Merge pull request 2i2c-org#4140 from AIDEA775/projectpythia-hubs

projectpythia: add staging and prod hubs

.github/workflows/deploy-hubs.yaml

@@ -248,6 +248,7 @@ jobs:
       failure_openscapes: "${{ env.failure_openscapes }}"
       failure_opensci: "${{ env.failure_opensci }}"
       failure_pangeo-hubs: "${{ env.failure_pangeo-hubs }}"
+      failure_projectpythia: "${{ env.failure_projectpythia }}"
       failure_qcl: "${{ env.failure_qcl }}"
       failure_smithsonian: "${{ env.failure_smithsonian }}"
       failure_ubc-eoas: "${{ env.failure_ubc-eoas }}"

config/clusters/projectpythia/cluster.yaml

@@ -14,4 +14,20 @@ support:
   helm_chart_values_files:
     - support.values.yaml
     - enc-support.secret.values.yaml
-hubs: []
+hubs:
+  - name: staging
+    display_name: projectpythia staging
+    domain: staging.projectpythia.2i2c.cloud
+    helm_chart: basehub
+    helm_chart_values_files:
+      - common.values.yaml
+      - staging.values.yaml
+      - enc-staging.secret.values.yaml
+  - name: prod
+    display_name: projectpythia prod
+    domain: projectpythia.2i2c.cloud
+    helm_chart: basehub
+    helm_chart_values_files:
+      - common.values.yaml
+      - prod.values.yaml
+      - enc-prod.secret.values.yaml

