used if it's not possible to set a `nodeNameTemplate`
# One can pass here the name of a function, defined in the configuration,
# to fetch the DNS name or IP of the compute node where the
# notebooks will run
customStateGetHost: None
# Timeout in seconds before giving up on a spawned HTTP server
# Once a server has successfully been spawned, this is the amount of time
# that the hub waits before assuming that the server is unable to accept connections.
http_timeout: 300
# Timeout in seconds for the job to start
start_timeout: 300
# JupyterHub options form
# It allows users to customize their environment
# (e.g., selecting resources, environment type, or packages)
# before launching their Jupyter notebook server
# The settings here are reflected on the batch script
# that submits the JupyterLab job
optionsForm: |
<hr>
<div class="col-md-4">
<div class="form-group">
<label for="reservation"> Reservation (optional) </label>
<input name="reservation" class="form-control">
</div>
</div>
<div class="col-md-4">
<div class="form-group">
<label for="nnodes"> Nodes </label>
<select name="nnodes" id="nnodes" class="form-control">
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
</select>
</div>
</div>
<div class="col-md-4">
<div class="form-group">
<label for="runtime"> Job Duration </label>
<select name="runtime" id="runtime" class="form-control">
<option value="1:00:00">1 hour</option>
<option value="2:00:00">2 hours</option>
<option value="4:00:00">4 hours</option>
<option value="8:00:00">8 hours</option>
<option value="12:00:00">12 hours</option>
</select>
</div>
</div>
# Literal python code to add at the end of jupyterhub's configuration
extraConfig: |
c.JupyterHub.authenticate_prometheus = False
# Add announcements to be displayed on different pages of the hub
announcements:
# The announcement will be placed on the top of all pages
general: null
# The announcement will be placed on the home page
home: null
# The announcement will be placed on the spawn page
spawn: null
# The announcement will be placed on the login page
login: null
# The announcement will be placed on the logout page
logout: null