Merge pull request #6740 from berkeley-dsep-infra/staging

Merge 6712, 6717, 6732, 6736, 6737, 6741 to prod

deployments/a11y/hubploy.yaml

@@ -1,6 +1,6 @@
 images:
   images:
-    - name: us-central1-docker.pkg.dev/ucb-datahub-2018/user-images/a11y-user-image:6dcc885aabf9
+    - name: us-central1-docker.pkg.dev/ucb-datahub-2018/user-images/a11y-user-image:b321bfa2ac82
 
 cluster:
   provider: gcloud

deployments/cdss-discovery/config/certificate-staging.yml

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  name: cdss-discovery-staging-cert
+spec:
+  commonName: cdss-discovery-staging.datahub.berkeley.edu
+  dnsNames:
+  - cdss-discovery-staging.datahub.berkeley.edu
+  issuerRef:
+    kind: Issuer
+    name: letsencrypt
+  secretName: cdss-discovery-staging-tls

deployments/cdss-discovery/config/common.yaml

@@ -0,0 +1,180 @@
+# A melding of https://ucsd-prp.gitlab.io/userdocs/jupyter/values.yaml and
+# datahub-based deployment configuration.
+
+# Nautilus does not use an NFS server.
+nfsPVC:
+  enabled: false
+
+# Nautilus does not let cluster admins set this.
+node-placholder:
+  priorityClass:
+    create: false
+
+jupyterhub:
+  scheduling:
+    podPriority:
+      enabled: false
+    userScheduler:
+      enabled: false
+    userPlaceholder:
+      enabled: false
+
+  prePuller:
+    hook:
+      enabled: false
+    continuous:
+      enabled: false
+
+  # We set this in hub/values, but we are forbidden from setting
+  # net.ipv4.ip_local_port_range at Nautilus, and the proxy replicaset will
+  # fail to deploy without this. This setting might not be relevant for
+  # Nautilus since their proxy might not be leaky.
+  proxy:
+    chp:
+      extraPodSpec:
+        securityContext:
+          sysctls: null
+
+  hub:
+    # Nautilus uses rook-ceph-block for hub db storage.
+    db:
+      type: sqlite-pvc
+      pvc:
+        accessModes:
+          - ReadWriteOnce
+        storage: 1Gi
+        storageClassName: rook-ceph-block
+    resources:
+      limits:
+        cpu: "2"
+        memory: 1Gi
+      requests:
+        cpu: 100m
+        memory: 512Mi
+    # We set this in hub/values, but we should unset it on Nautilus
+    networkPolicy:
+      enabled: false
+      egress: null
+    config:
+    loadRoles:
+      # datahub staff
+      datahub-staff:
+        description: Enable admin for datahub staff
+        # this role provides permissions to...
+        scopes:
+          - admin-ui
+          - admin:groups
+          - admin:users
+          - admin:servers
+          - read:roles
+          - read:hub
+          - access:servers
+        # this role will be assigned to...
+        groups:
+          - course::1524699::group::all-admins
+
+  # Nautilus uses haproxy for ingress
+  ingress:
+    enabled: true
+    annotations:
+      kubernetes.io/ingress.class: haproxy
+    #hosts:
+    #  #- "cdss-discovery-staging.nrp-nautilus.io"
+    #  - cdss-discovery-staging.datahub.berkeley.edu
+    pathSuffix: ''
+    #tls:
+    #  - hosts:
+    #    #- cdss-discovery-staging.nrp-nautilus.io
+    #    - cdss-discovery-staging.datahub.berkeley.edu
+
+  singleuser:
+    # Nautilus-specific configuration
+    uid: 0
+    fsGid: 100
+    extraEnv:
+      GRANT_SUDO: "yes"
+      # Unset NotebookApp from hub/values. Necessary for recent lab versions.
+      JUPYTERHUB_SINGLEUSER_APP: "jupyter_server.serverapp.ServerApp"
+    extraPodConfig:
+      securityContext:
+          fsGroupChangePolicy: "OnRootMismatch"
+          fsGroup: 100
+    extraNodeAffinity:
+      required:
+        - matchExpressions:
+          - 'key': 'topology.kubernetes.io/region'
+            'operator': 'In'
+            'values': ["us-west"]
+    cloudMetadata:
+      blockWithIptables: false
+    networkPolicy:
+      enabled: false
+    # /Nautilus-specific configuration
+    extraFiles:
+      # DH-216
+      remove-exporters:
+        mountPath: /etc/jupyter/jupyter_notebook_config.py
+        stringData: |
+          c.QtPDFExporter.enabled = False
+          c.QtPNGExporter.enabled = False
+          c.WebPDFExporter.enabled = False
+
+    # Nautilus-specific configuration
+    storage:
+      type: dynamic
+      extraLabels: {}
+      extraVolumes: []
+      extraVolumeMounts: []
+      capacity: 5Gi
+      homeMountPath: /home/jovyan
+      dynamic:
+        storageClass: rook-ceph-block
+        pvcNameTemplate: claim-{username}{servername}
+        volumeNameTemplate: volume-{username}{servername}
+        storageAccessModes: [ReadWriteOnce]
+    # /Nautilus-specific configuration
+
+    startTimeout: 600
+    cpu:
+      limit: 3
+      guarantee: 3
+    memory:
+      guarantee: 10G
+      limit: 10G
+
+  #custom:
+  #  group_profiles:
+  #
+  #    # Example: increase memory for everyone affiliated with a course.
+  #
+  #    # Name of Class 100, Fall '22; requested in #98765
+  #    course::123456:
+  #      mem_limit: 4096M
+  #      mem_guarantee: 2048M
+  #
+  #    # Example: grant admin rights to course staff.
+  #    # Enrollment types returned by the Canvas API are `teacher`,
+  #    # `student`, `ta`, `observer`, and `designer`.
+  #    # https://canvas.instructure.com/doc/api/enrollments.html
+  #
+  #    # Some other class 200, Spring '23; requested in #98776
+  #    course::234567::enrollment_type::teacher:
+  #      mem_limit: 2096M
+  #      mem_guarantee: 2048M
+  #    course::234567::enrollment_type::ta:
+  #      mem_limit: 2096M
+  #      mem_guarantee: 2048M
+  #
+  #
+  #    # Example: a fully specified CanvasOAuthenticator group name.
+  #    # This could be useful for temporary resource bumps where the
+  #    # instructor could add people to groups in the bCourses UI. This
+  #    # would benefit from the ability to read resource bumps from
+  #    # jupyterhub's properties. (attributes in the ORM)
+  #
+  #    # Name of Class 100, Fall '22; requested in #98770
+  #    course::123456::group::lab4-bigdata:
+  #      - mountPath: /home/rstudio/.ssh
+  #        name: home
+  #        subPath: _some_directory/_ssh
+  #        readOnly: true

