Hi all,
I am following the instructions for setting https for JupyterHub. I already bought the domain, created a CNAME zone (the instructions mentioned A Zone, but based on this issue looks like CNAME can be used in AWS), and made it point to my external-ip. After that, I can connect to my JupyterHub using the domain but still under http.
I then changed the proxy configuration in the helm chart to this:
proxy:
https:
enabled: true
hosts:
- <my-domain>
letsencrypt:
contactEmail: <myemail>
It created a new autohttps pod that gets stuck at Init:0/1
I read in other topics that the solution could be delaying the starting of Traefik, but that still doesn’t work. In the same thread I read that deleting the pod helped, but in my case it doesn’t
When I run kubectl describe, this is the output:
Name: autohttps-764f9d5b44-cvvf7
Namespace: default
Priority: 0
Service Account: autohttps
Node: i-0005b46cc367a9f22/172.20.58.123
Start Time: Wed, 12 Jun 2024 01:15:55 +0000
Labels: app=jupyterhub
component=autohttps
hub.jupyter.org/network-access-proxy-http=true
pod-template-hash=764f9d5b44
release=jupyterhub
Annotations: checksum/static-config: eaf9940443dcbb831724385f5c6f760fb89aecc6b26dc4ce9adda17e0c8f2049
kubernetes.io/limit-ranger:
LimitRanger plugin set: cpu request for container traefik; cpu request for container secret-sync; cpu request for init container load-acme
Status: Pending
IP: 100.96.2.1
IPs:
IP: 100.96.2.1
Controlled By: ReplicaSet/autohttps-764f9d5b44
Init Containers:
load-acme:
Container ID: containerd://471d16cef822452af81bf667baab71998f01efb2f1e84df72996f14e0bfaaf9a
Image: quay.io/jupyterhub/k8s-secret-sync:3.3.7
Image ID: quay.io/jupyterhub/k8s-secret-sync@sha256:cd53bef49a271d88628211e463c345250d6dc81da018e6c3d359b8176b7eebd0
Port: <none>
Host Port: <none>
Args:
load
proxy-public-tls-acme
acme.json
/etc/acme/acme.json
State: Running
Started: Wed, 12 Jun 2024 01:53:23 +0000
Last State: Terminated
Reason: Error
Exit Code: 1
Started: Wed, 12 Jun 2024 01:43:40 +0000
Finished: Wed, 12 Jun 2024 01:52:40 +0000
Ready: False
Restart Count: 4
Requests:
cpu: 100m
Environment:
PYTHONUNBUFFERED: True
Mounts:
/etc/acme from certificates (rw)
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-mbdzs (ro)
Containers:
traefik:
Container ID:
Image: traefik:v2.11.0
Image ID:
Ports: 8080/TCP, 8443/TCP
Host Ports: 0/TCP, 0/TCP
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Requests:
cpu: 100m
Environment: <none>
Mounts:
/etc/acme from certificates (rw)
/etc/traefik from traefik-config (rw)
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-mbdzs (ro)
secret-sync:
Container ID:
Image: quay.io/jupyterhub/k8s-secret-sync:3.3.7
Image ID:
Port: <none>
Host Port: <none>
Args:
watch-save
--label=app=jupyterhub
--label=release=jupyterhub
--label=chart=jupyterhub-3.3.7
--label=heritage=secret-sync
proxy-public-tls-acme
acme.json
/etc/acme/acme.json
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Requests:
cpu: 100m
Environment:
PYTHONUNBUFFERED: True
Mounts:
/etc/acme from certificates (rw)
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-mbdzs (ro)
Conditions:
Type Status
PodReadyToStartContainers True
Initialized False
Ready False
ContainersReady False
PodScheduled True
Volumes:
certificates:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit: <unset>
traefik-config:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: autohttps
Optional: false
kube-api-access-mbdzs:
Type: Projected (a volume that contains injected data from multiple sources)
TokenExpirationSeconds: 3607
ConfigMapName: kube-root-ca.crt
ConfigMapOptional: <nil>
DownwardAPI: true
QoS Class: Burstable
Node-Selectors: <none>
Tolerations: hub.jupyter.org/dedicated=core:NoSchedule
hub.jupyter.org_dedicated=core:NoSchedule
node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 46m default-scheduler Successfully assigned default/autohttps-764f9d5b44-cvvf7 to i-0005b46cc367a9f22
Normal Pulling 46m kubelet Pulling image "quay.io/jupyterhub/k8s-secret-sync:3.3.7"
Normal Pulled 45m kubelet Successfully pulled image "quay.io/jupyterhub/k8s-secret-sync:3.3.7" in 4.128s (4.128s including waiting)
Warning BackOff 8m51s (x6 over 27m) kubelet Back-off restarting failed container load-acme in pod autohttps-764f9d5b44-cvvf7_default(ac7791ac-0ee7-484b-803a-4738c97f10be)
Normal Created 8m36s (x5 over 45m) kubelet Created container load-acme
Normal Started 8m36s (x5 over 45m) kubelet Started container load-acme
Normal Pulled 8m36s (x4 over 36m) kubelet Container image "quay.io/jupyterhub/k8s-secret-sync:3.3.7" already present on machine
Any idea what I am doing wrong?
Thanks in advance!
