### Clone and run Onyxia web app locally Source: https://docs.onyxia.sh/contributors-doc/onyxia Commands to clone the Onyxia repository, navigate to the web directory, install dependencies, and start the development server. Optionally, edit the .env.local.yaml file (created automatically on first run) to test against your own Onyxia instance. ```bash git clone https://github.com/InseeFrLab/onyxia cd onyxia/web yarn install # To start the app locally yarn dev # If you want to test against your own Onyxia instance edit the .env.local.yaml # file (created automatically the first time you run `yarn dev`) ``` -------------------------------- ### Install Onyxia with custom values and remove manual version tags Source: https://docs.onyxia.sh/release-notes/migrating-to-the-new-helm-repo Shows the new installation workflow: add the new repo, create a values file without the web and api image tags, and install the chart. The version is now managed solely by the chart version. ```bash helm repo add onyxia https://inseefrlab.github.io/onyxia DOMAIN=my-domain.net cat << EOF > ./onyxia-values.yaml # ... web: image: - tag: 2.29.4 api: image: - tag: v0.32 # ... EOF helm install onyxia onyxia/onyxia -f onyxia-values.yaml ``` -------------------------------- ### Initialize Vault in dev mode with Helm Source: https://docs.onyxia.sh/admin-doc/readme/vault Commands to add the HashiCorp Helm repo, set the domain, create a vault-values.yaml file for dev mode with ingress, and install Vault. This is for initial setup only; do not use dev mode in production. ```bash helm repo add hashicorp https://helm.releases.hashicorp.com DOMAIN=my-domain.net cat << EOF > ./vault-values.yaml server: dev: enabled: true # Set VAULT_DEV_ROOT_TOKEN_ID value devRootToken: "root" ingress: enabled: true annotations: kubernetes.io/ingress.class: nginx hosts: - host: "vault.lab.$DOMAIN" tls: - hosts: - vault.lab.$DOMAIN EOF helm install vault hashicorp/vault -f vault-values.yaml ``` -------------------------------- ### Example Markdown document for onboarding Source: https://docs.onyxia.sh/admin-doc/custom-pages Example content of onboarding_en.md, a Markdown document that can be linked from the UI. It demonstrates standard Markdown, HTML image embedding, code snippets, and links to other pages. ```markdown # This is a test document in english This could be for example a guide specific to your Onyxia instance. ## It's standard markdown You can embed images, including with HTML syntax: You can render code snippets: ```bash echo "Hello world" ``` You can also link to pages of your instance: [Catalog](/catalog). You can link to [another document](%PUBLIC_URL%/custom-resources/onboarding_sub_en.md). ``` -------------------------------- ### Install Onyxia with Helm Source: https://docs.onyxia.sh/admin-doc/readme/s3-explorer-standalone-deployment Adds the Onyxia Helm repository, updates it, and installs or upgrades the Onyxia release in the 'onyxia' namespace using the provided values file. ```bash helm repo add onyxia https://inseefrlab.github.io/onyxia helm repo update helm upgrade --install onyxia onyxia/onyxia \ --namespace onyxia \ --create-namespace \ --values onyxia-values.yaml ``` -------------------------------- ### Obtain TLS certificate with certbot Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Installs certbot and runs a manual DNS challenge to obtain a wildcard certificate for datalab.my-domain.net and *.lab.my-domain.net. Requires sudo and manual DNS TXT record setup. ```bash brew install certbot #On Mac, lookup how to install certbot for your OS #Because we need a wildcard certificate we have to complete the DNS callange. sudo certbot certonly --manual --preferred-challenges dns # When asked for the domains you wish to optains a certificate for enter: # datalab.my-domain.net *.lab.my-domain.net ``` -------------------------------- ### Update Helm repository and install command Source: https://docs.onyxia.sh/release-notes/migrating-to-the-new-helm-repo Shows the diff for switching the Helm repository from inseefrlab/helm-charts to onyxia and updating the install command to use onyxia/onyxia. ```bash -helm repo add inseefrlab https://inseefrlab.github.io/helm-charts +helm repo add onyxia https://inseefrlab.github.io/onyxia -helm install onyxia inseefrlab/helm-charts +helm install onyxia onyxia/onyxia ``` -------------------------------- ### Helm oneliner to install Onyxia with minimal configuration Source: https://docs.onyxia.sh/admin-doc Adds the Onyxia Helm repository, creates a minimal values file with an ingress host, and installs the chart. This results in a degraded mode instance lacking authentication, S3 explorer, and secret management, but still allows launching services from the catalog. ```bash helm repo add onyxia https://inseefrlab.github.io/onyxia cat << EOF > ./onyxia-values.yaml ingress: enabled: true hosts: - host: onyxia.my-domain.net EOF helm install onyxia onyxia/onyxia -f onyxia-values.yaml # Navigate to https://onyxia.my-domain.net ``` -------------------------------- ### Install ingress-nginx with custom values Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Install ingress-nginx using Helm with a custom values file that sets the default SSL certificate and watches ingress objects without a class. This enables SSL termination for both wildcard and datalab domains. ```bash cat << EOF > ./ingress-nginx-values.yaml controller: extraArgs: default-ssl-certificate: "ingress-nginx/onyxia-tls" watchIngressWithoutClass: true EOF helm install ingress-nginx ingress-nginx \ --repo https://kubernetes.github.io/ingress-nginx \ --version 4.9.1 \ --namespace ingress-nginx \ -f ./ingress-nginx-values.yaml ``` -------------------------------- ### Install ArgoCD with Helm and configure ingress Source: https://docs.onyxia.sh/admin-doc/readme/gitops Sets up ArgoCD using Helm with a custom values file that configures the ingress for argocd.lab.my-domain.net. Requires a domain and DNS pointing to the cluster. ```bash DOMAIN=my-domain.net cat << EOF > ./argocd-values.yaml server: extraArgs: - --insecure ingress: #ingressClassName: nginx enabled: true hostname: argocd.lab.$DOMAIN extraTls: - hosts: - argocd.lab.$DOMAIN EOF helm install argocd argo-cd \ --repo https://argoproj.github.io/argo-helm \ --version 6.0.9 \ -f ./argocd-values.yaml ``` -------------------------------- ### Link onyxia-ui locally in onyxia-web Source: https://docs.onyxia.sh/contributors-doc/onyxia/dependencies Steps to link onyxia-ui locally in onyxia-web. Clone onyxia, install its dependencies, then clone onyxia-ui, build it, link it with yarn link-in-web, and run TypeScript watch. After linking, start the web app to see live updates. If installing/updating dependencies, remove node_modules and link again. ```shell cd ~/github ``` ```shell git clone https//github.com/InseeFrLab/onyxia ``` ```shell cd onyxia/web yarn install ``` ```shell cd ~/github/onyxia #This is just a suggestion, clone wherever you see fit. git clone https://github.com/InseeFrLab/onyxia-ui ui cd ui yarn install yarn build yarn link-in-web npx tsc -w ``` ```shell # Open a new terminal cd ~/github/onyxia/web yarn start ``` -------------------------------- ### Install ingress-nginx on AWS Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Applies the ingress-nginx controller manifest for AWS. Use the GCP or Azure commands for those providers. ```bash kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.2.0/deploy/static/provider/aws/deploy.yaml ``` -------------------------------- ### Example user profile context values Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs/declarative-user-profile Shows the structure of xOnyxiaContext.user.profile after the user fills the form. The values are accessible programmatically and can be used in charts and deployments. ```json { "generalInfo": { "firstName": "Joseph", "lastName": "Garrone", "email": "joseph.garrone@code.gouv.fr" }, "git": { "username": "garronej", "email": "joseph.garrone.gj@gmail.com" } } ``` -------------------------------- ### overwriteDefaultWith example in values.schema.json Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs/onyxia-extension Example of using the x-onyxia overwriteDefaultWith option in a values.schema.json file. The default value is dynamically generated by concatenating project.id, k8s.randomSubdomain, and k8s.domain using the {{}} syntax. ```json "hostname": { "type": "string", "form": true, "title": "Hostname", "x-onyxia": { "overwriteDefaultWith": "{{project.id}}-{{k8s.randomSubdomain}}.{{k8s.domain}}" } } ``` -------------------------------- ### Create DNS CNAME records for Onyxia Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Alternative DNS records using CNAME for DDNS domains. Replace the example domain with your own. ```bash datalab.my-domain.net CNAME jhon-doe-home.ddns.net. *.lab.my-domain.net CNAME jhon-doe-home.ddnc.net. ``` -------------------------------- ### S3 OIDC ID token claim example Source: https://docs.onyxia.sh/admin-doc/s3-configuration Example JSON object in an S3 OIDC ID token containing the preferred_username claim value 'alice'. This claim is used by the bookmark to resolve to the bucket name. ```json { "preferred_username": "alice" } ``` -------------------------------- ### Using useThunks to get isUserLoggedIn (recommended approach) Source: https://docs.onyxia.sh/contributors-doc/onyxia/architecture Shows the recommended way to get `isUserLoggedIn` via thunks, because the value is constant from the app's perspective (login redirects and reloads the app). ```typescript const { userAuthenticationThunks } = useThunks(); const isUserLoggedIn = userAuthenticationThunks.getIsUserLoggedIn(); ``` -------------------------------- ### Obtain wildcard TLS certificate with certbot Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Install certbot and obtain a wildcard certificate for datalab.my-domain.net and *.lab.my-domain.net using DNS challenge. The certificate must be renewed every three months. ```bash brew install certbot #On Mac, lookup how to install certbot for your OS # Because we need a wildcard certificate we have to complete the DNS callange. sudo certbot certonly --manual --preferred-challenges dns # When asked for the domains you wish to optains a certificate for enter: # datalab.my-domain.net *.lab.my-domain.net ``` -------------------------------- ### Helm chart values for onyxia-web environment variables Source: https://docs.onyxia.sh/contributors-doc/onyxia/dependencies Example Helm chart configuration for the web service, showing environment variables such as MINIO_URL, VAULT_URL, OIDC_URL, OIDC_REALM, and TITLE. All accepted env vars are prefixed with REACT_APP_ and default values are defined in the .env file. ```yaml web: replicaCount: 2 env: MINIO_URL: https://minio.lab.sspcloud.fr VAULT_URL: https://vault.lab.sspcloud.fr OIDC_URL: https://auth.lab.sspcloud.fr/auth OIDC_REALM: sspcloud TITLE: SSP Cloud ``` -------------------------------- ### Get ArgoCD initial admin password Source: https://docs.onyxia.sh/admin-doc/readme/gitops Retrieves the auto-generated admin password for ArgoCD. Wait for all pods to be ready before running. ```bash kubectl get secret argocd-initial-admin-secret \ -o jsonpath="{.data.password}" | base64 -d ``` -------------------------------- ### Configure custom catalogs in values.yaml Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs Example configuration for defining a custom Helm catalog under `onyxia.api.catalogs` in `apps/onyxia/values.yaml`. It shows a catalog with id 'aerospace', a Helm repository location, localized names and descriptions, optional highlighted/excluded charts, status, TLS settings, and user restrictions based on JWT claims. ```yaml onyxia: web: # ... api: # ... catalogs: [ { type: "helm", id: "aerospace", # The url of the Helm chart repository location: "https://myorg.github.io/helm-charts-aerospace/", # Display under the search bar as selection tab: # https://github.com/InseeFrLab/onyxia/assets/6702424/a7247c7d-b0be-48db-893b-20c9352fdb94 name: { en: "Aerospace services", fr: "Services aérospatiaux" # ... other languages your instance supports }, # Optional. Defines the chart that should appear first highlightedCharts: ["jupyter-artemis", "rstudio-dragonfly"], # Optional. Defines the chart that should be excluded excludedCharts: ["a-vendor-locking-chart"], # Optional, If defined, displayed in the header of the catalog page: # https://github.com/InseeFrLab/onyxia/assets/6702424/57e32f44-b889-41b2-b0c7-727c35b07650 # Is rendered as Markdown description: { en: "A catalog of services for aerospace engineers", fr: "Un catalogue de services pour les ingénieurs aérospatiaux" # ... }, # Can be "PROD" or "TEST". If test the catalogs will be accessible if you type the url in the search bar # but you won't have a tab to select it. status: "PROD", # Optional. If true the certificate verification for `${location}/index.yaml` will be skipped. skipTlsVerify: false, # Optional. certificate authority file to use for the TLS verification caFile: "/path/to/ca.crt", # Optional: Enables you to a specific group of users. # You can match any claim in the JWT token. # If the claim's value is an array, it match if one of the value is the one you specified. # The match property can also be a regex. restrictions: [ { userAttribute: { key: "groups", matches: "nasa-engineers" } } ] }, # { ... } another catalog ] ``` -------------------------------- ### Static listEnum field in values.schema.json Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs/onyxia-extension Example of a values.schema.json field with a static listEnum for a select input. This is the base case before using overwriteListEnumWith. ```json "pullPolicy": { "type": "string", "default": "IfNotPresent", "listEnum": [ "IfNotPresent", "Always", "Never" ] } ``` -------------------------------- ### Docker Compose environment variables for Onyxia deployment Source: https://docs.onyxia.sh/contributors-doc/onyxia/architecture Example of specifying environment variables in a `web` service, including `ORG_NAME` to restrict search to a GitHub organization. If `ORG_NAME` is not provided, the app shows 999 stars for any repo. ```yaml web: env: MINIO_URL: https://minio.lab.sspcloud.fr VAULT_URL: https://vault.lab.sspcloud.fr OIDC_URL: https://auth.lab.sspcloud.fr/auth OIDC_REALM: sspcloud TITLE: SSP Cloud ORG_NAME: InseeFrLab #<========== ``` -------------------------------- ### overwriteListEnumWith example in values.schema.json Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs/onyxia-extension Example of using the x-onyxia overwriteListEnumWith option to dynamically generate the options for a select field. The default is set to the first group from the user's decoded ID token, and the list is populated from the groups array. ```json "group": { "type": "string", "default": "", "listEnum": [""], "x-onyxia": { "overwriteDefaultWith": "{{user.decodedIdToken.groups[0]}}", "overwriteListEnumWith": "{{user.decodedIdToken.groups}}" } } ``` -------------------------------- ### Add global alert banner to Onyxia values.yaml Source: https://docs.onyxia.sh/admin-doc/readme/gitops Shows a diff adding a GLOBAL_ALERT environment variable to the Onyxia web deployment to display a banner to all users. The example uses a demo domain and includes both English and French messages. ```yaml onyxia: ingress: enabled: true hosts: - host: datalab.demo-domain.ovh web: env: + GLOBAL_ALERT: | + { + severity: "success", + message: { + en: "A **big** announcement! [Check it out](https://example.com)!", + fr: "Une annonce **importante**! [Regardez](https://example.com)!" + } + } api: regions: [...] ``` -------------------------------- ### Example of x-onyxia.overwriteSchemaWith in values.schema.json Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/override-schema-for-a-specific-instance Shows how to reference a custom schema file for a field using the x-onyxia.overwriteSchemaWith property. The schema file can come from the default schemas embedded in Onyxia API or from an instance-level override. ```json { "properties": { "service": { "properties": { "image": { "properties": { "custom": { "properties": { "enabled": { "x-onyxia": { "overwriteSchemaWith": "ide/customImage.json" } } } } } } } } } } ``` -------------------------------- ### Get external IP of ingress-nginx Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Lists services in the ingress-nginx namespace to find the LoadBalancer's External IP. If it shows , wait and retry. ```bash kubectl get services -n ingress-nginx ``` -------------------------------- ### Onyxia values.yaml for Keycloak OIDC configuration Source: https://docs.onyxia.sh/admin-doc/openid-connect-configuration Example values.yaml for Onyxia when using Keycloak as the OIDC provider. It sets authentication mode to openidconnect, specifies the issuer URI, client ID, audience, and username claim. Also configures OIDC client IDs for MinIO, Vault, and Kubernetes API server. Note the warning that the client ID is for onyxia-web and that the username claim should be RFC1123 compliant. ```yaml onyxia: api: env: authentication.mode: "openidconnect" oidc.issuer-uri: "https://auth.lab.my-domain.net/auth/realms/datalab" # Warning: This is the client ID used by onyxia-web (the fronted) # Onyxia-api does not need any client, just to validate an audience. oidc.clientID: "onyxia_onyxia-api" oidc.audience: "onyxia-api" # The username should be RFC1123 complient oidc.username-claim: "preferred_username" regions: [ { data: { S3: { sts: { oidcConfiguration: { clientID: "onyxia_minio" } } } }, vault: { oidcConfiguration: { clientID: "onyxia_vault" } }, services: { k8sPublicEndpoint: { oidcConfiguration: { clientID: "onyxia_kub-api-server" } } } } ] ``` -------------------------------- ### Add sts.role to S3 configuration Source: https://docs.onyxia.sh/release-notes/v10-greater-than-v11 Shows the addition of the now-mandatory 'sts.role' block to the S3 configuration. For MinIO setups, set 'profileName' to 'default' and keep 'roleARN' and 'roleSessionName' empty. ```yaml onyxia: api: regions: [ { data: { S3: { URL: "https://minio.lab.my-domain.net", sts: { + role: { + profileName: "default", + roleARN: "", + roleSessionName: "" + } } } } } ] ``` -------------------------------- ### Get JWT auth mount accessor Source: https://docs.onyxia.sh/admin-doc/readme/vault Retrieves the mount accessor for the JWT authentication method. The output is something like 'auth_jwt_xyz', which is needed for writing policies. ```bash vault auth list -format=json | jq -r '.