deployments/cdss-discovery/config/issuer.yml

@@ -0,0 +1,20 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: letsencrypt
+spec:
+  acme:
+    email: [email protected]
+    preferredChain: ""
+    privateKeySecretRef:
+      name: issuer-account-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - http01:
+        ingress:
+          class: haproxy
+          ingressTemplate:
+            metadata:
+              annotations:
+                ingress.kubernetes.io/ssl-redirect: "false"
+          serviceType: ClusterIP

deployments/cdss-discovery/config/prod.yaml

@@ -0,0 +1,10 @@
+jupyterhub:
+  ingress:
+    hosts:
+      - cdss-discovery.datahub.berkeley.edu
+      #- cdss-discovery.nrp-nautilus.io
+    tls:
+      - secretName: tls-cert
+        hosts:
+          - cdss-discovery.datahub.berkeley.edu
+          #- cdss-discovery.nrp-nautilus.io

deployments/cdss-discovery/config/staging.yaml

@@ -0,0 +1,16 @@
+jupyterhub:
+  scheduling:
+    userScheduler:
+      replicas: 1
+  prePuller:
+    continuous:
+      enabled: false
+  ingress:
+    hosts:
+      - cdss-discovery-staging.datahub.berkeley.edu
+      #- cdss-discovery-staging.nrp-nautilus.io
+    tls:
+      - secretName: tls-cert
+        hosts:
+          - cdss-discovery-staging.datahub.berkeley.edu
+          #- cdss-discovery-staging.nrp-nautilus.io

deployments/cdss-discovery/hubploy.yaml

@@ -0,0 +1,9 @@
+images:
+  images:
+    #- name: quay.io/jupyter/datascience-notebook:2024-04-22
+    - name: "quay.io/jupyter/base-notebook:2025-01-28"
+
+cluster:
+  provider: kubeconfig
+  kubeconfig:
+    filename: nautilus-kubeconfig.yaml

