jupyter-health: use CHCS auth provider for staging

[minrk]

The JupyterHub CHCS client is a Public Application, meaning it has only a client id and requires PKCE, no client secret.

Not ready for prod since we only have test accounts on CHCS so far.

[github-actions]

Merging this PR will trigger the following deployment actions.

Support and Staging deployments

Cloud Provider	Cluster Name	Upgrade Support?	Reason for Support Redeploy	Upgrade Staging?	Reason for Staging Redeploy
aws	jupyter-health	No		Yes	Following helm chart values files were modified: staging.values.yaml

Production deployments

No production hub upgrades will be triggered

[consideRatio]

Manually deploying this, I see the following when pressing login:

Is there a way to provide access to 2i2c members to ensure we are able to help debug and support this - ideally by using either github / google identities? This deployment will stand out, because we otherwise have access to hubs as 2i2c employees using github / google identities.

[minrk]

Since this is an oauth provider, we would need to create accounts for you on the oauth provider. Either that, or enable both with multiauthenticator, which I'm happy to try as well. That's not in the default image either, but it is proposed. I'm happy to test it here, and potentially merge jupyterhub/zero-to-jupyterhub-k8s#3459

[consideRatio]

@minrk I've pinged a few people in 2i2c about this as I'm not confident on merging this myself since it brings in an exception to other hubs.

[minrk]

Makes sense! I'll suggest trying out multiauthenticator, which should be a generic solution for 2i2c, since you could add GitHub login for any deployment where a cluster wants to use credentials where you don't have accounts.

[consideRatio]

I want to avoid putting pressure on z2jh to include multiauthenticator right away to unblock this, so lets reduce that option to having a custom image for jupyter-health where its installed for now.

With that said, I see the following constructive short term choices remain:

1. Create users for 2i2c employees within this oauth provider
2. Create a single user for 2i2c employees to impersonate within this oauth provider
3. Use multiauthenticator with either github or google alongside the jupyter-health specific oauth provider

I've looped in @Gman0909, @aprilmj, and @yuvipanda about this for now in slack. 2i2c internal slack reference https://2i2c.slack.com/archives/C07SJJWVCAD/p1729169838322779

[github-actions]

🎉🎉🎉🎉

Monitor the deployment of the hubs here 👉 https://github.com/2i2c-org/infrastructure/actions/runs/11400373642