configurable namespaces

[minrk]

I'm looking to test out if kbatch meets my needs for launching some jobs from a JupyterHub instance, and one thing I want to do is apply resource quotas on a group basis. As I understand it, that means that I'd like to be able to route multiple users to the same namespace, and ideally not grant kbatch-proxy permission to create new namespaces. Does that make sense? I know how I'd hardcode an implementation in the proxy itself, but I'm not sure how it should look as configuration.

[TomAugspurger]

It's been a while since I looked (and FYI, I don't have a ton of time to work on k-batch these days, but maybe @yuvipanda can chime in).

As for the configuration, is your desired target namespace static, and doesn't depend on anything in the HTTP request?Maybe the kbatch-proxy deployment would get a user_namespace: <string | None> config value that would be None by default, which implies using the user's namespace. An admin could set that to a static value like jobs and it would us that if present?

[minrk]

Initially, it would be a static value because I've only got one group of users right now, but for the system I'm supporting, I think I'll eventually need at least two, and should be derived from the user.

It would be nice if I could drop-in my own function for namespace_for_username (and even nicer if it could be namespace_for_user with the whole User object returned from the auth).

Right now, there's an issue with collision possibilities in the current namespace_for_username derivation (depending on JupyterHub's source of usernames), which is another reason it would be nice to be able to override the namespace derivation.

[minrk]

I may have a bit of time to contribute to this over the next few months, if that would be helpful. I think I also need #34 (not from the user, but a constant set in the proxy). I will try to sync with @yuvipanda when he's back.

[minrk]

If a user-provided callable is not suitable for kube-proxy design goals, I think I can also make it work with dict config that is a mapping of group: namespace and/or username: namespace.

[TomAugspurger]

I’m fine either. I personally haven’t implemented anything like that before, but you and Yuvi are the experts here :)

…

On Sep 5, 2024, at 10:52 AM, Min RK ***@***.***> wrote: If a user-provided callable is not suitable for kube-proxy design goals, I think I can also make it work with dict config that is a mapping of group: namespace and/or username: namespace. — Reply to this email directly, view it on GitHub <#66 (comment)> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKAOIQYFTV33RA5SSUNV6LZVB43DBFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVE2DCNZVGU3DOMZTQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRSGUYDEMZQGEZTCNVHORZGSZ3HMVZKMY3SMVQXIZI>. You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[yuvipanda]

Excited to see @minrk make additional changes here :)

@TomAugspurger can you invite me to the PyPI project too, so I can make releases?

[TomAugspurger]

I sent you PyPI invites sent for both kbatch and batch-proxy @yuvipanda.