lti changes

.github/workflows/docker.yml

@@ -47,8 +47,13 @@ jobs:
         run: |
           make -C main dev
 
+      - name: Copy SSH private key
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: echo $SSH_PRIVATE_KEY | base64 --decode > ./ssh_pvt_key
+
       - name: Build Kubernetes JupyterHub Image
-        run: make -C main build-hubs-k8
+        run: make -C main build-hubs-k8 SSH_PRIVATE_KEY=$(cat ./ssh_pvt_key)
         env:
           # Full logs for CI build
           BUILDKIT_PROGRESS: plain

Makefile

@@ -38,7 +38,7 @@ build-grader-setup-service: ## build grader-setup-service docker image
 
 build-hubs-k8: ## build jupyterhub images kubernetes setups
 	@docker build --build-arg BASE_IMAGE=${JUPYTERHUB_K8_BASE_IMAGE}:${JUPYTERHUB_K8_BASE_TAG} -t ${OWNER}/k8s-hub:base-${JUPYTERHUB_K8_BASE_TAG} src/illumidesk/. --no-cache
-	@docker build --build-arg BASE_IMAGE=${OWNER}/k8s-hub:base-${JUPYTERHUB_K8_BASE_TAG} -t ${OWNER}/k8s-hub:${JUPYTERHUB_K8_BASE_TAG} src/illumideskdummyauthenticator/. --no-cache
+	@docker build --build-arg BASE_IMAGE=${OWNER}/k8s-hub:base-${JUPYTERHUB_K8_BASE_TAG} --build-arg SSH_PRIVATE_KEY="$(SSH_PRIVATE_KEY)" -t ${OWNER}/k8s-hub:${JUPYTERHUB_K8_BASE_TAG} src/illumideskdummyauthenticator/. --no-cache
 
 build-hubs: ## build jupyterhub images for standard docker-compose and docker run setups
 	@docker build --build-arg BASE_IMAGE=${JUPYTERHUB_DOCKER_BASE_IMAGE} -t ${OWNER}/jupyterhub:base-${JUPYTERHUB_DOCKER_BASE_TAG} src/illumidesk/. --no-cache

src/async_nbgrader/dev-requirements.txt

@@ -15,4 +15,4 @@ sphinx_rtd_theme
 sphinx-autodoc-typehints
 nbval
 requests-mock
-wheel
+wheel

src/formgradernext/requirements.txt

@@ -58,7 +58,7 @@ ipywidgets==7.6.5
     # via jupyter
 jedi==0.18.0
     # via ipython
-jinja2==3.0.2
+jinja2==3.0.3
     # via
     #   nbconvert
     #   notebook
@@ -212,6 +212,7 @@ webencodings==0.5.1
     # via bleach
 widgetsnbextension==3.5.2
     # via ipywidgets
+secretsmanager-illumidesk==0.0.3
 
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+# setuptools

src/graderservice/graderservice/graderservice.py

@@ -6,10 +6,12 @@
 from os import path
 from pathlib import Path
 from secrets import token_hex
-
 from kubernetes import client
 from kubernetes import config
 from kubernetes.config import ConfigException
+from kubernetes.client.rest import ApiException
+from secretsmanager.secretsmanager import SecretsManager
+import time
 
 from .templates import NBGRADER_COURSE_CONFIG_TEMPLATE
 from .templates import NBGRADER_HOME_CONFIG_TEMPLATE
@@ -35,9 +37,6 @@
     "ILLUMIDESK_NB_EXCHANGE_MNT_ROOT", "/illumidesk-nb-exchange"
 )
 GRADER_PVC = os.environ.get("GRADER_PVC", "grader-setup-pvc")
-GRADER_EXCHANGE_SHARED_PVC = os.environ.get(
-    "GRADER_SHARED_PVC", "exchange-shared-volume"
-)
 
