nebari-dev
diff --git a/‎.github/workflows/test.yaml‎
Lines changed: 47 additions & 44 deletions b/‎.github/workflows/test.yaml‎
Lines changed: 47 additions & 44 deletions
diff --git a/‎README.md‎
Lines changed: 20 additions & 0 deletions b/‎README.md‎
Lines changed: 20 additions & 0 deletions
diff --git a/‎config/jupyterhub/00-gateway-auth.py‎
Lines changed: 34 additions & 1 deletion b/‎config/jupyterhub/00-gateway-auth.py‎
Lines changed: 34 additions & 1 deletion
@@ -7,63 +7,66 @@ on:
     branches: [main]
 
 jobs:
-  test:
+  e2e:
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
-      - name: Install k3d
-        run: curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
-
-      - name: Create k3d cluster
-        run: k3d cluster create test --wait
-
-      - name: Install Helm
+      - name: Install kind
         run: |
-          curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+          curl -fsSLo /tmp/kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
+          sudo install -m 0755 /tmp/kind /usr/local/bin/kind
 
-      - name: Update Helm dependencies
-        run: helm dependency update
+      - name: Install Helm
+        run: curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
-      - name: Deploy chart
-        run: helm install data-science-pack . --namespace default --set nebariapp.enabled=false
+      - name: Install uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
 
-      - name: Wait for pods with progress
+      # Singleuser image is multi-GB and is the dominant cold-start cost
+      # (~73s pulled in-cluster during the first test). Cache the tar across
+      # CI runs and side-load it into kind so kubelet never goes to the
+      # registry. Cache key is the image ref so a `values.yaml` bump
+      # invalidates automatically.
+      - name: Resolve singleuser image ref
+        id: img
         run: |
-          for i in {1..60}; do
-            echo "=== Attempt $i/60 ==="
-            kubectl get pods
-            echo "--- Hub logs (last 10 lines) ---"
-            kubectl logs -l component=hub --tail=10 2>/dev/null || echo "(not ready)"
-            echo "--- Proxy logs (last 5 lines) ---"
-            kubectl logs -l component=proxy --tail=5 2>/dev/null || echo "(not ready)"
-            if kubectl wait --for=condition=ready pod -l component=hub --timeout=5s 2>/dev/null && \
-               kubectl wait --for=condition=ready pod -l component=proxy --timeout=5s 2>/dev/null; then
-              echo "All pods ready!"
-              exit 0
-            fi
-            sleep 5
-          done
-          echo "Timeout waiting for pods"
-          exit 1
+          REF=$(yq -r '.jupyterhub.singleuser.image | .name + ":" + .tag' values.yaml)
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+          echo "tar=/tmp/singleuser.tar" >> "$GITHUB_OUTPUT"
 
-      - name: Test JupyterHub endpoint
+      - name: Cache singleuser image
+        id: img-cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: ${{ steps.img.outputs.tar }}
+          key: singleuser-${{ steps.img.outputs.ref }}
+
+      - name: Pull + save singleuser image (cache miss only)
+        if: steps.img-cache.outputs.cache-hit != 'true'
         run: |
-          kubectl port-forward svc/proxy-public 8000:80 &
-          PF_PID=$!
-          sleep 5
-          echo "=== Response from /hub/login ==="
-          curl -sS http://localhost:8000/hub/login || true
-          echo ""
-          echo "=== Checking for JupyterHub ==="
-          curl -sS http://localhost:8000/hub/login | grep -q "JupyterHub"
-          RESULT=$?
-          kill $PF_PID 2>/dev/null || true
-          exit $RESULT
+          docker pull "${{ steps.img.outputs.ref }}"
+          docker save "${{ steps.img.outputs.ref }}" -o "${{ steps.img.outputs.tar }}"
+
+      # Pre-create the cluster here (instead of letting the pytest fixture
+      # do it) so we can side-load the cached image before any pod is
+      # scheduled. The fixture's ensure_cluster() reuses an existing one.
+      - name: Create kind cluster
+        run: kind create cluster --name nbtest-e2e --wait 60s
+
+      - name: Side-load singleuser image into kind node
+        run: kind load image-archive "${{ steps.img.outputs.tar }}" --name nbtest-e2e
+
+      - name: Run e2e tests
+        env:
+          KIND_CLUSTER: "nbtest-e2e"  # reuse the cluster created above
+          KIND_KEEP: "1"  # runner is ephemeral, skip teardown
+          PYTHONUNBUFFERED: "1"  # stream logs live (no block buffering on non-TTY)
+        run: uvx pytest tests/e2e -v --color=yes
 
-      - name: Check hub logs for errors
+      - name: Hub logs on failure
         if: failure()
-        run: kubectl logs -l component=hub --tail=100
+        run: kubectl logs -l component=hub --tail=200 || true
@@ -58,6 +58,26 @@ make down
 
 See `values.yaml` for all configuration options. The chart wraps the [JupyterHub Helm chart](https://z2jh.jupyter.org/) - all `jupyterhub.*` values are passed through.
 
