Adjust network policies for singleuser pod

swan-cern/files/private/side_container_tokens_perm.sh

@@ -27,13 +27,6 @@ if [[ ! -f "/srv/side-container/eos/krb5cc" ]]; then
     exit 1
 fi
 
-if [[ -f "/srv/side-container/hadoop/webhdfs.toks" ]]; then
-    echo "add hadoop.toks to user container"
-    copy_token_to_notebook /srv/side-container/hadoop/webhdfs.toks /srv/notebook/tokens/webhdfs.toks
-else
-    echo "webhdfs.toks not required, skipping"
-fi
-
 if [[ -f "/srv/side-container/hadoop/hadoop.toks" ]]; then
     echo "add hadoop.toks to user container"
     copy_token_to_notebook /srv/side-container/hadoop/hadoop.toks /srv/notebook/tokens/hadoop.toks

swan-cern/files/swan_computing_config.py

@@ -145,7 +145,6 @@ async def _init_hadoop_secret(self):
         username = self.spawner.user.name
         hadoop_secret_name = f'hadoop-tokens-{username}'
 
-        webhdfs_token_base64 = ''
         k8suser_config_base64 = ''
 
         if cluster == 'k8s':
@@ -159,24 +158,6 @@ async def _init_hadoop_secret(self):
                 # if no access, all good for now
                 raise ValueError("Could not setup user on k8s")
 
-            try:
-                # Retrieve hdfs token for user
-                webhdfs_token_base64 = subprocess.check_output(
-                    ['sudo', '--preserve-env=SWAN_DEV', '/srv/jupyterhub/private/webhdfs_token.sh', hdfs_cluster, username], timeout=60
-                ).decode('ascii')
-            except Exception as e:
-                # if no access, all good for now
-                raise ValueError("Could not get webhdfs tokens")
-        else:
-            try:
-                # Retrieve hdfs token for user
-                webhdfs_token_base64 = subprocess.check_output(
-                    ['sudo', '--preserve-env=SWAN_DEV', '/srv/jupyterhub/private/webhdfs_token.sh', cluster, username], timeout=60
-                ).decode('ascii')
-            except Exception as e:
-                # if no access, all good for now
-                raise ValueError("Could not get webhdfs tokens")
-
         # Create V1Secret with webdhfs token and k8s user config
         try:
             secret_data = V1Secret()
@@ -187,7 +168,6 @@ async def _init_hadoop_secret(self):
             secret_data.metadata = secret_meta
             secret_data.data = {}
             secret_data.data['k8s-user.config'] = k8suser_config_base64
-            secret_data.data['webhdfs.toks'] = webhdfs_token_base64
 
             try:
                 await self.spawner.api.read_namespaced_secret(hadoop_secret_name, swan_container_namespace)
@@ -257,20 +237,6 @@ def _modify_containers_for_spark(self, hadoop_secret_name):
             ),
         )
 
-        # webhdfs token
-        notebook_container.env = self._add_or_replace_by_name(
-            notebook_container.env,
-            V1EnvVar(
-                name='WEBHDFS_TOKEN',
-                value_from=V1EnvVarSource(
-                    secret_key_ref=V1SecretKeySelector(
-                        key='webhdfs.toks',
-                        name=hadoop_secret_name
-                    )
-                )
-            ),
-        )
-
     def _gpu_enabled(self):
         """
         return True if the user has requested a GPU

swan-cern/values.yaml

@@ -66,11 +66,6 @@ swan:
           - from:
             - ipBlock:
                 cidr: 0.0.0.0/0
-                # Exclude connections from other pods in our cluster's pod network.
-                except:
-                  - 10.0.0.0/8
-                  - 172.16.0.0/12
-                  - 192.168.0.0/16
             ports:
             - protocol: TCP
               port: 30000
@@ -83,6 +78,14 @@ swan:
                     app: hadoop-token-generator
             ports:
               - port: 80
+          # Allow outgoing connections to the internet, but restrict access to pod network
+          # and metadata server.
+          - to:
+            - ipBlock:
+                cidr: 0.0.0.0/0
+                except:
+                - 10.100.0.0/16
+                - 169.254.169.254/32
     scheduling:
       userPods:
         nodeAffinity:

swan/values.yaml

@@ -61,6 +61,7 @@ jupyterhub:
       egressAllowRules:
         dnsPortsCloudMetadataServer: false
         dnsPortsPrivateIPs: false
+        nonPrivateIPs: false
     extraAnnotations:
       kubectl.kubernetes.io/default-container: notebook
     extraEnv: