values.yaml

hub:
  # Inject OAuth and AWS credentials from K8s secrets into environment
  extraEnv:
    GITHUB_CLIENT_ID:
      valueFrom:
        secretKeyRef:
          name: jupyter-oauth-secret
          key: GITHUB_CLIENT_ID
    GITHUB_CLIENT_SECRET:
      valueFrom:
        secretKeyRef:
          name: jupyter-oauth-secret
          key: GITHUB_CLIENT_SECRET
    CILOGON_CLIENT_ID:
      valueFrom:
        secretKeyRef:
          name: jupyter-oauth-secret
          key: CILOGON_CLIENT_ID
    CILOGON_CLIENT_SECRET:
      valueFrom:
        secretKeyRef:
          name: jupyter-oauth-secret
          key: CILOGON_CLIENT_SECRET
    PROXY_SECRET_TOKEN:
      valueFrom:
        secretKeyRef:
          name: jupyter-proxy-secret
          key: PROXY_SECRET_TOKEN
    AWS_ACCESS_KEY_ID:
      valueFrom:
        secretKeyRef:
          name: jupyter-aws-secret
          key: AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY:
      valueFrom:
        secretKeyRef:
          name: jupyter-aws-secret
          key: AWS_SECRET_ACCESS_KEY
    OPENAI_API_KEY:
      valueFrom:
        secretKeyRef:
          name: nrp-llm-secret
          key: NRP_LLM_API_KEY
  extraConfig:
    # Read OAuth credentials from environment variables (set via extraEnv from K8s secret)
    configure-oauth-from-env: |
      import os
      c.GitHubOAuthenticator.client_id = os.environ.get('GITHUB_CLIENT_ID')
      c.GitHubOAuthenticator.client_secret = os.environ.get('GITHUB_CLIENT_SECRET')
      c.CILogonOAuthenticator.client_id = os.environ.get('CILOGON_CLIENT_ID')
      c.CILogonOAuthenticator.client_secret = os.environ.get('CILOGON_CLIENT_SECRET')
    # Read proxy secret token from environment variable
    configure-proxy-from-env: |
      import os
      c.ConfigurableHTTPProxy.auth_token = os.environ.get('PROXY_SECRET_TOKEN')
    # Pass secrets from hub env into singleuser pods via KubeSpawner
    configure-singleuser-secrets: |
      import os
      c.KubeSpawner.environment.update({
          'AWS_ACCESS_KEY_ID': os.environ.get('AWS_ACCESS_KEY_ID'),
          'AWS_SECRET_ACCESS_KEY': os.environ.get('AWS_SECRET_ACCESS_KEY'),
          'OPENAI_API_KEY': os.environ.get('OPENAI_API_KEY'),
      })
      c.KubeSpawner.lifecycle_hooks = {
          "postStart": {
              "exec": {
                  "command": ["bash", "-c",
                      # RStudio 2026.05.0 (rocker/ml rebuild 2026-05-31) bakes a
                      # root-owned 0600 session-rpc-key; rootless rserver (via
                      # jupyter-rsession-proxy) can't read it. Make it readable.
                      "sudo chmod a+r /var/lib/rstudio-server/session-rpc-key 2>/dev/null || true; "
                      # Write secrets to ~/.Renviron so RStudio sees them.
                      # Use > (truncate) not >> to avoid appending duplicates on every spawn.
                      "for v in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY OPENAI_API_KEY OPENAI_BASE_URL; do echo \"$v=${!v}\"; done > /home/jovyan/.Renviron"
                  ]
              }
          }
      }
  config:
    GitHubOAuthenticator:
      allowed_organizations:
        - espm-157
        - espm-288
        - boettiger-lab
        - SchmidtDSE
        - berkeley-espm
      scope:
        - read:org
      oauth_callback_url: https://espm.nrp-nautilus.io/hub/oauth_callback
    CILogonOAuthenticator:
      oauth_callback_url: https://espm.nrp-nautilus.io/hub/oauth_callback
      admin_users:
      - cboettig@berkeley.edu
      # NRP-required admin users (per https://nrp.ai/documentation/userdocs/jupyter/jupyterhub/)
      - mfsada@ucsd.edu
      - d4diaz@ucsd.edu
      - dmishin@ucsd.edu
      # IDP Lookup: https://cilogon.org/idplist/
      allowed_idps:
        urn:mace:incommon:berkeley.edu:
          allowed_domains:
          - berkeley.edu
          username_derivation:
            username_claim: email
        # UCSD required so NRP admins can authenticate
        urn:mace:incommon:ucsd.edu:
          allowed_domains:
          - ucsd.edu
          username_derivation:
            username_claim: email
    JupyterHub:
      admin_access: true
      admin_users:
        - "cboettig@berkeley.edu"
        # NRP-required admin users
        - "mfsada@ucsd.edu"
        - "d4diaz@ucsd.edu"
        - "dmishin@ucsd.edu"
      authenticator_class: cilogon
    KubeSpawner:
      environment:
        SHELL: /usr/bin/bash
        GH_SCOPED_CREDS_CLIENT_ID: "Iv1.8d384d9612c2ecc3"
        GH_SCOPED_CREDS_APP_URL: "https://github.com/apps/jupyterhub-gh-creds"
        OPENAI_BASE_URL: "https://ellm.nrp-nautilus.io/v1"
        LANG: "C.UTF-8"
        LC_ALL: "C.UTF-8"