["jwt/"].accessor' ``` -------------------------------- ### Using useCoreState for user authentication (alternative approach) Source: https://docs.onyxia.sh/contributors-doc/onyxia/architecture Shows a more natural but discouraged way to get `isUserLoggedIn` from Redux state. The page explains that values that never change should not be stored in Redux state to avoid unnecessary re-renders. ```typescript const { isUserLoggedIn } = useCoreState(state => state.userAuthentication); ``` -------------------------------- ### Inject user profile value into Helm chart Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs/declarative-user-profile Use the x-onyxia.overwriteDefaultWith key to inject a profile value into a Helm chart field. This example auto-fills a field with the user's last name from the profile. ```json "x-onyxia": { "overwriteDefaultWith": "{{user.profile.generalInfo.lastName}}" } ``` -------------------------------- ### values.schema.json JSONSchema for overriding defaults Source: https://docs.onyxia.sh/release-notes/v8-greater-than-v9 JSONSchema example that supports the new JSONSchemas override. The overwriteDefaultWith attribute is the old method for overriding with the region's defaultConfiguration and is no longer supported in v9. The overwriteSchemaWith attribute replaces it and offers more flexibility via JSON Schemas; default schemas from Onyxia-API are used if no override is provided. ```json "nodeSelector": { "type": "object", "description": "NodeSelector", "default": {}, "x-onyxia": { "hidden": false, "overwriteDefaultWith": "region.nodeSelector", "overwriteSchemaWith": "nodeSelector.json" } } ``` -------------------------------- ### Update Onyxia configuration to enable MinIO Source: https://docs.onyxia.sh/admin-doc/readme/data-s3 Clone the onyxia-ops repository, navigate to the Onyxia app directory, and replace the configuration file with `values-minio-enabled.yaml.yaml` (or `values-s3-explorer-only.yaml` for standalone S3 Explorer mode). Commit and push to enable MinIO. ```bash git clone https://github.com//onyxia-ops cd onyxia-ops cd apps/onyxia mv values-minio-enabled.yaml.yaml values.yaml # OR: For deploying Onyxia in s3 Explorer standalone mode: # mv values-s3-explorer-only.yaml values.yaml git commit -am "Enable MinIO" git push ``` -------------------------------- ### Launch Storybook locally Source: https://docs.onyxia.sh/contributors-doc/onyxia/dependencies Launches Storybook locally to test graphical components in isolation. Run from the web directory. ```shell yarn storybook ``` -------------------------------- ### Create DNS A records for Onyxia Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Create DNS A records for the Onyxia datalab and wildcard subdomain. Replace with your internet box routable IP. ```bash datalab.my-domain.net A *.lab.my-domain.net A ``` -------------------------------- ### Onyxia Configuration for S3 Explorer (onyxia-values.yaml) Source: https://docs.onyxia.sh/admin-doc/readme/s3-explorer-standalone-deployment Helm values for Onyxia to enable the S3 Explorer with MinIO, including the web environment variables and a bookmark that uses the preferred_username claim. ```yaml ingress: enabled: true hosts: - host: onyxia.example.com web: env: HEADER_TEXT_FOCUS: "S3 Explorer" S3: | { URL: "https://minio.example.com", region: "us-east-1", pathStyleAccess: true, sts: { role: { profileName: "default", roleARN: "", roleSessionName: "" }, oidcConfiguration: { issuerURI: "https://auth.example.com/realms/my-realm", clientID: "onyxia-minio" } }, bookmarks: [ { s3Uri: "s3://user-$1/", title: { en: "Personal bucket", fr: "Bucket personnel" }, claimName: "preferred_username", forProfileName: "default" } ] } api: enabled: false ``` -------------------------------- ### Replace workingDirectory with bookmarks (bucketMode: multi) Source: https://docs.onyxia.sh/release-notes/v10-greater-than-v11 Shows the v10 to v11 migration for S3 configuration when bucketMode is 'multi'. The old workingDirectory block is replaced with a bookmarks array, each entry using s3Uri with $1 substitution for claimName values. ```yaml onyxia: api: regions: [ { "data": { "S3": { - "workingDirectory": { - "bucketMode": "multi", - "bucketNamePrefix": "", - "bucketNamePrefixGroup": "projet-" - }, + "bookmarks": [ + { + "s3Uri": "s3://$1/", + "title": "Personal", + "claimName": "preferred_username" + }, + { + "s3Uri": "s3://projet-$1/", + "title": "Group $1", + "claimName": "groups" + } + ] } } } ] ``` -------------------------------- ### Deploy MinIO: clone onyxia-ops and set OIDC client secret Source: https://docs.onyxia.sh/admin-doc/readme/data-s3 Clone the onyxia-ops repository, navigate to the MinIO app directory, and replace the `$KEYCLOAK_MINIO_CLIENT_SECRET` placeholder in values.yaml with the copied client secret. Commit and push the change to deploy MinIO. ```bash git clone https://github.com//onyxia-ops cd onyxia-ops cd apps/minio # In the values.yaml file replace `$KEYCLOAK_MINIO_CLIENT_SECRET` by the value # you have copied in the previous step. git commit -am "Set minio OIDC client secret" git push ``` -------------------------------- ### Rename bookmarkedDirectories to bookmarks Source: https://docs.onyxia.sh/release-notes/v10-greater-than-v11 Shows the migration from the old 'bookmarkedDirectories' key to the new 'bookmarks' key, and the change from 'fullPath' to 's3Uri' with the new path format. ```yaml onyxia: api: regions: [ { "data": { "S3": { - "bookmarkedDirectories": [ + "bookmarks": [ { - "fullPath": "donnees-insee/diffusion/", + "s3Uri": "s3://donnees-insee/diffusion/", "title": { "fr": "Données de diffusion", "en": "Dissemination Data" } } ] } } } ] ``` -------------------------------- ### values.schema.json sample with x-onyxia overwriteDefaultWith Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/custom-catalogs/onyxia-extension Sample of the values.schema.json for the Jupyter chart, showing the git configuration object with x-onyxia overwriteDefaultWith properties for per-user defaults. ```json "git": { "description": "Git user configuration", "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Add git config inside your environment", "default": true }, "name": { "type": "string", "description": "user name for git", "default": "", "x-onyxia": { "overwriteDefaultWith": "{{git.name}}" }, "hidden": { "value": false, "path": "git/enabled" } }, "email": { "type": "string", "description": "user email for git", "default": "", "x-onyxia": { "overwriteDefaultWith": "{{git.email}}" }, "hidden": { "value": false, "path": "git/enabled" } }, "cache": { "type": "string", "description": "duration in seconds of the credentials cache duration", "default": "", "x-onyxia": { "overwriteDefaultWith": "{{git.credentials_cache_duration}}" }, "hidden": { "value": false, "path": "git/enabled" } }, "token": { "type": "string", "description": "personal access token", "default": "", "x-onyxia": { "overwriteDefaultWith": "{{git.token}}" }, "hidden": { "value": false, "path": "git/enabled" } }, "repository": { "type": "string", "description": "Repository url", "default": "", "hidden": { "value": false, "path": "git/enabled" } }, "branch": { "type": "string", "description": "Brach automatically checkout", "default": "", "hidden": { "value": "", "path": "git/repository" } } } }, ``` -------------------------------- ### Git Commands to Enable Keycloak in Onyxia Deployment Source: https://docs.onyxia.sh/admin-doc/readme/user-authentication Clone the onyxia-ops repository, navigate to the onyxia app directory, replace the values file with the keycloak-enabled version, and commit the change to enable Keycloak authentication. ```bash git clone https://github.com//onyxia-ops cd onyxia-ops cd apps/onyxia mv values-keycloak-enabled.yaml values.yaml git commit -am "Enable keycloak" git push ``` -------------------------------- ### Replace workingDirectory with bookmarks (bucketMode: shared) Source: https://docs.onyxia.sh/release-notes/v10-greater-than-v11 Shows the v10 to v11 migration for S3 configuration when bucketMode is 'shared'. The old workingDirectory block is replaced with a bookmarks array using s3Uri with $1 substitution for claimName values. ```yaml onyxia: api: regions: [ { "data": { "S3": { - "workingDirectory": { - "bucketMode": "shared", - "bucketName": "onyxia", - "prefix": "user-", - "prefixGroup": "project-" - } + "bookmarks": [ + { + "s3Uri": "s3://onyxia/user-$1/", + "title": "Personal", + "claimName": "preferred_username" + }, + { + "s3Uri": "s3://onyxia/project-$1/", + "title": "Group $1", + "claimName": "groups" + } + ] } } } ] ``` -------------------------------- ### Run onyxia-web Docker with OIDC_URL env var Source: https://docs.onyxia.sh/contributors-doc/onyxia/dependencies Runs the onyxia-web Docker image with an environment variable, e.g., OIDC_URL. The variable can then be accessed in code as process.env["OIDC_URL"]. This works thanks to vite-envs (cra-envs) without recompiling. ```shell docker run --env OIDC_URL="https://url-of-our-keycloak.fr/auth" InseeFrLab/onyxia-web ``` -------------------------------- ### Configure Dapla Honey theme with header, palette, fonts, homepage and languages in onyxia/values.yaml Source: https://docs.onyxia.sh/admin-doc/theme Configure a complete Onyxia theme for the Dapla 'Honey' preview: logo, header links, a palette with focus and custom colors, Geist font weights, homepage assets, background images, hero texts, terms of service links, and an extra HTML head. Uses environment variables in