statefulset.yaml

kind: StatefulSet
apiVersion: apps/v1
metadata:
  name: {{ name }}
spec:
  # NOTE: With the default podManagementPolicy the pod does not always update when the statefulset is updated
  # See: https://github.com/kubernetes/kubernetes/issues/67250 and
  # https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#forced-rollback
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      app: {{ name }}
  serviceName: {{ name }}
  # Scaling up is not intended and won't work
  replicas: 1
  template:
    metadata:
      labels:
        app: {{ name }}
    spec:
      imagePullSecrets: []
      initContainers: []
      volumes:
        {% if oidc["enabled"] %}
        - name: oauth2-proxy-config
          configMap:
            name: {{ name }}
            items:
              - key: authorized-users.txt
                path: authorized-users.txt
        {% else %}
        - name: traefik-dynamic-config
          configMap:
            name: {{ name }}
            items:
              - key: traefik-dynamic-config.yaml
                path: traefik-dynamic-config.yaml
        {% endif %}
        - name: jupyter-server-secrets
          secret:
            secretName: {{ name }}
            items:
              - key: jupyterServerCookieSecret
                path: cookie_secret
        - name: jupyter-config-notebook
          configMap:
            name: {{ name }}
            items:
              - key: jupyter_notebook_config.py
                path: jupyter_notebook_config.py
        - name: jupyter-config-server
          configMap:
            name: {{ name }}
            items:
              - key: jupyter_server_config.py
                path: jupyter_server_config.py
        - name: jupyter-config
          emptyDir:
            sizeLimit: "2Mi"
        {% if pvc["enabled"] %}
        - name: workspace
          persistentVolumeClaim:
            claimName: {{ name }}
        {% else %}
        - name: workspace
          emptyDir:
            {% if storage["size"] is not none and storage["size"] != "" %}
            sizeLimit: {{ storage["size"] }}
            {% endif %}
        {% endif %}
      terminationGracePeriodSeconds: 30
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 100
      enableServiceLinks: false
      {% if scheduler_name %}
      schedulerName: {{ scheduler_name }}
      {% endif %}
      containers:
        - name: jupyter-server
          image: {{ jupyter_server["image"] }}
          workingDir: {{ jupyter_server["rootDir"] }}
          volumeMounts:
            - name: workspace
              mountPath: {{ storage["pvc"]["mountPath"] }}
            - name: jupyter-server-secrets
              mountPath: /etc/jupyter_server_secrets
              readOnly: true
            - name: jupyter-config
              mountPath: {{ storage["pvc"]["mountPath"] }}/.jupyter_config
            - name: jupyter-config-server
              mountPath: {{ storage["pvc"]["mountPath"] }}/.jupyter_config/jupyter_server_config.py
              subPath: jupyter_server_config.py
            - name: jupyter-config-notebook
              mountPath: {{ storage["pvc"]["mountPath"] }}/.jupyter_config/jupyter_notebook_config.py
              subPath: jupyter_notebook_config.py
          env:
            - name: SERVER_APP_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ name }}
                  key: jupyterServerAppToken
            - name: JUPYTER_CONFIG_PATH
              value: {{ storage["pvc"]["mountPath"] }}/.jupyter_config
          resources: {{ jupyter_server["resources"] | default({}) | tojson }}
          securityContext:
            runAsUser: 1000
            runAsGroup: 100
            allowPrivilegeEscalation: false
            runAsNonRoot: true

          # We allow quite some time (5 + 1 minutes) for the jupyter container to come up in
          # case the entrypoint contains a lot of code which has to be executed before the
          # Jupyter server can even accept connections. However, really long running tasks
          # should be put into an init container.
          livenessProbe:
            httpGet:
              path: {{ probe_path }}
              port: 8888
              {% if not oidc["enabled"] %}
              httpHeaders:
                - name: Authorization
                  value: {{ "token " ~ jupyter_server_app_token }}
              {% endif %}
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:
            httpGet:
              path: {{ probe_path }}
              port: 8888
              {% if not oidc["enabled"] %}
              httpHeaders:
                - name: Authorization
                  value: {{ "token " ~ jupyter_server_app_token }}
              {% endif %}
            periodSeconds: 2
            failureThreshold: 10
            successThreshold: 2
          startupProbe:
            httpGet:
              path: {{ probe_path }}
              port: 8888
              {% if not oidc["enabled"] %}
              httpHeaders:
                - name: Authorization
                  value: {{ "token " ~ jupyter_server_app_token }}
              {% endif %}
            # NOTE: if the startup probe does not succeed within periodSeconds X failureThreshold
            # Then the container is killed and restarted according to the pod's restartPolicy
            periodSeconds: 2
            failureThreshold: 150
        
