DRAFT - Add explicit ability to disable external Nebi integration

[kenafoster]

Add nebi.enabled master switch to disable separate-pack integration

Adds a single nebi.enabled flag (default true, so no change to existing deployments) that cleanly disables integration with a separate nebi-pack deployment. When set to false, the nebiRemoteURL and nebiInternalURL template helpers return empty regardless of any explicit value, which switches off every downstream surface that keys off them:

• the jhub-apps environment selector (config/jupyterhub/03-nebi-envs.py)
• the remote pre-spawn auth and the "Nebi" launcher card (config/jupyterhub/01-spawner.py)
• the hub → nebi egress NetworkPolicy

The in-JupyterLab standalone Nebi binary is independent of this flag — it's driven solely by nebi.image.tag and stays fully wired when nebi.enabled: false.

Motivation

The in-JupyterLab Nebi works on its own. The local + remote dual experience introduced by the standalone Nebi pack can be more confusing than helpful for some use cases, and operators should be able to opt out of it without giving up in-lab Nebi. The local Nebi still supports connecting to OCI registries, so teams can still share "approved/curated" environments amongst themselves.

Previously there was no supported way to fully turn off the separate-pack integration from values alone: nebi-internal-url always auto-derived an in-cluster service address, so the environment selector stayed enabled and pointed at a nebi-pack that may not exist — producing failed lookups and log noise with no clean off switch. Disabling it required commenting out multiple unrelated values blocks and still left the derived internal URL active.

Reference Issues or PRs

No explicit call to do this yet, but it relates to:

#50

nebari-dev/nebi#423

What does this implement/fix?

Put a x in the boxes that apply

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features not to work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• [ X ] Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe):

Testing

• Did you test the pull request locally?
• Did you add new tests?

Rendered the chart with helm template in both states:

• nebi.enabled: true (default): nebi-remote-url and nebi-internal-url derive as before; hub → nebi NetworkPolicy renders. No change from current behavior.
• nebi.enabled: false: both URLs render empty (even with an explicit URL set), the environment selector logs "environment selector will not be enabled", and the NetworkPolicy is not rendered. nebi-image is unchanged, confirming the standalone in-lab binary is unaffected.

Documentation

TODO: if approved, docs need updating

Access-centered content checklist

Text styling

• The content is written with plain language (where relevant).
• If there are headers, they use the proper header tags (with only one level-one header: H1 or # in markdown).
• All links describe where they link to (for example, check the Nebari website).
• This content adheres to the Nebari style guides.

Non-text content

• All content is represented as text (for example, images need alt text, and videos need captions or descriptive transcripts).
• If there are emojis, there are not more than three in a row.
• Don't use flashing GIFs or videos.
• If the content were to be read as plain text, it still makes sense, and no information is missing.

Any other comments?

[Copilot]

Pull request overview

Adds a nebi.enabled master switch to cleanly disable integration with an external nebari-nebi-pack (while keeping the in-pod Nebi binary behavior driven by nebi.image.tag).

Changes:

• Introduces nebi.enabled (default true) in values.yaml and documents intended downstream effects.
• Updates Helm helper templates so nebiRemoteURL / nebiInternalURL render empty when nebi.enabled: false.
• Gates the hub→nebi NetworkPolicy on nebi.enabled (but currently still gates on the raw nebi.internalURL value rather than the derived helper output).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
values.yaml	Adds nebi.enabled and documents how it disables external nebi-pack integration surfaces.
templates/_helpers.tpl	Makes nebiRemoteURL/nebiInternalURL helpers return empty when nebi.enabled is false.
templates/hub-nebi-networkpolicy.yaml	Adds nebi.enabled to the NetworkPolicy condition (but needs adjustment to match derived internal URL behavior).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.