Merge pull request #10 from yacchin1205/feature/upgrade-2025-01-rcosdp

Upstreamの取り込み(JupyterHub 5.2.1対応)

Author: ikfj

.circleci/config.yml

@@ -1,72 +1,70 @@
+# We use CircleCI to run a basic test for arm64.
+#
+# To reduce the complexity, we let this test verify our built images works with
+# arm64, but doesn't test the acquisition of HTTPS certificates (because it
+# requires a ACME server) or enforcement of the chart's NetworkPolicy resources
+# (because it requires Calico or similar to do it robustly).
+#
 version: 2.1
 
 orbs:
-  python: circleci/python@0.2.1
+  python: circleci/python@2.1.1
 
 jobs:
-  # Testing on ARM64
-  # https://circleci.com/docs/2.0/arm-resources/#using-arm-resources
+  # Testing on arm64
+  # https://circleci.com/docs/using-arm/#using-arm-resources
   test-arm:
     machine:
-      image: ubuntu-2004:2022.04.1
+      image: ubuntu-2204:current
     resource_class: arm.medium
     steps:
       - checkout
 
+      # The k3s setup should be kept similar to how we do it in
+      # https://github.com/jupyterhub/action-k3s-helm.
       - run:
-          command: uname -a
-          name: Check architecture
-
-      - run:
-          # NOTE: we can't use k3s 1.24 and --docker unless we also install for
-          #       example cri-dockerd as done in
-          #       https://github.com/jupyterhub/action-k3s-helm.
-          #
-          # NOTE: we declare --egress-selector-mode=disabled to workaround
-          #       intermittent issues in k3s introduced as a regression in k3s
-          #       1.22.10, 1.23.7, and 1.24.0. This is tracked in
-          #       https://github.com/k3s-io/k3s/issues/5633.
-          #
+          name: Setup k3s
           command: >-
             curl -sfL https://get.k3s.io |
-            INSTALL_K3S_CHANNEL=v1.23 sh -s -
+            INSTALL_K3S_CHANNEL=latest sh -s -
             --disable metrics-server
             --disable traefik
+            --disable-network-policy
             --docker
             --egress-selector-mode=disabled
-          name: Install K3S
 
       - run:
+          name: Prepare a kubeconfig in ~/.kube/config
           command: |
             mkdir -p ~/.kube
             sudo cat /etc/rancher/k3s/k3s.yaml > "$HOME/.kube/config"
             chmod 600 "$HOME/.kube/config"
-          name: Prepare a kubeconfig in ~/.kube/config
 
       - run:
+          name: Install dependencies
           command: |
             . ci/common
             setup_helm
             pip3 install --no-cache-dir -r dev-requirements.txt
-          name: Install dependencies
 
       - run:
+          name: Run chartpress
           command: |
             export DOCKER_BUILDKIT=1
             chartpress
-          name: Run chartpress
 
       - run:
+          name: Install local chart
           command: |
             export KUBECONFIG="$HOME/.kube/config"
             helm upgrade --install jupyterhub ./jupyterhub \
                 --wait \
                 --values dev-config.yaml \
                 --values dev-config-arm.yaml \
                 --values dev-config-local-chart-extra-config.yaml
-          name: Install local chart
 
       - run:
+          name: Run tests
           command: |
             export KUBECONFIG="$HOME/.kube/config"
             export HUB_URL=http://localhost:30080
@@ -80,19 +78,30 @@ jobs:
                  kubectl describe {} && \
                  kubectl logs --all-containers {} && \
                  echo --------------------------------"
-          name: Run tests
 
       - run:
-          name: k8s namespace report
+          name: k3s.service status
           when: on_fail
           command: |
-            export KUBECONFIG="$HOME/.kube/config"
-            wget https://raw.githubusercontent.com/jupyterhub/action-k8s-namespace-report/v1.1.0/k8s-namespace-report
-            bash k8s-namespace-report
+            systemctl status --no-pager --full k3s.service || true
+
+      - run:
+          name: k3s.service logs
+          when: on_fail
+          command: |
+            journalctl --no-pager -xu k3s.service
+
+      - run:
+          name: k8s namespace report
+          when: on_fail
           environment:
             NAMESPACE: ""
             POD_SELECTOR: ""
             IMPORTANT_WORKLOADS: ""
+          command: |
+            export KUBECONFIG="$HOME/.kube/config"
+            wget https://raw.githubusercontent.com/jupyterhub/action-k8s-namespace-report/v1.1.0/k8s-namespace-report
+            bash k8s-namespace-report
 
 workflows:
   main:

