How to use JupyterHub user account to create remote kernel?

JupyterHub
1

I’m working with JupyterHub and Enterprise Gateway, and I’m encountering an issue where the KERNEL_USERNAME for remote kernels is always set to jovyan, regardless of the user who logs in via JupyterHub. I would like to ensure that the kernel uses the actual JupyterHub username (e.g., even), not a fixed one like jovyan.

Additionally, I aim to use the “authorized_users” field in kernel.json to control which users are authorized to use this kernel. However, no matter how I set it up, the kernel always seems to default to the jovyan user

Has anyone faced a similar issue and found a solution to dynamically assign KERNEL_USERNAME based on the JupyterHub login user, while also successfully using the authorized_users feature in kernel.json?

2

Have you tried setting the $KERNEL_USERNAME env and JUPYTER_GATEWAY_ALLOWED_ENVS=KERNEL_USERNAME?

1 Like
3

Hi, minrk!
Thanks for your help!

I tried to set this variable into JupyterHub config

singleuser:
  extraEnv:
    JUPYTER_GATEWAY_URL: "http://enterprise-gateway.jhub.svc.cluster.local:8888"
    JUPYTER_GATEWAY_REQUEST_TIMEOUT: "3600"
    JUPYTER_GATEWAY_ALLOWED_ENVS: "KERNEL_USERNAME"

and modified the kernel.json

  "env": {
    "KERNEL_USERNAME": "even"
  },

But it still not work, when I open remote kernel the pod it still use the jovyan as username
like below

apiVersion: v1
│ kind: Pod
│ metadata:
│   annotations:
│     cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
│     cni.projectcalico.org/containerID: 70778ad5c01adf3256a01e524886422e72ee20d3c31ffeec0e89b2e2a0cc7cf1
│     cni.projectcalico.org/podIP: 10.233.84.65/32
│     cni.projectcalico.org/podIPs: 10.233.84.65/32
│   creationTimestamp: "2025-03-19T09:30:06Z"
│   labels:
│     app: enterprise-gateway
│     component: kernel
│     kernel_id: 91d9c194-4ff7-4749-bc92-873561a5d1e7
│     source: kernel-pod.yaml
│   name: jovyan-91d9c194-4ff7-4749-bc92-873561a5d1e7
│   namespace: jovyan-91d9c194-4ff7-4749-bc92-873561a5d1e7
│   resourceVersion: "13264673"
│   uid: a7a45a7e-da5a-4d98-831b-43649f8f754f
│ spec:
│   containers:
│   - env:
│     - name: PATH
│       value: /opt/conda/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
│     - name: KERNEL_LAUNCH_TIMEOUT
│       value: "3598"
│     - name: KERNEL_USERNAME
│       value: jovyan
│     - name: KERNEL_GATEWAY
│       value: "1"
│     - name: KUBERNETES_SERVICE_PORT_HTTPS
│       value: "443"
│     - name: KUBERNETES_SERVICE_PORT
│       value: "443"
│     - name: KUBERNETES_SERVICE_HOST
│       value: 10.233.0.1
│     - name: KERNEL_POD_NAME
│       value: jovyan-91d9c194-4ff7-4749-bc92-873561a5d1e7
│     - name: KERNEL_SERVICE_ACCOUNT_NAME
│       value: default
│     - name: KERNEL_NAMESPACE
│       value: jovyan-91d9c194-4ff7-4749-bc92-873561a5d1e7

Do you have any ideas? Thanks!

4

I’ve resolved it!

Need to add KERNEL_USERNAME: "{username}" into singleuser field in JupyterHub configuration! This will ensure that the JupyterHub user is passed correctly to the remote kernel pods

singleuser:
  extraEnv:
    JUPYTER_GATEWAY_URL: "http://enterprise-gateway.jhub.svc.cluster.local:8888"
    JUPYTER_GATEWAY_REQUEST_TIMEOUT: "3600"
    JUPYTER_GATEWAY_ALLOWED_ENVS: "KERNEL_USERNAME"
    KERNEL_USERNAME: "{username}"
1 Like