Added base config for tenant-a

README.md

@@ -13,12 +13,17 @@ brew install docker
 
 # 2. Images
 
-```
+To created the needed dependency, I did a simple 2 images base + jupyter.
+The first image is a minimal python slim. I then add some 
+
+### 2.1. Base
+
+```images/base/dockerfile
 FROM python:3.12-slim-bookworm AS base
 
 LABEL org.opencontainers.image.title="tenant-base" \
       org.opencontainers.image.description="Hardened base image for tenant workspaces" \
-      org.opencontainers.image.source="https://github.com/yourorg/yourrepo"
+      org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
 
 # System deps only — keep this layer stable so it's rarely rebuilt
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -36,3 +41,41 @@ USER appuser
 
 ENTRYPOINT ["tini", "--"]
 ```
+
+Then build and push it to the registry
+
+```
+docker build -t registry.bouvais.lu/tenant-base:1.0.0 images/base
+docker push registry.bouvais.lu/tenant-base:1.0.0
+```
+
+### 2.2. Jupyter
+
+Now I dp the same for a simple jupyter image.
+
+```
+ARG BASE_IMAGE=registry.bouvais.lu/tenant-base:1.0.0
+FROM ${BASE_IMAGE}
+
+LABEL org.opencontainers.image.title="tenant-jupyter" \
+      org.opencontainers.image.description="JupyterLab image built on tenant-base" \
+      org.opencontainers.image.base.name="${BASE_IMAGE}"
+
+USER root
+COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir -r /tmp/requirements.txt \
+    && rm /tmp/requirements.txt
+
+# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
+USER appuser
+WORKDIR /home/appuser/work
+
+EXPOSE 8888
+
+CMD ["jupyter", "lab", \
+     "--ip=0.0.0.0", \
+     "--port=8888", \
+     "--no-browser", \
+     "--ServerApp.token=", \
+     "--ServerApp.allow_remote_access=True"]
+```

tenants/tenant-a/values.yaml

@@ -0,0 +1,34 @@
+tenant:
+  name: tenant-a
+  namespace: tenant-a
+
+serviceAccount:
+  create: true
+  name: tenant-a-sa
+
+image:
+  repository: registry.bouvais.lu/tenant-jupyter
+  tag: "1.0.0"
+
+s3:
+  endpoint: http://minio.minio-system.svc:9000
+  refBucket: ref-tenant-a
+  workBucket: work-tenant-a
+  secretName: tenant-a-s3-creds
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    cpu: "1"
+    memory: 2Gi
+
+gpu:
+  enabled: true
+  type: "t4"          # one of: none | t4 | a100 | l4
+  count: 1
+
+networkPolicy:
+  allowedEgress:
+    - minio.minio-system.svc.cluster.local