nublado Helm values reference#

Helm values reference table for the nublado application.

Key

Type

Default

Description

cloudsql.affinity

object

{}

Affinity rules for the Cloud SQL Proxy pod

cloudsql.enabled

bool

false

Enable the Cloud SQL Auth Proxy, used with CloudSQL databases on Google Cloud. This will be run as a separate service, because shoehorning it into Zero to Jupyterhub’s extraContainers looks messy, and it’s not necessary that it be very performant.

cloudsql.image.pullPolicy

string

"IfNotPresent"

Pull policy for Cloud SQL Auth Proxy images

cloudsql.image.repository

string

"gcr.io/cloudsql-docker/gce-proxy"

Cloud SQL Auth Proxy image to use

cloudsql.image.tag

string

"1.33.13"

Cloud SQL Auth Proxy tag to use

cloudsql.instanceConnectionName

string

None, must be set if Cloud SQL Auth Proxy is enabled

Instance connection name for a CloudSQL PostgreSQL instance

cloudsql.nodeSelector

object

{}

Node selection rules for the Cloud SQL Proxy pod

cloudsql.podAnnotations

object

{}

Annotations for the Cloud SQL Proxy pod

cloudsql.resources

object

See values.yaml

Resource limits and requests for the Cloud SQL Proxy pod

cloudsql.serviceAccount

string

None, must be set if Cloud SQL Auth Proxy is enabled

The Google service account that has an IAM binding to the gafaelfawr Kubernetes service account and has the cloudsql.client role

cloudsql.tolerations

list

[]

Tolerations for the Cloud SQL Proxy pod

controller.affinity

object

{}

Affinity rules for the lab controller pod

controller.config.fileserver.enabled

bool

false

Enable fileserver management

controller.config.fileserver.image

string

"ghcr.io/lsst-sqre/worblehat"

Image for fileserver container

controller.config.fileserver.namespace

string

"fileservers"

Namespace for user fileservers

controller.config.fileserver.pullPolicy

string

"IfNotPresent"

Pull policy for fileserver container

controller.config.fileserver.tag

string

"0.1.0"

Tag for fileserver container

controller.config.fileserver.timeout

int

3600

Timeout for user fileservers, in seconds

controller.config.images.aliasTags

list

[]

Additional tags besides recommendedTag that should be recognized as aliases.

controller.config.images.cycle

string

nil

Restrict images to this SAL cycle, if given.

controller.config.images.numDailies

int

3

Number of most-recent dailies to prepull.

controller.config.images.numReleases

int

1

Number of most-recent releases to prepull.

controller.config.images.numWeeklies

int

2

Number of most-recent weeklies to prepull.

controller.config.images.pin

list

[]

List of additional image tags to prepull. Listing the image tagged as recommended here is recommended when using a Docker image source to ensure its name can be expanded properly in the menu.

controller.config.images.recommendedTag

string

"recommended"

Tag marking the recommended image (shown first in the menu)

controller.config.images.source

object

None, must be specified

Source for prepulled images. For Docker, set type to docker, registry to the hostname and repository to the name of the repository. For Google Artifact Repository, set type to google, location to the region, projectId to the Google project, repository to the name of the repository, and image to the name of the image.

controller.config.lab.application

string

See values.yaml

ArgcoCD application in which to collect user lab objects.

controller.config.lab.env

object

See values.yaml

Environment variables to set for every user lab.

controller.config.lab.files

object

See values.yaml

Files to be mounted as ConfigMaps inside the user lab pod. contents contains the file contents. Set modify to true to make the file writable in the pod.

controller.config.lab.initcontainers

list

[]

Containers run as init containers with each user pod. Each should set name, image (a Docker image reference), and privileged, and may contain volumes (similar to the main volumes configuration). If privileged is true, the container will run as root with allowPrivilegeEscalation true. Otherwise it will, run as UID 1000.

controller.config.lab.pullSecret

string

Do not use a pull secret

Pull secret to use for labs. Set to the string pull-secret to use the normal pull secret from Vault.

controller.config.lab.secrets

list

[]

Secrets to set in the user pods. Each should have a secretKey key pointing to a secret in the same namespace as the controller (generally nublado-secret) and secretRef pointing to a field in that key.

controller.config.lab.sizes

object

See values.yaml (specifies small, medium, and

Available lab sizes. Names must be chosen from fine, diminutive, tiny, small, medium, large, huge, gargantuan, and colossal in that order. Each should specify the maximum CPU equivalents and memory. SI prefixes for memory are supported. large)

controller.config.lab.volumes

list

[]

Volumes that should be mounted in lab pods. This supports NFS, HostPath, and PVC volume types (differentiated in source.type)

controller.config.safir.logLevel

string

"INFO"

Level of Python logging

controller.config.safir.pathPrefix

string

"/nublado"

Path prefix that will be routed to the controller

controller.googleServiceAccount

string

None, must be set when using Google Artifact Registry

If Google Artifact Registry is used as the image source, the Google service account that has an IAM binding to the nublado-controller Kubernetes service account and has the Artifact Registry reader role

controller.image.pullPolicy

string

"IfNotPresent"

