zyratlo commented on code in PR #8073:
URL: https://github.com/apache/texera/pull/8073#discussion_r3938226159
##########
bin/k8s/values.yaml:
##########
@@ -195,6 +195,61 @@ webserver:
type: ClusterIP
port: 8080
+notebookMigrationService:
+ # Turns the whole notebook migration tool on or off: the service, its route,
the per-user
+ # JupyterLab pool, and the button in the workspace.
+ enabled: false
+ name: notebook-migration-service
+ numOfPods: 1
+ serviceAccountName: notebook-migration-service-service-account
+ imageName: texera-notebook-migration-service
+ service:
+ type: ClusterIP
+ port: 9098
+ # Origin the browser reaches Texera on, used for the JupyterLab iframe URL
and for the
+ # CSP that lets Texera embed it. Required wherever there is no DNS name,
such as a
+ # port-forward or a NodePort. Falls back to the gateway hostname when left
empty.
+ publicOrigin: ""
+ # HMAC key each user's JupyterLab token is derived from. Nothing is stored,
so this must
+ # stay stable across restarts or previously issued tokens stop matching.
+ # Development-only default. Production environments MUST override this with
a different,
+ # securely generated secret.
+ jupyterTokenSecret:
"c4e1f7a9b2d5c8e0f3a6b9d2e5f8a1c4b7d0e3f6a9c2b5d8e1f4a7c0b3d6e9f2"
Review Comment:
Fixed in 524ccb9f3, and you are right that a published default is exactly as
public as an empty one while sailing past #8032's guard. The chart default is
now empty and the Secret template wraps it in `required`, so enabling the tool
without a secret fails at install with a message naming the key;
values-development.yaml carries an explicitly dev-scoped value so the Minikube
flow still works. Verified on a cluster: the served token now matches HMAC(dev
secret, uid) and no longer matches the old published key.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
