Set up user groups based on github organization membership

.gitignore

@@ -5,3 +5,5 @@ values-customize.yaml
 cluster/load_balancer
 cluster/ebs_driver
 cluster/*.json
+
+run.env

images/groups_notebook/Dockerfile

@@ -0,0 +1,137 @@
+FROM astronomycommons/public-hub-singleuser:0.6.3
+
+USER root
+
+# Update cache
+RUN apt-get -y update \
+ && apt-get -y install apt-file \
+ && apt-file update
+
+# Install LSST dependencies https://pipelines.lsst.io/v/DM-14099/install/prereqs/debian.html
+RUN apt-get install --no-install-recommends -y \
+    bison \
+    ca-certificates \
+    cmake \
+    curl \
+    # Java 11 already installed
+    # default-jre \ 
+    flex \
+    gettext \
+    git \
+    libbz2-dev \
+    libcurl4-openssl-dev \
+    libfontconfig1 \
+    libglib2.0-dev \
+    libncurses5-dev \
+    libreadline6-dev \
+    libx11-dev \
+    libxrender1 \
+    libxt-dev \
+    m4 \
+    make \
+    perl-modules \
+    zlib1g-dev
+
+# Install extra packages
+RUN apt-get install --no-install-recommends -y \
+    joe \
+    telnet \
+    bind9utils \ 
+    traceroute \
+    vim \
+    emacs \
+    nano \
+    cron \
+    git \
+    sextractor \
+    psfex \
+    swarp \
+    scamp \
+    mariadb-client mariadb-server mycli \
+    postgresql 
+
+# Install Desktop
+RUN apt-get -y install \
+    dbus-x11 \
+    xfce4 \
+    xfce4-panel \
+    xfce4-session \
+    xfce4-settings \
+    xorg \
+    xubuntu-icon-theme \
+    firefox \
+ # Disable creation of Music, Documents, etc.. directories
+ # ref: https://unix.stackexchange.com/questions/268720/who-is-creating-documents-video-pictures-etc-in-home-directory
+ && apt-get remove -y xdg-user-dirs \
+ # Disable the Applications|Log Out menu item in XFCE
+ # ref: https://github.com/yuvipanda/jupyter-desktop-server/issues/16
+ && rm -f /usr/share/applications/xfce4-session-logout.desktop
+
+# Install ds9
+RUN cd /usr/local/bin \
+ && curl -L http://ds9.si.edu/download/ubuntu18/ds9.ubuntu18.8.4.1.tar.gz | tar xzvf -
+
+#
+# Install github API packages to system python (which will be safe to use by
+# root)
+#
+RUN apt-get -y install python3-pip
+RUN /usr/bin/pip3 install PyGithub
+
+# remove apt cache files
+RUN apt-get -y clean \
+ && rm -rf /var/lib/apt/lists/*
+
+#
+# Work to be done by 'admin' (package installs, path adjustments)
+#
+
+USER admin
+
+# Grab conda envs from the NFS server
+RUN rmdir /opt/conda/envs && \
+    ln -s /home/opt/conda/envs /opt/conda/envs
+
+# Link to the LSST stack
+RUN ln -s /home/opt/lsst /opt/lsst
+
+# Pick up the LSST environment's kernel as the default
+RUN rm -r /opt/conda/share/jupyter/kernels && \
+    ln -s /opt/conda/envs/lsst/share/jupyter/kernels /opt/conda/share/jupyter/kernels
+
+# Add nb_conda_kernels
+RUN mamba install nb_conda_kernels
+
+# Clean in-container conda install ...
+# ... and work around a conda bug when pkgs dir is empty (see
+# https://github.com/conda/conda/issues/7267#issuecomment-458661530)
+RUN conda clean --all -f -y \
+ && mkdir /opt/conda/pkgs && touch /opt/conda/pkgs/urls.txt
+
+
+#
+# More root work
+#
+
+USER root
+# Hide system kernels from nb_conda_kernels
+# Place user-defined conda environments into the user's directory
+RUN printf '\
+\n\
+c.CondaKernelSpecManager.env_filter = r"^/opt/.*$" \n\
+c.CondaKernelSpecManager.name_format = "'"{0}"' ({1})" \n'\
+>> /etc/jupyter/jupyter_notebook_config.py
+
+# Get rid of the jovyan user's (huge) home directory
+RUN rm -rf /home/jovyan
+# STEVEN add
+RUN userdel jovyan
+
+#
+# Startup scripts
+#
+COPY scripts/get-org-memberships.py /usr/local/bin/
+COPY scripts/startup.sh /usr/local/bin/
+COPY scripts/run-startup.sh /usr/local/bin/start-notebook.d/
+
+USER root