onyxia/values.yaml. ```yaml onyxia: web: env: #ONYXIA_API_URL: https://datalab.sspcloud.fr/api CUSTOM_RESOURCES: "https://www.sspcloud.fr/honey/custom-resources.zip" HEADER_LOGO: "%PUBLIC_URL%/custom-resources/dapla_honey.svg" HEADER_TEXT_BOLD: "Onyxia Preview" HEADER_TEXT_FOCUS: "v10" HEADER_LINKS: | [ { "label": "AIML4OS", "icon": "VideoCall", "url": "https://insee-fr.zoom.us/webinar/register/WN_6dhMgoUvRXmkiyvYYIyKvw" } ] PALETTE_OVERRIDE: | { "focus": { "main": "#FF9100", // Light mode focus light: "#FAB900", // Dark mode focus }, "limeGreen": { "main": "#00DF0A" }, "dapla": { yellow: "#FAB900", darkerYellow: "#FF9100" } } FONT: | { fontFamily: "Geist", dirUrl: "%PUBLIC_URL%/custom-resources/fonts/Geist", "400": "Geist-Regular.woff2", "500": "Geist-Medium.woff2", "600": "Geist-SemiBold.woff2", "700": "Geist-Bold.woff2" } HOMEPAGE_MAIN_ASSET: "%PUBLIC_URL%/custom-resources/dapla_bee_logo.png" HOMEPAGE_MAIN_ASSET_SCALE_FACTOR: "0.8" HOMEPAGE_MAIN_ASSET_Y_OFFSET: "3rem" HEADER_HIDE_ONYXIA: "true" BACKGROUND_ASSET: | { dark: "%PUBLIC_URL%/custom-resources/dapla_background_dark.svg", light: "%PUBLIC_URL%/custom-resources/dapla_background_light.svg" } #HOMEPAGE_CARDS: "[]" ENABLED_LANGUAGES: "no,en" HOMEPAGE_HERO_TEXT: | { en: "Welcome to the Dapla **Lab**", no: "Velkommen til Dapla **Lab**", } HOMEPAGE_HERO_TEXT_AUTHENTICATED: | { en: "Welcome %USER_FIRSTNAME%!", no: "Velkommen %USER_FIRSTNAME%!", } TERMS_OF_SERVICES: | { en: "%PUBLIC_URL%/custom-resources/tos_en.md", fr: "%PUBLIC_URL%/custom-resources/tos_fr.md", } CUSTOM_HTML_HEAD: | ``` -------------------------------- ### Onyxia configuration for custom resources and links Source: https://docs.onyxia.sh/admin-doc/custom-pages Configuration snippet for onyxia/values.yaml that sets the CUSTOM_RESOURCES key and defines header, footer, homepage, and terms of service links to the custom Markdown files. ```yaml onyxia: web: env: CUSTOM_RESOURCES: "https://.../custom-resources.zip" HEADER_TEXT_BOLD: My Organization HEADER_TEXT_FOCUS: Datalab HEADER_LINKS: | [ { label: { en: "Onboarding Guide", fr: "Guide d'intégration" }, icon: "School", url: { en: "%PUBLIC_URL%/custom-resources/onboarding_en.md", fr: "%PUBLIC_URL%/custom-resources/onboarding_fr.md" } } ] FOOTER_LINKS: | [ { label: { en: "Onboarding Guide", fr: "Guide d'intégration" }, icon: "School", url: { en: "%PUBLIC_URL%/custom-resources/onboarding_en.md", fr: "%PUBLIC_URL%/custom-resources/onboarding_fr.md" } } ] HOMEPAGE_BELOW_HERO_TEXT: | { en: "See our [onboarding guide](%PUBLIC_URL%/custom-resources/onboarding_en.md)", fr: "Consultez notre [guide d'intégration](%PUBLIC_URL%/custom-resources/onboarding_fr.md)" } HOMEPAGE_CALL_TO_ACTION_BUTTON: | { label: { en: "Read our get started guide", fr: "Lire notre guide de démarrage" }, startIcon: "School", url: { en: "%PUBLIC_URL%/custom-resources/onboarding_en.md", fr: "%PUBLIC_URL%/custom-resources/onboarding_fr.md" } } TERMS_OF_SERVICES: "%PUBLIC_URL%/custom-resources/tos_fr.md" ``` -------------------------------- ### Override nodeSelector-gpu.json schema for fullgpu role in values.yaml Source: https://docs.onyxia.sh/admin-doc/catalog-of-services/override-schema-for-a-specific-instance Configure Onyxia to override the built-in 'nodeSelector-gpu.json' schema only for users with the 'fullgpu' role. Other users still get the default schema. The schema allows selecting disk type and GPU type, with H100 as an option. ```yaml onyxia: api: schemas: enabled: true roles: - roleName: fullgpu files: - relativePath: nodeSelector-gpu.json content: | { "$schema": "http://json-schema.org/draft-07/schema#", "title": "Node Selector", "type": "object", "properties": { "disktype": { "description": "The type of disk", "type": "string", "enum": ["ssd", "hdd"], "default": "ssd" }, "gpu": { "description": "The type of GPU", "type": "string", "enum": ["A2", "H100"], "default": "A2" } }, "additionalProperties": false } ``` -------------------------------- ### MinIO OIDC and Policy Configuration (values.yaml) Source: https://docs.onyxia.sh/admin-doc/readme/s3-explorer-standalone-deployment Relevant parts of the MinIO values file to enable OIDC and define the stsonly policy. The policy uses the preferred_username claim to grant access to a user-specific bucket. ```yaml minio: oidc: enabled: true configUrl: "https://auth.example.com/realms/my-realm/.well-known/openid-configuration" clientId: "minio" clientSecret: "" claimName: "policy" claimPrefix: "" policies: - name: stsonly statements: - resources: - 'arn:aws:s3:::user-${jwt:preferred_username}' - 'arn:aws:s3:::user-${jwt:preferred_username}/*' actions: - "s3:*" ``` -------------------------------- ### Configure JWT authentication with