CI / Local dev refresh and Helm2->3 transition

.gitattributes

@@ -1,2 +1 @@
-secrets/** filter=git-crypt diff=git-crypt
 binderhub/_version.py export-subst

.gitignore

@@ -104,12 +104,13 @@ package-lock.json
 # Built files
 binderhub/static/dist
 helm-chart/binderhub/charts
+helm-chart/binderhub/requirements.lock
+testing/k8s-binder-k8s-hub/binderhub-chart-config-remote.yaml
+ci/id_rsa
 
 # Instructions we download
 k8s.txt
 helm.txt
-travis
-helm-chart/travis-binder.yaml
 
 # Federation data page
 doc/federation/data-federation.txt

.travis.yml

@@ -1,62 +1,163 @@
 dist: bionic
 language: python
 python:
-  - 3.7
+  - 3.8
 git:
   depth: false
 services:
   - docker
+env:
+  global:
+    # Version of CI dependencies to be installed
+    - MINIKUBE_VERSION=1.14.2   # https://github.com/kubernetes/minikube/releases
+    - KUBE_VERSION=1.19.3       # https://github.com/kubernetes/kubernetes/releases
+    - HELM_VERSION=3.4.0        # https://github.com/helm/helm/releases
+
+    # GITHUB_ACCESS_TOKEN - to increase quota with GitHub
+    - secure: ugOe1mIyit6BmzuTLtzVM7+edswAES1TfAnGST0EkYv341z0NnqRGdRJYtH1q1rRoZ6ciSnjHdVe8zmentxDwRJSi50888ro8EG7NnvAjG31cdwEgm7Vdv4sEbt7Dp8gYxKb5kWtt9w4IxPdMocpWPeNBmjctX+7QWwvIJZstWDjOtt8BhDufiTTHeiZR3FTNy5ykJXnFXn/WMsZoxI/a3GAgSzV4wKu0OzZYYk3GY20inJKUwxwWgyNbzQXecWlup6REd+YYrq0h4hJESyrtTQwHsijssCuy+mH8fxPpPZuF2WtHAqej0zGVKyUU/xmpCgdIHbjsheIyEE1leYn+USuoWqiHf0gjx2sYvBJP4HizJNPgj67UUNcUfGXzjegy6cDZE8iXW5clDRDkmWgx53VFlVgWV0TgdxtmOFK3IpQVOoaWc4q0e4T+/38rmUiBFnbbEep2q1wwjZojYhyaIrsEG9jOhtLW2rTADc5fdXURYqfPpubM1SCTseT43T86sRfOH3x8o9MSDnVejZ317oPfoZyqrL/FwpW45M68v/RAfvb6mY/5vM7Jw+70trgz4RhLQS55nuqnZ7NwK8ooX27YnvVnx3YisADz1Cf/A/bNixj8pVkJ7TTw/TnR/gTzat2wfsgPTWRtC8hhOyLSFnZh3J5OyeHQQMmdPspilE=
+
+
+stages:
+  - name: publish
+    if: tag IS present OR ( branch IN (master) AND type IN (push) )
+  - name: test
+
 
 before_install:
-  - nvm install 14; nvm use 14
-  - pip install --upgrade pip setuptools
-install:
-  - export PATH=$PWD/bin:$PATH
-  - ./ci/install.sh
-  - pip install --upgrade -r dev-requirements.txt
-  - npm install
-  - npm run webpack
-  - pip install --upgrade . -r helm-chart/images/binderhub/requirements.txt
+  # Exit immediately if a command exits with a non-zero status.
+  - set -e
+  - . ci/common
+
   # NOTE: The latest docker python package (4.3.0) requires a more modern docker
   #       version (newer than 18.06.0-ce / API version: 1.38) which is not yet
   #       available on travis.
-  #       ref: https://github.com/jupyterhub/zero-to-jupyterhub-k8s/pull/1743
-  - pip install -U "docker~=4.2.0"
+  - pip install "docker~=4.2.0"
+
+  # Fix to avoid rebuilding images already built
+  - remove_docker_mirror_on_travis
+
+
+install:
+  # Setup our minikube based Kubernetes cluster
+  - setup_minikube
+  - setup_kubectl
+  - setup_helm
+  - helm repo add jupyterhub https://jupyterhub.github.io/helm-chart/
+  - helm repo update
+
+  # Install node/npm which the BinderHub Python package use as a build step to
+  # generate static HTML/JS to serve.
+  - nvm install 14; nvm use 14
+  # Install NodeJS dependencies and build HTML/CSS/JS in binderhub/static into
+  # distributable dist/bundle.js in as static resource required by the binderhub
+  # Python package.
+  - npm install
+  - npm run webpack
+
+  # Install development requirements, package requirements, and frozen image
+  # requirements, with an increasing priority.
+  - pip install -r dev-requirements.txt
+  - pip install .
+  - pip install -r helm-chart/images/binderhub/requirements.txt
+
+  # Print information about the Pyton environment
   - pip freeze
 
