Config ideas for refreshing external keys in z2h environment?

Mike · November 19, 2020, 3:16pm

I have a running docker-based hub infrastructure where I’m using Authenticator.refresh_user to refresh/regenerate infrastructure API keys that are then passed (live) to the spawned jupyter instances via per-user filesystem mounts (being updated/refreshed by the hub before the keys expire for the end-user, every few hours - with the user automatically pulling in the updates via boto RefreshableCredential overrides)

I’m attempting to build up a similar key refreshing environment in kubernetes (z2h). My issue is I’m unsure how to approach getting the continously updated (hub) keys to the (running) spawned jupyter pods.

Searching through the forum, one solution that struck me was to use the spawned-instance’s Hub API key to have the instance request updated key from the hub (found from this post JupyterLab extension to get info from hub api )

Using that approach I’m wondering if I would have to extend the hub’s REST API because the updated keys are currently being stored in the auth_state database and I don’t see any REST calls for access that.

Given @minrk comments in How to refresh oauth tokens it seems like the hub may be doing this itself soon for the OAuth access tokens - so I’m planning to dig in the repo a bit looking for any leads

Has anyone else addressed having the hub send key updates out to running spawned instances or have any other ideas on how to approach this?

manics · November 19, 2020, 6:40pm

JupyterHub should allow admins to access the auth_state for a user:

github.com

jupyterhub/jupyterhub/blob/ce11959b1a94d94c4de888667c2b59c3de5ecc48/jupyterhub/apihandlers/users.py#L124-L138


class UserAPIHandler(APIHandler):
    @admin_or_self
    async def get(self, name):
        user = self.find_user(name)
        model = self.user_model(
            user, include_servers=True, include_state=self.current_user.admin
        )
        # auth state will only be shown if the requester is an admin
        # this means users can't see their own auth state unless they
        # are admins, Hub admins often are also marked as admins so they
        # will see their auth state but normal users won't
        requester = self.current_user
        if requester.admin:
            model['auth_state'] = await user.get_auth_state()
        self.write(json.dumps(model))

Mike · November 19, 2020, 7:04pm

Ah, props @manics!

Assuming the REST “pull” technique is the only solution (I have my fingers crossed that someone else might have a different approach) then that code is a great lead!

Though if I have to go down that route, I expect I’ll have to write quite a bit, given that I need a user (who typically wouldn’t be an admin) to have the ability to pull only certain elements of that structure (and only for themselves)

Thanks again for the lead!

manics · November 19, 2020, 7:52pm

It’s also worth bearing I’m mind that if you need to augment JupyterHub creating a service is an option:

Since the service can run as an admin you should be able to obtain the auth_state whilst adding whatever user restrictions you require.

Topic		Replies	Views
Accessing upstream oauth2 token from python code within singleuser notebook server discuss jupyterhub , help-wanted	5	2222	March 11, 2021
Forward authentication to other services JupyterHub help-wanted	6	675	May 10, 2022
How to refresh oauth tokens JupyterHub	4	2306	June 4, 2020
Authenticate request from hub to JupyterHub service JupyterHub	0	360	June 4, 2020
Adding authenticators, spawners or other custom pieces in the Z2JH setup Zero to JupyterHub on Kubernetes	7	1827	March 21, 2019

Config ideas for refreshing external keys in z2h environment?

Related Topics