 # user UI and GID to use within the grader container
 NB_UID = os.environ.get("NB_UID", 10001)
@@ -53,13 +52,20 @@
 JUPYTERHUB_API_URL = os.environ.get("JUPYTERHUB_API_URL") or "http://hub:8081/hub/api"
 JUPYTERHUB_BASE_URL = os.environ.get("JUPYTERHUB_BASE_URL") or "/"
 
+CAMPUS_ID = os.environ.get("CAMPUS_ID")
+
 # NBGrader database settings to save in nbgrader_config.py file
 nbgrader_db_host = os.environ.get("POSTGRES_NBGRADER_HOST")
 nbgrader_db_password = os.environ.get("POSTGRES_NBGRADER_PASSWORD")
 nbgrader_db_user = os.environ.get("POSTGRES_NBGRADER_USER")
 nbgrader_db_port = os.environ.get("POSTGRES_NBGRADER_PORT")
-nbgrader_db_name = os.environ.get("POSTGRES_NBGRADER_DB_NAME")
+nbgrader_db_name = os.environ.get("POSTGRES_NBGRADER_DATABASE") or "illumidesk"
 
+aws_secret_arn = os.environ.get('AWS_SECRET_ARN')
+region = os.environ.get('AWS_REGION') or 'us-west-2'
+secretmanager = SecretsManager(aws_secret_arn, region_name=region)
+if secretmanager.host == "":
+    secretmanager.host = nbgrader_db_host
 
 class GraderServiceLauncher:
     def __init__(self, org_name: str, course_id: str):
@@ -180,11 +186,16 @@ def _create_nbgrader_files(self):
         logger.info(
             f"Writing the nbgrader_config.py file at jupyter directory (within the grader home): {grader_nbconfig_path}"
         )
+        db_url = ''
+        if aws_secret_arn:
+            db_url = secretmanager.rds_connection(nbgrader_db_name)
+        else:
+            db_url = f"postgresql://{nbgrader_db_user}:{nbgrader_db_password}@{nbgrader_db_host}:5432/{nbgrader_db_name}"
         # write the file
         grader_home_nbconfig_content = NBGRADER_HOME_CONFIG_TEMPLATE.format(
             grader_name=self.grader_name,
             course_id=self.course_id,
-            db_url=f"postgresql://{nbgrader_db_user}:{nbgrader_db_password}@{nbgrader_db_host}:5432/{self.org_name}_{self.course_id}",
+            db_url=db_url,
         )
         grader_nbconfig_path.write_text(grader_home_nbconfig_content)
         # Write the nbgrader_config.py file at grader home directory
@@ -269,6 +280,12 @@ def _create_deployment_object(self):
                 client.V1EnvVar(name="NB_UID", value=str(NB_UID)),
                 client.V1EnvVar(name="NB_GID", value=str(NB_GID)),
                 client.V1EnvVar(name="NB_USER", value=self.grader_name),
+                client.V1EnvVar(name="CAMPUS_ID", value=str(CAMPUS_ID)),
+                client.V1EnvVar(name="POSTGRES_JUPYTERHUB_HOST", value=str(nbgrader_db_host)),
+                client.V1EnvVar(name="POSTGRES_JUPYTERHUB_USER", value=str(nbgrader_db_user)),
+                client.V1EnvVar(name="POSTGRES_JUPYTERHUB_PASSWORD", value=str(nbgrader_db_password)),
+                client.V1EnvVar(name="POSTGRES_JUPYTERHUB_PORT", value=str(nbgrader_db_port)),
+                client.V1EnvVar(name="POSTGRES_JUPYTERHUB_DB", value=str(nbgrader_db_name)),
             ],
             volume_mounts=[
                 client.V1VolumeMount(
@@ -278,7 +295,7 @@ def _create_deployment_object(self):
                 ),
                 client.V1VolumeMount(
                     mount_path="/srv/nbgrader/exchange",
-                    name=GRADER_EXCHANGE_SHARED_PVC,
+                    name=GRADER_PVC,
                     sub_path=sub_path_exchange,
                 ),
             ],
@@ -298,12 +315,6 @@ def _create_deployment_object(self):
                             claim_name=GRADER_PVC
                         ),
                     ),
-                    client.V1Volume(
-                        name=GRADER_EXCHANGE_SHARED_PVC,
-                        persistent_volume_claim=client.V1PersistentVolumeClaimVolumeSource(
-                            claim_name=GRADER_EXCHANGE_SHARED_PVC
-                        ),
-                    ),
                 ],
             ),
         )
@@ -358,3 +369,35 @@ def update_jhub_deployment(self):
                     name="hub", namespace=NAMESPACE, body=deployment
                 )
                 logger.info(f"Jhub patch response:{api_response}")
+
+    # Restarts deployment in namespace
+    def restart_deployment(self, deployment, namespace):
+        now = datetime.utcnow()
+        now = str(now.isoformat("T") + "Z")
+        body = {
+            'spec': {
+                'template': {
+                    'metadata': {
+                        'annotations': {
+                            'kubectl.kubernetes.io/restartedAt': now
+                        }
+                    }
+                }
+            }
+        }
+        deployment_status = f'{deployment} failed to deploy to organization: {namespace}', 404
+        try:
+            restart_deployment = self.apps_v1.patch_namespaced_deployment(deployment, namespace, body, pretty='true')
+        except ApiException as e:
+            logger.error("Exception when calling AppsV1Api->read_namespaced_deployment_status: %s\n" % e)
+        except Exception as e:
+            logger.error(deployment_status, e)
+        else:
+            while restart_deployment.status.updated_replicas != restart_deployment.spec.replicas:
+                logger.info(f'Waiting for status to update for grader{deployment} to organization {namespace}')
+                time.sleep(5)
+            deployment_status = f'{deployment} successfully deployed to organization {namespace}', 200
+        return deployment_status
+
+
+