deployments/cdss-discovery/secrets/nautilus-kubeconfig.yaml

@@ -0,0 +1,33 @@
+apiVersion: ENC[AES256_GCM,data:28s=,iv:aTyMAMkH2vfrC0y3XHLluaBuVlpbctkKeAtv3CRdZFI=,tag:cJqGAE0N/k7SjUH787pnNQ==,type:str]
+clusters:
+    - cluster:
+        certificate-authority-data: ENC[AES256_GCM,data:d7/n9AKFvj+t2Z3FOuxAZpcsc0N4IElL6deyOo2G5BjXBY6iM60nchd1+by/WID0zTXuMPWecsDnaHIi05hJVdZrekLMBAxdX5vGtfqpvdPZY9V963lhtbNo7yWzH1kTSsM2I3oqvNom2i/2LvWlWtt/7gE94vrJ3Lb5WwNnRNbap1DMjcSNRDxhMiuYkGm/RaXahnW3a4fH3nF0ZFpK+6SWrr+h80XrVKeohWUA4i8iispD841vpiOapSKUOm9ihqDYlknGRGdQRRSEk4OZTpedXVEiw1mwDh2M1BFXk8fwM6hnVLpWoInagHxwVT9qH36OtIhtMZmt1MNftDGbL0g1tZYoEcHt7UpB8oXJY4yLVI4QAoIWPVtZyOmWi2/1kAL5xOh0u9sEDOQxuBIO2RKinZW9mPIjAnA+L6VEYklAiC0T/pVEQdp1tNcJsj94mKGQ5PtPWs02PXMdx4p6gRM7MYisfXe8d20QU/RPU/qVpxWPZxrolm/OZbzL5s2SeaWmm5k1Kw6sfepuKiMizEwPFHGz9B2k27KtSP2IwaRNc6BPZVjoxpYOtQNKcrJyM7spSiwofT3CjxVkyo4ftdGSbHclneITk1agT8ywyiteA6aajxTdAU9JGZOtDOUB1LOYtpG6p6HRI5ewcprFZL5M7/TX6obgczrn+ijJTofcRsZdt1BRmoRdm0hibFfTZ22xCjuzs++8ExJtNsdmzKZc4XsDoE2/vm4JoIVGLY2VW6dd/TiJ+UcDaC5JSh7GxlcYyGTlOU4SxARWeuHHdGNHwsfmUl/6Y8Q87Y3yCMHxFhFu71tgMirLVoIo+qG4BeWsKasIU/4zLZNcW2ZulMeK1nQ3s1DBFqDuNAm5yPn9VZIgucoQqXGTbGsUpdJNDR+NOxD9UT5F8EL01d6dqPsQgli7HifDDCjFpgN4fTNEiaaCNyi7+qQxVR3CHDjCe7kgZefiXnCGdu9MeGDGpwSOnsrmV+RB55GVpEtW1HEA/41MlJKqsfchC8qpSUy1Y0Ye3SV14pQ3fqCk1x2lIDUlVnslZxb5kSrqjROyuAt67+VM10gfcKlFEbS0ypwzlIZ4nOJVh7keED5VGjZfcd9evobgHZXZxTGMNs7Ky3g+sL0W2kQResskPGczeKGv6W7es3erKFLM8vbbqjUjszAN3p7gJLT0wpRbx5DAX8GHeywlGTMUZdnE3g+jAGOiwzMjbj5bMDCZCjNbXMqf1HXhXfV+ls1o5at0ayFuFEJA1Yn+UpoNrm2gfexzI2sW9AWmPxT/Y475MMxuTiNyAc+HV3o3DFh7o9H4U5orPK9b3bGK/07BAVBl46u/tOtpSR6UPZLYaunQS6LMs/ies0K4hylMNpGQME6JHV5ZFiXSe2oxlCVkS8H3DmU/9U0cV3y088K4mIWWhdiEe5aUlCa1D63f9EsWW/uaAyUSJy3wxKd4e6r9E0u6mINLZKcRniJ6CGx3L6yqb1YxhxrgQgCkCPN4JxbBvQKIsplFrC03RuBLftAIzL/kOlraaMidP1G0kqIZU2WLKqvdYFOR6enRu7EDj02l9O3uAS4XRpdCGqnqIovF5dgYUnVnc5dX5ME1I0u4LTxaf3mcsUu8IVrYiUqMZj7gMDx7Jgq4hpWGvAjduIRNFLlhCZpV65xfwjKHIAQjFqCfjUSQfcpYk2Vz463Vo/z45uR82XHzmkUkIOhrPKpTey0ZkgplSnUFGyInRGySo6YR0osS/6NLO9RON/65seaR/T6w9dXUqIj070ueYL5SRl3X31C0s7hbxaNenaPWdO1iR3tDu6zTiIGOcVDwWfhf,iv:aH+WaAYF6cvYS1uIeZar6PMmqUs1hTUOVI8zXC8+F/U=,tag:JKaP/Y7tY99oTav5KSpBFw==,type:str]
+        server: ENC[AES256_GCM,data:FA787tWI6VFuy+tDUX5DmTm9NUyzDkA4ow==,iv:/imL/sKwMbBCf47IeB16BV01sWaQwrHbEhGdXfaLY/U=,tag:VheLL4FqUCXIUV9tzEuoCA==,type:str]
+      name: ENC[AES256_GCM,data:8GWojMEyjjw=,iv:0DMp7X1JL9Nno0wTUo1V8e0H4qr5QyefwKNoa/sjWps=,tag:xfxNQo5H6zjySN40URl+pg==,type:str]
+contexts:
+    - context:
+        cluster: ENC[AES256_GCM,data:N2G+5WibFHA=,iv:dkDbE500Ew/bL8nLEqZlwlYmTWKgLBdysKiFYq/jlKY=,tag:kpdsiRcEupU4bcZ+B/KBwA==,type:str]
+        namespace: ENC[AES256_GCM,data:933gOpLld+Eu9+30Z3dkXo7/ThwiZQ==,iv:cJs81/6+JrAQ75WcQtEaKfToxwbcanhBBr1ZaCmOpiw=,tag:vWDSgUm5iLC0DHwsIva/eA==,type:str]
+        user: ENC[AES256_GCM,data:nS+ExC4JXA==,iv:+sXMz/7CQz9Y6VL/jjnj2ck9nRxM4F0ysu18F0LOym0=,tag:d24N+pbsTilkuFl3jSJOCw==,type:str]
+      name: ENC[AES256_GCM,data:pUHGPPfYD9s=,iv:uO2X98vcXi7pHx7kvBQ4O7A6YOSYqsW3A1w/douglKY=,tag:6uJ+VhiMZ47fn4XhCohLow==,type:str]
+current-context: ENC[AES256_GCM,data:oW++cDt96xo=,iv:4HKCHnhmCYgTRNDpKLqC+wpBUgUpJcOjzqSFM1wP4hY=,tag:rgdCK+f9d+3hAn8/w708lg==,type:str]
+kind: ENC[AES256_GCM,data:+0H1oNJp,iv:F4pX4q2RmWErbUQeIlh0VU/QuM09mR+WwoTjLpYfjx8=,tag:AhSU7qBqzNKWH8mVWUelTw==,type:str]
+preferences: {}
+users:
+    - name: ENC[AES256_GCM,data:2IdJqVPpeA==,iv:yt8GxG4Wf5YxzUYH/xsXeAPY/JLQg2j80sL9a45kkB0=,tag:+LNhBnl0n5gOK2gxL4knqQ==,type:str]
+      user:
