Merge pull request 2i2c-org#4298 from sgibson91/opensci/big-binder

Deploy big binder to opensci cluster

config/clusters/opensci/big-binder.values.yaml

@@ -0,0 +1,108 @@
+jupyterhub:
+  ingress:
+    hosts: [hub.big.binder.opensci.2i2c.cloud]
+    tls:
+      - hosts: [hub.big.binder.opensci.2i2c.cloud]
+        secretName: https-auto-tls
+  custom:
+    binderhubUI:
+      enabled: true
+    2i2c:
+      add_staff_user_ids_to_admin_users: true
+      add_staff_user_ids_of_type: github
+    homepage:
+      gitRepoBranch: "no-homepage-subsections"
+      templateVars:
+        org:
+          name: Sciencecore
+          logo_url: https://2i2c.org
+          url: https://2i2c.org/media.logo.png
+        designed_by:
+          name: 2i2c
+          url: https://2i2c.org
+        operated_by:
+          name: 2i2c
+          url: https://2i2c.org
+        funded_by:
+          name: ""
+          url: ""
+    jupyterhubConfigurator:
+      enabled: false
+    singleuserAdmin:
+      extraVolumeMounts: []
+  singleuser:
+    cpu:
+      limit: 0.25
+    memory:
+      limit: 1G
+      guarantee: 256M
+    storage:
+      type: none
+      extraVolumeMounts: []
+    initContainers: []
+    profileList: []
+  hub:
+    config:
+      BinderSpawnerMixin:
+        auth_enabled: true
+      JupyterHub:
+        authenticator_class: github
+      GitHubOAuthenticator:
+        oauth_callback_url: https://hub.big.binder.opensci.2i2c.cloud/hub/oauth_callback
+        allowed_organizations:
+          - 2i2c-nasa-binder-access:big-binder-team
+    redirectToServer: false
+    services:
+      binder:
+        oauth_no_confirm: true
+        oauth_redirect_uri: https://big.binder.opensci.2i2c.cloud/oauth_callback
+    loadRoles:
+      binder:
+        services:
+          - binder
+        scopes:
+          - servers
+          - read:users # admin:users is required if authentication isn't enabled
+      user:
+        scopes:
+          - self
+          # Admin users will by default have access:services, so this is only
+          # observed to be required for non-admin users.
+          - access:services!service=binder
+binderhub-service:
+  enabled: true
+  ingress:
+    enabled: true
+    hosts: [big.binder.opensci.2i2c.cloud]
+    tls:
+      - hosts: [big.binder.opensci.2i2c.cloud]
+        secretName: binder-https-auto-tls
+  config:
+    BinderHub:
+      base_url: /
+      hub_url: https://hub.big.binder.opensci.2i2c.cloud
+      badge_base_url: https://big.binder.opensci.2i2c.cloud
+      image_prefix: quay.io/opensci-big-binder/binderhub-ui-
+      auth_enabled: true
+      enable_api_only_mode: false
+      banner_message: ""
+      about_message: ""
+  extraEnv:
+    - name: JUPYTERHUB_API_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: hub
+          key: hub.services.binder.apiToken
+    - name: JUPYTERHUB_CLIENT_ID
+      value: "service-binder"
+    - name: JUPYTERHUB_API_URL
+      value: "https://hub.big.binder.opensci.2i2c.cloud/hub/api"
+    # Without this, the redirect URL to /hub/api/... gets
+    # appended to binderhub's URL instead of the hub's
+    - name: JUPYTERHUB_BASE_URL
+      value: "https://hub.big.binder.opensci.2i2c.cloud/"
+    - name: JUPYTERHUB_OAUTH_CALLBACK_URL
+      value: "https://big.binder.opensci.2i2c.cloud/oauth_callback"
+  buildPodsRegistryCredentials:
+    server: "https://quay.io"
+    username: opensci-big-binder+image_builder

config/clusters/opensci/cluster.yaml

@@ -52,3 +52,10 @@ hubs:
     helm_chart_values_files:
       - small-binder.values.yaml
       - enc-small-binder.secret.values.yaml
+  - name: big-binder
+    display_name: OpenSci Binder (Big)
+    domain: hub.big.binder.opensci.2i2c.cloud
+    helm_chart: basehub
+    helm_chart_values_files:
+      - big-binder.values.yaml
+      - enc-big-binder.secret.values.yaml