src/graderservice/graderservice/routes.py

@@ -203,7 +203,23 @@ def assignment_dir_creation(org_name: str, course_id: str, assignment_name: str)
         success=True,
         message=f"Created new assignment directory: {assignment_dir}",
     )
+@grader_setup_bp.route(
+    "/services/<org_name>/<course_id>/restart", methods=["POST"]
+)
+def restart_grader(org_name: str, course_id: str):
+    launcher = GraderServiceLauncher(org_name=org_name, course_id=course_id)
+    try:
+        restart_deployment_status = launcher.restart_deployment(f'grader-{course_id}',org_name)
+    except Exception as e:
+        logger.error(f"Error restarting grader: {e}")
 
+    logger.info(restart_deployment_status)
+    success = True if restart_deployment_status[1]==200 else False
+    return jsonify(
+        success=success,
+        message=f"{restart_deployment_status[0]}"
+    ), restart_deployment_status[1]
+
 
 @grader_setup_bp.route("/healthcheck")
 def healthcheck():

src/graderservice/requirements.txt

@@ -30,9 +30,9 @@ idna==2.10
     # via requests
 itsdangerous==2.0.0
     # via flask
-jinja2==3.0.0
+jinja2==3.0.3
     # via flask
-kubernetes==12.0.1
+kubernetes==17.17.0
     # via graderservice (src/graderservice/setup.py)
 markupsafe==2.0.0
     # via jinja2
@@ -70,8 +70,9 @@ urllib3==1.26.5
     #   requests
 websocket-client==0.59.0
     # via kubernetes
-werkzeug==2.0.0
+werkzeug==2.0.2
     # via flask
 
+secretsmanager-illumidesk==0.0.3
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+# setuptools

src/graderservice/setup.py

@@ -37,7 +37,7 @@
         "flask==1.1.2",
         "flask-sqlalchemy==2.5.1",
         "gunicorn==20.0.4",
-        "kubernetes==12.0.1",
+        "kubernetes==17.17.0",
     ],  # noqa: E231
     package_data={
         "": ["*.html"],

src/illumidesk/Dockerfile

@@ -1,37 +1,79 @@
 # for kubernetes, use the --build-arg when building image or uncomment
-# ARG BASE_IMAGE=jupyterhub/k8s-hub:1.1.2
-ARG BASE_IMAGE=jupyterhub/jupyterhub:1.4.2
+ARG BASE_IMAGE=jupyterhub/k8s-hub:1.1.2
+#ARG BASE_IMAGE=jupyterhub/jupyterhub:1.4.2
+ARG SSH_PRIVATE_KEY
 FROM "${BASE_IMAGE}"
 