-script:
-  - export BINDER_TEST_NAMESPACE=binder-test-$TEST
-  - ./ci/test-$TEST
+
+jobs:
+  ## don't wait for the jobs that are allowed to fail to report success
+  ##
+  ## ref: https://docs.travis-ci.com/user/customizing-the-build/#rows-that-are-allowed-to-fail
+  ## ref: https://docs.travis-ci.com/user/customizing-the-build/#fast-finishing
+  ##
+  allow_failures: []
+  fast_finish: true
+
+  ## define individual jobs that can rely on defaults from above
+  include:
+    - stage: test
+      name: main
+      script:
+        - ./testing/local-binder-k8s-hub/install-jupyterhub-chart
+        - await_jupyterhub
+        - pytest -m "not auth" --log-cli-level=10 -vsx --cov binderhub
+
+    - stage: test
+      name: auth
+      script:
+        - ./testing/local-binder-k8s-hub/install-jupyterhub-chart --auth
+        - await_jupyterhub
+        - pytest -m "auth" --log-cli-level=10 -vsx --cov binderhub
+
+    - stage: test
+      name: helm
+      script:
+        # Prepare:  builds images and updates default values.yaml to reference
+        #           the images
+        - echo "Preparing local BinderHub Helm chart"
+        - helm dependency update ./helm-chart/binderhub
+        - (cd helm-chart && chartpress)
+        - git --no-pager diff
+
+        # Validate: renders Helm chart templates and validates the rendered k8s
+        #           manifests against the k8s api-server.
+        - |
+          helm template --validate binderhub-test helm-chart/binderhub \
+              --values testing/k8s-binder-k8s-hub/binderhub-chart-config.yaml \
+              --set config.BinderHub.hub_url=http://$(minikube ip):30902 \
+              --set config.BinderHub.access_token=$GITHUB_ACCESS_TOKEN
+
+        # Install:  installs the local BinderHub Helm chart and await it to
+        #           become ready.
+        - echo "Installing local BinderHub Helm chart with JupyterHub as a dependency into k8s cluster"
+        - |
+          helm upgrade --install binderhub-test helm-chart/binderhub \
+              --values testing/k8s-binder-k8s-hub/binderhub-chart-config.yaml \
+              --set config.BinderHub.hub_url=http://$(minikube ip):30902 \
+              --set config.BinderHub.access_token=$GITHUB_ACCESS_TOKEN
+        - await_binderhub
+
+        # Test
+        - export BINDER_URL=http://$(minikube ip):30901
+        - echo "Running tests against $BINDER_URL"
+        - pytest -vsx -m "remote" --log-cli-level=10 --cov binderhub
+
+
+    - stage: publish
+      name: publish:helm-chart
