Refine upgrade pathway to z2jh 4 (JupyterHub 5, KubeSpawner 7, OAuthenticator 17)

[consideRatio]

Z2JH 4.0.0 is now out (changelog). This issue tracks refining work to make it get done.

I've already trialed upgrading z2jh from 3 to 4 (beta-4) for a 2i2c deployment (#4916, #4979), and I figure its reasonable for 2i2c to upgrade all hubs to z2jh 4.0.0 at this point in time.

---

Tasks

• verify chart changelog breaking changes
• verify sub-projects new versions breaking changes
• verify compatibility with user images not using jupyterhub 5

Definition of done

• Other issues have been created and refined to drive us towards upgrading to z2jh 4 more concretely.

[yuvipanda]

We would need 2i2c-org/jupyterhub-fancy-profiles#72 merged and deployed as well before we can upgrade

[GeorgianaElena]

TL;DR

I just went through all of the breaking changes mentioned by the chat's changelog and also checked the changelogs of the related sub-projects and basehub dependencies.

I am pasting below my findings. The checked boxes aren't impacting us, whereas the others have an action attached to them that we need to take on the 2i2c side.

The plan is open a planning issue and what's below will be turned into an ordered list of sub-issues

Breaking changes that the chart brings:

• The chart now require Kubernetes 1.28+, up from 1.23+

• Python is upgraded in chart images from 3.11 to 3.12

• KubeSpawner is upgraded from 6.2.0 to 7.0.0

  • Action: per the upgrade docs, update volume mounts to

      c.KubeSpawner.volume_mounts = {
          "name": "home",
          "mountPath": "/home/jovyan",
          "subPath": "{escaped_username}",  # matches "{username}" in kubespawner 6
      }
  

• JupyterHub 4.1.6 has been upgraded to 5.2.1

  • switch from jupyter-telemetry to jupyter-events:
    • Action:
      • change

        infrastructure/helm-charts/basehub/values.yaml

        Line 71 in 5bb9010

        c.EventLog.handlers_maker = _make_eventsink_handler

      • to EventLogger per switch from jupyter-telemetry to jupyter-events jupyterhub/jupyterhub#4807
  • update bootstrap to v5
    • Action Support JupyterHub 5: Upgrade to Bootstrap 5 jupyterhub-fancy-profiles#45
  • explicitly require groups in auth model when Authenticator.manage_groups is enabled
  • add JupyterHub.subdomain_hook: Only used when JupyterHub.subdomain_host is set and we're not setting it

• OAuthenticator 16.3.1 has been upgraded to 17.1.0

  • [Generic, OpenShift] OAuthenticator.allowed_groups and OAuthenticator.admin_groups now require OAuthenticator.manage_groups to be set to True, and will otherwise raise an error
    • Action: set manage_groups to True as we're configuring admin_groups pretty much for all hubs

• LDAPAuthenticator 1.3.2 has been upgraded to 2.0.2

Infrastructure dependencies related actions:

• Rm https://github.com/2i2c-org/infrastructure/blob/main/helm-charts/images/hub/pkce-requirements.txt, revert https://github.com/2i2c-org/infrastructure/pull/4968/files
• Check if jupyterhub-configurator pinned branch still works with latest z2jh chart