config/clusters/projectpythia/common.values.yaml

@@ -0,0 +1,151 @@
+nfs:
+  enabled: true
+  # volumeReporter will report 100% for all hubs as EFS is unbounded, we disable
+  # it to save a limited amount of pods we can allocate per core node
+  volumeReporter:
+    enabled: false
+  pv:
+    enabled: true
+    # from https://docs.aws.amazon.com/efs/latest/ug/mounting-fs-nfs-mount-settings.html
+    mountOptions:
+      - rsize=1048576
+      - wsize=1048576
+      - timeo=600
+      - soft # We pick soft over hard, so NFS lockups don't lead to hung processes
+      - retrans=2
+      - noresvport
+    serverIP: fs-0c29370cc50856b5d.efs.us-west-2.amazonaws.com
+    baseShareName: /
+
+jupyterhub:
+  custom:
+    2i2c:
+      add_staff_user_ids_to_admin_users: true
+      add_staff_user_ids_of_type: "github"
+    jupyterhubConfigurator:
+      enabled: false
+    homepage:
+      templateVars:
+        designed_by:
+          name: "2i2c"
+          url: https://2i2c.org
+        operated_by:
+          name: "2i2c"
+          url: https://2i2c.org
+        funded_by:
+          name: "NSF"
+          url: https://doi.org/10.5281/zenodo.8184298
+        org:
+          url: https://projectpythia.org/
+          logo_url: https://projectpythia.org/_static/images/logos/pythia_logo-blue-rtext.svg
+
+  hub:
+    allowNamedServers: true
+    config:
+      JupyterHub:
+        authenticator_class: github
+      Authenticator:
+        admin_users:
+          - jmunroe
+          - ktyle
+
+  scheduling:
+    userScheduler:
+      enabled: true
+
+  singleuser:
+    profileList:
+      - display_name: Pangeo Notebook
+        slug: pangeo
+        default: true
+        kubespawner_override:
+          image: quay.io/pangeo/pangeo-notebook:2024.05.21
+          default_url: /lab
+          node_selector:
+            node.kubernetes.io/instance-type: r5.xlarge
+        profile_options: &profile_options
+          resource_allocation: &resource_allocation
+            display_name: Resource Allocation
+            choices:
+              mem_1_9:
+                display_name: 1.9 GB RAM, upto 3.7 CPUs
+                kubespawner_override:
+                  mem_guarantee: 1991244775
+                  mem_limit: 1991244775
+                  cpu_guarantee: 0.2328125
+                  cpu_limit: 3.725
+                default: true
+              mem_3_7:
+                display_name: 3.7 GB RAM, upto 3.7 CPUs
+                kubespawner_override:
+                  mem_guarantee: 3982489550
+                  mem_limit: 3982489550
+                  cpu_guarantee: 0.465625
+                  cpu_limit: 3.725
+              mem_7_4:
+                display_name: 7.4 GB RAM, upto 3.7 CPUs
+                kubespawner_override:
+                  mem_guarantee: 7964979101
+                  mem_limit: 7964979101
+                  cpu_guarantee: 0.93125
+                  cpu_limit: 3.725
+              mem_14_8:
+                display_name: 14.8 GB RAM, upto 3.7 CPUs
+                kubespawner_override:
+                  mem_guarantee: 15929958203
+                  mem_limit: 15929958203
+                  cpu_guarantee: 1.8625
+                  cpu_limit: 3.725
+              mem_29_7:
+                display_name: 29.7 GB RAM, upto 3.7 CPUs
+                kubespawner_override:
+                  mem_guarantee: 31859916406
+                  mem_limit: 31859916406
+                  cpu_guarantee: 3.725
+                  cpu_limit: 3.725
+      - display_name: NVIDIA Tesla T4, ~16 GB, ~4 CPUs
+        description: "Start a container on a dedicated node with a GPU"
+        profile_options:
+          image:
+            display_name: Image
+            choices:
+              tensorflow:
+                display_name: Pangeo Tensorflow ML Notebook
+                slug: tensorflow
+                kubespawner_override:
+                  image: pangeo/ml-notebook:2024.05.21
+                  default_url: /lab
+              pytorch:
+                display_name: Pangeo PyTorch ML Notebook
+                default: true
+                slug: pytorch
+                kubespawner_override:
+                  image: pangeo/pytorch-notebook:2024.05.21
+                  default_url: /lab
+        kubespawner_override:
+          environment:
+            NVIDIA_DRIVER_CAPABILITIES: compute,utility
+          mem_limit: null
+          mem_guarantee: 14G
+          node_selector:
+            node.kubernetes.io/instance-type: g4dn.xlarge
+          extra_resource_limits:
+            nvidia.com/gpu: "1"
+      - display_name: Bring your own image
+        description: Specify your own docker image (must have python and jupyterhub installed in it)
+        slug: custom
+        profile_options:
+          image:
+            display_name: Image
+            unlisted_choice:
+              enabled: True
+              display_name: "Custom image"
+              validation_regex: "^.+:.+$"
+              validation_message: "Must be a publicly available docker image, of form <image-name>:<tag>"
+              kubespawner_override:
+                image: "{value}"
+            choices: {}
+          resource_allocation: *resource_allocation
+        kubespawner_override:
+          node_selector:
+            node.kubernetes.io/instance-type: r5.xlarge

config/clusters/projectpythia/enc-prod.secret.values.yaml

@@ -0,0 +1,20 @@
+jupyterhub:
+    hub:
+        config:
+            GitHubOAuthenticator:
+                client_id: ENC[AES256_GCM,data:TseiqbF9pWK5jARuZhRQcF9A/wY=,iv:YlVeaLufXR21Fjj2urg8mySKAFBb6LZev7u7+DN8rTw=,tag:zmk+3N+cGc2i7rJvPFiTVQ==,type:str]
+                client_secret: ENC[AES256_GCM,data:NO4DihPlLwoaYadShO8EhIXYFh7wum54JQgJUo8wvWPggyixDO0jqg==,iv:XbIi4wp5b2VnZ7z5GgXFJVCc9dbuiRpE9r7HeHBhg9Q=,tag:PR/ZH3LQSt+IxCh48KaA2w==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
+          created_at: "2024-05-27T20:11:52Z"
+          enc: CiUA4OM7eMToeLf5fQgnKvrZXGKFZcOPUlmXBirxzPu2FTmAqdkxEkkAWX/fcVFQzEb04SBjy+ByZyCOayfihNs7RoK/TtYGIs/TDVkYj6/ubVzrkxIHif8Ff0T28PhhhdWWNLzKer3K6nEuOC4M/fjV
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-05-27T20:11:54Z"
+    mac: ENC[AES256_GCM,data:1xqEnPANWfjtJEM4ecW3iXxmULa0QO4EqR2CydUfyPsHul+wqPrD+5eKRXbrtPVtz37Q+JHEEzxw6MJe1RGkU3X7nf0NQwrRzYmUd1q+h01S7eddiJa0wsgn7/fkN3p9g64PhgCQCcaQfMBonm/+zS1c2aEJAMTupy5asih+wvo=,iv:wothVj08hdLhYw6wcx/Fuq88bJofyH9Up+Xabici3JE=,tag:wf/z1Mi5cyE+hjHI6zFhSA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

