One year anniversary update.
Thanks for all the replies, and sorry for my lack of engagement. I have revisited the issue, and after some hacking around I finally managed to get it to work.
In the following I will outline how to set up authentication (AAD in this case) in a VCS-friendly way (using existingSecret). This has also been updated to the new version of Z2JH (using helm chart version 1.1.0 at the time of writing).
Restating the problem
When setting up authentication we need to specify the following in the values.yaml-file:
# in values.yaml
hub:
config:
AzureAdOAuthenticator:
client_id: <my secret client_id>
client_secret: <my secret client secret>
tenant_id: <my tenant id>
oauth_callback_url: <callback url>
JupyterHub:
authenticator_class: azuread
Some of these values are things you do not want to commit to VCS’ like GitHub.
The Solution
To solve this problem, we can use the existingSecret keyword in values.yaml and let Jupyter Hub pull configuration settings from an already existing K8s secret. To me the documentation is still lacking in providing a clear example on how to do this, especially on how exactly the secret should be set up.
After some trial and error, I realised that the existing secret has to mirror exactly the values.yaml-syntax. And that the config residing in the secret, and the config residing in the original values.yaml-file will be merged.
Thus, for me, the solution was to create a my_secret_aad_config.yaml containing the authentication settings from above:
# in my_secret_aad_config.yaml
hub:
config:
AzureAdOAuthenticator:
client_id: <my secret client_id>
client_secret: <my secret client secret>
tenant_id: <my tenant id>
oauth_callback_url: <callback url>
JupyterHub:
authenticator_class: azuread
Then creating a kubernetes secret from this file:
kubectl create secret generic secret-aad-config --from-file=values.yaml=my_secret_aad_config.yaml -n <namespace jupyterhub deployed to>
(I then delete the file my_secret_aad_config.yaml as this is no longer needed).
Then, in values.yaml (which is the config commited to GitHub), we remove the auth-config, and reference the existing secret as such:
# in values.yaml
hub:
existingSecret: secret-aad-config # name of the k8s secret
# Removed the config set in the secret
Verify the solution
I was struggling to figure out how to verify that the hub properly picks up on the existing secret. However, when the hub-pod is being deployed, the first few lines of logs are:
Loading /usr/local/etc/jupyterhub/secret/values.yaml
Loading /usr/local/etc/jupyterhub/existing-secret/values.yaml
Documentation
I had to spend a fair bit of time figuring this out, and I think that the documentation could greatly benefit from a walk-through example of how to use this feature.