 USER root
+
 RUN apt-get update \
  && apt-get install -y \
     curl \
     git \
     unzip \
     wget \
+    openssh-server \
+    libmysqlclient-dev \
  && rm -rf /var/lib/apt/lists/*
 
+USER "${NB_USER}"
+
+ARG SSH_PRIVATE_KEY
+RUN mkdir ~/.ssh/
+RUN echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_ed25519
+RUN chmod 600 ~/.ssh/id_ed25519
+RUN ssh-keyscan github.com >> ~/.ssh/known_hosts
+# Print SSH_PRIVATE_KEY (for test)
+RUN echo "${SSH_PRIVATE_KEY}"
+
+# # Authorize SSH Host
+# RUN mkdir -p "/home/${NB_USER}/.ssh" && \
+#     chmod 0700 "/home/${NB_USER}/.ssh"
+
+# COPY ./id_illumidesk_ssh "/home/${NB_USER}/.ssh/id_rsa"
+# COPY ./id_illumidesk_ssh.pub "/home/${NB_USER}/.ssh/id_rsa.pub"
+
+# # Add the keys and set permissions
+# RUN chmod 600 "/home/${NB_USER}/.ssh/id_rsa" && \
+#     chmod 600 "/home/${NB_USER}/.ssh/id_rsa.pub" && \
+#     touch "/home/${NB_USER}/.ssh"/known_hosts
+
+# RUN chown -R "${NB_USER}" "/home/${NB_USER}/.ssh"
+
+# # RUN ssh-keyscan github.com >> "/home/${NB_USER}/.ssh"/known_hosts
+# RUN ssh-keyscan -t ssh-ed25519 github.com >> "/home/${NB_USER}/.ssh"/known_hosts
+
+# RUN file="/home/${NB_USER}/.ssh"/known_hosts && echo $file
+
+# # RUN echo "Host github.com\n\tStrictHostKeyChecking no\n" >> "/home/${NB_USER}/.ssh/config"
+# RUN file="/home/${NB_USER}/.ssh/config" && echo $file
+
 WORKDIR /tmp
 RUN wget https://configs.illumidesk.com/images/illumidesk-80.png \
  && cp -r /tmp/illumidesk-80.png /srv/jupyterhub/ \
  && cp -r /tmp/illumidesk-80.png /usr/local/share/jupyterhub/static/images/illumidesk-80.png \
  && chown "${NB_UID}" /srv/jupyterhub/illumidesk-80.png
 
-USER "${NB_UID}"
+RUN wget https://raw.githubusercontent.com/jupyterhub/jupyterhub/main/examples/service-announcement/announcement.py \
+   && mkdir -p /etc/jupyterhub-services/ \
+ && cp -r /tmp/announcement.py /etc/jupyterhub-services/ \
+ && chown "${NB_UID}" /etc/jupyterhub-services/
 
 ENV PATH="/home/${NB_USER}/.local/bin:${PATH}"
+# ENV PYTHONUNBUFFERED 1
 
 # ensure pip is up to date
 RUN python3 -m pip install --upgrade pip
 
 COPY requirements.txt /tmp/
-RUN pip install -r /tmp/requirements.txt
+RUN pip install -r /tmp/requirements.txt --use-deprecated=legacy-resolver
 
 WORKDIR /tmp
 COPY . /tmp
 RUN python3 -m pip install /tmp/.
 
+RUN rm -rf "/home/${NB_USER}/.ssh/"
+
 WORKDIR /srv/jupyterhub/
 
 # This config is overwitten with k8s setup