Merge develop into main for 2024.3.3 release (#2364)

Co-authored-by: Sumit Jha <[email protected]>
Co-authored-by: Tyler Graff <[email protected]>
Co-authored-by: Chuck McAndrew <[email protected]>
Co-authored-by: Adam Lewis <[email protected]>
Co-authored-by: Amit Kumar <[email protected]>
Co-authored-by: Michał Krassowski <[email protected]>
Co-authored-by: Scott Blair <[email protected]>
Co-authored-by: kenafoster <[email protected]>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

.github/workflows/generate_cli_doc.yml

@@ -25,10 +25,10 @@ jobs:
         working-directory: ./docs-sphinx
     steps:
       - name: Check out repository 🛎️
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 

.github/workflows/release.yaml

@@ -12,15 +12,15 @@ jobs:
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
       - name: Set up python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
       - name: Upgrade pip
         run: python -m pip install --upgrade pip build
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -58,15 +58,15 @@ jobs:
 
     steps:
       - name: Set up python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
       - name: Upgrade pip
         run: python -m pip install --upgrade pip build
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

.github/workflows/run-precommit.yaml

@@ -17,9 +17,9 @@ jobs:
         shell: bash -l {0}
     steps:
       - name: Checkout repository 🔔
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.1
 
       - name: Run terraform pre-commit ⚡️
-        uses: pre-commit/[email protected].0
+        uses: pre-commit/[email protected].1
         with:
           extra_args: --all-files terraform_fmt

.github/workflows/test-provider.yaml

@@ -56,7 +56,7 @@ jobs:
       fail-fast: false
     steps:
       - name: "Checkout Infrastructure"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Checkout the branch from the PR that triggered the job
         if: ${{ github.event_name == 'issue_comment' }}
@@ -65,9 +65,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: "3.11"
 
       - name: Retrieve secret from Vault
         uses: hashicorp/[email protected]

.github/workflows/test.yaml

@@ -32,22 +32,21 @@ jobs:
     strategy:
       matrix:
         python-version:
-          - "3.8"
-          - "3.9"
           - "3.10"
           - "3.11"
+          - "3.12"
       fail-fast: false
     concurrency:
       group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}-${{ matrix.python-version }}
       cancel-in-progress: true
     steps:
       - name: "Checkout Infrastructure"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup miniconda
-        uses: conda-incubator/setup-miniconda@v2
+        uses: conda-incubator/setup-miniconda@v3
         with:
           auto-update-conda: true
           python-version: ${{ matrix.python-version }}

.github/workflows/test_aws_integration.yaml

@@ -43,13 +43,13 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ env.NEBARI_GH_BRANCH }}
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: 3.11
 

.github/workflows/test_conda_build.yaml

@@ -25,21 +25,21 @@ jobs:
         cancel-in-progress: true
     steps:
       - name: "Checkout Infrastructure"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup miniconda
-        uses: conda-incubator/setup-miniconda@v2
+        uses: conda-incubator/setup-miniconda@v3
         with:
           auto-update-conda: true
-          python-version: 3.8
+          python-version: "3.10"
           channels: conda-forge
           activate-environment: nebari-dev
 
       - name: Install dependencies
         run: |
-          conda install build grayskull conda-build
+          conda install build grayskull conda-build conda-verify
 
       - name: Generate sdist
         run: |
@@ -52,3 +52,8 @@ jobs:
       - name: Build conda package
         run: |
           conda build nebari
+
+      - name: Test conda package
+        run: |
+          conda install --use-local nebari
+          nebari --version

.github/workflows/test_do_integration.yaml

@@ -42,12 +42,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ env.NEBARI_GH_BRANCH }}
           fetch-depth: 0
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
             python-version: 3.11
 

.github/workflows/test_gcp_integration.yaml

@@ -42,13 +42,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ env.NEBARI_GH_BRANCH }}
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: 3.11
 

