feat: admin-provisioned nebi OCI registries for user pods - #202
Open
tylerpotts wants to merge 7 commits into
Open
feat: admin-provisioned nebi OCI registries for user pods#202tylerpotts wants to merge 7 commits into
tylerpotts wants to merge 7 commits into
Conversation
6 tasks
nebi local mode rejects non-loopback Origin headers, which browsers send on the SPA's crossorigin asset requests, blanking the Nebi tile (nebari-dev/nebi#489). Inject NEBI_SERVER_ALLOWED_ORIGINS with the hub's public origin; requires a nebi build with server.allowed_origins (nebari-dev/nebi#490), older builds ignore the variable.
Contributor
Author
|
Added spawner wiring for nebari-dev/nebi#489: user pods now get NEBI_SERVER_ALLOWED_ORIGINS=https:// so nebi netguard accepts the browser's CORS-mode asset requests. Companion nebi change: nebari-dev/nebi#490. Without the pair, any nebi image newer than sha-cad5783 renders a blank Nebi tile. |
7 tasks
…gMap Requirements changed: admin-provisioned nebi OCI registries support public registries only, so entries no longer carry username/password/ api_token. With no credentials in the rendered config.yaml there is no reason for a Secret; render a ConfigMap instead and mount that.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chart-side wiring for nebari-dev/nebi#475 (companion to nebari-dev/nebi#477).
Summary
nebi.registries(list of admin-provisioned public OCI registries, passed through verbatim in nebi's ownregistries.entriesschema:name,url,namespace,default) andnebi.seedDefaultRegistry(set false to remove the built-in quay.io/nebari_environments registry from every user's nebi instance).config.yamlinto a ConfigMap and the spawner mounts it at/etc/nebi/config.yamlin every singleuser pod, a path nebi searches at boot. A single helper (nebi-config) is the source of truth for both the ConfigMap rendering and the spawner substitution, so they cannot diverge.Test plan
helm lintclean;helm templateverified for all three cases (defaults -> no ConfigMap, registries set -> ConfigMap + mount, seedDefaultRegistry=false alone -> ConfigMap with seed_default: false)tyler-hetzner-dev, ArgoCD-deployed from this branch with nebisha-a511a19): user pod gets/etc/nebi/config.yamlfrom the ConfigMap, nebi reportsv0.13-53-ga511a19,/api/v1/registriesreturns only the config-managed entry (config_managed: true,is_default: true, no credentials) with the default seed suppressed, and update/delete on it return 409