Merge pull request #1544 from consideRatio/pr/update-z2jh

Update to z2jh 2 and JupyterHub 3

.github/workflows/test.yml

@@ -50,7 +50,7 @@ jobs:
       matrix:
         k3s-channel:
           # Available channels: https://github.com/k3s-io/k3s/blob/HEAD/channel.yaml
-          - v1.24
+          - latest
         test:
           - main
           - auth
@@ -64,7 +64,7 @@ jobs:
           - k3s-channel: v1.20
             helm-version: v3.5.0
             test: helm
-          - k3s-channel: v1.24
+          - k3s-channel: latest
             test: helm
             test-variation: upgrade
             # upgrade-from represents a release channel, see: https://jupyterhub.github.io/helm-chart/info.json

doc/authentication.rst

@@ -26,7 +26,6 @@ you need to add the following into ``config.yaml``:
           binder:
             oauth_no_confirm: true
             oauth_redirect_uri: "https://<binderhub_url>/oauth_callback"
-            oauth_client_id: "binder-oauth-client-test"
 
       singleuser:
         # to make notebook servers aware of hub

helm-chart/binderhub/Chart.yaml

@@ -12,7 +12,7 @@ dependencies:
   #            and run "./dependencies freeze --upgrade".
   #
   - name: jupyterhub
-    version: "1.2.0"
+    version: "2.0.0"
     repository: "https://jupyterhub.github.io/helm-chart"
 description: |-
   BinderHub is like a JupyterHub that automatically builds environments for the

helm-chart/binderhub/templates/deployment.yaml

@@ -118,6 +118,8 @@ spec:
               name: "{{ include "jupyterhub.hub.fullname" . }}"
               key: hub.services.binder.apiToken
         {{- if .Values.config.BinderHub.auth_enabled }}
+        - name: JUPYTERHUB_SERVICE_NAME
+          value: binder
         - name: JUPYTERHUB_API_URL
           value: {{ (print (.Values.config.BinderHub.hub_url_local | default .Values.config.BinderHub.hub_url | trimSuffix "/") "/hub/api/") }}
         - name: JUPYTERHUB_BASE_URL

helm-chart/binderhub/values.yaml

@@ -56,14 +56,20 @@ jupyterhub:
   cull:
     enabled: true
     users: true
-  rbac:
-    enabled: true
   hub:
     config:
       JupyterHub:
         authenticator_class: nullauthenticator.NullAuthenticator
       BinderSpawner:
         auth_enabled: false
+    loadRoles:
+      binder:
+        services:
+          - binder
+        scopes:
+          - servers
+          # we don't need admin:users if auth is not enabled!
+          - "admin:users"
     extraConfig:
       0-binderspawnermixin: |
         """
@@ -188,8 +194,7 @@ jupyterhub:
         c.JupyterHub.spawner_class = BinderSpawner
     services:
       binder:
-        admin: true
-        apiToken:
+        display: false
   singleuser:
     # start notebook server with lab ui as default
     # *if available*

helm-chart/images/binderhub/requirements.in

@@ -10,7 +10,7 @@ google-cloud-logging==3.*
 # jupyterhub's major version should be matched with the JupyterHub Helm chart's
 # used version of JupyterHub.
 #
-jupyterhub==1.*
+jupyterhub==3.*
 
 # https://github.com/kubernetes-client/python
 kubernetes==9.*

helm-chart/images/binderhub/requirements.txt

@@ -26,8 +26,6 @@ cryptography==38.0.1
     # via pyopenssl
 docker==6.0.0
     # via -r helm-chart/images/binderhub/../../../requirements.txt
-entrypoints==0.4
-    # via jupyterhub
 escapism==1.0.1
     # via -r helm-chart/images/binderhub/../../../requirements.txt
 google-api-core[grpc]==2.10.2
@@ -68,6 +66,8 @@ grpcio-status==1.49.1
     # via google-api-core
 idna==3.4
     # via requests
+importlib-metadata==5.0.0
+    # via jupyterhub
 jinja2==3.1.2
     # via
     #   -r helm-chart/images/binderhub/../../../requirements.txt
@@ -78,7 +78,7 @@ jsonschema==4.16.0
     #   jupyter-telemetry
 jupyter-telemetry==0.1.0
     # via jupyterhub
-jupyterhub==1.5.0
+jupyterhub==3.0.0
     # via
     #   -r helm-chart/images/binderhub/../../../requirements.txt
     #   -r helm-chart/images/binderhub/requirements.in
@@ -97,7 +97,9 @@ oauthlib==3.2.1
     #   jupyterhub
     #   requests-oauthlib
 packaging==21.3
-    # via docker
+    # via
+    #   docker
+    #   jupyterhub
 pamela==1.0.0
     # via jupyterhub
 prometheus-client==0.14.1
@@ -186,6 +188,8 @@ websocket-client==1.4.1
     # via
     #   docker
     #   kubernetes
+zipp==3.9.0
+    # via importlib-metadata
 
 # The following packages are considered to be unsafe in a requirements file:
 # setuptools

testing/local-binder-k8s-hub/binderhub_config_auth_additions.py

@@ -25,4 +25,5 @@
 c.HubOAuth.base_url = c.BinderHub.base_url
 c.HubOAuth.hub_prefix = c.BinderHub.base_url + "hub/"
 c.HubOAuth.oauth_redirect_uri = "http://127.0.0.1:8585/oauth_callback"
-c.HubOAuth.oauth_client_id = "binder-oauth-client-test"
+c.HubOAuth.oauth_client_id = "service-binder"
+c.HubOAuth.access_scopes = {"access:services!service=binder"}

testing/local-binder-k8s-hub/jupyterhub-chart-config-auth-additions.yaml

@@ -6,11 +6,15 @@ hub:
     binder:
       oauth_no_confirm: true
       oauth_redirect_uri: "http://127.0.0.1:8585/oauth_callback"
-      oauth_client_id: "binder-oauth-client-test"
   config:
     JupyterHub:
       authenticator_class: "dummy"
     DummyAuthenticator:
       password: "dummy"
     BinderSpawner:
       auth_enabled: true
+  loadRoles:
+    user:
+      scopes:
+        - self
+        - "access:services"

tools/templates/lint-and-validate-values.yaml

@@ -53,8 +53,6 @@ jupyterhub:
   cull:
     enabled: true
     users: true
-  rbac:
-    enabled: true
   hub:
     config:
       JupyterHub: