values.yaml

etcJupyter:
  jupyter_notebook_config.json:
    NotebookApp:
      allow_origin: '*'
      tornado_settings:
        trust_xheaders: true
      # shutdown the server after no activity
      shutdown_no_activity_timeout: 600

    # if a user leaves a notebook with a running kernel,
    # the effective idle timeout will typically be CULL_TIMEOUT + CULL_KERNEL_TIMEOUT
    # as culling the kernel will register activity,
    # resetting the no_activity timer for the server as a whole
    MappingKernelManager:
      # shutdown kernels after no activity
      cull_idle_timeout: 600
      # check for idle kernels this often
      cull_interval: 60
      # a kernel with open connections but no activity still counts as idle
      # this is what allows us to shutdown servers
      # when people leave a notebook open and wander off
      cull_connected: true

binderhub:

  replicas: 2
  pdb:
    minAvailable: 1

  networkPolicy:
    enabled: true
    egress:
      tcpPorts:
        - 80 # http
        - 443 # https
        - 9418 # git
        - 873 # rsync
        - 1094 # xroot
      cidr: 0.0.0.0/0

  config:
    GitHubRepoProvider:
      # Add banned repositories to the list below
      # They should be strings that will match "^<org-name>/<repo-name>.*"
      banned_specs:
        # e.g. '^org/repo.*'
        - ^ines/spacy-binder.*
        - ^soft4voip/rak.*
        - ^RasaHQ/rasa_core.*
    BinderHub:
      use_registry: true
      build_image: jupyter/repo2docker:9bcc41af
      per_repo_quota: 100
      about_message: |
        <p>mybinder.org is public infrastructure operated by the <a href="https://jupyterhub-team-compass.readthedocs.io/en/latest/team.html#binder-team">Binder Project team</a>.<br /><br />
        The Binder Project is a member of <a href="https://jupyter.org">Project Jupyter</a>, which is a fiscally
        sponsored project of <a href="https://numfocus.org/">NumFocus</a>, a US 501c3 non-profit.<br /><br />
        For abuse please email: <a href="mailto:binder-team@googlegroups.com">binder-team@googlegroups.com</a>, to report a
        security vulnerability please see: <a href="https://mybinder.readthedocs.io/en/latest/faq.html#where-can-i-report-a-security-issue">Where can I report a security issue</a><br /><br />
        For more information about the Binder Project, see <a href="https://mybinder.readthedocs.io/en/latest/about.html">the About Binder page</a></p>

      extra_footer_scripts:
        01-matomo: |
          // Only load Matomo if DNT is not set.
          // This respects user preferences, and gives us a full score on uBlock origin
          if (navigator.doNotTrack != "1" && // Most Firefox & Chrome
            window.doNotTrack != "1" && // IE & Safari
            navigator.msDoNotTrack != "1" // Old IE
          ) {
          console.log("Loading Matomo tracking, since Do Not Track is off");
            var _paq = _paq || [];
            /* tracker methods like "setCustomDimension" should be called before "trackPageView" */
            _paq.push(['trackPageView']);
            (function() {
              var u="//" + window.location.hostname + "/matomo/";
              _paq.push(['setTrackerUrl', u+'piwik.php']);
              _paq.push(['setSiteId', '1']);
              var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
              g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'piwik.js'; s.parentNode.insertBefore(g,s);
            })();
          }

  extraConfig:
    # Send Events to StackDriver on Google Cloud
    # This doesn't need any extra permissions, since the GKE nodes have
    # permission to write to StackDriver by default. We don't block access
    # to cloud metadata in binderhub pod, so this should 'just work'.
    01-eventlog: |
      import google.cloud.logging
      import google.cloud.logging.handlers
      # importing google cloud configures a root log handler,
      # which prevents tornado's pretty-logging
      import logging
      logging.getLogger().handlers = []

      class JSONCloudLoggingHandler(google.cloud.logging.handlers.CloudLoggingHandler):
          def emit(self, record):
              record.name = None
              super().emit(record)

      def _make_eventsink_handler(el):
          client = google.cloud.logging.Client()
          # These events are not parsed as JSON in stackdriver, so give it a different name
          # for now. Should be fixed in https://github.com/googleapis/google-cloud-python/pull/6293
          return [JSONCloudLoggingHandler(client, name='binderhub-events-text')]
      c.EventLog.handlers_maker = _make_eventsink_handler

  registry:
    url: https://gcr.io

  service:
    type: ClusterIP

  cors: &cors
    allowOrigin: '*'