.github/workflows/test_helm_charts.yaml

@@ -23,13 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout Infrastructure"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.8"
+          python-version: "3.11"
       - name: Install additional Python dependencies
         run: |
           pip install python-hcl2

.github/workflows/test_local_integration.yaml

@@ -57,20 +57,20 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: conda-incubator/setup-miniconda@v2
+        uses: conda-incubator/setup-miniconda@v3
         env:
           CONDA: /home/runnerx/miniconda3
         with:
           auto-update-conda: true
-          python-version: 3.8
+          python-version: "3.11"
           miniconda-version: "latest"
 
       - name: Install Nebari and playwright
         run: |
           pip install .[dev]
           playwright install
 
-      - uses: azure/setup-kubectl@v3
+      - uses: azure/setup-kubectl@v4.0.0
         with:
           version: v1.19.16
 
@@ -140,9 +140,9 @@ jobs:
           nebari keycloak adduser --user "${TEST_USERNAME}" "${TEST_PASSWORD}" --config nebari-config.yaml
           nebari keycloak listusers --config nebari-config.yaml
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
-          node-version: 16
+          node-version: 20
 
       - name: Get nebari-config.yaml full path
         run: echo "NEBARI_CONFIG_PATH=`realpath ./local-deployment/nebari-config.yaml`" >> "$GITHUB_ENV"
@@ -170,7 +170,7 @@ jobs:
 
       - name: Save Cypress screenshots and videos
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: e2e-cypress
           path: |

.github/workflows/typing.yaml

@@ -24,12 +24,12 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.11"
           cache: "pip"

README.md

@@ -79,7 +79,7 @@ Amazon [AWS](https://aws.amazon.com/), [GCP](https://cloud.google.com/ "Google C
 
 - Operating System: Currently, Nebari supports development on macOS and Linux operating systems. Windows is NOT supported.
   However, we would welcome contributions that add and improve support for Windows.
-- You need Python >= 3.8 on your local machine or virtual environment to work on Nebari.
+- You need Python >= 3.10 on your local machine or virtual environment to work on Nebari.
 - Adopting virtual environments ([`conda`](https://docs.conda.io/en/latest/), [`pipenv`](https://github.com/pypa/pipenv) or
   [`venv`](https://docs.python.org/3/library/venv.html)) is also encouraged.
 

RELEASE.md

@@ -9,6 +9,27 @@ This file is copied to nebari-dev/nebari-docs using a GitHub Action. -->
 
 ---
 
+## Release 2024.3.3 - March 27, 2024
+
+### What's Changed
+* get default variable value when following a terraform variable by @Adam-D-Lewis in https://github.com/nebari-dev/nebari/pull/2322
+* Upgrade Actions versions by @isumitjha in https://github.com/nebari-dev/nebari/pull/2291
+* Cleanup spawner logs by @krassowski in https://github.com/nebari-dev/nebari/pull/2328
+* Fix loki gateway url when deployed on non-dev namespace by @aktech in https://github.com/nebari-dev/nebari/pull/2327
+* Dmcandrew update ruamel.yaml by @dcmcand in https://github.com/nebari-dev/nebari/pull/2315
+* upgrade auth0-python version to ultimately resolve CVE-2024-26130 by @tylergraff in https://github.com/nebari-dev/nebari/pull/2314
+* remove deprecated code paths by @Adam-D-Lewis in https://github.com/nebari-dev/nebari/pull/2349
+* Create SECURITY.md by @dcmcand in https://github.com/nebari-dev/nebari/pull/2354
+* Set node affinity for more pods to ensure they run on general node pool by @Adam-D-Lewis in https://github.com/nebari-dev/nebari/pull/2353
+* Deduplicate conda-store in JupyterLab main menu by @krassowski in https://github.com/nebari-dev/nebari/pull/2347
+* Pass current namespace to argo via environment variable by @krassowski in https://github.com/nebari-dev/nebari/pull/2317
+* PVC for Traefik Ingress (prevent LetsEncrypt throttling) by @kenafoster in https://github.com/nebari-dev/nebari/pull/2352
+
+### New Contributors
+* @isumitjha made their first contribution in https://github.com/nebari-dev/nebari/pull/2291
+* @tylergraff made their first contribution in https://github.com/nebari-dev/nebari/pull/2314
+
+**Full Changelog**: https://github.com/nebari-dev/nebari/compare/2024.3.2...2024.3.3
 