  service:
    type: ClusterIP
    annotations: {}
    ports:
      nodePort:
    loadBalancerIP:
  deploymentStrategy:
    type: Recreate
  db:
    type: sqlite-pvc
    pvc:
      # TEMPORARY PVC SWAP to unblock deployment, 2026-01-25
      # Old PVC hub-db-dir is stuck in ContainerCreating due to Ceph mount issue.
      # DO NOT DELETE the old volume; data not migrated. To revert: return size to 10Gi below.
      accessModes:
        - ReadWriteOnce
      storage: 11Gi
      storageClassName: rook-ceph-block
  resources:
    limits:
      cpu: 2
      memory: 4Gi
    requests:
      cpu: 2 
      memory: 512Mi
  networkPolicy:
    enabled: false
proxy:
  service:
    type: ClusterIP
  chp:
    resources:
      limits:
        cpu: "10"
        memory: 10Gi
      requests:
        cpu: "2"
        memory: 512Mi
singleuser:
  allowPrivilegeEscalation: true
  startTimeout: 3600
  fsGid: 100
  extraPodConfig:
    securityContext:
      fsGroupChangePolicy: "OnRootMismatch"
      fsGroup: 100
  extraNodeAffinity:
    required:
      - matchExpressions:
          - key: topology.kubernetes.io/region
            operator: In
            values: ["us-west"]
  cloudMetadata:
    blockWithIptables: false
  networkPolicy:
    enabled: false
  storage:
    type: dynamic
    extraLabels: {}
    capacity: 15Gi
    homeMountPath: /home/jovyan
    dynamic:
      storageClass: rook-ceph-block
      pvcNameTemplate: claim-{username}{servername}
      volumeNameTemplate: volume-{username}{servername}
      storageAccessModes: [ReadWriteOnce]
    extraVolumeMounts:
      - name: shm-volume
        mountPath: /dev/shm
    extraVolumes:
      - name: shm-volume
        emptyDir:
          medium: Memory
  extraFiles:
    jupyter_server_config.json:
        mountPath: /usr/local/etc/jupyter/jupyter_server_config.json
        data:
          ContentsManager:
            allow_hidden: true
          FileContentsManager:
            always_delete_dir: true
  image:
    name: gitlab-registry.nrp-nautilus.io/cboettig/images
    pullPolicy: IfNotPresent
  cpu:
    limit: 10
    guarantee: 1
  memory:
    limit: 10G
    guarantee: 10G
  profileList:
  - display_name: "Choose your environment and resources"
    default: true
    profile_options:
      interface:
        display_name: Interface
        choices:
          vscode:
            display_name: VS Code
            kubespawner_override:
              default_url: "/vscode"
          rstudio:
            display_name: RStudio
            default: true
            kubespawner_override:
              default_url: "/rstudio"
          lab:
            display_name: JupyterLab
            kubespawner_override:
              default_url: "/lab"
      image:
        display_name: Environment
        unlisted_choice:
          enabled: True
          display_name: "Custom image"
          display_name_in_choices: "Specify an existing docker image"
          description_in_choices: "Use a pre-existing docker image from a public docker registry"
          description: "Specify your own docker image (must have jupyterhub-singleuser installed)"
          validation_regex: "^.+:.+$"
          validation_message: "Must be a publicly available docker image, of form <image-name>:<tag>"
          kubespawner_override:
            image: "{value}"
        choices:
          01-rocker-ml:
            display_name: rocker/ml (CPU)
            description: Machine Learning environment for R & python (rocker/ml)
            kubespawner_override:
              image: "ghcr.io/boettiger-lab/k8s@sha256:c0fe49ad472e0a96803a7ad5085b7b0a61b44050ddcae9ae69aa1cdf60d06b72"
            default: true
          02-speciesnet:
            display_name: SpeciesNet (GPU)
            description: CV/ML for ecology
            kubespawner_override:
              image: "ghcr.io/boettiger-lab/speciesnet:latest"
              extra_resource_limits:
                nvidia.com/gpu: "1"
          03-rocker-cuda:
            display_name: rocker/cuda (GPU)
            description: Machine Learning environment for R & python
            kubespawner_override:
              image: "ghcr.io/rocker-org/cuda:latest"
              extra_resource_limits:
                nvidia.com/gpu: "1"
          04-geospatial:
            display_name: Rocker ML spatial
            description: Geospatial environment for R & python (rocker/ml-spatial)
            kubespawner_override:
              image: "ghcr.io/rocker-org/ml-spatial:latest"