  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
    https:
      enabled: true
      type: kube-lego

  dind:
    enabled: true
    daemonset:
      image:
        name: docker
        tag: 18.09.2-dind

  imageCleaner:
    enabled: true
    # when 80% of inodes are used,
    # cull images until only 40% are used.
    imageGCThresholdHigh: 80
    imageGCThresholdLow: 40
    host:
      enabled: false

  jupyterhub:
    custom:
      cors: *cors
    cull:
      # cull every 11 minutes so it is out of phase
      # with the proxy check-routes interval of five minutes
      every: 660
      timeout: 600
      # maxAge is 6 hours: 6 * 3600 = 21600
      maxAge: 21600
    hub:
      networkPolicy:
        enabled: true
      pdb:
        minAvailable: 0
      extraConfig:
        neverRestart: |
          c.KubeSpawner.extra_pod_config.update({'restart_policy': 'Never'})
      service:
        annotations:
          prometheus.io/scrape: 'true'
          prometheus.io/path: '/hub/metrics'
    proxy:
      networkPolicy:
        enabled: true
      pdb:
        minAvailable: 0
      service:
        type: ClusterIP
      chp:
        cmd:
          - configurable-http-proxy
          - --ip=0.0.0.0
          - --port=8000
          - --api-ip=0.0.0.0
          - --api-port=8001
          - --default-target=http://$(HUB_SERVICE_HOST):$(HUB_SERVICE_PORT)
          - --error-target=http://$(HUB_SERVICE_HOST):$(HUB_SERVICE_PORT)/hub/error
          - --log-level=error
    ingress:
      enabled: true
      annotations:
        ingress.kubernetes.io/proxy-body-size: 64m
        kubernetes.io/ingress.class: nginx
        kubernetes.io/tls-acme: 'true'
    scheduling:
      userScheduler:
        enabled: true
        replicas: 2
      podPriority:
        enabled: true
      userPlaceholder:
        enabled: true
        # replicas set in config/<deployment>
    singleuser:
      networkPolicy:
        enabled: true
        egress: []
      storage:
        extraVolumes:
          - name: etc-jupyter
            configMap:
              name: user-etc-jupyter
          - name: etc-jupyter-templates
            configMap:
              name: user-etc-jupyter-templates
        extraVolumeMounts:
          - name: etc-jupyter
            mountPath: /etc/jupyter
          - name: etc-jupyter-templates
            mountPath: /etc/jupyter/templates

      initContainers:
        - name: tc-init
          image: minrk/tc-init:0.0.4
          env:
            - name: WHITELIST_CIDR
              value: 10.0.0.0/8
            - name: EGRESS_BANDWIDTH
              value: 1mbit
          securityContext:
          # capabilities.add seems to be disabled
          # by the `runAsUser: 1000` in the pod-level securityContext
          # unless we explicitly run as root
            runAsUser: 0
            capabilities:
              add:
                - NET_ADMIN
      schedulerStrategy: pack

playground:
  image:
    name: yuvipanda/play.nteract.io
    tag: v0.2
  replicas: 1

nginx-ingress:
  rbac:
    create: true
  defaultBackend:
    minAvailable: 0
  statsExporter:
    service:
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: '10254'
  controller:
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 100
          podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - nginx-ingress
              - key: component
                operator: In
                values:
                - controller
            topologyKey: kubernetes.io/hostname
    replicaCount: 2
    scope:
      enabled: true
    config:
      # Allow POSTs of upto 64MB, for large notebook support.
      proxy-body-size: 64m
    stats:
      enabled: true
    metrics:
      enabled: true
      service:
        annotations:
          prometheus.io/scrape: 'true'
          prometheus.io/port: '10254'
    service:
      # Preserve client IPs
      externalTrafficPolicy: Local

redirector:
  nodeSelector: {}
  redirects: []

static:
  paths:
    - /badge.svg
    - /badge_logo.svg

kube-lego:
  config:
    LEGO_EMAIL: yuvipanda@gmail.com
    LEGO_URL: https://acme-v01.api.letsencrypt.org/directory
  rbac:
    create: true
  image:
    tag: 0.1.7

grafana:
  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: 'true'
  persistence:
    enabled: true
    size: 1Gi
    accessModes:
      - ReadWriteOnce

  grafana.ini:
    auth.anonymous:
      enabled: true
      org_name: Main Org.
      org_role: Viewer
    auth.basic:
      enabled: true
    smtp:
      enabled: true

prometheus:
  nodeExporter:
    updateStrategy:
      type: RollingUpdate
  alertmanager:
    enabled: false
  pushgateway:
    enabled: false
  rbac:
    create: true
  server:
    ingress:
      enabled: true
      annotations:
        kubernetes.io/ingress.class: nginx
        kubernetes.io/tls-acme: 'true'

proxyPatches:
  nodeSelector: {}
  enabled: true
  interval: 60
  routes:
    /user: service:proxy-patches

matomo:
  enabled: true
  nodeSelector: {}
  resources: {}
  replicas: 1
  service:
    type: ClusterIP
  db:
    username: matomo
    name: matomo
    tables_prefix: matomo_

gcsProxy:
  replicas: 1
  nodeSelector: {}

analyticsPublisher:
  events:
    logName: binderhub-events-text
  image:
    name: jupyterhub/mybinder-extraevents-archiver
    tag: set-by-chartpress