Merge pull request 2i2c-org#4320 from sgibson91/hhmi-binder

Deploy binder to HHMI cluster

config/clusters/hhmi/binder.values.yaml

@@ -0,0 +1,128 @@
+jupyterhub:
+  ingress:
+    hosts: [hub.binder.hhmi.2i2c.cloud]
+    tls:
+      - hosts: [hub.binder.hhmi.2i2c.cloud]
+        secretName: https-auto-tls
+  custom:
+    binderhubUI:
+      enabled: true
+    2i2c:
+      add_staff_user_ids_to_admin_users: false
+    jupyterhubConfigurator:
+      enabled: false
+    singleuserAdmin:
+      extraVolumeMounts: []
+    homepage:
+      templateVars:
+        org:
+          name: ""
+          url: ""
+          logo_url: ""
+        designed_by:
+          name: ""
+          url: ""
+        operated_by:
+          name: ""
+          url: ""
+        funded_by:
+          name: ""
+          url: ""
+  singleuser:
+    cpu:
+      limit: 2
+    memory:
+      guarantee: 256M
+      limit: 1G
+    storage:
+      type: none
+      extraVolumeMounts: []
+    initContainers: []
+    profileList: []
+    cmd:
+      - python3
+      - "-c"
+      - |
+        import os
+        import sys
+
+        try:
+            import jupyterlab
+            import jupyterlab.labapp
+            major = int(jupyterlab.__version__.split(".", 1)[0])
+        except Exception as e:
+            print("Failed to import jupyterlab: {e}", file=sys.stderr)
+            have_lab = False
+        else:
+            have_lab = major >= 3
+
+        if have_lab:
+            # technically, we could accept another jupyter-server-based frontend
+            print("Launching jupyter-lab", file=sys.stderr)
+            exe = "jupyter-lab"
+        else:
+            print("jupyter-lab not found, launching jupyter-notebook", file=sys.stderr)
+            exe = "jupyter-notebook"
+
+        # launch the notebook server
+        os.execvp(exe, sys.argv)
+  hub:
+    config:
+      BinderSpawnerMixin:
+        auth_enabled: false
+      JupyterHub:
+        authenticator_class: "null"
+    redirectToServer: false
+    services:
+      binder: {}
+    loadRoles:
+      binder:
+        services:
+          - binder
+        scopes:
+          - servers
+          - admin:users
+      user:
+        scopes:
+          - self
+          # Admin users will by default have access:services, so this is only
+          # observed to be required for non-admin users.
+          - access:services!service=binder
+binderhub-service:
+  enabled: true
+  ingress:
+    enabled: true
+    hosts: [binder.hhmi.2i2c.cloud]
+    tls:
+      - hosts: [binder.hhmi.2i2c.cloud]
+        secretName: binder-https-auto-tls
+  config:
+    BinderHub:
+      base_url: /
+      hub_url: https://hub.binder.hhmi.2i2c.cloud
+      badge_base_url: https://binder.hhmi.2i2c.cloud
+      image_prefix: quay.io/hhmi-binder/binderhub-ui-
+      auth_enabled: false
+      enable_api_only_mode: false
+      banner_message: ""
+      about_message: ""
+    GitHubRepoProvider:
+      allowed_specs:
+        - "^binder-examples/.*"
+  extraEnv:
+    - name: JUPYTERHUB_API_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: hub
+          key: hub.services.binder.apiToken
+    - name: JUPYTERHUB_CLIENT_ID
+      value: "service-binder"
+    - name: JUPYTERHUB_API_URL
+      value: "https://hub.binder.hhmi.2i2c.cloud/hub/api"
+    # Without this, the redirect URL to /hub/api/... gets
+    # appended to binderhub's URL instead of the hub's
+    - name: JUPYTERHUB_BASE_URL
+      value: "https://hub.binder.hhmi.2i2c.cloud/"
+  buildPodsRegistryCredentials:
+    server: https://quay.io
+    username: hhmi-binder+image_builder

config/clusters/hhmi/cluster.yaml

@@ -39,3 +39,10 @@ hubs:
     helm_chart_values_files:
       - spyglass.values.yaml
       - enc-spyglass.secret.values.yaml
+  - name: binder
+    display_name: "HHMI Binder (ephemeral)"
+    domain: binder.hhmi.2i2c.cloud
+    helm_chart: basehub
+    helm_chart_values_files:
+      - binder.values.yaml
+      - enc-binder.secret.values.yaml

config/clusters/hhmi/enc-binder.secret.values.yaml

@@ -0,0 +1,23 @@
+jupyterhub:
+    imagePullSecret:
+        create: ENC[AES256_GCM,data:veoe/w==,iv:yxmfxT/+9JQE05lj1qQrPWK7IQhE17wRPS2e4PoQN2I=,tag:Jaui9rzVaJuja8iF25/obg==,type:bool]
+        registry: ENC[AES256_GCM,data:5MAFxN7cSg==,iv:UF3ML4yGjVJGc5jmS2R2yMakGYBch+d/5LwE0VULbVs=,tag:B6yC5s+ysX80HmvjDxnohw==,type:str]
+        username: ENC[AES256_GCM,data:qfEVEMnG5dKUU4RQIxT+JJVuov+wWYv9yw==,iv:SVWg6XGRNNAdW1l5Tox6O6hv2jcfZujETk9iw2j0dP0=,tag:SCEUOPEG0U9Xevaf9iPkJw==,type:str]
+        password: ENC[AES256_GCM,data:5TGw4Fr1AuiajWQSQ+3eIESbF/igZxQg2YnYyvCmHZUfzk3X3QHjon6B6UJV+1eJ6NkKF0+ULfYX3kV3zMG9ig==,iv:VCrCdK+7WAVIYwNDLaPqJUGWRS6x2ICQKX82Yp93vbE=,tag:PqAPt1wR+x9TCEj9pxtqMA==,type:str]
+binderhub-service:
+    buildPodsRegistryCredentials:
+        password: ENC[AES256_GCM,data:vMpNPcnXuVj0OWe7tE8+jUey3xFOna+Qn3VcWNBFO6LdU57yl5N9bFOR82FEdbLjGQMlu/aHhoF3F2x5OjxobQ==,iv:/ShrZ0PdyCJMbjCVlXRW3W8pWBlQGR9KTJRw2wR3rmI=,tag:xSMrEWHqdVgzJfGK9xnvMg==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
+          created_at: "2024-07-02T09:38:23Z"
+          enc: CiUA4OM7eBaPTVhNKBJdH7e9GnLGUvNw3C7W9TgmCpgqYqRk/9mcEkkAWX/fcSEUhej1mrRSje5G7oLWFATeIepFXHUN9Do1/ukucmF59qNHTmoBgImzEUxmkhnRI8zVov5ClSstNoOqUPksYS2ShdKZ
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-07-02T09:38:23Z"
+    mac: ENC[AES256_GCM,data:RvkoEcrj5tv0a0z2hYFkjycjQRFx4OBkpq/j2RTU6/g+pg59g/iF5jgK8JBm5sj+/x6zKxT4qbdIk9vIPeZ/jxdjeozjrb6NqAicrl1uzNbr7Zc3ahTKxvlBAdyCy90gj/4h7KdMkn0mr0n58RHsZis1aGPuAexk99QXehdB7PE=,iv:giQOj1KFfGKNGer6wVE9TJqBguIS6xTJwIpPHXSUluU=,tag:LA9VudE/HKMOBBc0IHLdJA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1