Support different container registry to push and pull #1904
Conversation
rgaiacs
changed the title
|
When I run locally and request a launch for https://github.com/binder-examples/requirements, the output was There are a minor error related with The launch attempt fail because I was not running Jupyter Hub locally. |
There was a problem hiding this comment.
My initial thoughts are that most BinderHubs will use the same prefix for push and pull, so how about just have image_prefix as the default property as at present, and maybe add just one new property, image_prefix_pull?
I think it's fine to keep using the *_push and *_pull variables in builder.py if you want though, for clarity.
binderhub/app.py
Outdated
| @@ -443,6 +443,42 @@ def _pod_quota_deprecated(self, change): | |||
| config=True, | |||
| ) | |||
|
|
|||
| image_prefix_push = Unicode( | |||
| help=""" | |||
| Prefix for built docker images push to container registry. | |||
There was a problem hiding this comment.
| Prefix for built docker images push to container registry. | |
| Prefix for built docker images being pushed to the container registry. |
binderhub/app.py
Outdated
|
|
||
| image_prefix_pull = Unicode( | ||
| help=""" | ||
| Prefix for built docker images pull from container registry. |
There was a problem hiding this comment.
| Prefix for built docker images pull from container registry. | |
| Prefix for built docker images being pulled from container registry. |
You are absolutely right. I think that 99% of BinderHubs will use a single registry. But there will be the 1% like GESIS that want to push to Docker Hub or GitHub Packages Registry and pull from a local Harbor that operates as proxy cache.
|
|
I forgot that the credentials to the registries might be different and must also be provided. @manics @minrk @yuvipanda can I get a bit of help on how the registry credentials are handle? Thanks! |
for image_prefix_push and image_prefix_pull.
- image_prefix_pull - image_prefix_push
for more information, see https://pre-commit.ci
as suggested by @manics.
rgaiacs
force-pushed
the
1903-container-registry-push-pull
branch
from
c322eab to
8cd2bcb
Compare
|
I tested this PR. 2025-01-28.10-07-48.mp4The launch log shows The container image was pushed to harbor.notebooks-test.gesis.org and pulled from nexus.notebooks-test.gesis.org. nexus.notebooks-test.gesis.org is configured to operate as a cache proxy to harbor.notebooks-test.gesis.org. The Helm deployment was configured with the following values config:
BinderHub:
use_registry: true
image_prefix_push: harbor.notebooks-test.gesis.org/gesiscss/binder-
image_prefix_pull: nexus.notebooks-test.gesis.org/gesiscss/binder-
hub_url: http://jupyterhub.binbderhub.10.6.46.141.nip.io
service:
type: ClusterIP
ingress:
enabled: true
annotations:
# use the shared ingress-nginx
kubernetes.io/ingress.class: "nginx"
https:
# This is unsafe! Only se for local development
enabled: false
hosts:
- binderhub.10.6.46.141.nip.io
jupyterhub:
proxy:
service:
type: ClusterIP
ingress:
enabled: true
annotations:
# use the shared ingress-nginx
kubernetes.io/ingress.class: "nginx"
hosts:
- jupyterhub.binbderhub.10.6.46.141.nip.ioThe secrets were # https://binderhub.readthedocs.io/en/latest/zero-to-binderhub/setup-binderhub.html#if-you-are-using-azure-container-registry
registry:
url: https://harbor.notebooks-test.gesis.org
username: methodshub
password: REDACTED
# https://z2jh.jupyter.org/en/stable/resources/reference.html#imagepullsecrets
jupyterhub:
imagePullSecrets:
# Created using
#
# kubectl \
# create \
# secret \
# docker-registry \
# nexus.notebooks-test.gesis.org \
# --docker-server=<your-registry-server> \
# --docker-username=<your-name> \
# --docker-password=<your-pword> \
# --docker-email=<your-email> \
# --namespace='binderhub-test'
#
# Source: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line
- "nexus.notebooks-test.gesis.org"On a second launch, BinderHub is not checking if the container image exists in the registry but starts a new build. I will try to fix this. If you can share the location in the code where BinderHub decides to do a build, I will appreciate. |
|
@manics @minrk @yuvipanda my understanding is that in binderhub/binderhub/builder.py Lines 408 to 421 in 2ac9124 binderhub/binderhub/registry.py Lines 139 to 146 in 2ac9124 binderhub/binderhub/registry.py Lines 164 to 171 in 2ac9124 For this PR to move forward, the user will need to pass two credentials. One for the registry to push and another for the registry to pull. For this, backward compatibility will be broken. Can you advise me what is your preferable way to move this forward? Duplicate the credentials as done for the image name? Or use another format? Thanks! |
|
09051c4 has a backward compatibility change in the Helm chart. |
|
BinderHub is missing the existing image in the container registry because the binderhub/binderhub/registry.py Line 42 in 2ac9124 .docker/config.json in 09051c4 does not preserve the order from the Helm value.
|
This covers #1903.