config/clusters/opensci/enc-big-binder.secret.values.yaml

@@ -0,0 +1,28 @@
+binderhub-service:
+    buildPodsRegistryCredentials:
+        password: ENC[AES256_GCM,data:LjAmYI3e8BuXi4K68q613ne5pR61RVRgUSdgCAUaMyiMNP/38z8KMDOyLRpNtllLwwY1VWLND9MqRiRYXFHvMQ==,iv:bqoHRXMENCIDHpdiiuybM4oUpXqAIt4EOcrnUEWBmPQ=,tag:MZqUfRf1m1NZx0Nifo8kng==,type:str]
+jupyterhub:
+    hub:
+        config:
+            GitHubOAuthenticator:
+                client_id: ENC[AES256_GCM,data:OGFXl4BPWB3wxyIRXhxLNJY9GLE=,iv:7aJvKzFLX4QVgOgNqhSojhlJsirvSR9tBvAdq654+wk=,tag:6qkxSYfDkAR8/m4SN5NrHQ==,type:str]
+                client_secret: ENC[AES256_GCM,data:EBZzMDZ2E6xayQQkQH1KEZ/sF6+JBmqWrGpHs3V4I66L2zbJIG9XxA==,iv:nXJlVoY68JNB1ui773VoUTR8YvGygRN7jbzmG5k71E8=,tag:OFDNIDmUSHIaJXj5R5MdAw==,type:str]
+    imagePullSecret:
+        create: ENC[AES256_GCM,data:dobSiQ==,iv:3uGTeWyoV2yo2U+u7Qc+l8+dLxwAd2m5w2J4u1bSSFc=,tag:Ob+ygkxTDYaw2NMhPBCSGg==,type:bool]
+        registry: ENC[AES256_GCM,data:AlZLr2oClQ==,iv:CtSf5UUtY3zcMffTNZAbQ+Ek+hVSj1PySXrh5vAaYgA=,tag:RHXVqg2MikfidEHaU3TAlg==,type:str]
+        username: ENC[AES256_GCM,data:coGDOM1G1wirMCGXoVEFvA9e3ePwCIfnE8TJmPKTElY=,iv:rtUdjUaTVbDbbHcLzS/Msav5T19i4b6QmdEV+4f/P5g=,tag:02/yRzbHZrfYrmyBkMywMQ==,type:str]
+        password: ENC[AES256_GCM,data:BLe5W/bWTqRxwWdza9ZoRLFXqrTKB+uxBHZaSv2dF+vIjFBmdxUVmBhCsDLJPxQCEufO6eXyLtTirSxhd703vQ==,iv:mgl062MUzQXTxIRZnTYNdncVo4oeURqeRV/YhSz1UZk=,tag:KDhtJqlaG+DRvh8bk4MGiw==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
+          created_at: "2024-06-27T14:19:04Z"
+          enc: CiUA4OM7eBoidZ3F3zbV0vnQg1mYdW4as7N8dZLotnrdmJXMBZ3FEkkAWX/fcXaiubwYqoRquIFm/vnxzZL7ROQTAsNK1jxvEwSF7us3uBlfTntLtFEL9oMgpne3ekofjrCrcxFOMPKZYaV4jCXkvZBO
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-06-27T14:19:05Z"
+    mac: ENC[AES256_GCM,data:JALMuth+497Io0zHzikv/309XwkOv5YKQ+ZoEA/jMjdGv0iwXCt20PA5Q+AOu4Fxz/BJG+OS1ICxjW9sKQdCV3qElrBWjbcR4tnAV/dzEuHv8Yv0KrLEQfmjDn9K8wIP/Y2dX4N054lugafAMeKKjnbVUclpZ2h2EYg6a+jKWu8=,iv:7GBqSaLI38TCqQbn9ewC4S7/wDB4zJHsyh2QBto3sxQ=,tag:/S5w7Tew51z1PHr4ojyUig==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1