[BUG] - Cannot edit/delete conda-environment after creating if 'default' or 'filesystem' namespaces are chosen.

[dharhas]

OS system and architecture in which you are running QHub

GCP

Expected behavior

The conda-store flask interface lets me pick from several namespaces:

• default
• filesystem
• username (i.e. [email protected])
• various groups I belong to (analyst etc)

I created a new environment via the conda-store flask interface and picked the default namespace. I am now unable to edit that environment. I get the error msg:

{
message: "request not authorized",
status: "error"
}

I am also unable to delete it, hitting delete, redirects me to the main jupyterhub home page (i.e. https://quansight-beta.qhub.dev/hub/home) and navigating back to conda-store shows me that the environment hasn't been deleted.

Actual behavior

A couple of options here.

First of all the 'filesystem' namespace should be hidden as an option since I assume this is meant to cover environments created from yaml files on a filesystem somewhere. In addition, I should not be able to create an environment in this namespace via the flask app.

What is the purpose of the 'Default' namespace? Are these environments coming from the git repo or is it something different. If it is mean to be a readonly environment I should not have the ability to create environments in this namespace and it should be hidden as an option as well.

How to Reproduce the problem?

1. create an environment via the conda-store flask interface and choose default of filesystem as the namespace
2. attempt to edit or delete the environment

Command output

No response

Versions and dependencies used.

So is there a way to get the QHub version? I don't think it is displayed anywhere.

Compute environment

GCP

Integrations

conda-store

Anything else?

No response

[costrouc]

@dharhas we probably need to talk about https://github.com/Quansight/qhub/blob/main/qhub/template/stages/07-kubernetes-services/modules/kubernetes/services/conda-store/config/conda_store_config.py#L74-L99. This mainly has to do with how I have the user's setup with group <-> role mappings would be my guess.

I've worked on the conda-store ui for a better error message in conda-incubator/conda-store#261. So the user will no longer see the

{
message: "request not authorized",
status: "error"
}

And will instead see a red banner message that the operation was not permitted.

[dharhas]

@costrouc Part of the issue is that if I have the ability to create an environment in a namespace, I should also have the ability to edit & delete it. I can create envs in defaults and filesystem but I can't edit and delete them.

Overall maybe we do this:

• filesystem namespace: This should be a configurable name (with a better default name). no-one should have the ability to create/edit or delete environments since these are supposed to be coming from a gitops controlled location. Everyone should be able to use this namespace
• defaults namespace: (This should be a configurable name). This should be a global readonly namespace that only admins can add environments to and other cannot. Everyone should be able to use this namespace
• project/group specific namespaces

Actually now that I think about it, a better model might be:

• the gitops namespace
• group based namespaces that are either editable by everyone or only editable by admins and readonly to others.

[trallard]

Is this still an issue after all the conda-store work done over the last few months? @costrouc

[pavithraes]

Is this still an issue after all the conda-store work done over the last few months?

Don't think so, closing as out-of-context with recent updates in conda-store 0.4.14. We can re-open later if needed. :)