+        token: ENC[AES256_GCM,data:qcHJhkEQKF6leespQn1vfuBtBeJ618j4tiXh/WQA/xmJXian0mbA0O7WzYWg4gNP6Br0xgSaiaRI1qDmEnFjDxxGYAUk0rLEkGbRRKE8sahyN52Z+j+dsoOMq6osioY9vlJeUNZDSCYRV3Cy2WjB57BSU/2pxOIBlTTH0nErQY44fw375nxeiRb4499EYen+KOOKcXouuVqcaF/4/0JD5VeprmpcnEiYBiVdA1dw2xOoHGJHORnzjjTWWFQjyRIkVeHPdoM+S4LefTZpF8qbZHrztaTYRoyy/t8DRD68Q4WH5UR7uHjd4FNv53fghiVYhW9M9A6xbAuLahBWZCbjPA2KReegixQq8HMPpLBMYCkZN5CnjX3Yr2rRsCEvXPbKcJRJEBS97X/qt9z6QfTtF+KpGKTCXIQaik3OH6JVUxWAkAJjYCi3cKx8/a8aPMZYV4BS+Tud4WLiwtUnIWqCeJ9ry5pNJHgh+GXN/4+8iFLBN2+OkQDhcPiTuaxnA9xMu16x1XSipSuE4s5pgkDk1DP59ID9mcwiOXV7MDJARGk+2h43mi08c98gcFVra+vzsGSD0SDlDNxqEUpQ842fWchJxTxeiEGnZqT6KKLhTO9kQ1dC9RWWe5kNXUngx5JovRIm3vruc+iHwiIt2IVF9WoER0cWtv/H22Scg/lq/a2e0sIO3D5BUSf7ZYhBG50HqXrEVSgd/QxT7WDGc86mGptmmtAVoBZuoc0qUJRCX/gmcPLVGmr+eHvVvy9I+oPrXKnynsYeniFCKHifTjpIDBkleZHsL7xn2Vy66RF7N87NvJwGz+2eK6h88qaHYUUxKcijrua7p+NNvCpD5SrPA5HOx7mUogziWTdDc11PDRJbhK+pTlwAOk+Jkit0SyVOh+GSGiJui+FBWKdT61XBy9CuVaXK6IwicWhdHQzKu/SYpWm1T7hGfs5bH4bSXrob2526wgWuENrr1b2wygqL1HEPR3orpSZw9IbENeRrGXyKlVIvTWV9cjVU0kCxwYEA9hpVZFM/vISPZtFD+v3f8QSZGog6s3B2ueidNhivw3UIQC/FD51sydq+1o18oNZasLYNt87GmvZoHb4+KQy2uZmQlpdlPcLUYpdY3zF3xI8u8cA+G3UEfsiTk77lCu8mKjV6VhVQjvHWaVSJSixVq17pyllhssWKoDqxh/YoevgpMDSP8ZufSVCE2JLhCfrbjvHG3H1aly10QVNyPlel7LntdrxS,iv:v+Dk+wr03hMrzXRwEieEFwc8K6cqh6Td1fr9rVkxZlE=,tag:3IIlXSEALp6NZH21o5kGZw==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/ucb-datahub-2018/locations/global/keyRings/datahub/cryptoKeys/sops
+          created_at: "2025-01-28T01:37:45Z"
+          enc: CiUA67O9AKyodiN+RXU1HrUd1kDg5RWkq0EAiMafjbRmgVh/PTjCEkgAxMHsvBE7drnnV8VIbuRNV/e2GPj95fEDBuD3frXqz2rnYpDJxCE6U/6XXTGMMIDa8C99/3Gkp4CGUPEXNoiCkpqVFIn7lKQ=
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2025-01-28T01:37:45Z"
+    mac: ENC[AES256_GCM,data:PEK/wCtq3ybS2lZxABY9ttL6AsV+fxn6XvP4iFhQ19jJwla96+E/uRrW6Em3qSBj4MjYWatafVm8nCKQIrPEVDEEloCIwcMiS9sPJQ8i8SUpSNekKyFr0KVgpy+weA8rjJvCtZ/gZCPHLXX360mw06vpEpLw4ZUbEBYtJeqLyzM=,iv:xVl1xmqlvKxhpxH3dWowMzgIIgI9bWClmrYqy9Jbgpc=,tag:kwyaYsaCrlpY/KcLGmJcXA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

