daskhub.yaml

dask-gateway:
  enabled: true
  traefik:
    service:
      type: ClusterIP
    additionalArguments:
      - "--providers.kubernetescrd.allowcrossnamespace=false"
      - "--providers.kubernetescrd.namespaces=c-scale-pangeo-dask"
      - "--providers.kubernetesgateway.namespaces=c-scale-pangeo-dask"
      - "--providers.kubernetesingress.namespaces=c-scale-pangeo-dask"
  gateway:
#    loglevel: DEBUG
    extraConfig:
      # https://gateway.dask.org/resource-limits.html
      dasklimits: |
        # see https://github.com/dask/dask-gateway/issues/315
        c.ClusterConfig.cluster_max_cores = 40 # instead of "32"
        c.ClusterConfig.cluster_max_memory = "140 G" # instead of "128 G"
        c.ClusterConfig.cluster_max_workers = 4
        c.ClusterConfig.idle_timeout = 1800
      optionHandler: |
        from dask_gateway_server.options import Options, Integer, Float, String

        def options_handler(options):
          if ":" not in options.image:
            raise ValueError("When specifying an image you must also provide a tag")
          return {
            "worker_cores": options.worker_cores,
            "worker_memory": int(options.worker_memory * 2 ** 30),
            "image": options.image,
          }

        c.Backend.cluster_options = Options(
          Integer("worker_cores", default=1, min=1, max=8, label="Worker Cores"),
          Float("worker_memory", default=2, min=2, max=32, label="Worker Memory (GiB)"),
          String("image", default="quay.io/pangeo/pangeo-notebook:2024.08.18", label="Image"),
          handler=options_handler,
        )
    prefix: /services/dask-gateway
    backend:
      scheduler:
        extraPodConfig:
          securityContext:
            fsGroupChangePolicy: OnRootMismatch
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
        extraContainerConfig:
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            capabilities:
             drop:
             - ALL
        cores:
          request: 1
          limit: 1
        memory:
          request: 8G
          limit: 8G
      worker:
        extraPodConfig:
          securityContext:
            fsGroupChangePolicy: OnRootMismatch
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
        extraContainerConfig:
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            capabilities:
             drop:
             - ALL

dask-kubernetes:
  enabled: false

rbac:
  enabled: true

jupyterhub:
  hub:
    initContainers:
      - name: git-clone-templates
        image: alpine/git
        args:
          - clone
          - --single-branch
          - --branch=main
          - --depth=1
          - --
          - https://github.com/pangeo-data/pangeo-eosc.git
          - /etc/jupyterhub/custom
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          allowPrivilegeEscalation: false
          capabilities:
           drop:
           - ALL
        volumeMounts:
          - name: custom-templates
            mountPath: /etc/jupyterhub/custom
      - name: git-clone-static
        image: alpine/git
        args:
          - clone
          - --single-branch
          - --branch=main
          - --depth=1
          - --
          - https://github.com/pangeo-data/pangeo-eosc.git
          - /usr/local/share/jupyterhub/static/custom
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          allowPrivilegeEscalation: false
          capabilities:
           drop:
           - ALL
        volumeMounts:
          - name: custom-static
            mountPath: /usr/local/share/jupyterhub/static/custom
    extraVolumes:
      - name: custom-templates
        emptyDir: {}
      - name: custom-static
        emptyDir: {}
    extraVolumeMounts:
      - name: custom-templates
        mountPath: /etc/jupyterhub/custom
      - name: custom-static
        mountPath: /usr/local/share/jupyterhub/static/custom
    extraConfig:
      templates: |
        c.JupyterHub.template_paths = ['/etc/jupyterhub/custom/templates']
#      01-add-message: |
#        c.JupyterHub.template_vars = {'announcement_login': 'Pangeo@EOSC: scheduled maintenance window ' +
#                                                            'on 7th May, 2.30pm - 3.30pm CEST. ' +
#                                                            'Backup your data!'
#                                     }
      pre-spawn-hook: |
        async def bootstrap_pre_spawn(spawner):
          spawner.container_security_context = {"capabilities": {"drop": ["ALL"]}}

        c.KubeSpawner.pre_spawn_hook = bootstrap_pre_spawn
    networkPolicy:
      interNamespaceAccessLabels: "accept"
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
       drop:
       - ALL
    podSecurityContext:
      fsGroupChangePolicy: OnRootMismatch
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault

  ingress:
    annotations:
      kubernetes.io/ingress.class: nginx
      cert-manager.io/cluster-issuer: "letsencrypt-prod"
      nginx.ingress.kubernetes.io/proxy-body-size: "1g"
    enabled: true
    hosts:
      - pangeo-eosc.vm.fedcloud.eu # replace this with your DNS name
    tls:
      - hosts:
        - pangeo-eosc.vm.fedcloud.eu # replace this with your DNS name
        secretName: pangeo-eosc.vm.fedcloud.eu # replace this with your DNS name

  proxy:
    service:
      type: ClusterIP
    chp:
      containerSecurityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
      extraPodSpec:
        securityContext:
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault

  singleuser:
    extraFiles:
      jupyter_notebook_config.json:
        mountPath: /etc/jupyter/jupyter_notebook_config.json
        data:
          MappingKernelManager:
            cull_idle_timeout: 3600
            cull_interval: 300
            cull_connected: true
            cull_busy: false
    networkPolicy:
      enabled: false
    cloudMetadata:
      blockWithIptables: false
    cpu:
      guarantee: 1
      limit: 8
    defaultUrl: /lab
    image:
      name: quay.io/pangeo/pangeo-notebook
      tag: 2024.08.18
    profileList:
      - display_name: "pangeo-notebook"
        description: "Pangeo stack"
        default: true
      - display_name: "ml-notebook"
        description: "pangeo-notebook + GPU-enabled tensorflow2"
        kubespawner_override:
          image: quay.io/pangeo/ml-notebook:2024.08.18
          extra_resource_guarantees:
            nvidia.com/gpu: 1
          extra_resource_limits:
            nvidia.com/gpu: 1
      - display_name: "pytorch-notebook"
        description: "pangeo-notebook + GPU-enabled pytorch"
        kubespawner_override:
          image: quay.io/pangeo/pytorch-notebook:2024.08.18
          extra_resource_guarantees:
            nvidia.com/gpu: 1
          extra_resource_limits:
            nvidia.com/gpu: 1
      - display_name: "datascience-notebook"
        description: "Python, R, and Julia."
        kubespawner_override:
          image: quay.io/jupyter/datascience-notebook:2024-09-02
    memory:
      guarantee: 2G
      limit: 32G
    startTimeout: 600
    storage:
      capacity: 10Gi
      dynamic:
        storageClass: nfs-csi-backup
    allowPrivilegeEscalation: false
    extraPodConfig:
      securityContext:
        fsGroupChangePolicy: OnRootMismatch
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault

  scheduling:
    userScheduler:
      enabled: false
    userPlaceholder:
      enabled: false

  prePuller:
    hook:
      enabled: false
    continuous:
      enabled: false