        {% if oidc["enabled"] %}
        - name: oauth2-proxy
          image: "bitnami/oauth2-proxy:7.4.0"
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
          args:
            - "--provider=oidc"
            - "--client-id={{ oidc["clientId"] }}"
            - "--oidc-issuer-url={{ oidc["issuerUrl"] }}"
            - "--session-cookie-minimal"
            - "--http-address=:4180"
            - "--skip-provider-button"
            - "--upstream=http://127.0.0.1:8888"
            - "--redirect-url={{ full_url }}/oauth2/callback"
            - "--cookie-path={{ path }}"
            - "--proxy-prefix={{ path if path != '/' else '' }}/oauth2"
            - "--authenticated-emails-file=/etc/oauth2-proxy/authorized-users.txt"
            - "--skip-auth-route=^{{ path if path != '/' else '' }}/api/status$"
            - "--exclude-logging-path=/ping"
            {% for group in oidc["authorizedGroups"] %}
            - "--allowed-group={{ group }}"
            {% endfor %}
          ports:
            - name: http
              containerPort: 4180
              protocol: TCP
          env:
            - name: OAUTH2_PROXY_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ name }}
                  key: oauth2ProxyCookieSecret
            - name: OAUTH2_PROXY_CLIENT_SECRET
              valueFrom:
              {% if "value" in auth["oidc"]["clientSecret"] %}
                secretKeyRef:
                  name: {{ name }}
                  key: oidcClientSecret
              {% endif %}
              {% if "secretKeyRef" in auth["oidc"]["clientSecret"] %}
                secretKeyRef:
                  name: {{ auth["oidc"]["clientSecret"]["secretKeyRef"]["name"] }}
                  key: {{ auth["oidc"]["clientSecret"]["secretKeyRef"]["key"] }}
              {% endif %}
          volumeMounts:
            - name: oauth2-proxy-config
              mountPath: /etc/oauth2-proxy/authorized-users.txt
              subPath: authorized-users.txt
          resources:
            requests:
              cpu: 20m
              memory: 16Mi
            limits:
              cpu: 100m
              memory: 32Mi
          livenessProbe:
            httpGet:
              port: 4180
              path: /ping
            periodSeconds: 10
            failureThreshold: 6
          readinessProbe:
            httpGet:
              port: 4180
              path: /ping
            periodSeconds: 2
            failureThreshold: 30
            successThreshold: 2
          startupProbe:
            httpGet:
              port: 4180
              path: /ping
            periodSeconds: 2
            failureThreshold: 150
        {% else %}
        - name: passthrough-proxy
          image: traefik:v2.5
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            runAsNonRoot: true
          args:
           - --entryPoints.web.address=:4180
           - --providers.file.directory=/traefik
           - --ping.entryPoint=web
          ports:
            - name: http
              containerPort: 4180
              protocol: TCP
          volumeMounts:
            - name: traefik-dynamic-config
              mountPath: /traefik/traefik-dynamic-config.yaml
              subPath: traefik-dynamic-config.yaml
          resources:
            requests:
              cpu: 20m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 64Mi
          livenessProbe:
            httpGet:
              port: 4180
              path: /ping
            periodSeconds: 10
            failureThreshold: 6
          readinessProbe:
            httpGet:
              port: 4180
              path: /ping
            periodSeconds: 2
            failureThreshold: 30
            successThreshold: 2
          startupProbe:
            httpGet:
              port: 4180
              path: /ping
            periodSeconds: 2
            failureThreshold: 150
        {% endif %}