Merge branch 'main' into pre-commit-ci-update-config

Author: Adam-D-Lewis

README.md

@@ -37,7 +37,7 @@
   - [Install Nebari](#install-nebari)
 - [Usage 🚀](#usage-)
 - [Nebari HPC](#nebari-hpc)
-- [Contributing to Nebari 👩🏻‍💻](#contributing-to-nebari-)
+- [Contributing to Nebari 👩🏻‍💻](#contributing-to-nebari-%E2%80%8D)
   - [Installing the Development version of Nebari ⚙️](#installing-the-development-version-of-nebari-️)
   - [Questions? 🤔](#questions-)
 - [Code of Conduct 📖](#code-of-conduct-)

src/_nebari/constants.py

@@ -1,4 +1,4 @@
-CURRENT_RELEASE = "2025.6.1"
+CURRENT_RELEASE = "2025.10.1"
 
 HELM_VERSION = "v3.15.3"
 KUSTOMIZE_VERSION = "5.4.3"
@@ -9,7 +9,7 @@
 # 04-kubernetes-ingress
 DEFAULT_TRAEFIK_IMAGE_TAG = "2.9.1"
 
-HIGHEST_SUPPORTED_K8S_VERSION = ("1", "31")  # specify Major and Minor version
+HIGHEST_SUPPORTED_K8S_VERSION = ("1", "32")  # specify Major and Minor version
 DEFAULT_GKE_RELEASE_CHANNEL = "UNSPECIFIED"
 
 DEFAULT_NEBARI_DASK_VERSION = CURRENT_RELEASE

src/_nebari/provider/helm.py

@@ -59,7 +59,10 @@ def download_helm_binary(version=constants.HELM_VERSION) -> Path:
 def run_helm_subprocess(processargs, **kwargs) -> None:
     helm_path = download_helm_binary()
     logger.info("helm at %s", helm_path)
-    if run_subprocess_cmd([helm_path] + processargs, **kwargs):
+    return_code, output = run_subprocess_cmd(
+        [helm_path] + processargs, capture_output=True, **kwargs
+    )
+    if return_code:
         raise HelmException("Helm returned an error")
 
 

src/_nebari/stages/infrastructure/template/gcp/modules/kubernetes/main.tf

@@ -2,9 +2,10 @@ data "google_client_config" "main" {
 }
 
 resource "google_container_cluster" "main" {
-  name               = var.name
-  location           = var.location
-  min_master_version = var.kubernetes_version
+  name                = var.name
+  location            = var.location
+  min_master_version  = var.kubernetes_version
+  deletion_protection = false
 
   node_locations = var.availability_zones
 

src/_nebari/stages/infrastructure/template/local/main.tf

@@ -48,7 +48,7 @@ resource "kind_cluster" "default" {
 
     node {
       role  = "general"
-      image = "kindest/node:v1.32.0"
+      image = "kindest/node:v1.32.5"
     }
   }
 }

src/_nebari/stages/kubernetes_services/__init__.py

@@ -239,13 +239,28 @@ class CondaEnvironment(schema.Base):
     dependencies: List[Union[str, Dict[str, List[str]]]]
 
 
+class WorkerResources(schema.Base):
+    cpu_limit: Optional[Union[str, float, int]] = 2
+    mem_limit: Optional[Union[str, float, int]] = "6Gi"
+    cpu_guarantee: Optional[Union[str, float, int]] = 1
+    mem_guarantee: Optional[Union[str, float, int]] = "4Gi"
+
+
+class CondaStoreWorker(schema.Base):
+    resources: Optional[WorkerResources] = WorkerResources()
+    # for the rest defaults are handled in terraform (worker.tf),
+    # so we don't need to set it here
+    max_workers: Optional[int] = None
+
+
 class CondaStore(schema.Base):
     extra_settings: Dict[str, Any] = {}
     extra_config: str = ""
     image: str = "quansight/conda-store-server"
     image_tag: str = constants.DEFAULT_CONDA_STORE_IMAGE_TAG
     default_namespace: str = "nebari-git"
     object_storage: str = "200Gi"
+    worker: Optional[CondaStoreWorker] = None
 
 
 class NebariWorkflowController(schema.Base):
@@ -489,6 +504,9 @@ class CondaStoreInputVars(schema.Base):
     conda_store_service_token_scopes: Dict[str, Dict[str, Any]] = Field(
         alias="conda-store-service-token-scopes"
     )
+    conda_store_worker: CondaStoreWorker | None = Field(
+        alias="conda-store-worker",
+    )
 