+## Shared Storage
+
+Per-group shared directories (`/shared/<group>` in every user pod) need a
+ReadWriteMany `StorageClass` on the cluster. On NIC-managed clusters that's
+[Longhorn](https://longhorn.io/), installed by NIC's storage layer:
+
+```yaml
+sharedStorage:
+  enabled: true
+  storageClass: longhorn
+  size: 100Gi
+```
+
+For clusters where NIC has not yet wired up an RWX class (local dev, current
+GCP/Azure paths), the chart includes a transitional
+`sharedStorage.nfsServer.enabled=true` mode that runs an in-cluster NFS
+server pod. It depends on the `quay.io/nebari/volume-nfs` workaround image
+and is tracked for removal in
+[issue #29](https://github.com/nebari-dev/nebari-data-science-pack/issues/29).
+
 ## Architecture
 
 ```
 
@@ -93,17 +93,27 @@ async def authenticate(self, handler, data=None):
 
         username = claims.get("preferred_username") or claims.get("sub")
         if not username:
-            self.log.warning("No username claim in IdToken: %s", list(claims.keys()))
+            self.log.warning("authenticate: no username claim in IdToken: %s", list(claims.keys()))
             return None
 
         # Extract groups from the token (set by the "groups" scope / group mapper)
         groups = claims.get("groups", [])
+        if not groups:
+            self.log.warning(
+                "authenticate: no groups claim in IdToken for %s "
+                "(check Keycloak client scope / group mapper configuration)",
+                username,
+            )
         # Keycloak returns groups as paths (e.g. "/admin"), strip leading slash
         groups = [g.strip("/") for g in groups]
 
         # Determine admin from group membership
         admin_groups = set(get_config("custom.admin-groups", ["admin"]))
         is_admin = bool(admin_groups & set(groups))
+        self.log.info(
+            "authenticate: user=%s groups=%s is_admin=%s",
+            username, groups, is_admin,
+        )
 
         return {
             "name": username,
@@ -114,6 +124,7 @@ async def authenticate(self, handler, data=None):
                     "id_token": id_token,
                     "access_token": access_token,
                     "refresh_token": refresh_token,
+                    "groups": groups,  # stored so spawner can read at spawn time
                 }.items() if v is not None
             },
         }
@@ -130,6 +141,7 @@ async def refresh_user(self, user, handler=None):
         """
         if handler is None:
             # No request context (e.g. internal API call) — can't read cookies
+            self.log.debug("refresh_user: no handler for %s (internal call), returning True", user.name)
             return True
 
         id_token, access_token, refresh_token = self._extract_envoy_cookies(handler)
@@ -157,14 +169,35 @@ async def refresh_user(self, user, handler=None):
             )
             return True
 
+        # Re-parse groups from the refreshed IdToken so auth_state stays current
+        try:
+            payload_b64 = id_token.split(".")[1]
+            payload_b64 += "=" * (4 - len(payload_b64) % 4)
+            claims = json.loads(base64.urlsafe_b64decode(payload_b64))
+            groups = [g.strip("/") for g in claims.get("groups", [])]
+            self.log.debug("refresh_user: refreshed groups for %s: %s", user.name, groups)
+        except Exception:
+            self.log.warning(
+                "refresh_user: failed to parse groups from IdToken for %s "
+                "— auth_state will have empty groups until next full login",
+                user.name,
+                exc_info=True,
+            )
+            groups = []
+
         auth_state = {
             k: v for k, v in {
                 "id_token": id_token,
                 "access_token": access_token,
                 "refresh_token": refresh_token,
+                "groups": groups,
             }.items() if v is not None
         }
 
+        self.log.debug(
+            "refresh_user: auth_state refreshed for %s (access_token=%s, groups=%s)",
+            user.name, bool(access_token), groups,
+        )
         return {"name": user.name, "auth_state": auth_state}