Hub image - using unreleased versions of some jupyterhub packages

[GeorgianaElena]

Context

The 2i2c hubs run a custom docker image as per the Dockerfile at https://github.com/2i2c-org/infrastructure/blob/master/helm-charts/images/hub/Dockerfile. More details about this image and how to update it, can be found in the docs at https://infrastructure.2i2c.org/en/latest/topic/hub-image.html.

In this custom hub image we're currently installing unreleased versions of oathenticator and configurator. This is because we want to try out the latest changes of this packages and improve/fix anything that might not work as it should.

This however means that we're using unreleased versions of these packages and we should make sure we're upgrading to released versions as soon as those are available.

Proposal

A few points about the current situation:

• Our current mechanism for automating the packages upgrades (dependabot and bump-image-tags action) won't work on the pip packages in this Dockerfile
• Not aware of other software we could use that does this already (please comment to this issue, if you know any)
• 2i2c members are maintainers/contributors to releases of this packages and are more or less up to speed to the changes that happen there

Starting from the current situation described above, how about instead of always opening new issues about going back to an official released version of a package whenever we pin to a specific commit (as in #1583 (comment)), we document this as being a best practice to follow?

Updates and actions

My suggested plan is to:

• document going back to an official released version of the packages in https://github.com/2i2c-org/infrastructure/blob/master/helm-charts/images/hub/Dockerfile, whenever these are available. Maybe https://infrastructure.2i2c.org/en/latest/topic/hub-image.html is the appropriate docs place for it?
• add inline comments whenever we pin to specific commits, to go back to a released version in https://github.com/2i2c-org/infrastructure/blob/master/helm-charts/images/hub/Dockerfile

[damianavila]

Our current mechanism for automating the packages upgrades (dependabot and bump-image-tags action) won't work on the pip packages in this Dockerfile

Quick question, what about putting these packages into a requirements file and pip install the requirements file in the Dockerfile... in that way we may use the dependabot, right?

[sgibson91]

Quick question, what about putting these packages into a requirements file and pip install the requirements file in the Dockerfile... in that way we may use the dependabot, right?

Yep!

[damianavila]

Super!
Then I would advocate going into that route... because, in that way, we have better control of the upgrade step using the action. @GeorgianaElena, WDYT?

[yuvipanda]

With #1690 we no longer use a custom jupyterhub version!

[GeorgianaElena]

That's awesome ✨ So the only pkgs we're using custom versions for, are the oauthenticator and the configurator

[GeorgianaElena]

btw, oauthenticator 15.1.0 has just been released thanks to @consideRatio 🚀