zyratlo commented on code in PR #8073:
URL: https://github.com/apache/texera/pull/8073#discussion_r3938229140
##########
bin/k8s/templates/base/gateway/gateway-routes.yaml:
##########
@@ -135,6 +148,13 @@ spec:
- path:
type: PathPrefix
value: /api/pve
+ {{- if .Values.notebookMigrationService.enabled }}
+ # Per-user JupyterLab. ExtAuthz reads the uid from the path and
rewrites Host to
+ # that user's pod; the per-user Jupyter token is what authorizes the
request.
+ - path:
+ type: PathPrefix
+ value: /jupyter
Review Comment:
Fixed in bd9cd1d4e, taking the first option. The route match is templated
from jupyterPool.basePath, and the regex is built from
KubernetesConfig.jupyterBaseUrl with Regex.quote, so a prefix is treated as a
path and not a pattern. Your premise about access-control was right that it can
read the config, but it was not being given it: the deployment never set
KUBERNETES_JUPYTER_BASE_URL, so the regex silently fell back to the default and
the same defect survived. That env var is part of the commit, and with
basePath: /lab/notebooks the pod base_url, recorded URL, gateway route and
regex all move together, verified on a cluster with an ablation that removing
the env restores the break.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