Pull policy for the nublado image

controller.image.repository

string

"ghcr.io/lsst-sqre/jupyterlab-controller"

nublado image to use

controller.image.tag

string

The appVersion of the chart

Tag of nublado image to use

controller.ingress.annotations

object

{}

Additional annotations to add for the lab controller pod ingress

controller.nodeSelector

object

{}

Node selector rules for the lab controller pod

controller.podAnnotations

object

{}

Annotations for the lab controller pod

controller.resources

object

{}

Resource limits and requests for the lab controller pod

controller.slackAlerts

bool

false

Whether to enable Slack alerts. If set to true, slack_webhook must be set in the corresponding Nublado Vault secret.

controller.tolerations

list

[]

Tolerations for the lab controller pod

global.baseUrl

string

Set by Argo CD

Base URL for the environment

global.host

string

Set by Argo CD

Host name for ingress

global.vaultSecretsPath

string

Set by Argo CD

Base path for Vault secrets

hub.internalDatabase

bool

true

Whether to use the cluster-internal PostgreSQL server instead of an external server. This is not used directly by the Nublado chart, but controls how the database password is managed.

hub.timeout.spawn

int

600

Timeout for the Kubernetes spawn process in seconds. (Allow long enough to pull uncached images if needed.)

hub.timeout.startup

int

90

Timeout for JupyterLab to start. Currently this sometimes takes over 60 seconds for reasons we don’t understand.

jupyterhub.cull.enabled

bool

true

Enable the lab culler.

jupyterhub.cull.every

int

600 (10 minutes)

How frequently to check for idle labs in seconds

jupyterhub.cull.maxAge

int

5184000 (60 days)

Maximum age of a lab regardless of activity

jupyterhub.cull.removeNamedServers

bool

true

Whether to remove named servers when culling their lab

jupyterhub.cull.timeout

int

2592000 (30 days)

Default idle timeout before the lab is automatically deleted in seconds

jupyterhub.cull.users

bool

true

Whether to log out the server when culling their lab

jupyterhub.hub.authenticatePrometheus

bool

false

Whether to require metrics requests to be authenticated

jupyterhub.hub.baseUrl

string

"/nb"

Base URL on which JupyterHub listens

jupyterhub.hub.containerSecurityContext

object

{"allowPrivilegeEscalation":false,"runAsGroup":768,"runAsUser":768}

Security context for JupyterHub container

jupyterhub.hub.db.password

string

Comes from nublado-secret

Database password (not used)

jupyterhub.hub.db.type

string

"postgres"

Type of database to use

jupyterhub.hub.db.url

string

Use the in-cluster PostgreSQL installed by Phalanx

URL of PostgreSQL server

jupyterhub.hub.existingSecret

string

"nublado-secret"

Existing secret to use for private keys

jupyterhub.hub.extraEnv

object

Gets JUPYTERHUB_CRYPT_KEY from nublado-secret

Additional environment variables to set

jupyterhub.hub.extraVolumeMounts

list

hub-config and the Gafaelfawr token

Additional volume mounts for JupyterHub

jupyterhub.hub.extraVolumes

list

The hub-config ConfigMap and the Gafaelfawr token

Additional volumes to make available to JupyterHub

jupyterhub.hub.image.name

string

"ghcr.io/lsst-sqre/rsp-restspawner"

Image to use for JupyterHub

jupyterhub.hub.image.tag

string

"0.5.0"

Tag of image to use for JupyterHub

jupyterhub.hub.loadRoles.server.scopes

list

["self"]

Default scopes for the user’s lab, overridden to allow the lab to delete itself (which we use for our added menu items)

jupyterhub.hub.networkPolicy.enabled

bool

false

Whether to enable the default NetworkPolicy (currently, the upstream one does not work correctly)

jupyterhub.hub.resources

object

{"limits":{"cpu":"900m","memory":"1Gi"}}

Resource limits and requests

jupyterhub.ingress.enabled

bool

false

Whether to enable the default ingress

jupyterhub.prePuller.continuous.enabled

bool

false

Whether to run the JupyterHub continuous prepuller (the Nublado controller does its own prepulling)

jupyterhub.prePuller.hook.enabled

bool

false

Whether to run the JupyterHub hook prepuller (the Nublado controller does its own prepulling)

jupyterhub.proxy.chp.networkPolicy.interNamespaceAccessLabels

string

"accept"

Enable access to the proxy from other namespaces, since we put each user’s lab environment in its own namespace

jupyterhub.proxy.service.type

string

"ClusterIP"

Only expose the proxy to the cluster, overriding the default of exposing the proxy directly to the Internet

jupyterhub.scheduling.userPlaceholder.enabled

bool

false

Whether to spawn placeholder pods representing fake users to force autoscaling in advance of running out of resources

jupyterhub.scheduling.userScheduler.enabled

bool

false

Whether the user scheduler should be enabled

jupyterhub.singleuser.cloudMetadata.blockWithIptables

bool

false

Whether to configure iptables to block cloud metadata endpoints. This is unnecessary in our environments (they are blocked by cluster configuration) and thus is disabled to reduce complexity.

jupyterhub.singleuser.cmd

string

"/opt/lsst/software/jupyterlab/runlab.sh"

Start command for labs

jupyterhub.singleuser.defaultUrl

string

"/lab"

Default URL prefix for lab endpoints

proxy.ingress.annotations

object

Increase proxy-read-timeout and proxy-send-timeout to 5m

Additional annotations to add to the proxy ingress (also used to talk to JupyterHub and all user labs)

secrets.templateSecrets

bool

false

Whether to use the new secrets management mechanism. If enabled, the Vault nublado secret will be split into a nublado secret for JupyterHub and a nublado-lab-secret secret used as a source for secret values for the user’s lab.