Stop using continuous prePuller

config/clusters/2i2c/climatematch.values.yaml

@@ -1,11 +1,7 @@
 jupyterhub:
-  # pre-puller is necessary as the image is pretty big, and
-  # pulling during first user spawn might cause timeouts and poor user
-  # experience. Also helps with node pre-warming. This works ok here
-  # because they have a dedicated nodepool.
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   singleuser:

config/clusters/callysto/common.values.yaml

@@ -9,12 +9,9 @@ nfs:
     # Name of Google Filestore share
     baseShareName: /homes/
 jupyterhub:
-  # pre-puller is necessary as the image is pretty big, and
-  # pulling during first user spawn might cause timeouts and poor user
-  # experience. Also helps with node pre-warming.
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   custom:

config/clusters/catalystproject-latam/common.values.yaml

@@ -13,9 +13,7 @@ jupyterhub:
     allowNamedServers: true
   singleuser:
     image:
-      # This image specification is likeley overridden via the configurator, so
-      # use of prePuller is probably going to pull this instead of the
-      # configured image and just slow users down.
+      # This image specification is likely overridden via the configurator.
       #
       # jupyter/scipy-notebook is maintained at: https://github.com/jupyter/docker-stacks
       # tags can be viewed at: https://hub.docker.com/r/jupyter/scipy-notebook/tags

config/clusters/cloudbank/demo.values.yaml

@@ -5,8 +5,8 @@ jupyterhub:
       - hosts: [demo.cloudbank.2i2c.cloud]
         secretName: https-auto-tls
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   singleuser:

config/clusters/cloudbank/humboldt.values.yaml

@@ -5,8 +5,8 @@ jupyterhub:
       - hosts: [humboldt.cloudbank.2i2c.cloud]
         secretName: https-auto-tls
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   singleuser:

config/clusters/cloudbank/sjsu.values.yaml

@@ -5,8 +5,8 @@ jupyterhub:
       - hosts: [sjsu.cloudbank.2i2c.cloud]
         secretName: https-auto-tls
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   singleuser:

config/clusters/gridsst/common.values.yaml

@@ -12,9 +12,6 @@ basehub:
       serverIP: fs-05f68d7e096d7cf16.efs.us-west-2.amazonaws.com
       baseShareName: /
   jupyterhub:
-    prePuller:
-      continuous:
-        enabled: true
     custom:
       2i2c:
         add_staff_user_ids_to_admin_users: true

config/clusters/qcl/common.values.yaml

@@ -10,8 +10,8 @@ nfs:
     baseShareName: /homes/
 jupyterhub:
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   custom:

config/clusters/utoronto/common.values.yaml

@@ -13,12 +13,9 @@ jupyterhub:
   scheduling:
     userScheduler:
       enabled: true
-  # pre-puller is necessary as the image is pretty big, and
-  # pulling during first user spawn might cause timeouts and poor user
-  # experience. Also helps with node pre-warming.
   prePuller:
-    continuous:
-      enabled: true
+    # hook prePuller shouldn't be enabled when configuring images in any other
+    # way than singleuser.image
     hook:
       enabled: true
   custom:

docs/howto/features/ephemeral.md

@@ -107,34 +107,19 @@ jupyterhub:
 ```
 
 
-## Pre-pulled images
+## Image configuration in chart
 
-We want *consistently* faster startups wherever possible, as inconsistent start
-times is one of the big issues with folks using mybinder.org for events and
-workshops. So we enable the [pre-puller](https://z2jh.jupyter.org/en/latest/administrator/optimization.html#pulling-images-before-users-arrive)
-functionality to make startups faster and more consistent.
-
-This requires the user image is also set in config (and not via the JupyterHub
-configurator). But `tmpauthenticator` doesn't support admin accounts anyway,
-so this is fine.
+The image needs to be specified in the chart directly and not via the JupyterHub
+configurator because with `tmpauthenticator` we can't distinguish admin users to
+have such rights without providing it to every user.
 
 ```yaml
 jupyterhub:
   singleuser:
+    # image could also be configured via singleuser.profileList configuration
     image:
       name: <image-name>
       tag: <tag>
-      
-  prePuller:
-    # Startup performance is important for this event, and so we use
-    # pre-puller to make sure the images are already present on the
-    # nodes. This means image *must* be set in config, and not the configurator.
-    # tmpauthenticator doesn't support admin access anyway, so images
-    # must be set in config regardless.
-    hook:
-      enabled: true
-    continuous:
-      enabled: true
 ```
 
 ## Disabling home page customizations

helm-charts/basehub/values.yaml

@@ -143,9 +143,34 @@ jupyterhub:
           memory: 64Mi
         limits:
           memory: 1G
+  # prePuller is about pulling a one or more images identified via chart
+  # configuration, including singleuser.image, singleuser.profileList entries
+  # with a dedicated image, but not profileList entries with images' specified
+  # via profile_options.
   prePuller:
+    # continuous prePuller leads to the creation of a DaemonSet that starts a
+    # pod on each node to pull images.
+    #
+    # It is disabled as its only relevant for nodes started before user pods
+    # gets scheduled on them, in other cases it could delay startup and isn't
+    # expected to reduce startup times.
+    #
     continuous:
       enabled: false
+    # hook prePuller leads to the creation of a temporary DaemonSet and a pod
+    # awaiting pulling to complete before `helm upgrade` starts its main work.
+    #
+    # It is disabled as it adds notable complexity for a smaller benefit when
+    # correctly adopted. The added complexity includes:
+    #
+    # - risk of misconfiguration making image pulls not actually needed
+    # - risk of broken expectations and additional cognitive load
+    # - risk of causing significantly longer `helm upgrade` commands slowing
+    #   down our CI system
+    # - ClusterRoleBinding resources are needed for the image-awaiter Pod
+    #   involved, a resource that requires the highest k8s cluster permission
+    #   otherwise possibly not needed to deploy basehub
+    #
     hook:
       enabled: false
   proxy:
@@ -267,7 +292,7 @@ jupyterhub:
           MappingKernelManager: *server_config_mapping_kernel_manager
           NotebookApp: *server_config_server_app
           BaseFileIdManager: *server_config_base_file_id_manager
-    startTimeout: 600 # 10 mins, because sometimes we have too many new nodes coming up together
+    startTimeout: 600 # 10 mins, node startup + image pulling makes it relevant
     defaultUrl: /tree
     image:
       name: jupyter/scipy-notebook