deployments/cdss-discovery/secrets/prod.yaml

@@ -0,0 +1,21 @@
+jupyterhub:
+    hub:
+        config:
+            CanvasOAuthenticator:
+                client_id: ENC[AES256_GCM,data:/VedfPLyL+Rj3gciMxQ5H84=,iv:WZsC/06SEfEEeH4/NY+txGypgP/lShrJLc8DVXS7tco=,tag:kdZCzktRscuCYz4nRlkxTA==,type:str]
+                client_secret: ENC[AES256_GCM,data:EqzXDvAIMyGeTnGjUDOg6X6XqSwDmogtz/HXhc2LNYMhoSgg8PSUqvEFNUNG6w59tkRXPerBR6PyOuG31ftYXQ==,iv:D/rf3aWams6O2NcmdjFYxEVV5dQoWv3ubZ1kTN5KMO8=,tag:/LLaEHP/RB17Td0UW1I2bQ==,type:str]
+                oauth_callback_url: ENC[AES256_GCM,data:8BmkBWJKxZmbKHVqJT50obT2D9RdQpEOCw9plqhZDyUeh7uiJVG5y5guXdiO+0MvwKIoXAQbz2z9zZq8Mk0=,iv:ZwPIuR/dAfY33smRpzlu9UZu9/Xu2z9hhpSTINd0Vpk=,tag:mpDxFk77V3Hp9JoWFvoo+g==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/ucb-datahub-2018/locations/global/keyRings/datahub/cryptoKeys/sops
+          created_at: "2021-05-05T10:57:58Z"
+          enc: CiQA67O9AK2027WGYGTzywa01Cz+Ez7sOTk/d9payovyK5pg8g4SSADmhpq89bbIWFjlGg79o/iupJ4anLU5Ab9VL+qNzhu6e83JtJ7wSv6sK+cDiEfVSaKQ1YIcadDXFt4WUKRt7MFvAa1sLqp2LA==
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2025-01-22T23:27:26Z"
+    mac: ENC[AES256_GCM,data:qb/TlQuC0eEqE9q8W/SyUNl6qdI0j1KsKNFa+jGGHdP7wpPrIfgVLEaBgq8cEUDRBpBcRlfXDN5eDlAy68PtOlPMfX4ZwwuEvmWjM7NHNV4YYb+JJ4FOB9PtZCn3VqBuvYFB0bwZTppRC0aNc4QTDancDXz4Q005pBsq+r+Npk0=,iv:lWue6Dp1XRALy3/1x+FjcFeJOaoz5s8zGhecp3gzPWY=,tag:2f/d2btNncS3QRHXjgj7ng==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