+      install:  # overrides default
+        - setup_helm
+        - pip install chartpress
+      script:   # overrides default
+        - ./ci/publish
+      after_failure:
+        - echo "Required dummy override of default 'after_failure' in .travis.yml."
+      after_success:
+        - echo "Required dummy override of default 'after_success' in .travis.yml."
+      env:
+        # DOCKER_USERNAME and DOCKER_PASSWORD are represented as the secure
+        # entries below as encrypted environment variables used in the publish
+        # script to push built docker images to docker hub.
+        #
+        # ref: https://docs.travis-ci.com/user/environment-variables/#encrypting-environment-variables
+        #
+        # encrypted_d8355cc3d845_key, encrypted_d8355cc3d845_iv are environment
+        # variables are also available because they are set in the TravisCI UI.
+        # They are used to decrypt a private SSH key registered with push rights
+        # to our GitHub repo acting as a Helm container registry.
+        #
+        # ref: https://travis-ci.com/github/jupyterhub/binderhub/settings
+        #
+        - secure: BuO4oUz5YZvWhH919Tk8h3McM60NybLImIwB+0C4cmcDC/Z4uS1Jh8R8UbD3vIkJyjPgd+WuoaYGzzgJfCiS5i5TZZfi5yI0URu67fc044vaS7zSegZWsuN40mP4QNYTb+VdYniav8pqqyPyUpKNbOQ+/YJ+BWrC/ncqSL+P+UR6PE9T3TQ4XDuB45z0B2hhfDWBMpP6KtGae7YOWstIPi8ufiS76jjRzE4ziLqsOSwJRGhRbjJXqdcZeH2d54jUJSzCEGMSo5lxrFL27YOJ6Vuzr0V208AiQe60CyxtAzyiamVoE9U8pYOnv9KRDMeROSdz2HJkGetedNgCHpf0mNUWLZzQ6udzXtKeG2pxKeLDYKSm8Y3GGGa87nWRaWS1dYwCTHLe1r6Jwt6QwuBqqIa0oOMujStTEgbUOLLw5e80kSWqTxb52XnDi5SgOMGNzcylAYJLHFCL5U9ShAyZWGRAy0p7tFycXy44/k7RiqXr6Xur7NuB9bzXkmsDa7qS1t2DXoUA8FlpxfvqaSqVuFSrN16JHQeBOZGEYondQ2NPvi2vNT68Us4saWUxBf8oxF5pctbJYDDOxWpYFq/pza2+Elset9dv5KjCb61qtotLpo4PER4zgvde5/5HRa1CAOJlVfZB1Au3+b1NoVWNnPcwlb2UGut1+bcaDWyPf20=
+        - secure: uqQrm6T6oGloQIHs1tLtQm3iIZFUtv1lNgtT+oCfYw3MC1CJ5AkKRaClAcVlFVOoCAE1GeCbnkob0i+LkwE+FQ1uw0fH9QyGx0PiEBrT3ilOXtkHvLXzcB/8PqPnIRR+vQnqigX2wsfiy0po99gBeaKiQjfybZ8UVp03M7+peQ4Y/Dxoj0G0nYZPsCo4F5plfdalJQX+ZVi1QlkglTotVxvb8QjrxXUrJ3OgXyVgW5fmkrRY6rWlb7RkSPlxmOhOZ7KM0BghMvox2VAD2jTatW/IEjqqaek8VqyKe1Dhw8wRUwQIwAH0VV1tUslHGcPcpbosGTPsfH7pTSUIa6ZRWd2dymMCpp7NwmFPm38QOZS/psiYNFPM6FvQnyqmtiUiU9MfcwMNJxiAUyTSslficd1Lt/aTTgBJQnK9Zd+/J6uuSc1aMGSgVNaM6eXxyNITXqz067zn8apCJm6UUEVM5FFs5SdfNXycJeV7qBwT8oe2+lvC4YzB2bHVGlnynK4IBPZsSFiBxPTBhcHVZp2FIMoC7cm/2dKW0gKPMho2Glhb7Zxn0mFej7XrT+IllD4yCjYSuSG2hpNMgE0+pc/89F2eLtey+oRAH0p4+K8DXsVCHsb7rSq+i7WDtFhFR0DBRWPG8B//CyLSbr4UoKumShbXYCI1dpSYzATmVyphQc8=
+
 
