README
¶
Jupyter K8s
A Kubernetes operator for Jupyter notebooks and interactive IDEs — managing compute, storage, networking, and access control for multiple users.
- Kubernetes Native — Workspaces are native Kubernetes resources. Your users manage and access them using their Kubernetes identities and RBAC policies.
- Multi-Application Support — Run JupyterLab, VS Code, or bring your own apps. Persistent per-user storage with optional shared volumes for team collaboration.
- Secure by Default — Scope a workspace access to a single user or a team. Namespace-scoped RBAC, JWT-based authentication with automatic key rotation.
- Flexible Access — Connect to your workspaces from your web browser with OAuth 2 or bearer token URL, or directly from your desktop IDE.
- Fine-Grained Control — Provide default configurations to your users and enforce bounds with templates. Automatically shutdown idle workspaces.
- Vendor Neutral — Compatible with any cloud provider via an HTTP sidecar plugin pattern. Bring your own integration.
Documentation
https://jupyter-k8s.readthedocs.io
Installation
helm install jupyter-k8s oci://ghcr.io/jupyter-infra/charts/jupyter-k8s \
--namespace jupyter-k8s-system \
--create-namespace
See the Getting Started guide for prerequisites, configuration, and next steps.
Packages
| Artifact | Description |
|---|---|
jupyter-k8s Helm chart |
Operator chart — CRDs, controller, webhooks, RBAC, extension API server. |
jupyter-k8s-controller image |
Controller and Extension API server. |
jupyter-k8s-authmiddleware image |
JWT auth middleware for reverse-proxy deployments. |
jupyter-k8s-rotator image |
HMAC key rotation CronJob. |
For cloud-specific guided charts, see jupyter-k8s-aws.
Contributing
Refer to the Contributing guide. Pull requests get an automated AI code
review, and you can run the same review locally before pushing with make review.
License
This project is licensed under the MIT License.
Directories
¶
| Path | Synopsis |
|---|---|
|
api
|
|
|
connection/v1alpha1
Package v1alpha1 contains API Schema definitions for the connection.workspace.jupyter.org v1alpha1 API group +kubebuilder:object:generate=true +groupName=connection.workspace.jupyter.org
|
Package v1alpha1 contains API Schema definitions for the connection.workspace.jupyter.org v1alpha1 API group +kubebuilder:object:generate=true +groupName=connection.workspace.jupyter.org |
|
v1alpha1
Package v1alpha1 contains API Schema definitions for the workspaces v1alpha1 API group.
|
Package v1alpha1 contains API Schema definitions for the workspaces v1alpha1 API group. |
|
entry point for the jupyter-k8s operator
|
entry point for the jupyter-k8s operator |
|
authmiddleware
command
Package main provides the entry point for the authmiddleware service that handles JWT-based authentication and authorization for Jupyter-k8s workspaces.
|
Package main provides the entry point for the authmiddleware service that handles JWT-based authentication and authorization for Jupyter-k8s workspaces. |
|
manager
command
entry point for the jupyter-k8s operator manager
|
entry point for the jupyter-k8s operator manager |
|
rotator
command
Package main implements the JWT secret rotator binary.
|
Package main implements the JWT secret rotator binary. |
|
internal
|
|
|
authmiddleware
Package authmiddleware provides JWT-based authentication and authorization middleware for Jupyter-k8s workspaces, handling user identity and cookie management.
|
Package authmiddleware provides JWT-based authentication and authorization middleware for Jupyter-k8s workspaces, handling user identity and cookie management. |
|
awsadapter
Package awsadapter provides the SSM-based pod event adapter implementation.
|
Package awsadapter provides the SSM-based pod event adapter implementation. |
|
controller
Package controller defines the jupyter-k8s controller logic
|
Package controller defines the jupyter-k8s controller logic |
|
extensionapi
Package extensionapi provides extension API server functionality.
|
Package extensionapi provides extension API server functionality. |
|
jwt
Package jwt provides JWT token management with pluggable signing strategies.
|
Package jwt provides JWT token management with pluggable signing strategies. |
|
pluginadapters
Package pluginadapters defines interfaces for handling plugin lifecycle events in a plugin-agnostic way.
|
Package pluginadapters defines interfaces for handling plugin lifecycle events in a plugin-agnostic way. |
|
rotator
Package rotator provides JWT signing key rotation functionality for Kubernetes secrets.
|
Package rotator provides JWT signing key rotation functionality for Kubernetes secrets. |
|
stringutil
Package stringutil provides string utility functions.
|
Package stringutil provides string utility functions. |
|
webhook
Package webhook provides constants and utilities for webhook validation.
|
Package webhook provides constants and utilities for webhook validation. |
|
workspace
Package workspace provides utilities for workspace operations.
|
Package workspace provides utilities for workspace operations. |
|
test
|
|
|
helm
Package helm contains helpers for Helm chart testing
|
Package helm contains helpers for Helm chart testing |
|
utils
Package utils provides method for end-to-end testing
|
Package utils provides method for end-to-end testing |
Click to show internal directories.
Click to hide internal directories.