images/groups_notebook/README.md

@@ -0,0 +1,28 @@
+1. Build the image
+```
+$ docker build --platform linux/amd64 . -t astronomycommons/lincc-notebook:testing
+```
+
+2. Get a GitHub token from: https://github.com/settings/tokens
+- Click "Generate new token" --> "Generate new token (classic)"
+- Add "read:user" and "read:org" permissions
+- Click "Generate token"
+- Copy the token to "GH_TOKEN=..." in step (4)
+
+3. Create `run.env`:
+```
+$ cp run.env.template run.env
+```
+
+4. Update `run.env`
+```
+# file: run.env
+GH_TOKEN=<paste github token here>
+NB_UID=12345 # or any number 1001+
+NB_USER=stevenstetzler # or any string
+```
+
+5. Run the notebook server:
+```
+./run.sh
+```

images/groups_notebook/run.env.template

@@ -0,0 +1,17 @@
+#
+# Generate a personal access token on github
+#
+GH_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+#
+# find your user id at https://caius.github.io/github_id/
+#
+NB_UID=xxxxxx
+NB_USER=xxxxxxxx
+#
+# These usually don't have to be changed
+#
+MEM_LIMIT=7030702080
+MEM_GUARANTEE=7030702080
+CPU_LIMIT=2.0
+CPU_GUARANTEE=1.5
+CHOWN_HOME=yes

images/groups_notebook/run.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+#
+# A simple driver to test the container. You'll need to create
+# run.env by filling out the missing info in run.env.template
+#
+
+#
+# About docker volumes: https://docs.docker.com/storage/volumes/
+#
+
+# docker volume rm lincc-homes
+
+RUN_ARGS=(
+ 	-it 
+	--rm 
+	-p 8888:8888 
+	--user=root
+	--name jupyter-testuser
+	--env-file run.env
+	--mount source=lincc-homes,target=/home
+	-v $PWD/scripts/startup.sh:/usr/local/bin/startup.sh
+	-v $PWD/scripts/get-org-memberships.py:/usr/local/bin/get-org-memberships.py
+)
+IMAGE=astronomycommons/lincc-notebook:testing
+if [ $# == 0 ]; then
+	CMD_ARGS=(
+		jupyterhub-singleuser
+		--ip=0.0.0.0 
+		--port=8888 
+		--allow-root
+	)
+else
+	CMD_ARGS=("$@")
+fi
+
+docker run ${RUN_ARGS[@]} ${IMAGE} ${CMD} ${CMD_ARGS[@]}

images/groups_notebook/scripts/entrypoint.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+echo "Running command ${1}"
+
+# Check the command that is trying to be run in the container
+# and pass that command to the start-spark script in case we are
+# trying to launch a spark worker
+case "$1" in
+    # We are in spark land
+    driver | driver-py | driver-r | executor)
+      source /usr/local/bin/pre-start-source.sh
+      export CONTAINER_TYPE="spark"
+      CMD=("/usr/local/bin/start.sh"
+           "/usr/local/bin/start-spark.sh"
+           "$@"
+          )
+      ;;
+    start-ssh.sh)
+      export CONTAINER_TYPE="ssh"
+      CMD=("/usr/local/bin/start.sh"
+           "/usr/local/bin/start-ssh.sh"
+           "$@")
+      ;;
+    /bin/bash | bash | /bin/sh | sh)
+      export CONTAINER_TYPE="shell"
+      CMD=("/usr/local/bin/start.sh"
+           "$@")
+      ;;
+    # We are spawning a single user notebook session, a dask worker, or something else
+    # Just pass the command through
+    *)
+      source /usr/local/bin/pre-start-source.sh
+      export CONTAINER_TYPE="notebook"
+      CMD=("/usr/local/bin/start-notebook.sh"
+           "${@:2}")
+      ;;
+esac
+
+# Run the command
+echo "${CMD[@]}"
+exec "${CMD[@]}"

images/groups_notebook/scripts/get-org-memberships.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+#
+# Grab organization membership information from GitHub, and
+# print it out as "<org-name> <org-id>", one per line.
+#
+# Must have GitHub auth token in $GH_TOKEN envvar
+#
+
+import os, argparse
+from github import Github
+
+parser = argparse.ArgumentParser(description='Fetch organization membership info. Authentication token must be in the GH_TOKEN environmental variable.')
+parser.add_argument('what', choices=['member', 'owner'], help='which info to return')
+args = parser.parse_args()
+
+# this script expects the access token to be given in an environment variable
+token = os.environ["GH_TOKEN"]
+g = Github(token)
+
+# find our identity, and our organizations
+me = g.get_user()
+orgs = me.get_orgs()
+
+if args.what == 'member':
+	for org in orgs:
+		print(org.login, org.id)
+elif args.what == 'owner':
+	for org in orgs:
+		if any(member.login == me.login for member in org.get_members(role='admin')):
+			print(org.login, org.id)

images/groups_notebook/scripts/pre-start-source.sh

@@ -0,0 +1,4 @@
+# Automatically create JAVA_HOME
+export JAVA_HOME="$(dirname $(dirname $(readlink -f $(which java))))"
+# Add py4j libraries to pythonpath
+export PYTHONPATH=$SPARK_HOME/python:$(ls $SPARK_HOME/python/lib/py4j*.zip)

images/groups_notebook/scripts/run-startup.sh

@@ -0,0 +1,2 @@
+# this gets overridden by exactly the same script in the helm chart
+. /usr/local/bin/startup.sh