 after_failure:
-  - |
-    # get pod logs
-    kubectl get pod --all-namespaces
-    for pod in $(kubectl get pod --no-headers --namespace=$BINDER_TEST_NAMESPACE | awk '{print $1}'); do
-      echo $pod
-      kubectl logs --namespace=$BINDER_TEST_NAMESPACE $pod || echo 'no logs'
-    done
+  - full_namespace_report
+
+
 after_success:
   # make sure we are back at the top of the checkout directory no matter
   # what previous commands might have done or not
   - cd $TRAVIS_BUILD_DIR
   - codecov
-
-env:
-  matrix:
-    - TEST=main
-    - TEST=auth
-    - TEST=helm
-  global:
-    # minikube version: https://github.com/kubernetes/minikube/releases
-    - MINIKUBE_VERSION=1.14.2
-    # kubernetes version: https://github.com/kubernetes/kubernetes/releases
-    - KUBE_VERSION=1.19.3
-    # helm version: https://github.com/helm/helm/releases
-    - HELM_VERSION=2.16.12
-
-    # DOCKER_USERNAME and DOCKER_PASSWORD
-    - secure: BuO4oUz5YZvWhH919Tk8h3McM60NybLImIwB+0C4cmcDC/Z4uS1Jh8R8UbD3vIkJyjPgd+WuoaYGzzgJfCiS5i5TZZfi5yI0URu67fc044vaS7zSegZWsuN40mP4QNYTb+VdYniav8pqqyPyUpKNbOQ+/YJ+BWrC/ncqSL+P+UR6PE9T3TQ4XDuB45z0B2hhfDWBMpP6KtGae7YOWstIPi8ufiS76jjRzE4ziLqsOSwJRGhRbjJXqdcZeH2d54jUJSzCEGMSo5lxrFL27YOJ6Vuzr0V208AiQe60CyxtAzyiamVoE9U8pYOnv9KRDMeROSdz2HJkGetedNgCHpf0mNUWLZzQ6udzXtKeG2pxKeLDYKSm8Y3GGGa87nWRaWS1dYwCTHLe1r6Jwt6QwuBqqIa0oOMujStTEgbUOLLw5e80kSWqTxb52XnDi5SgOMGNzcylAYJLHFCL5U9ShAyZWGRAy0p7tFycXy44/k7RiqXr6Xur7NuB9bzXkmsDa7qS1t2DXoUA8FlpxfvqaSqVuFSrN16JHQeBOZGEYondQ2NPvi2vNT68Us4saWUxBf8oxF5pctbJYDDOxWpYFq/pza2+Elset9dv5KjCb61qtotLpo4PER4zgvde5/5HRa1CAOJlVfZB1Au3+b1NoVWNnPcwlb2UGut1+bcaDWyPf20=
-    - secure: uqQrm6T6oGloQIHs1tLtQm3iIZFUtv1lNgtT+oCfYw3MC1CJ5AkKRaClAcVlFVOoCAE1GeCbnkob0i+LkwE+FQ1uw0fH9QyGx0PiEBrT3ilOXtkHvLXzcB/8PqPnIRR+vQnqigX2wsfiy0po99gBeaKiQjfybZ8UVp03M7+peQ4Y/Dxoj0G0nYZPsCo4F5plfdalJQX+ZVi1QlkglTotVxvb8QjrxXUrJ3OgXyVgW5fmkrRY6rWlb7RkSPlxmOhOZ7KM0BghMvox2VAD2jTatW/IEjqqaek8VqyKe1Dhw8wRUwQIwAH0VV1tUslHGcPcpbosGTPsfH7pTSUIa6ZRWd2dymMCpp7NwmFPm38QOZS/psiYNFPM6FvQnyqmtiUiU9MfcwMNJxiAUyTSslficd1Lt/aTTgBJQnK9Zd+/J6uuSc1aMGSgVNaM6eXxyNITXqz067zn8apCJm6UUEVM5FFs5SdfNXycJeV7qBwT8oe2+lvC4YzB2bHVGlnynK4IBPZsSFiBxPTBhcHVZp2FIMoC7cm/2dKW0gKPMho2Glhb7Zxn0mFej7XrT+IllD4yCjYSuSG2hpNMgE0+pc/89F2eLtey+oRAH0p4+K8DXsVCHsb7rSq+i7WDtFhFR0DBRWPG8B//CyLSbr4UoKumShbXYCI1dpSYzATmVyphQc8=
-    # GITHUB_ACCESS_TOKEN
-    - secure: ugOe1mIyit6BmzuTLtzVM7+edswAES1TfAnGST0EkYv341z0NnqRGdRJYtH1q1rRoZ6ciSnjHdVe8zmentxDwRJSi50888ro8EG7NnvAjG31cdwEgm7Vdv4sEbt7Dp8gYxKb5kWtt9w4IxPdMocpWPeNBmjctX+7QWwvIJZstWDjOtt8BhDufiTTHeiZR3FTNy5ykJXnFXn/WMsZoxI/a3GAgSzV4wKu0OzZYYk3GY20inJKUwxwWgyNbzQXecWlup6REd+YYrq0h4hJESyrtTQwHsijssCuy+mH8fxPpPZuF2WtHAqej0zGVKyUU/xmpCgdIHbjsheIyEE1leYn+USuoWqiHf0gjx2sYvBJP4HizJNPgj67UUNcUfGXzjegy6cDZE8iXW5clDRDkmWgx53VFlVgWV0TgdxtmOFK3IpQVOoaWc4q0e4T+/38rmUiBFnbbEep2q1wwjZojYhyaIrsEG9jOhtLW2rTADc5fdXURYqfPpubM1SCTseT43T86sRfOH3x8o9MSDnVejZ317oPfoZyqrL/FwpW45M68v/RAfvb6mY/5vM7Jw+70trgz4RhLQS55nuqnZ7NwK8ooX27YnvVnx3YisADz1Cf/A/bNixj8pVkJ7TTw/TnR/gTzat2wfsgPTWRtC8hhOyLSFnZh3J5OyeHQQMmdPspilE=