 ## Release 2024.3.2 - March 14, 2024
 

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+We support only the latest version, and we use [CalVer](https://calver.org/) for versioning.
+
+You should feel comfortable upgrading if you're using our documented public APIs and pay attention to `DeprecationWarnings`. Whenever there is a need to break compatibility, it is announced in the [Changelog](https://www.nebari.dev/docs/references/RELEASE) and will raise a `DeprecationWarning` before it's finally really broken.
+
+## Reporting a Vulnerability
+
+If you think you found a vulnerability, please report it at [nebari/security](https://github.com/nebari-dev/nebari/security/new). Please do not report security vulnerabilities on our public issue tracker. Exposing vulnerabilities publicly without giving maintainers a chance to release a fix puts users at risk.

pyproject.toml

@@ -23,7 +23,7 @@ name = "nebari"
 dynamic = ["version"]
 description = "A Jupyter and Dask-powered open source data science platform."
 readme = "README.md"
-requires-python = ">=3.8"
+requires-python = ">=3.10"
 license = "BSD-3-Clause"
 authors = [
     { name = "Nebari development team", email = "[email protected]" },
@@ -42,8 +42,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Topic :: Software Development :: Build Tools",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.8",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Intended Audience :: Developers",
@@ -55,23 +53,23 @@ classifiers = [
 ]
 
 dependencies = [
-    "auth0-python==4.4.2",
+    "auth0-python==4.7.1",
     "azure-identity==1.12.0",
     "azure-mgmt-containerservice==26.0.0",
     "azure-mgmt-resource==23.0.1",
     "bcrypt==4.0.1",
-    "boto3==1.28.40",
+    "boto3==1.34.63",
     "cloudflare==2.11.7",
     "kubernetes==27.2.0",
     "pluggy==1.3.0",
     "prompt-toolkit==3.0.36",
     "pydantic==1.10.12",
     "pynacl==1.5.0",
-    "python-keycloak==3.3.0",
+    "python-keycloak>=3.9.0",
     "questionary==2.0.0",
     "requests-toolbelt==1.0.0",
     "rich==13.5.1",
-    "ruamel.yaml==0.17.32",
+    "ruamel.yaml==0.18.6",
     "typer==0.9.0",
     "packaging==23.2",
 ]

scripts/helm-validate.py

@@ -67,7 +67,7 @@ def _load_variable_value(self, argument, parent_contents):
             var_name = self._clean_var_name(argument, "var")
             for var in parent_contents.get("variable", {}):
                 if var_name in var:
-                    return var[var_name]
+                    return var[var_name]["default"]
             else:
                 raise ValueError(f"Could not find variable {var_name}")
 

src/_nebari/constants.py

@@ -1,4 +1,4 @@
-CURRENT_RELEASE = "2024.3.2"
+CURRENT_RELEASE = "2024.3.3"
 
 # NOTE: Terraform cannot be upgraded further due to Hashicorp licensing changes
 # implemented in August 2023.

src/_nebari/render.py

@@ -8,7 +8,6 @@
 from rich.table import Table
 
 from _nebari.deprecate import DEPRECATED_FILE_PATHS
-from _nebari.utils import is_relative_to
 from nebari import hookspecs, schema
 
 
@@ -89,7 +88,7 @@ def render_template(
         for path in deleted:
             abs_path = (output_directory / path).resolve()
 
-            if not is_relative_to(abs_path, output_directory):
+            if not abs_path.is_relative_to(output_directory):
                 raise Exception(
                     f"[ERROR] SHOULD NOT HAPPEN filename was about to be deleted but path={abs_path} is outside of output_directory"
                 )