Package: kbatch-proxy
kbatch-proxyA simple Kubernetes proxy, allowing JupyterHub users to make requests to the Kubernetes API without having direct access to the Kubernetes API.MotivationWe wantkbatchusers to be able to create Kubernetes Jobs, access logs, etc., butDon't want to grant themdirectaccess to the Kubernetes APIDon't want to maintain a separate web application, with any state that's independent of KubernetesEnterkbatch-proxyDesignA simple FastAPI application that sits in betweenkbatchusers and the Kubernetes API. It's expected that thekbatch-proxyapplication has access to the Kubernetes API, with permission to create namespaces, jobs, etc. This will often be run as a JupyterHub service.Users will make requests tokbatch-proxy. Upon request we willValidate that the user is authenticated with JupyterHub (checking theBearertoken)Validate that data the user is submitting or requesting meets oursecurity modelMake the request to the Kubernetes API on behalf of the userSecurity modelThis remains to be proven effective, but the hope is to let users do whatever they want in their own namespace and nothing outside of their namespace.Container imagesWe provide container images athttps://github.com/kbatch-dev/kbatch/pkgs/container/kbatch-proxy.$ docker pull ghcr.io/kbatch-dev/kbatch-proxy:latestDeploymentkbatch-proxyis most easily deployed as a JupyterHub service using Helm. A few values need to be configured:# file: config.yamlapp:jupyterhub_api_token:"<jupyterhub-api-token>"jupyterhub_api_url:"https://<jupyterhub-url>/hub/api/"extra_env:KBATCH_PREFIX:"/services/kbatch"# image:#   tag: "0.1.4"  # you likely want to pin the latest here.Note: we don't currently publish a helm chart, so you have togit clonethe kbatch repository.From thekbatch/kbatch-proxydirectory, use helm to install the chart$ helm upgrade --install kbatch-proxy ../helm/kbatch-proxy/ \
    -n "<namepsace> \
    -f config.yamlYou'll need to configure kbatch as a JupyterHub service. This example makes it available at/services/kbatch(this should matchKBATCH_PREFIXabove):jupyterhub:hub:services:kbatch:admin:trueapi_token:"<jupyterhub-api-token>"# match the api token aboveurl:"http://kbatch-proxy.<kbatch-namespace>.svc.cluster.local"That example relies on kbatch being deployed to the same Kubernetes cluster as JupyterHub, so JupyterHub can proxy requests tokbatch-proxyusing Kubernetes' internal DNS. The namespace in that URL should match the namespace wherekbatchwas deployed.Dask Gateway IntegrationIf your JupyterHub is deployed with Dask Gateway, you might want to set a few additional environment variables in the job
so that they behave similarly to the singleuser notebook pod.app:extra_env:KBATCH_JOB_EXTRA_ENV:|{"DASK_GATEWAY__AUTH__TYPE": "jupyterhub","DASK_GATEWAY__CLUSTER__OPTIONS__IMAGE": "{JUPYTER_IMAGE_SPEC}","DASK_GATEWAY__ADDRESS":  "https://<JUPYTERHUB_URL>/services/dask-gateway","DASK_GATEWAY__PROXY_ADDRESS": "gateway://<DASK_GATEWAY_ADDRESS>:80"}Development setupWe don't have a fully working docker-ized setup, since we (i.e. Tom) don't know how to do Kubernetes within docker. So the current setup relies onk3d for KubernetesJupyterHub as a regular Python processkbatch-proxy as a regular Python processCreate a cluster$ k3d cluster create ksubmitCreate a Hubmake sure tonpm installconfigurable-http-proxy.$ cd hub
$ jupyterhubStart kbatch-proxyKBATCH_PREFIX=/services/kbatch \
  KBATCH_PROFILE_FILE=tests/profile_template.yaml \
  JUPYTERHUB_API_TOKEN=super-secret \
  JUPYTERHUB_API_URL=http://127.0.0.1:8000/hub/api \
  JUPYTERHUB_HOST=http://127.0.0.1:8000 \
  uvicorn kbatch_proxy.main:app --reload --port=8050You'll might want to log in and create a token athttp://localhost:8000/hub/token. Thekbatch configurewith that token.