.github/dependabot.yaml

@@ -15,3 +15,15 @@ updates:
       interval: monthly
       time: "05:00"
       timezone: Etc/UTC
+  - package-ecosystem: pip
+    directory: /images/hub/unfrozen
+    labels: [breaking]
+    groups:
+      major-versions:
+        update-types: [major]
+        exclude-patterns:
+          - jupyterhub # bumped by other automation
+    schedule:
+      interval: daily
+      time: "05:00"
+      timezone: Etc/UTC

.github/workflows/publish.yml

@@ -42,7 +42,7 @@ jobs:
           # correctly
           fetch-depth: 0
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
@@ -144,7 +144,7 @@ jobs:
         run: helm package jupyterhub
 
       # ref: https://github.com/actions/upload-artifact
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: steps.publishing.outputs.publishing == ''
         with:
           name: jupyterhub-${{ github.sha }}

.github/workflows/release-tag.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       # https://github.com/actions/github-script
       # https://octokit.github.io/rest.js/v18#repos-create-release
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v7
         with:
           script: |
             if (!context.ref.startsWith('refs/tags/')) {

.github/workflows/support-bot.yml

@@ -12,7 +12,7 @@ jobs:
   action:
     runs-on: ubuntu-22.04
     steps:
-      - uses: dessant/support-requests@v3
+      - uses: dessant/support-requests@v4
         with:
           github-token: ${{ github.token }}
           support-label: "support"

.github/workflows/test-chart.yaml

@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
@@ -78,7 +78,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
@@ -129,21 +129,22 @@ jobs:
         # k3s-channel: https://update.k3s.io/v1-release/channels
         #
         include:
-          - k3s-channel: v1.29.0+k3s1
+          - k3s-channel: latest
             test: install
           - k3s-channel: stable # also test hub-slim, and prePuller.hook
             test: install
             local-chart-extra-args: >-
               --set hub.image.name=gcr.io/nii-ap-ops/k8s-hub
               --set prePuller.hook.enabled=true
               --set prePuller.hook.pullOnlyOnChanges=true
-          - k3s-channel: v1.26 # also test hub.existingSecret
+          - k3s-channel: v1.31 # also test hub.existingSecret and subdomain_host
             test: install
             local-chart-extra-args: >-
               --set hub.existingSecret=test-hub-existing-secret
               --set proxy.secretToken=aaaa1111
               --set hub.cookieSecret=bbbb2222
               --set hub.config.CryptKeeper.keys[0]=cccc3333
+              --set hub.config.JupyterHub.subdomain_host=jupyterhub.example.org
             create-k8s-test-resources: true
           # We run three upgrade tests where we first install an already released
           # Helm chart version and then upgrade to the version we are now
@@ -159,7 +160,7 @@ jobs:
           # information from
           # https://hub.jupyter.org/helm-chart/info.json
           #
-          - k3s-channel: v1.25
+          - k3s-channel: v1.30
             test: upgrade
             upgrade-from: stable
             upgrade-from-extra-args: >-
@@ -172,46 +173,44 @@ jobs:
               --set hub.db.type=sqlite-pvc
               --set singleuser.storage.type=dynamic
             create-k8s-test-resources: true
-          # v1.24はEOLとなっており、利用想定がないのでテストを除外する
-          # - k3s-channel: v1.24
-          #   test: upgrade
-          #   upgrade-from: dev
-          #   upgrade-from-extra-args: >-
-          #     --set proxy.secretToken=aaaa1111
-          #     --set hub.db.type=sqlite-pvc
-          #     --set singleuser.storage.type=dynamic
-          #   local-chart-extra-args: >-
-          #     --set hub.db.type=sqlite-pvc
-          #     --set singleuser.storage.type=dynamic
-          # RCOSのリポジトリにjupyterhub chart version 2.0.0がないため、テストを除外する
-          # - k3s-channel: v1.23
-          #   test: upgrade
-          #   # We're testing hub.db.upgrade with PostgreSQL so this version must be old
-          #   # enough to require a DB upgrade
-          #   upgrade-from: 2.0.0
-          #   upgrade-from-extra-args: >-
-          #     --set proxy.secretToken=aaaa1111
-          #     --set hub.cookieSecret=bbbb2222
-          #     --set hub.config.CryptKeeper.keys[0]=cccc3333
-          #     --set hub.db.type=postgres
-          #     --set hub.db.url=postgresql+psycopg2://postgres:postgres@postgresql:5432/jupyterhub
-          #     --set singleuser.storage.type=dynamic
-          #   local-chart-extra-args: >-
-          #     --set hub.db.type=postgres
-          #     --set hub.db.url=postgresql+psycopg2://postgres:postgres@postgresql:5432/jupyterhub
-          #     --set singleuser.storage.type=dynamic
-          #     --set hub.db.upgrade=true
-          #   create-k8s-test-resources: true
-          #   # https://artifacthub.io/packages/helm/bitnami/postgresql
-          #   setup-postgresql-args: >-
-          #     --version=11.6.13
-          #     --set auth.enablePostgresUser=true
-          #     --set auth.postgresPassword=postgres
-          #     --set auth.database=jupyterhub
-          #     --set audit.logHostname=true
-          #     --set audit.logConnections=true
-          #     --set audit.logDisconnections=true
-          #     --set audit.clientMinMessages=debug
+          - k3s-channel: v1.29
+            test: upgrade
+            upgrade-from: dev
+            upgrade-from-extra-args: >-
+              --set proxy.secretToken=aaaa1111
+              --set hub.db.type=sqlite-pvc
+              --set singleuser.storage.type=dynamic
+            local-chart-extra-args: >-
+              --set hub.db.type=sqlite-pvc
+              --set singleuser.storage.type=dynamic
+          - k3s-channel: v1.28
+            test: upgrade
+            # We're testing hub.db.upgrade with PostgreSQL so this version must be old
+            # enough to require a DB upgrade
+            upgrade-from: 3.2.1-20240523
+            upgrade-from-extra-args: >-
+              --set proxy.secretToken=aaaa1111
+              --set hub.cookieSecret=bbbb2222
+              --set hub.config.CryptKeeper.keys[0]=cccc3333
+              --set hub.db.type=postgres
+              --set hub.db.url=postgresql+psycopg2://postgres:postgres@postgresql:5432/jupyterhub
+              --set singleuser.storage.type=dynamic
+            local-chart-extra-args: >-
+              --set hub.db.type=postgres
+              --set hub.db.url=postgresql+psycopg2://postgres:postgres@postgresql:5432/jupyterhub
+              --set singleuser.storage.type=dynamic
+              --set hub.db.upgrade=true
+            create-k8s-test-resources: true
+            # https://artifacthub.io/packages/helm/bitnami/postgresql
+            setup-postgresql-args: >-
+              --version=16.0.5
+              --set auth.enablePostgresUser=true
+              --set auth.postgresPassword=postgres
+              --set auth.database=jupyterhub
+              --set audit.logHostname=true
+              --set audit.logConnections=true
+              --set audit.logDisconnections=true
+              --set audit.clientMinMessages=debug
 
