feat(hub): add static service token

README.md

@@ -228,8 +228,6 @@ helm install jupyterhub bioos/jupyterhub \
 kubectl -n bioos port-forward --address 0.0.0.0 service/hub 8081:8081
 ```
 
-打开浏览器访问：http://Server-IP/jupyterhub, 申请新 token.
-![jupyterhub token](./img/jupyterhub.png)
 ## 3.3 安装 Cromwell
 ```bash
 helm repo add https://bio-os.github.io/helm-charts/charts
@@ -255,8 +253,7 @@ helm install bioos bioos/bioos \
     --set mysql.username=root \
     --set mysql.password=Bytedance2023 \
     --set wes.endpoint=http://cromwell.bioos.svc.cluster.local:8000 \ #配置cromwell在K8S中的访问地址
-    --set jupyterhub.endpoint=http://{{INGRESS-ADDRESS:PORT}}/jupyterhub/ \
-    --set jupyterhub.adminToken=${jupyterhub-token}  # 这里填写2.2步骤中获取的token
+    --set jupyterhub.endpoint=http://{{INGRESS-ADDRESS:PORT}}/jupyterhub
 
 # 端口转发：
 kubectl -n ingress-nginx port-forward --address 0.0.0.0 service/ingress-nginx-controller 8888:80

charts/bioos/values.yaml

@@ -90,9 +90,9 @@ storage:
 
 wes:
 #  cromwell service address
-  endpoint: http://180.184.43.61:8000
+  endpoint: http://10.0.0.0:8000
 
 jupyterhub:
 #  jupyterhub service address
-  endpoint: http://180.184.43.61/jupyterhub
-  adminToken: c876b254956a433aaf02836605565af6
+  endpoint: http://10.0.0.0/jupyterhub
+  adminToken: mybioostoken

charts/jupyterhub/files/hub/jupyterhub_config.py

@@ -7,6 +7,7 @@
 from jupyterhub.utils import url_path_join
 from kubernetes_asyncio import client
 from tornado.httpclient import AsyncHTTPClient
+import kubespawner
 
 # Make sure that modules placed in the same directory as the jupyterhub config are added to the pythonpath
 configuration_directory = os.path.dirname(os.path.realpath(__file__))
@@ -36,7 +37,7 @@ def camelCaseify(s):
 # at the rate required.
 AsyncHTTPClient.configure("tornado.curl_httpclient.CurlAsyncHTTPClient")
 
-c.JupyterHub.spawner_class = "myspawner.KubeSpawner"
+c.JupyterHub.spawner_class = kubespawner.KubeSpawner
 
 # Connect to a proxy running in a different pod. Note that *_SERVICE_*
 # environment variables are set by Kubernetes for Services

charts/jupyterhub/values.yaml

@@ -38,6 +38,14 @@ hub:
         headers:
           Access-Control-Allow-Origin: "*"
           Content-Security-Policy: "frame-ancestors 'self' http://localhost"
+      service_tokens:
+        # The token MUST be same with apiserver jupyterhub.adminToken
+        mybioostoken: bioos
+      load_roles:
+      - name: bioos
+        description: 'bioos apiserver access'
+        scopes: ['admin:users', 'admin:servers']
+        services: ['bioos']
     Spawner:
       args:
         - "--NotebookApp.allow_origin=*"
@@ -670,4 +678,4 @@ debug:
   enabled: false
 
 global:
-  safeToShowValues: false
+  safeToShowValues: false