config/clusters/projectpythia/enc-staging.secret.values.yaml

@@ -0,0 +1,20 @@
+jupyterhub:
+    hub:
+        config:
+            GitHubOAuthenticator:
+                client_id: ENC[AES256_GCM,data:0ajnzt23/BGSneWNJ84r/cYQdjU=,iv:7Yi2sKvUUTYvJxdBcNaUjJrvbXDqDLEJCAoZ+gdfLqM=,tag:vtBeoT9LO9r97rX/iXAgsw==,type:str]
+                client_secret: ENC[AES256_GCM,data:uO5RWaJ0qB69ckrLfC+g/vYj3NSxmP68/6/YsW6C1CqcwQBzmwjI9A==,iv:Ad7ZCboDBBg9ctNeWEyFOeSskyIKKe4MK/C/ItIRhVw=,tag:E49K+Duk0fbdjLASuTVbNg==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
+          created_at: "2024-05-27T19:19:26Z"
+          enc: CiUA4OM7eA1OVvPVmxScdCOMBLzNzFuJ9d5kKdXfNRG6oR/WnMA5EkkAWX/fcZkGAwiOgpH6HkUJh9v8WtjnmyEReoXqrJiX1rZ1zQJNHoDauAV53EIKwWj4Vn3spxDMcnYzt2zQXcCpqctkiwZ0P47D
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-05-27T19:19:27Z"
+    mac: ENC[AES256_GCM,data:Yf2hqUGgYoi8fn4f+XaVxy+IcyGQJIce+Hw/F0vETJAniVvjiMGqnqao3kmyjmUwFGco8bzfAmcbxzdCBilEa9A34ujjFYp998KHigR1CiF1+QBY/bgGXT2lLKcGT8xs25/SGj/0doaMQ5ZxsyHiF3vuQn5MUOrWC2G2bKIFEFM=,iv:HKfcX124k21DqoeNeZBipF5AsRAAjeRFsqKFO9JUmnQ=,tag:I5FBh3bZN0vEkYsi0xBTXA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

config/clusters/projectpythia/prod.values.yaml

@@ -0,0 +1,19 @@
+jupyterhub:
+  ingress:
+    hosts: [projectpythia.2i2c.cloud]
+    tls:
+      - hosts: [projectpythia.2i2c.cloud]
+        secretName: https-auto-tls
+  custom:
+    homepage:
+      templateVars:
+        org:
+          name: ProjectPythia
+  hub:
+    config:
+      GitHubOAuthenticator:
+        oauth_callback_url: https://projectpythia.2i2c.cloud/hub/oauth_callback
+        allowed_organizations:
+          - ProjectPythia
+        scope:
+          - read:org

config/clusters/projectpythia/staging.values.yaml

@@ -0,0 +1,19 @@
+jupyterhub:
+  ingress:
+    hosts: [staging.projectpythia.2i2c.cloud]
+    tls:
+      - hosts: [staging.projectpythia.2i2c.cloud]
+        secretName: https-auto-tls
+  custom:
+    homepage:
+      templateVars:
+        org:
+          name: projectpythia staging
+  hub:
+    config:
+      GitHubOAuthenticator:
+        oauth_callback_url: https://staging.projectpythia.2i2c.cloud/hub/oauth_callback
+        allowed_organizations:
+          - ProjectPythia
+        scope:
+          - read:org