     steps:
       - uses: actions/checkout@v4
@@ -224,14 +223,14 @@ jobs:
       # kubectl and helm
       #
       # ref: https://github.com/jupyterhub/action-k3s-helm/
-      - uses: jupyterhub/action-k3s-helm@v3
+      - uses: jupyterhub/action-k3s-helm@v4
         with:
           k3s-channel: ${{ matrix.k3s-channel }}
           metrics-enabled: false
           traefik-enabled: false
           docker-enabled: true
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
@@ -270,7 +269,7 @@ jobs:
       # jupyterhub and the autohttps pod is about to start, so for CI
       # performance we delayed this until now and did other things in between.
       - name: Await local ACME server
-        uses: jupyterhub/action-k8s-await-workloads@v2
+        uses: jupyterhub/action-k8s-await-workloads@v3
         with:
           timeout: 150
           max-restarts: 1
@@ -336,7 +335,7 @@ jobs:
 
       - name: "(Upgrade) Await ${{ matrix.upgrade-from }} chart"
         if: matrix.test == 'upgrade'
-        uses: jupyterhub/action-k8s-await-workloads@v2
+        uses: jupyterhub/action-k8s-await-workloads@v3
         with:
           timeout: 150
           max-restarts: 1
@@ -361,7 +360,7 @@ jobs:
               ${{ matrix.local-chart-extra-args }}
 
       - name: "Await local chart"
-        uses: jupyterhub/action-k8s-await-workloads@v2
+        uses: jupyterhub/action-k8s-await-workloads@v3
         with:
           timeout: 150
           max-restarts: 1
@@ -379,6 +378,9 @@ jobs:
         continue-on-error: ${{ matrix.accept-failure == true }}
         run: |
           . ./ci/common
+          if [ "${{ contains(matrix.local-chart-extra-args, 'subdomain_host') }}" = "true" ]; then
+            export CI_SUBDOMAIN_HOST=jupyterhub.example.org
+          fi
           # If you have problems with the tests add '--capture=no' to show stdout
           pytest --verbose --maxfail=2 --color=yes --capture=no ./tests
 

.github/workflows/test-docker-build.yaml

@@ -37,7 +37,7 @@ jobs:
           # correctly
           fetch-depth: 0
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 

.github/workflows/test-docs.yaml

@@ -32,7 +32,7 @@ jobs:
           # chartpress, used by docs/conf.py, requires git history to set
           # chart version and image tags correctly
           fetch-depth: 0
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.11"