deployments/cdss-discovery/secrets/staging.yaml

@@ -0,0 +1,21 @@
+jupyterhub:
+    hub:
+        config:
+            CanvasOAuthenticator:
+                client_id: ENC[AES256_GCM,data:G0+pIvyOsh+Zj4ZxddKbON4=,iv:iX8jMrXcJvjBi0GKRtuN886bXWFwBfCsaUoH+HRMn6U=,tag:BsyGAveKrd8TvWMuUlw3kw==,type:str]
+                client_secret: ENC[AES256_GCM,data:6mR3zs4jvkVuVwjut56tuW3HIOHcYWRSIJJZiOeC+H82tqgZeuVEe7+/zMxq6J0ba5RMas9npep4svuL+TppcA==,iv:K6/MFusdxnLkrEA5LaXLO8mFm1Xa4U2OmxUBOLqdpJk=,tag:xweE4+/ZCIcXj9CtbFpUSw==,type:str]
+                oauth_callback_url: ENC[AES256_GCM,data:2/P2qI4U2sEJaOlVoy82Bupx1ItpHX7T89cdHXrA2L70s/pIVe/f2t+cDHIjdBbN70/R84GAiM8f/5Rdcj0gEEuwUnTDSg==,iv:azYHMJvWCUzCMEZ47/K4wkx6QiOdSxzqY6BZJ4H+u7g=,tag:Q1qtGTH3NlZPtJG2kC9WIg==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/ucb-datahub-2018/locations/global/keyRings/datahub/cryptoKeys/sops
+          created_at: "2021-05-05T10:57:58Z"
+          enc: CiQA67O9ALEiz+lgnWQQgjT08Fx2+SUNdWEA2MqdIoEl0Ett3zASSQDmhpq85T+08Rtt/sqeMktjA6t8rCVH8soCR/sNJwDHgXabOipn/od+64D/L+aggCaXqJ433twByk0+YUJAe5z733oW/3J53eU=
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2025-01-22T23:27:09Z"
+    mac: ENC[AES256_GCM,data:d7syHCj+TFEsBt3A4jKHrZ/fnv6v5CIb7iK5drTK4u76CMQOhRfpCRGadDdAeobl98E7RJjo+Z5i0/Gaoj59a5f5G3DOrnlJxTDhTkD19WjkxpxMYgDWlixBFc3L33xfiSCfY5+L+e+5uZAxqhOCR7+dsN2CAe+C2AYeb5mz/+A=,iv:gLH/NPsKsKOD5qsy4QFjh46FtQUUaX4rXdqq5OHebU8=,tag:jUMZDIqdLw7x+naJkfWCjA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

deployments/datahub/config/common.yaml

@@ -161,3 +161,8 @@ jupyterhub:
       course::1541056:
         mem_limit: 4096M
         mem_guarantee: 4096M
+
+      # Demog 175, Spring 25, https://github.com/berkeley-dsep-infra/datahub/issues/6725
+      course::1542976:
+        mem_limit: 4096M
+        mem_guarantee: 4096M

deployments/eecs/config/common.yaml

@@ -101,3 +101,8 @@ jupyterhub:
       course::1524699::group::all-admins:
         mem_limit: 2G
         mem_guarantee: 2G
+
+      # EE 120, Spring 25, https://github.com/berkeley-dsep-infra/datahub/issues/6676
+      course::1542501:
+        mem_limit: 4096M
+        mem_guarantee: 4096M

deployments/eecs/hubploy.yaml

@@ -1,6 +1,6 @@
 images:
   images:
-    - name: us-central1-docker.pkg.dev/ucb-datahub-2018/user-images/eecs-user-image:fbaa642ad7a5
+    - name: us-central1-docker.pkg.dev/ucb-datahub-2018/user-images/eecs-user-image:c0dcb92f86a4
 
 cluster:
   provider: gcloud

deployments/julia/hubploy.yaml

@@ -1,5 +1,5 @@
 images:
-  image_name: us-central1-docker.pkg.dev/ucb-datahub-2018/user-images/julia-user-image:fb504b6c71b2
+  image_name: us-central1-docker.pkg.dev/ucb-datahub-2018/user-images/julia-user-image:12b6fec91592
 
 cluster:
   provider: gcloud