Keycloak Source: https://docs.onyxia.sh/admin-doc/readme/vault Writes the OIDC discovery URL and default role to the JWT auth configuration. The realm is 'datalab' as used throughout the documentation. ```bash vault write auth/jwt/config \ oidc_discovery_url="https://auth.lab.my-domain.net/auth/realms/datalab" \ default_role="onyxia-user" ``` -------------------------------- ### Configure Onyxia theme with onyxia/values.yaml Source: https://docs.onyxia.sh/admin-doc/theme Complete Onyxia theme configuration for the SSPCloud platform, covering all customizable options: custom resources, global alert, terms of services, header links, homepage call-to-action, social media metadata, fonts, color palettes, custom HTML, background assets, and contact links. ```yaml onyxia/values.yaml Copy ``` onyxia: web: env: #ONYXIA_API_URL: https://datalab.sspcloud.fr/api CUSTOM_RESOURCES: "https://www.sspcloud.fr/onyxia-theme-sspcloud-v0.zip" GLOBAL_ALERT: | { severity: "success", message: { en: "If you like the platform, you can give us a ⭐️ [on GitHub](https://github.com/InseeFrLab/onyxia). Thank you very much! 😊", fr: "Si vous aimez la plateforme, vous pouvez nous mettre une ⭐️ [sur GitHub](https://github.com/InseeFrLab/onyxia). Merci beaucoup ! 😊", } } DISABLE_PERSONAL_INFOS_INJECTION_IN_GROUP: true TERMS_OF_SERVICES: | { en: "%PUBLIC_URL%/custom-resources/tos_en.md", fr: "%PUBLIC_URL%/custom-resources/tos_fr.md" } HEADER_LINKS: | [ { label: { en: "Tutorials", fr: "Tutoriels", "zh-CN": "教程", fi: "Opastus", no: "Opplæring", it: "Tutorial", nl: "Zelfstudie" }, icon: "https://www.sspcloud.fr/trainings.svg", url: "https://www.sspcloud.fr/formation" }, { label: "AI Chat", icon: "SmartToy", url: "https://llm.lab.sspcloud.fr" }, { "label": { "en": "Contact us", "fr": "Contactez nous" }, "icon": "Support", "url": "https://join.slack.com/t/3innovation/shared_invite/zt-1bo6y53oy-Y~zKzR2SRg37pq5oYgiPuA" } ] HOMEPAGE_CALL_TO_ACTION_BUTTON_AUTHENTICATED: | { "label": { "fr": "Nouvel utilisateur du datalab ?", "en": "New user of the datalab?", "zh-CN": "数据实验室新用户？", "fi": "Uusi datalabin käyttäjä?", "no": "Ny bruker av datalaben?", "it": "Nuovo utente del datalab?", "nl": "Nieuwe gebruiker van het datalab?" }, "startIcon": "MenuBook", "url": "https://docs.sspcloud.fr" } SOCIAL_MEDIA_TITLE: "SSPCloud Datalab" SOCIAL_MEDIA_DESCRIPTION: "Open Innovation Platform powered by Onyxia" SOCIAL_MEDIA_IMAGE: "%PUBLIC_URL%/custom-resources/social-preview.png" HEADER_TEXT_BOLD: "SSPCloud" HEADER_TEXT_FOCUS: "Datalab" FONT: | { fontFamily: "Geist", dirUrl: "%PUBLIC_URL%/fonts/Geist", "400": "Geist-Regular.woff2", "500": "Geist-Medium.woff2", "600": "Geist-SemiBold.woff2", "700": "Geist-Bold.woff2" } PALETTE_OVERRIDE_LIGHT: | { focus: { main: "#3B82F6", light: "#3B82F6", }, light: { main: "#FAFAFA", light: "#FFFFFF", greyVariant1: "#EBEFF6" }, } PALETTE_OVERRIDE_DARK: | { focus: { main: "#5695FB", light: "#5695FB", }, dark: { main: "#0A152B", light: "#040B17", }, } HOMEPAGE_MAIN_ASSET: "false" CUSTOM_HTML_HEAD: | BACKGROUND_ASSET: | { "light": "%PUBLIC_URL%/custom-resources/OnyxiaNeumorphismLightMode.svg", "dark": "%PUBLIC_URL%/custom-resources/OnyxiaNeumorphismDarkMode.svg" } CONTACT_FOR_ADDING_EMAIL_DOMAIN: | { "en": "If your email domain is not yet allowed [contact us](https://3innovation.slack.com/signup#/domain-signup)", "fr": "Si votre domaine de messagerie n'est pas encore autorisé [contactez-nous](https://3innovation.slack.com/signup#/domain-signup)" } ``` ``` -------------------------------- ### Migrate header parameters: rename HEADER_ORGANIZATION, HEADER_USECASE_DESCRIPTION, DESCRIPTION Source: https://docs.onyxia.sh/release-notes/v6-greater-than-v7 Shows the values.yaml diff for renaming header parameters. HEADER_ORGANIZATION becomes HEADER_TEXT_BOLD, HEADER_USECASE_DESCRIPTION becomes HEADER_TEXT_FOCUS, and DESCRIPTION is replaced by SOCIAL_MEDIA_DESCRIPTION and SOCIAL_MEDIA_TITLE. ```yaml onyxia: web: env: - HEADER_ORGANIZATION: SSP Cloud + HEADER_TEXT_BOLD: SSP Cloud - HEADER_USECASE_DESCRIPTION: Datalab + HEADER_TEXT_FOCUS: Datalab - DESCRIPTION: Shared platform for statistical data processing and data science services + SOCIAL_MEDIA_DESCRIPTION: Shared platform for statistical data processing and data science services + SOCIAL_MEDIA_TITLE: Datalab - SSP Cloud ``` -------------------------------- ### Create DNS records for Onyxia Source: https://docs.onyxia.sh/admin-doc/readme/kubernetes Creates CNAME records for datalab and wildcard lab subdomains. Use A or AAAA records if the external IP is IPv4 or IPv6. ```text datalab.my-domain.net CNAME xxx.elb.eu-west-1.amazonaws.com. *.lab.my-domain.net CNAME xxx.elb.eu-west-1.amazonaws.com. ```