You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/tutorials/pages/jupyterhub.adoc
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ Keycloak is installed using a https://github.com/stackabletech/demos/blob/main/s
16
16
In the demo, the Keycloak and JupyterHub service (`proxy-public`) ports are fixed e.g.
17
17
18
18
[source,yaml]
19
-
---
19
+
----
20
20
apiVersion: v1
21
21
kind: Service
22
22
metadata:
@@ -185,7 +185,7 @@ We create a keystore with a self-generated and self-signed certificate and mount
185
185
<2> Mount this volume for Keycloak to use
186
186
<3> Pass the keystore file as an argument on start-up
187
187
188
-
For the self-signed certificate to be accepted during the handshake between JupyterHub and Keycloak it is important to create the JupyterHub-side certificate using the same secret class, although the format can be a different one:
188
+
For the self-signed certificate to be accepted during the handshake between JupyterHub and Keycloak it is important to create the JupyterHub-side certificate using the same SecretClass, although the format can be a different one:
189
189
190
190
[source,yaml]
191
191
----
@@ -272,8 +272,8 @@ To authenticate against a Keycloak instance it is necessary to provide the follo
272
272
273
273
* configuration for GenericOAuthenticator
274
274
* certificates that can be used between JupyterHub and Keycloak
275
-
* several URls (callback, authorize etc.) necessary for the authentication handshake
276
-
** in this tutorial these URls will be defined dynamically using start-up scripts, a ConfigMap and environment variables
275
+
* several URLs (callback, authorize etc.) necessary for the authentication handshake
276
+
** in this tutorial these URLs will be defined dynamically using start-up scripts, a ConfigMap and environment variables
277
277
278
278
=== GenericOAuthenticator
279
279
@@ -315,7 +315,7 @@ This involves:
315
315
316
316
* mounting a secret created with the same secret class as used for the self-signed certificate used by Keycloak
317
317
* make this secret available to JupyterHub
318
-
* it may also be necessary to point python at this specific certificate
318
+
* it may also be necessary to point Python at this specific certificate
319
319
320
320
This can be seen below:
321
321
@@ -431,7 +431,7 @@ This script instructs JupyterHub to use `KubeSpawner` to create a service refere
431
431
432
432
=== Profiles
433
433
434
-
The `singleuser.profileList` section of the Helm chart values allows us to define notebook profiles by setting the CPU, Memory and Image combinations that can be selected. For instance, the profiles below allows us to select 2/4/etc. CPUs, 4/8/etc. GB RAM and to choose between one of two images.
434
+
The `singleuser.profileList` section of the Helm chart values allows us to define notebook profiles by setting the CPU, memory and image combinations that can be selected. For instance, the profiles below allows us to select 2/4/etc. CPUs, 4/8/etc. GB RAM and to choose between one of two images.
435
435
436
436
[source,yaml]
437
437
----
@@ -540,7 +540,7 @@ To avoid this, care needs to be taken to use images for the notebook and the Spa
540
540
[#provisos]
541
541
=== Provisos
542
542
543
-
WARNING: When running a distributed Spark cluster from within a JupyterHub notebook, the notebook acts as the driver and requests executor Pods from k8s.
543
+
WARNING: When running a distributed Spark cluster from within a JupyterHub notebook, the notebook acts as the driver and requests executor Pods from Kubernetes.
544
544
These Pods in turn can mount *all* volumes and Secrets in that namespace.
545
545
To prevent this from breaking user isolation, it is planned to use an OPA gatekeeper to define OPA rules that restrict what the created executor Pods can mount. This is not yet implemented in the demo nor reflected in this tutorial.
0 commit comments