Update security

CHANGELOG.md

@@ -1,6 +1,11 @@
 # Changelog
 
-## [1.4.1] - 20260509
+## [1.4.2] - 20260504
+### Changed
+- Update version of Jupyter Hub dependency to 4.3.4
+- Expose seccompProfile for each profile (default used : RuntimeDefault) 
+
+## [1.4.1] - 20260409
 ### Changed
 - Update version of Jupyter Hub dependency to 4.3.3
 

charts/helix/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: jupyterhub
   repository: https://hub.jupyter.org/helm-chart/
-  version: 4.3.3
-digest: sha256:8cf556d445dcf22137d10c7e43462a7463893520acc29a1eee4e8af4a869f767
-generated: "2026-04-08T11:04:43.649910659+02:00"
+  version: 4.3.4
+digest: sha256:240905ee173bfffbaea0e6859ec1e096bbbc1c76de5691b173c5a60b4e845457
+generated: "2026-05-04T14:54:12.795275687+02:00"

charts/helix/Chart.yaml

@@ -20,7 +20,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "1.4.1"
+version: "1.4.2"
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -31,5 +31,5 @@ appVersion: "1.0.0.beta3"
 dependencies:
   - name: jupyterhub
     repository: https://hub.jupyter.org/helm-chart/
-    version: 4.3.3
+    version: 4.3.4
     condition: jupyterhub.enabled

charts/helix/configuration/jupyterhub/04-kubespawner_spawn_profiles_configuration.py

@@ -41,18 +41,6 @@ async def generate_profile_list(spawner):
 				'cpu_guarantee': {{- $profile.cpu_guarantee }},
 				'mem_limit': '{{- $profile.memory_limit }}',
 				'mem_guarantee': '{{- $profile.memory_guarantee }}', 
-				'pod_security_context':{
-					'runAsNonRoot': True,
-					"seccompProfile": {
-            			"type": "RuntimeDefault"
-						},					
-					},
-				"container_security_context": {
-					"allowPrivilegeEscalation": False,
-					"capabilities": {
-						"drop": ["ALL"],
-					},
-				},
 			},
 		},
 		{{- end }}
@@ -71,18 +59,6 @@ async def generate_profile_list(spawner):
 				'cpu_guarantee': {{- $profile.cpu_guarantee }},
 				'mem_limit': '{{- $profile.memory_limit }}',
 				'mem_guarantee': '{{- $profile.memory_guarantee }}', 
-				'pod_security_context':{
-					'runAsNonRoot': True,
-					"seccompProfile": {
-            			"type": "RuntimeDefault"
-						},
-				},
-				"container_security_context": {
-					"allowPrivilegeEscalation": False,
-					"capabilities": {
-						"drop": ["ALL"],
-					},
-				},
 			},
 		},
 		{{- end }}

charts/helix/configuration/jupyterhub/09-kubspawner_security_context.py

@@ -0,0 +1,23 @@
+seccompProfileType = '{{- .Values.configuration.jupyterhub.singleuser.securityContext.seccompProfile.type | default "RuntimeDefault" }}'
+localhostProfile = '{{- .Values.configuration.jupyterhub.singleuser.securityContext.seccompProfile.localhostProfile | default "" }}'
+
+seccompProfile = {
+    'type': seccompProfileType,
+}
+
+if ( seccompProfileType == "Localhost" ):
+    seccompProfile.update({
+        'localhostProfile': localhostProfile,
+    })
+
+c.KubeSpawner.pod_security_context.update({
+    'runAsNonRoot': True,
+    'seccompProfile': seccompProfile
+})
+
+c.KubeSpawner.container_security_context.update({
+    'allowPrivilegeEscalation': False,
+    'capabilities': {
+        'drop': ['ALL'],
+    },
+})

charts/helix/values.schema.json

@@ -93,6 +93,19 @@
                                             "type": "integer"
                                         }
                                     }
+                                },
+                                "securityContext": {
+                                    "type": "object",
+                                    "properties": {
+                                        "seccompProfile": {
+                                            "type": "object",
+                                            "properties": {
+                                                "type": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        }
+                                    }
                                 }
                             }
                         }

charts/helix/values.yaml

@@ -22,6 +22,12 @@ configuration:
     # @section -- HELIX settings
     # @default -- No override of existing Z2JHK8S Chart Configuration.
     singleuser:
+      # Follow specification of the securityContext field in Kubernetes, see https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details.
+      securityContext:
+        seccompProfile:
+          type: "RuntimeDefault"
+# -- This field is only relevant if the type field is set to "Localhost". It should be the name of a file containing a seccomp profile, which must be present in the container image. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-the-seccomp-profile for more details.
+#          localhostProfile: ""
 
       # -- Supports UID/GID manipulation to match custom volume persmisisons
       # @section -- HELIX settings
@@ -39,6 +45,7 @@ configuration:
         #- 123
         #- 543
 
+
     # -- Specifies JupyterHub's available profile, containing the notebook's docker images.
     # @section -- HELIX settings
     # @default -- Single-ser and collaborative profiles fitting an standard context.
@@ -72,22 +79,6 @@ configuration:
           cpu_guarantee: 2.1
           memory_limit: "8G"
           memory_guarantee: "4G"
-        - displayName: "Jupyter Minimal Notebook"
-          slug: "minimal"
-          image: "quay.io/jupyter/minimal-notebook:latest"
-          imagePullPolicy: "Always"
-          cpu_limit: 5.1
-          cpu_guarantee: 2.1
-          memory_limit: "8G"
-          memory_guarantee: "4G"
-        - displayName: "Jupyter Datascience Notebook"
-          slug: "datascience"
-          image: "quay.io/jupyter/datascience-notebook:latest"
-          imagePullPolicy: "Always"
-          cpu_limit: 5.1
-          cpu_guarantee: 2.1
-          memory_limit: "8G"
-          memory_guarantee: "4G"
 
       # -- Collaboration profiles, used when a user spawns a collaborative JLab.
       # @section -- HELIX settings