Merge branch 'main' into doc-readme

charts/jupyter-pyspark/Chart.yaml

@@ -24,9 +24,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.1.4
+version: 2.1.14
 
 dependencies:
   - name: library-chart
-    version: 1.5.25
+    version: 1.5.30
     repository: https://inseefrlab.github.io/helm-charts-interactive-services

charts/jupyter-pyspark/README.md

@@ -1,6 +1,6 @@
 # jupyter-pyspark
 
-![Version: 2.1.4](https://img.shields.io/badge/Version-2.1.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 2.1.14](https://img.shields.io/badge/Version-2.1.14-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 The JupyterLab IDE with PySpark, an interface to use Apache Spark from Python.
 
@@ -15,7 +15,7 @@ The JupyterLab IDE with PySpark, an interface to use Apache Spark from Python.
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://inseefrlab.github.io/helm-charts-interactive-services | library-chart | 1.5.25 |
+| https://inseefrlab.github.io/helm-charts-interactive-services | library-chart | 1.5.30 |
 
 ## Values
 
@@ -26,12 +26,14 @@ The JupyterLab IDE with PySpark, an interface to use Apache Spark from Python.
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
 | autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
+| certificates | object | `{}` |  |
 | coresite.configMapName | string | `""` |  |
 | discovery.hive | bool | `true` |  |
 | discovery.metaflow | bool | `true` |  |
 | discovery.mlflow | bool | `true` |  |
 | environment.group | string | `"users"` |  |
 | environment.user | string | `"onyxia"` |  |
+| extraEnvVars | list | `[]` |  |
 | fullnameOverride | string | `""` |  |
 | git.branch | string | `""` |  |
 | git.cache | string | `""` |  |
@@ -51,6 +53,7 @@ The JupyterLab IDE with PySpark, an interface to use Apache Spark from Python.
 | ingress.ingressClassName | string | `""` |  |
 | ingress.tls | bool | `true` |  |
 | ingress.useCertManager | bool | `false` |  |
+| ingress.useTlsSecret | bool | `false` |  |
 | ingress.userHostname | string | `"chart-example-user.local"` |  |
 | init.personalInit | string | `""` |  |
 | init.personalInitArgs | string | `""` |  |
@@ -105,9 +108,9 @@ The JupyterLab IDE with PySpark, an interface to use Apache Spark from Python.
 | security.password | string | `"changeme"` |  |
 | securityContext | object | `{}` |  |
 | service.image.custom.enabled | bool | `false` |  |
-| service.image.custom.version | string | `"inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.2"` |  |
+| service.image.custom.version | string | `"inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.3"` |  |
 | service.image.pullPolicy | string | `"IfNotPresent"` |  |
-| service.image.version | string | `"inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.2"` |  |
+| service.image.version | string | `"inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.3"` |  |
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |

charts/jupyter-pyspark/templates/secret-cacerts.yaml

@@ -0,0 +1 @@
+{{ include "library-chart.secretCacerts" . }}

charts/jupyter-pyspark/templates/secret-extraenv.yaml

@@ -0,0 +1 @@
+{{ include "library-chart.secretExtraEnv" . }}

charts/jupyter-pyspark/templates/statefulset.yaml

@@ -44,19 +44,24 @@ spec:
         {{- if .Values.s3.enabled }}
         checksum/s3: {{ include (print $.Template.BasePath "/secret-s3.yaml") . | sha256sum }}
         {{- end }}
-        {{- with .Values.podAnnotations }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
         {{- if not (empty (trim (include "library-chart.secretSparkConf" .)))}}
         checksum/sparkconf: {{ include (print $.Template.BasePath "/secret-sparkconf.yaml") . | sha256sum }}
         {{- end }}
         {{- if .Values.vault.enabled }}
         checksum/vault: {{ include (print $.Template.BasePath "/secret-vault.yaml") . | sha256sum }}
         {{- end }}
+        {{- if and .Values.certificates .Values.certificates.cacerts }}
+        checksum/cacerts: {{ .Values.certificates.cacerts | sha256sum }}
+        {{- end }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "library-chart.selectorLabels" . | nindent 8 }}
     spec:
       volumes:
+        - name: config-files
+          emptyDir: {}
         - name: home
         {{- if .Values.persistence.enabled }}
           persistentVolumeClaim:
@@ -99,8 +104,11 @@ spec:
             secretName: {{ include "library-chart.secretNameCoreSite" . }}
             defaultMode: 0664
         {{- end }}
-        - name: config-files
-          emptyDir: {}
+        {{- if and .Values.certificates .Values.certificates.cacerts }}
+        - name: cacerts
+          secret:
+            secretName: {{ include "library-chart.secretNameCacerts" . }}
+        {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -114,10 +122,10 @@ spec:
         - name: make-configmaps-writable
           image: inseefrlab/onyxia-base:latest
           imagePullPolicy: IfNotPresent
-          command: 
+          command:
             - sh
-            - -c 
-            - | 
+            - -c
+            - |
               echo 'initContainer make-configmaps-writable is started';
               {{- if .Values.s3.enabled }}
               mkdir /dest/coresite;
@@ -132,14 +140,29 @@ spec:
               cp /src/ivysettings/ivysettings.xml /dest/ivysettings/ivysettings.xml;
               {{- end }}
               {{- if .Values.discovery.hive }}
-              mkdir /dest/hive; 
+              mkdir /dest/hive;
               cp /src/hive/hive-site.xml /dest/hive/hive-site.xml;
               {{- end }}
               {{- if .Values.discovery.metaflow }}
               mkdir /dest/metaflow;
               cp /src/metaflow/config.json /dest/metaflow/config.json;
               {{- end }}
+              {{- if and .Values.certificates .Values.certificates.cacerts }}
+              mkdir /dest/cacerts;
+              {{- if regexMatch "^https?://" .Values.certificates.cacerts }}
+              curl -s $(cat /cacerts/ca-certs.url) -o /tmp/ca.pem
+              {{- else }}
+              cp /cacerts/ca.pem /tmp/ca.pem
+              {{- end }}
+              awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "/dest/cacerts/cert." c ".crt"}' < /tmp/ca.pem;
+              {{- end }}
           volumeMounts:
+            - name: config-files
+              mountPath: /dest
+            {{- if and .Values.certificates .Values.certificates.cacerts }}
+            - name: cacerts
+              mountPath: /cacerts
+            {{- end }}
             {{- if .Values.s3.enabled }}
             - name: secret-coresite
               mountPath: /src/coresite
@@ -148,8 +171,6 @@ spec:
             - name: secret-ivysettings
               mountPath: /src/ivysettings
             {{- end }}
-            - name: config-files
-              mountPath: /dest
             {{- if .Values.spark.default }}
             - name: secret-sparkconf
               mountPath: /src/spark
@@ -218,8 +239,8 @@ spec:
             {{- if .Values.userPreferences.darkMode }}
             - name: DARK_MODE
               value: "true"
-            {{- end }}          
-          envFrom: 
+            {{- end }}
+          envFrom:
             - secretRef:
                 name: {{ include "library-chart.secretNameToken" . }}
             {{- if .Values.s3.enabled }}
@@ -246,6 +267,10 @@ spec:
             - secretRef:
                 name: {{ include "library-chart.secretNameMLFlow" . }}
             {{- end }}
+            {{- if .Values.extraEnvVars }}
+            - secretRef:
+                name: {{ include "library-chart.secretNameExtraEnv" . }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /
@@ -296,6 +321,11 @@ spec:
               mountPath: /home/{{ .Values.environment.user}}/.metaflowconfig
               subPath: metaflow
             {{- end }}
+            {{- if and .Values.certificates .Values.certificates.pathToCaBundle }}
+            - name: config-files
+              mountPath: {{ .Values.certificates.pathToCaBundle }}
+              subPath: cacerts
+            {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/jupyter-pyspark/values.schema.json

