diff --git a/CHANGELOG.md b/CHANGELOG.md index 299345b..3607eb6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Changelog -## [1.4.1] - 20260509 +## [1.4.2] - 20260504 +### Changed +- Update version of Jupyter Hub dependency to 4.3.4 +- Expose seccompProfile for each profile (default used : RuntimeDefault) + +## [1.4.1] - 20260409 ### Changed - Update version of Jupyter Hub dependency to 4.3.3 diff --git a/charts/helix/Chart.lock b/charts/helix/Chart.lock index ecb13a3..1a8f2ff 100644 --- a/charts/helix/Chart.lock +++ b/charts/helix/Chart.lock @@ -1,6 +1,6 @@ dependencies: - name: jupyterhub repository: https://hub.jupyter.org/helm-chart/ - version: 4.3.3 -digest: sha256:8cf556d445dcf22137d10c7e43462a7463893520acc29a1eee4e8af4a869f767 -generated: "2026-04-08T11:04:43.649910659+02:00" + version: 4.3.4 +digest: sha256:240905ee173bfffbaea0e6859ec1e096bbbc1c76de5691b173c5a60b4e845457 +generated: "2026-05-04T14:54:12.795275687+02:00" diff --git a/charts/helix/Chart.yaml b/charts/helix/Chart.yaml index a538cc7..ad00e78 100644 --- a/charts/helix/Chart.yaml +++ b/charts/helix/Chart.yaml @@ -20,7 +20,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: "1.4.1" +version: "1.4.2" # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -31,5 +31,5 @@ appVersion: "1.0.0.beta3" dependencies: - name: jupyterhub repository: https://hub.jupyter.org/helm-chart/ - version: 4.3.3 + version: 4.3.4 condition: jupyterhub.enabled diff --git a/charts/helix/charts/jupyterhub-4.3.3.tgz b/charts/helix/charts/jupyterhub-4.3.3.tgz deleted file mode 100644 index 31ea5b0..0000000 Binary files a/charts/helix/charts/jupyterhub-4.3.3.tgz and /dev/null differ diff --git a/charts/helix/charts/jupyterhub-4.3.4.tgz b/charts/helix/charts/jupyterhub-4.3.4.tgz new file mode 100644 index 0000000..69bcda3 Binary files /dev/null and b/charts/helix/charts/jupyterhub-4.3.4.tgz differ diff --git a/charts/helix/configuration/jupyterhub/04-kubespawner_spawn_profiles_configuration.py b/charts/helix/configuration/jupyterhub/04-kubespawner_spawn_profiles_configuration.py index 2e962fa..d0b8479 100644 --- a/charts/helix/configuration/jupyterhub/04-kubespawner_spawn_profiles_configuration.py +++ b/charts/helix/configuration/jupyterhub/04-kubespawner_spawn_profiles_configuration.py @@ -41,18 +41,6 @@ async def generate_profile_list(spawner): 'cpu_guarantee': {{- $profile.cpu_guarantee }}, 'mem_limit': '{{- $profile.memory_limit }}', 'mem_guarantee': '{{- $profile.memory_guarantee }}', - 'pod_security_context':{ - 'runAsNonRoot': True, - "seccompProfile": { - "type": "RuntimeDefault" - }, - }, - "container_security_context": { - "allowPrivilegeEscalation": False, - "capabilities": { - "drop": ["ALL"], - }, - }, }, }, {{- end }} @@ -71,18 +59,6 @@ async def generate_profile_list(spawner): 'cpu_guarantee': {{- $profile.cpu_guarantee }}, 'mem_limit': '{{- $profile.memory_limit }}', 'mem_guarantee': '{{- $profile.memory_guarantee }}', - 'pod_security_context':{ - 'runAsNonRoot': True, - "seccompProfile": { - "type": "RuntimeDefault" - }, - }, - "container_security_context": { - "allowPrivilegeEscalation": False, - "capabilities": { - "drop": ["ALL"], - }, - }, }, }, {{- end }} diff --git a/charts/helix/configuration/jupyterhub/09-kubspawner_security_context.py b/charts/helix/configuration/jupyterhub/09-kubspawner_security_context.py new file mode 100644 index 0000000..1aaeece --- /dev/null +++ b/charts/helix/configuration/jupyterhub/09-kubspawner_security_context.py @@ -0,0 +1,23 @@ +seccompProfileType = '{{- .Values.configuration.jupyterhub.singleuser.securityContext.seccompProfile.type | default "RuntimeDefault" }}' +localhostProfile = '{{- .Values.configuration.jupyterhub.singleuser.securityContext.seccompProfile.localhostProfile | default "" }}' + +seccompProfile = { + 'type': seccompProfileType, +} + +if ( seccompProfileType == "Localhost" ): + seccompProfile.update({ + 'localhostProfile': localhostProfile, + }) + +c.KubeSpawner.pod_security_context.update({ + 'runAsNonRoot': True, + 'seccompProfile': seccompProfile +}) + +c.KubeSpawner.container_security_context.update({ + 'allowPrivilegeEscalation': False, + 'capabilities': { + 'drop': ['ALL'], + }, +}) \ No newline at end of file diff --git a/charts/helix/values.schema.json b/charts/helix/values.schema.json index e7ff9a2..589b0b3 100644 --- a/charts/helix/values.schema.json +++ b/charts/helix/values.schema.json @@ -93,6 +93,19 @@ "type": "integer" } } + }, + "securityContext": { + "type": "object", + "properties": { + "seccompProfile": { + "type": "object", + "properties": { + "type": { + "type": "string" + } + } + } + } } } } diff --git a/charts/helix/values.yaml b/charts/helix/values.yaml index 7f7fc55..a90d2c7 100644 --- a/charts/helix/values.yaml +++ b/charts/helix/values.yaml @@ -22,6 +22,12 @@ configuration: # @section -- HELIX settings # @default -- No override of existing Z2JHK8S Chart Configuration. singleuser: + # Follow specification of the securityContext field in Kubernetes, see https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details. + securityContext: + seccompProfile: + type: "RuntimeDefault" +# -- This field is only relevant if the type field is set to "Localhost". It should be the name of a file containing a seccomp profile, which must be present in the container image. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-the-seccomp-profile for more details. +# localhostProfile: "" # -- Supports UID/GID manipulation to match custom volume persmisisons # @section -- HELIX settings @@ -39,6 +45,7 @@ configuration: #- 123 #- 543 + # -- Specifies JupyterHub's available profile, containing the notebook's docker images. # @section -- HELIX settings # @default -- Single-ser and collaborative profiles fitting an standard context. @@ -72,22 +79,6 @@ configuration: cpu_guarantee: 2.1 memory_limit: "8G" memory_guarantee: "4G" - - displayName: "Jupyter Minimal Notebook" - slug: "minimal" - image: "quay.io/jupyter/minimal-notebook:latest" - imagePullPolicy: "Always" - cpu_limit: 5.1 - cpu_guarantee: 2.1 - memory_limit: "8G" - memory_guarantee: "4G" - - displayName: "Jupyter Datascience Notebook" - slug: "datascience" - image: "quay.io/jupyter/datascience-notebook:latest" - imagePullPolicy: "Always" - cpu_limit: 5.1 - cpu_guarantee: 2.1 - memory_limit: "8G" - memory_guarantee: "4G" # -- Collaboration profiles, used when a user spawns a collaborative JLab. # @section -- HELIX settings