     @field_validator("conda_store_filesystem_storage", mode="before")
     @classmethod
@@ -712,6 +730,7 @@ def _node_taint_tolerations(node_group_name: str) -> List[Toleration]:
             conda_store_extra_config=self.config.conda_store.extra_config,
             conda_store_image=self.config.conda_store.image,
             conda_store_image_tag=self.config.conda_store.image_tag,
+            conda_store_worker=(self.config.conda_store.worker or {}),
         )
 
         jupyterhub_vars = JupyterhubInputVars(

src/_nebari/stages/kubernetes_services/template/conda-store.tf

@@ -38,6 +38,13 @@ variable "conda-store-service-token-scopes" {
   type        = map(any)
 }
 
+variable "conda-store-worker" {
+  description = "Worker-specific overrides for conda-store worker pods."
+  type        = any
+  default     = {}
+}
+
+
 # ====================== RESOURCES =======================
 module "kubernetes-conda-store-server" {
   source = "./modules/kubernetes/services/conda-store"
@@ -63,6 +70,8 @@ module "kubernetes-conda-store-server" {
   extra-config   = var.conda-store-extra-config
   conda-store-fs = var.shared_fs_type
 
+  conda-store-worker = var.conda-store-worker
+
   depends_on = [
     module.rook-ceph
   ]
@@ -76,4 +85,14 @@ moved {
 
 locals {
   conda-store-fs = var.shared_fs_type
+  conda-store-worker-resources = {
+    limits = {
+      cpu    = "1"
+      memory = "2Gi"
+    }
+    requests = {
+      cpu    = "0.5"
+      memory = "1Gi"
+    }
+  }
 }

src/_nebari/stages/kubernetes_services/template/modules/kubernetes/nfs-server/main.tf

@@ -88,7 +88,7 @@ resource "kubernetes_deployment" "main" {
 
         container {
           name  = "nfs-server"
-          image = "gcr.io/google_containers/volume-nfs:0.8"
+          image = "quay.io/nebari/volume-nfs:0.8-repack"
 
           port {
             name           = "nfs"

src/_nebari/stages/kubernetes_services/template/modules/kubernetes/services/conda-store/variables.tf

@@ -86,3 +86,25 @@ variable "conda-store-fs" {
     error_message = "Allowed values for input_parameter are \"cephfs\", or \"nfs\"."
   }
 }
+
+variable "conda-store-worker" {
+  description = "Worker-specific overrides for conda-store worker pods."
+  type = object({
+    max_workers = optional(any)
+    resources = optional(object({
+      cpu_limit     = optional(any)
+      mem_limit     = optional(any)
+      cpu_guarantee = optional(any)
+      mem_guarantee = optional(any)
+    }))
+  })
+  default = {
+    max_workers = 1
+    resources = {
+      cpu_limit     = 2
+      mem_limit     = "6Gi"
+      cpu_guarantee = 1
+      mem_guarantee = "4Gi"
+    }
+  }
+}

src/_nebari/stages/kubernetes_services/template/modules/kubernetes/services/conda-store/worker.tf

@@ -66,7 +66,7 @@ resource "kubernetes_deployment" "worker" {
   }
 
   spec {
-    replicas = 1
+    replicas = var.conda-store-worker.max_workers != null ? tonumber(var.conda-store-worker.max_workers) : 1
 
     selector {
       match_labels = {
@@ -94,6 +94,8 @@ resource "kubernetes_deployment" "worker" {
             required_during_scheduling_ignored_during_execution {
               node_selector_term {
                 match_expressions {
+                  // Since all node selectors use the same provider key, we can reuse
+                  // the same key even when overriding the value.
                   key      = var.node-group.key
                   operator = "In"
                   values = [
@@ -115,6 +117,20 @@ resource "kubernetes_deployment" "worker" {
             "/etc/conda-store/conda_store_config.py"
           ]
 
+          dynamic "resources" {
+            for_each = var.conda-store-worker.resources == null ? [] : [var.conda-store-worker.resources]
+            content {
+              limits = {
+                cpu    = resources.value.cpu_limit == null ? null : resources.value.cpu_limit
+                memory = resources.value.mem_limit == null ? null : resources.value.mem_limit
+              }
+              requests = {
+                cpu    = resources.value.cpu_guarantee == null ? null : resources.value.cpu_guarantee
+                memory = resources.value.mem_guarantee == null ? null : resources.value.mem_guarantee
+              }
+            }
+          }
+
           volume_mount {
             name       = "config"
             mount_path = "/etc/conda-store"
@@ -140,7 +156,7 @@ resource "kubernetes_deployment" "worker" {
           for_each = local.enable-nfs-server-worker ? [1] : []
           content {
             name  = "nfs-server"
-            image = "gcr.io/google_containers/volume-nfs:0.8"
+            image = "quay.io/nebari/volume-nfs:0.8-repack"
 
             port {
               name           = "nfs"