Workbench user provisioning

[ihannache]

Hi,

first of all, Thank you for all your work.
I have a question, is there a simple way to add new users in RStudio workbench hem chart ?
we have a licence for 10 users, and with helm cher I can only generate one user which is the test user

[colearendt]

Howdy @ihannache ! Thanks for reaching out here! Unfortunately there is not a fantastic way (and this is something we are working to improve in the product)! However, we do talk about caveats here: https://github.com/rstudio/helm/tree/main/charts/rstudio-workbench#user-provisioning

And there are some limited examples:

• helm/examples/auto-scaling/rstudio-workbench/values.yaml

  Lines 148 to 173 in 2836542

  	startupCustom:
  	create-users-ongoing.sh: |
  	#!/bin/bash
  	for user in users.txt; do
  	USERNAME=$(cat users.txt | grep -v '^\s*#'| cut -d: -f1)
  	USERID=$(cat users.txt | grep -v '^\s*#'| cut -d: -f2)
  	echo "$USERNAME"
  	PASSWORD=$(cat users.txt | grep -v '^\s*#'| cut -d: -f3)
  	useradd -u $USERID -m -s /bin/bash -N $USERNAME
  	echo "$USERNAME:$PASSWORD" | sudo chpasswd
  	done;
  	echo 'sleeping forever'
  	while :; do read; done
  	user-provision.conf: |
  	[program:user-provision]
  	command=/startup/custom/create-users-ongoing.sh
  	autorestart=false
  	numprocs=1
  	startsecs=10
  	stdout_logfile=/dev/stdout
  	stdout_logfile_maxbytes=0
  	stderr_logfile=/dev/stderr
  	stderr_logfile_maxbytes=0

• A smidge more thorough, but I seem to recall some shortcoming...

[ihannache]

Hello @colearendt, thanks a lot for your quick answer. I have many questions about the users provisioning:
1- we have a licence for 10 users, can we have only one admin user and the rest cannot access to the admin console?
2- can I configure the helm chart session docker image for each user, if yes how ?
3- if there is a way for my second question is it a good idea to give some users sudo privileges ?
4- do you have an idea about the error below :
2023-03-18T02:12:48.864006Z [rstudio-kubernetes-launcher, log-source: Kubernetes] ERROR system error 71 (Protocol error) [description: watch api/v1/namespaces/rstudio/services?watch=true&timeoutSeconds=180&resourceVersion=5047152: timed out on our end]; OCCURRED AT rstudio::job_launcher::impls::kubernetes::KubernetesApi::watch(const string&, const rstudio_boost::optional<unsigned int>&, const rstudio_boost::optional<std::__cxx11::basic_string<char> >&, const OnWatchUpdateHandler&, const ErrorHandler&)::<lambda(const rstudio_boost::system::error_code&)> src/cpp/job_launcher/impls/kubernetes/KubernetesApi.cpp:1052; LOGGED FROM: void rstudio::job_launcher::impls::kubernetes::KubernetesJobStatusWatcher::onError(const rstudio::core::Error&, rstudio::job_launcher::impls::kubernetes::KubernetesJobStatusWatcher::WatchType, bool, bool) src/cpp/job_launcher/impls/kubernetes/KubernetesJobStatusWatcher.cpp:1007

thanks again !

[colearendt]

Woops - apologies for missing this.

1. Yes, it is possible to only let one user access the admin dashboard. This is typically done using an admin-group configuration in rserver.conf.
2. Are you saying you want to use a different default docker image for each user? That can be done using the launcher.kubernetes.profiles.conf configuration file 😄
3. It would be good to understand your use case for why you are giving users sudo privileges in their containers. It could be useful for adding system dependencies on the fly, for instance. However, any changes would be ephemeral since a new session would not have those changes
4. I believe this error is benign? It basically means that Kubernetes did not respond to us in the expected timeframe. Our timeout here is configurable. Please reach out to support if there is any behavior that concerns you!

[MariaSemple]

Hi @ihannache, thanks for filing this issue. I just wanted to reach out to let you know that Workbench now supports automatic user provisioning when using Okta or Entra ID as an IdP (identity provider) as of the 2024.04 release. If you're on that version or newer, it should be possible to update your values.yaml according to the linked documentation. If you give it a try and run into any issues, please don't hesitate to reach out!