      resource_allocation:
        display_name: Resource Allocation
        choices:
          mem_8:
            display_name: 8 GB RAM
            kubespawner_override:
              mem_guarantee: 8G
              mem_limit: 8G
              cpu_guarantee: 1
              cpu_limit: 1
            default: true
          mem_16:
            display_name: 16 GB RAM
            kubespawner_override:
              mem_guarantee: 16G
              mem_limit: 16G
              cpu_guarantee: 2
              cpu_limit: 2
          mem_32:
            display_name: 32 GB RAM
            kubespawner_override:
              mem_guarantee: 32G
              mem_limit: 32G
              cpu_guarantee: 4
              cpu_limit: 4
          mem_64:
            display_name: 64 GB RAM
            kubespawner_override:
              mem_guarantee: 64G
              mem_limit: 64G
              cpu_guarantee: 10
              cpu_limit: 10
          mem_128:
            display_name: 128 GB RAM
            kubespawner_override:
              mem_guarantee: 128G
              mem_limit: 128G
              cpu_guarantee: 10
              cpu_limit: 10



scheduling:
  userScheduler:
    enabled: false
  userPlaceholder:
    enabled: false
# prePuller relates to the hook|continuous-image-puller DaemonsSets
prePuller:
  hook:
    enabled: false 
  continuous:
    enabled: false

ingress:
  enabled: true
  annotations:
    kubernetes.io/ingress.class: haproxy
  hosts: ["espm.nrp-nautilus.io"]
  pathSuffix: ''
  tls:
    - hosts:
      - espm.nrp-nautilus.io

cull:
  enabled: true
  users: false
  removeNamedServers: true
  timeout: 3600
  every: 600
  concurrency: 10
  maxAge: 0