@@ -24,15 +24,15 @@
               "description": "supported versions",
               "type": "string",
               "listEnum": [
-                "inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.2",
-                "inseefrlab/onyxia-jupyter-pyspark:py3.11.10-spark3.5.2"
+                "inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.3",
+                "inseefrlab/onyxia-jupyter-pyspark:py3.11.10-spark3.5.3"
               ],
               "render": "list",
               "hidden": {
                 "value": true,
                 "path": "service/image/custom/enabled"
               },
-              "default": "inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.2"
+              "default": "inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.3"
             },
             "custom": {
               "description": "use a custom jupyter docker image",
@@ -50,7 +50,7 @@
                 "version": {
                   "description": "jupyter unsupported version",
                   "type": "string",
-                  "default": "inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.2",
+                  "default": "inseefrlab/onyxia-jupyter-pyspark:py3.12.6-spark3.5.3",
                   "hidden": {
                     "value": false,
                     "path": "service/image/custom/enabled"
@@ -264,6 +264,29 @@
         }
       }
     },
+    "extraEnvVars": {
+      "description": "environment variables available within your service",
+      "type": "array",
+      "default": [],
+      "x-onyxia": {
+        "hidden": true,
+        "overwriteSchemaWith": "ide/extraenv.json"
+      },
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "default": "",
+            "pattern": "^[a-zA-Z0-9_]+$"
+          },
+          "value": {
+            "type": "string",
+            "default": ""
+          }
+        }
+      }
+    },
     "kubernetes": {
       "description": "configuration of your kubernetes access",
       "type": "object",
@@ -691,6 +714,14 @@
             "hidden": true,
             "overwriteDefaultWith": "k8s.certManagerClusterIssuer"
           }
+        },
+        "useTlsSecret": {
+          "type": "boolean",
+          "description": "Whether you want to use the specified secretName in ingress tls",
+          "default": false,
+          "x-onyxia": {
+            "hidden": true
+          }
         }
       }
     },
@@ -779,41 +810,41 @@
       "description": "It can be used to inject proxy settings in the services",
       "type": "object",
       "x-onyxia": {
-          "overwriteSchemaWith": "proxy.json"
+        "overwriteSchemaWith": "proxy.json"
       },
       "properties": {
-          "enabled": {
-              "type": "boolean",
-              "description": "Inject proxy settings",
-              "default": false
-          },
-          "httpProxy": {
-              "type": "string",
-              "description": "URL of the enterprise proxy for the region for HTTP.",
-              "default": "",
-              "hidden": {
-                  "value": false,
-                  "path": "proxy/enabled"
-              }
-          },
-          "httpsProxy": {
-              "type": "string",
-              "description": "URL of the enterprise proxy for the region for HTTPS.",
-              "default": "",
-              "hidden": {
-                  "value": false,
-                  "path": "proxy/enabled"
-              }
-          },
-          "noProxy": {
-              "type": "string",
-              "description": "enterprise local domain that should not take proxy comma separated",
-              "default": "",
-              "hidden": {
-                  "value": false,
-                  "path": "proxy/enabled"
-              }
+        "enabled": {
+          "type": "boolean",
+          "description": "Inject proxy settings",
+          "default": false
+        },
+        "httpProxy": {
+          "type": "string",
+          "description": "URL of the enterprise proxy for the region for HTTP.",
+          "default": "",
+          "hidden": {
+            "value": false,
+            "path": "proxy/enabled"
+          }
+        },
+        "httpsProxy": {
+          "type": "string",
+          "description": "URL of the enterprise proxy for the region for HTTPS.",
+          "default": "",
+          "hidden": {
+            "value": false,
+            "path": "proxy/enabled"
           }
+        },
+        "noProxy": {
+          "type": "string",
+          "description": "enterprise local domain that should not take proxy comma separated",
+          "default": "",
+          "hidden": {
+            "value": false,
+            "path": "proxy/enabled"
+          }
+        }
       }
     },
     "startupProbe": {
@@ -866,6 +897,32 @@
         }
       }
     },
+    "certificates": {
+      "description": "It can be used to inject certificate authority into the services, if the Helm chart in the catalog allows it you can bind this value to the Helm chart value to add some certificate authorities in the pod.",
+      "type": "object",
+      "x-onyxia": {
+        "overwriteSchemaWith": "certificates.json"
+      },
+      "default": {},
+      "properties": {
+        "cacerts": {
+          "type": "string",
+          "description": "String of concatenated CA certificates. Alternatively a target URL can be provided.",
+          "default": "",
+          "x-onyxia": {
+            "hidden": true
+          }
+        },
+        "pathToCaBundle": {
+          "type": "string",
+          "description": "String path where a bundle is made or injected by third party solution",
+          "default": "/usr/local/share/ca-certificates/",
+          "x-onyxia": {
+            "hidden": true
+          }
+        }
+      }
+    },
     "message": {
       "type": "object",
       "description": "Warning message",
@@ -887,4 +944,4 @@
       }
     }
   }
-}
+}